Virtual LANs

Virtual LANs (VLANs) give an administrator the ability to break up a switched Layer 2 network into multiple broadcast domains. The advantage of this approach is that it can be done using switches that cost less than traditional routers. However, each broadcast domain is typically considered to be a separate subnet. To go between subnets, a Layer 3 component, such as a router, is still required.

VLANs can be based on the port identifier of a switch, on an end station's MAC address or Layer 3 address, or on directory or application information. They also can be implemented in many different ways, depending on the media topology (Ethernet, FDDI, or ATM) that's deployed.

Advantages of VLANs

One of the main reasons that network administrators buy switches is to help control bandwidth problems by creating multiple collision or bandwidth domains, but they can also help contain broadcasts by implementing VLANs. However, VLANs offer a network administrator many more advantages than just these. Here are some examples:

• They ease adding, moving, or changing users in a network, thereby reducing personnel costs.

• They enhance network security via logical segmentation of users and groups.

• They allow multiple parallel paths in a switched network for load balancing, unlike bridges and the Spanning Tree Protocol.

• They isolate problems within a small part of the intranet.

• They remove the physical boundaries of a network, thus enabling users and servers to be located anywhere.

• They allow for the deployment of applications across different media topologies, such as Ethernet, FDDI, and ATM.

• They increase performance by limiting the scope of broadcast traffic.

Containment of Broadcasts

Broadcasts are a normal occurrence in LAN-based protocols such as IP, IPX, and AppleTalk. In many cases, these broadcasts help users to find and use services. Many applications also use multicasts to disseminate information, which include LAN-based TV, video conferencing, routing protocols such as OSPF and Cisco's Enhanced IGRP, and even the bridges' and switches' Spanning Tree Protocol. Faulty network cards, Spanning Tree Protocol problems, or an incorrect application or desktop configuration could cause a flood of broadcasts or multicasts in a network. When switches see broadcasts and multicasts, they treat them as unknown destinations and flood the frames out all of their ports. Too many broadcasts, even from a single PC, can seriously slow a network's performance, if not bring it down completely.

From the users' perspective, the use of broadcasts makes their lives easier. However, from the network administrator's perspective, broadcasts use up bandwidth and affect every user's desktop in the switched network. Some mechanism is needed to reign in the propagation of broadcasts.

Routers were traditionally used to solve broadcast problems in data networks. Unfortunately, the use of routers on a port-by-port basis is a very expensive solution for performing this barrier function. When switches were first developed, they were essentially bridges with many ports. All ports were in the same broadcast domain, just like a bridge. This is sometimes referred to as a flat network.

Broadcasts and VLANs

VLANs are created by logically segmenting a network into separate broadcast domains. When you create VLANs, frames created by a member of one VLAN are switched only among ports that are designated as belonging to the same virtual LAN, which results in a more efficient use of bandwidth. In addition, instead of broadcast traffic propagating throughout the physical infrastructure, such traffic is restricted to the broadcast domain that represents the VLAN.

The advantage of this approach is that if a machine goes bonkers with broadcasts, it affects only the other machines in the same VLAN, not computers in other VLANs. VLANs allow for the extension of a broadcast barrier from the router. VLANs basically create the traditional illusion that users are off of different ports of a router, but in reality, the users are part of the same switched fabric. Because of this, routers are still required to connect the VLANs together. Each VLAN, as mentioned earlier, is typically a unique subnet; to go from one subnet to another, a router is required. Therefore, routers still perform their traditional role of containing broadcasts, but the quantity of ports is greatly reduced because of the use of switches.

Because of this huge advantage, VLANs should not be employed across an intranet, but should rather be terminated within an access layer or building access. In other words, broadcasts that occur in one-building access should not be propagated across the core or backbone of the network.

VLAN Implementations

Because broadcasts can be generated in all kinds of network operating systems and applications, you have a lot of flexibility in creating VLANs and assigning people and computers to them. You can base VLANs on the following items:

• The Layer 3 protocols currently being used in the network

• The groups, departments, or divisions in a company

• The specific security needs of certain resources

• The applications being used in the network

End-to-End VLANs

One of the unique properties of VLANs is that they can span multiple switches. The physical boundaries of where people and resources are located are removed. In Figure 3.1, a switched network has three VLANs spread across three switches: Accounting, Information Services, and Marketing.

Figure 3.1. A physical view of computers and a logical representation of VLANs.

Note that all the servers are located off of one switch. In traditional networks, resources such as local file servers would usually be located in the same place as the users. Spreading the resources like this makes their management much harder and security harder still. Using VLANs, an administrator can create the illusion that the file server is on the same segment as the users that access it, even though the file server could be on a completely different floor in a completely different building. Figure 3.2 gives a detailed view of both a physical and logical representation of this concept.

Figure 3.2. A physical representation of VLANs.

End-to-end VLANs have the following characteristics:

• Users are grouped into a VLAN based on function, not location.

• The user belongs to the same VLAN no matter where she plugs her PC into the network (this requires Cisco's VMPS, which is discussed later in this chapter).

• End-to-end VLANs are typically used for security reasons or for application or resource requirements.

• End-to-end VLANs are difficult to implement and troubleshoot.

Local VLANs

The problem with end-to-end VLANs is that they become extremely difficult to maintain as the campus network grows and changes. Because of this, most network administrators of campus environments use local VLANs.

Unlike end-to-end VLANs, local VLANs are very easy to plan and implement. Local VLANs are based on geographic locations by demarcation at a hierarchical boundary (core, distribution, access). Therefore, a local VLAN would never span from an access layer to a core block. Because VLANs are created based on geographic or physical boundaries, it's not uncommon to see much of the traffic leaving the broadcast domain to access a resource.

There are two generic rules when dealing with traffic flow: 80/20 and 20/80. The 80/20 rule assumes that 80% of the traffic stays local to a VLAN and 20% leaves a VLAN through a Layer 3 device. Local VLANs assume this premise. Note that with this implementation, VLANs are solely used to solve broadcast problems.

With the 20/80 rule, 20% of the traffic stays within the VLAN and 80% leaves it. In this situation, a burden is placed on the Layer 3 device that is used to interconnect VLANs. Although they do introduce a latency issue because of the access of resources outside of the VLAN, this can easily be solved with multilayer switching, which is discussed in Chapter 6, "Multilayer Switching."

VLAN Assignment

There are two methods that you can use to associate users to VLANs: dynamic and static. The following two sections compare and contrast the two methods.

Dynamic VLANs

Dynamic VLANs require you to assign a user to a VLAN, and switches dynamically use this information to configure the port on the switch automatically. Dynamic VLANs can be based on the following items:

• The MAC addresses of workstations

• The Layer 3 addresses (such as IP addresses)

• The protocol type (such as IP or IPX)

• Directory information stored in Novell's NDS or Microsoft's Active Directory

The advantage of using dynamic VLANs is that network technicians don't have to worry about making any changes on a switch when they move a user from one location to another, which is advantageous when end-to-end VLANs are deployed. Cisco currently allows you to use CiscoWorks 2000 to implement dynamic VLANs based on MAC addresses.

A VLAN Management Policy Server (VMPS) associates MAC addresses to VLANs. When a user connects to a switch and the switch sees the user's MAC address, the switch sends the user's MAC address to the VMPS server. The server responds with the user's VLAN and the switch associates this VLAN with the user's interface.

Problems with MAC-based dynamic VLANs include PC NICs failing, PCs being upgraded, and new PCs continually being added to the network. Managing these MAC addresses soon becomes a headache in a large-scale switched network.

Therefore, most administrators choose to base VLAN membership on directory information. Out of all these mechanisms for implementing dynamic VLANs, the use of directory information is the most flexible and the easiest to maintain. The only time you would have to make changes to the VLAN database is when a user is hired, fired, or changes departments. Many vendors, including Cisco, are developing directory-based dynamic VLANs. The remainder of this chapter and book focus on static VLANs and their configuration.

Dynamic VLANs use a VMPS to assign VLAN information to a switch, which is then associated with a user's port. This enables users to be located anywhere in the network and still be assigned to the correct VLAN. Membership is typically based on a device's MAC address.

Static VLANs

Cisco's initial implementation of VLANs was based on the port that a user was assigned to. This is sometimes referred to as port-based membership. Using this initial implementation, you would configure every port on a switch to reflect the appropriate VLAN for the users. This could easily be done either via a command-line interface or an SNMP-based product using a graphical interface. Anytime a user moved his workstation to a different area, you would have to reconfigure only the port to which the user attaches.

Static VLANs are normally used in local VLAN implementations, where the problem of containing broadcasts is more important than placing specific users in certain VLANs. Use static VLANs when any of the following criteria apply to your situation:

• You have tight control over the moving of users and resources in the campus

• You do not want the hassles of maintaining the large tables required of dynamic VLANs

• You have a management package that easily maintains VLANs in your campus

Static VLANs are manually configured: You specify which interface belongs to which VLAN. This configuration is typically used in a more stable or static environment. Configuring static VLANs is a very simple process.

Creating and Deleting VLANs

Creating VLANs on your switch is a very simple process. There are two methods for creating VLANs on Cisco IOS switches: from Privilege EXEC mode and Configuration mode. The old way, shown here, is done from Privilege EXEC mode:

 Switch# vlan database Switch(vlan)# [no] vlan vlan_number [name vlan_name] 

The newer method for configuring VLANs is shown here:

 Switch(config)# [no] vlan vlan_number [name vlan_name] 

As you can see, the newer method is done from within Configuration mode. To delete a VLAN, just preface the vlan command with the no parameter.

Cisco recommends that you perform all your VLAN configurations using the newer method; that is, from Configuration mode.

Use the vlan command to create your VLANs. This can be done from Privilege EXEC mode within the vlan database or from Configuration mode.

Associating Ports to VLANs

After you've created your VLANs, you can associate your switch's ports to your VLAN with the following configuration:

 Switch(config)# interface type slot_#/port_# Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan VLAN_# 

When you've entered the interface, use the switchport mode access command to specify that this interface is associated with a single VLAN. The switchport access vlan command associates a VLAN to this particular interface.

Depending on the model, there is at least one pre-configured VLAN on your switch: VLAN 1. By default, all ports are associated with VLAN 1.

Use the switchport mode access command to define an interface as an access link and the switchport access vlan command to associate an interface with a VLAN.

Verifying Your Configuration

After you've created your VLANs and placed interfaces in them, you can use various show commands to verify your VLAN configuration. To view your configured VLANs, use the show vlan command:

 Switch# show vlan [id VLAN_# | name VLAN_name] 

Without any of the optional parameters, all VLANs are listed. You can optionally specify a VLAN number or name to examine a specific VLAN. Here's an example of the use of this command:

 Switch# show vlan VLAN Name                             Status    Mod/Ports ---- -------------------------------- --------- ------------------ 1    default                          active    fa0/3-24 10   VLAN0010                         active    fa0/1-2 20   VLAN0020                         active VLAN Type  SAID    MTU   Parent RingNo BridgeNo Stp  Trans1 Trans2 ---- ----- ------- ----- ------ ------ -------- ---- ------ ------ 1    enet  100001  1500  -      -      -        -    0      0 10   enet  100010  1500  -      -      -        -    0      0 20   enet  100020  1500  -      -      -        -    0      0 Remote SPAN VLANs ------------------------------------------------------------------ Primary  Secondary  Type             Ports -------  ---------  ---------------  ----------------------------- 

To see an interface's configuration, use the show running-config interface command:

 Switch# show running-config interface fastethernet 0/1 Building configuration... ! Current configuration: 33 bytes interface FastEthernet 0/1  switchport access vlan 10  switchport mode access end 

To see switch port information, use the show interfaces command with the switchport parameter:

 Switch# show interfaces type slot_#/port_# switchport 

Here's an example:

 Switch# show interface fastethernet0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: On Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: ALL Pruning VLANs Enabled: 2-1001 Protected: false Unknown unicast blocked: disabled Unknown multicast blocked: disabled Broadcast Suppression Level: 100 Multicast Suppression Level: 100 Unicast Suppression Level: 100 

To see which MAC addresses are associated with which interfaces, as well as which VLAN the interface is associated with, you can use the show mac-address-table command, which displays the port address or CAM (content addressable memory) table:

 Switch# show mac-address-table           Mac Address Table ------------------------------------------ Vlan    Mac Address       Type       Ports ----    -----------       ----       -----    1    0008.7422.1234    DYNAMIC    Fa0/1 

As you can see in this example, there is one MAC address in the table off of interface fa0/1, which is associated with VLAN 1.

Troubleshooting VLAN Problems

If you're experiencing connectivity problems in a VLAN environment, you should perform the following troubleshooting steps:

1. Do you have a physical and data link layer connection? Check the status of the interface with the show interfaces command. Use CDP to check connectivity. Check the duplexing of the connection (auto negotiation is a common problem with the negotiation of the duplexing mode).

2. Is your router and switch configuration correct? Verify that you've configured your routing protocol and your router's interface. If you're trunking between the router and the switch, verify this configuration.

3. Have you set up your VLAN configuration correctly? Check to make sure that the appropriate interfaces are associated with the correct VLANs.