First introduced in Chapter 1, 'The Campus Network,' switch blocks represent a switch or group of switches providing access to users. These switches then connect to distribution-layer switches, which in turn handle routing issues and VLAN distribution.
To understand how many VLANs can be configured in a switch block, you must understand the following factors:
IP addressing scheme
Cisco recommends a one-to-one ratio between VLANs and subnets. For example, if you have 2000 users in a building, then you must understand how they are broken up by subnets to create your VLANs. If you had 1000 users in a subnet-which is ridiculous-you would create only 2 VLANs. If you had only 100 users in a subnet, you would create about 20 VLANs or more.
It is actually better to create your broadcast domain groups (VLANs) and then create a subnet mask that fits the need. That is not always possible, and you usually have to create VLANs around an already-configured network.
VLANs should not extend past the distribution switch on to the core.
When building the switch block, you need to understand two basic methods for defining the VLAN boundaries:
An end-to-end VLAN spans the switch-fabric from end to end; all switches with ports configured in end-to-end VLANs understand about any and all VLANs that may be configured on the network. End-to-end VLANs are configured to allow membership based on function, project, department, and so on.
The best feature of end-to-end VLANs is that users can be placed in a VLAN regardless of their physical location. The administrator defines the port the user is connected to as a VLAN member. If the user moves, the administrator defines their new port as a member of their existing VLAN. In accordance with the 80/20 rule, the goal of an administrator in defining end-to- end VLANs is to maintain 80 percent of the network traffic as local, or within the VLAN. Only 20 percent or less should extend outside the VLAN.
Unlike an end-to-end VLAN, a local VLAN is configured by physical location and not by function, project, department, and so on. Local VLANs are used in corporations that have centralized server and mainframe blocks because end-to-end VLANs are difficult to maintain in this situation. In other words, when the 80/20 rule becomes the 20/80 rule, end-to-end VLANs are more difficult to maintain, so you will want to use a local VLAN.
In contrast to end-to-end VLANs, local VLANs are configured by geographic location; these locations can be a building or just a closet in a building, depending on switch size. Geographically configured VLANs are designed around the fact that the business or corporation is using centralized resources, such as a server farm. The users will spend most of their time utilizing these centralized resources and 20 percent or less on the local VLAN. From what you have read in this book so far, you must be thinking that 80 percent of the traffic is crossing a layer 3 device. That doesn't sound efficient, does it?
Because many modern applications are not very tolerant of delay (a bit like users), you must design a geographic VLAN with a fast layer 3 device (or devices) for interconnecting your VLANs and for general site-to-site connectivity. Fortunately, layer 3 devices themselves are becoming faster. The benefit of this design is that it will give the users a predetermined, consistent method of getting to resources. But you can not create this design with a lower-end layer 3 model. In the past, these network types were only possible in large corporations with plenty of spending power, but as technology develops, the price is going down.
After your VLANs are created, you need to assign switch ports to them. There are two types of VLAN port configurations: static and dynamic. A static VLAN requires less work initially but is more difficult for an administrator to maintain. A dynamic VLAN, on the other hand, takes more work up front but is easier to maintain.
In a static VLAN, the administrator creates a VLAN and then assigns switch ports to it. The association does not change until the administrator changes the port assignment. This is the typical way of creating VLANs and it is the most secure. This type of VLAN configuration is easy to set up and monitor, working well in a network where the movement of users within the network is maintained by basically just locking the network closet doors. Using network management software to configure the ports can be helpful but is not mandatory.
If the administrator wants to do a little more work up front and add all devices' hardware addresses to a database, hosts in an internetwork can be assigned VLAN assignments dynamically. By using intelligent management software, you can enable hardware (MAC) addresses, protocols, or even applications to create dynamic VLANs. A dynamic VLAN will tell the switch port which VLAN it belongs to, based on the MAC address of the device that connects to the port.
For example, suppose MAC addresses have been entered into a centralized VLAN management application. If a node is then attached to an unassigned switch port, the VLAN management database can look up the hardware address and assign and configure the switch port to the correct VLAN. This can make management and configuration easier for the administrator. If a user moves, the switch automatically assigns them to the correct VLAN. However, more administration is needed initially to set up the database than to set up static VLANs, and additional administration is required for upkeep of the database.
Cisco administrators can use the VLAN Management Policy Server (VMPS) service to set up a database of MAC addresses that can be used for dynamic addressing of VLANs. VMPS is a MAC-address-to-VLAN mapping database.
For the Switching exam, Cisco is primarily interested in static VLAN configuration. We'll show you how to configure VLANs on a Catalyst 4000 switch and a range of Catalyst IOS-based switches.
It is important to understand the difference between the Catalyst 4000 series VLAN configuration and the IOS-based VLAN configuration.
To configure VLANs on a Catalyst 4000 switch, use the set vlan vlan# name vlan_name command. Then, after your VLANs are configured, assign the ports to each VLAN:
Terry_4000> (enable) set vlan 2 name Sales Vlan 2 configuration successful
After the VLAN is configured, use the set vlan vlan# slot/ports command:
Terry_4000> (enable) set vlan 2 2/1-2 VLAN Mod/Ports ---- ----------------------- 2 1/1-2 2/1-2 Please configure additional information for VLAN 2. Terry_4000> (enable)
The additional information the switch wants you to configure is the VLAN Trunk Protocol (VTP) information. (VTP and trunking are covered in more detail at the end of this chapter, where we will continue with the 4000 switch VLAN configuration.) The 4000 series switch enables you to configure as many ports as you wish to a VLAN at one time.
To configure VLANs on an IOS-based switch, first you need to enter the VLAN database. This mode is entered by typing the command vlan database. This command changes the prompt, as can be seen from the example shown next. Once in this new privileged mode, use the vlan vlan# name vlan_name. Note that you do not enter the standard configuration mode to enter this configuration.
Terry_2950#vlan database Terry_2950(vlan)#vlan ? <1-1005> ISL VLAN index Terry_2950(vlan)#vlan 2 ? are Maximum number of All Route Explorer hops for this VLAN backupcrf Backup CRF mode of the VLAN bridge Bridging characteristics of the VLAN media Media type of the VLAN mtu VLAN Maximum Transmission Unit name Ascii name of the VLAN parent ID number of the Parent VLAN of FDDI or Token Ring type VLANs ring Ring number of FDDI or Token Ring type VLANs said IEEE 802.10 SAID state Operational state of the VLAN ste Maximum number of Spanning Tree Explorer hops for this VLAN stp Spanning tree characteristics of the VLAN tb-vlan1 ID number of the first translational VLAN for this VLAN (or zero if none) tb-vlan2 ID number of the second translational VLAN for this VLAN (or zero if none) <cr> Terry_2950(vlan)#vlan 2 name ? WORD The ascii name for the VLAN Terry_2950(vlan)#vlan 2 name marketing VLAN 2 added: Name: marketing Terry_2950(vlan)#vlan 3 name production VLAN 3 added: Name: production Terry_2950(vlan)#exit APPLY completed. Exiting….
Remember that a created VLAN is unused until it is mapped to a switch port or ports, and that all ports are always in VLAN 1 unless set otherwise.
After you create the VLANs that you want, you use the show vlan command to see the configured VLANs. However, notice that, by default, all ports on the switch are in VLAN 1. To change that, you need to go to each interface and tell it what VLAN to be a part of:
Terry_2950#show vlan VLAN Name Status Ports ---- -------------- ------- -------------------------------------- 1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4 Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12 Fa0/13, Fa0/14, Fa0/15, Fa0/16 Fa0/17, Fa0/18, Fa0/19, Fa0/20 Fa0/21, Fa0/22, Fa0/23, Fa0/24 2 marketing active 3 production active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ------- ---- ---- ------ -------- --- ------- ------ ------ 1 enet 100001 1500 - - - - - 0 0 2 enet 100002 1500 - - - - - 0 0 3 enet 100003 1500 - - - - - 0 0 1002 fddi 101002 1500 - - - - - 0 0 1003 tr 101003 1500 - - - - - 0 0 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---- ---- ------ ------ -------- --- -------- ------ ------ 1004 fdnet 101004 1500 - - - ieee - 0 0 1005 trnet 101005 1500 - - - ibm - 0 0 Remote SPAN VLANs --------------------------------------------------------------------------- Primary Secondary Type Ports ------- --------- ----------------- ---------------------------------------
Configuring the interfaces on the 2950 and 3550 is very different. After the VLANs have been created, the interface needs to be made a member of the appropriate VLAN. The command switchport mode access is used to tell the port that it will be a member of a single VLAN. It is told what VLAN it is a member of with the command switchport access vlan vlan#.
Terry_2950(config-if)#switchport ? access Set access mode characteristics of the interface host Set port host mode Set trunking mode of the interface nonegotiate Device will not engage in negotiation protocol on this interface port-security Security related command priority Set appliance 802.1p priority protected Configure an interface to be a protected port trunk Set trunking characteristics of the interface voice Voice appliance attributes Terry_2950(config-if)#switchport access ? vlan Set VLAN when interface is in access mode Terry_2950(config-if)#switchport mode access Terry_2950(config-if)#^Z Terry_2950#co conf t Enter configuration commands, one per line. End with CNTL/Z. Terry_2950(config)#int fa 0/2 Terry_2950(config-if)#switchport ? access Set access mode characteristics of the interface host Set port host mode Set trunking mode of the interface nonegotiate Device will not engage in negotiation protocol on this interface port-security Security related command priority Set appliance 802.1p priority protected Configure an interface to be a protected port trunk Set trunking characteristics of the interface voice Voice appliance attributes Terry_2950(config-if)#switchport mode ? access Set trunking mode to ACCESS unconditionally dynamic Set trunking mode to dynamically negotiate access or trunk mode trunk Set trunking mode to TRUNK unconditionally Terry_2950(config-if)#switchport mode access Terry_2950(config-if)#switchport access ? vlan Set VLAN when interface is in access mode Terry_2950(config-if)#switchport access vlan 2 Terry_2950(config-if)#^Z
Now you need to confirm that the configuration has been accepted and the port to VLAN relationship established. You can use the show vlan command we used earlier, but the VLANs will also be shown in the running configuration:
Terry_2950#show run 00:49:36: %SYS-5-CONFIG_I: Configured from console by consolesho run Building configuration… Current configuration : 1512 bytes version 12.1 [output cut] interface FastEthernet0/2 switchport access vlan 2 switchport mode access no ip address
Now, type show vlan to see the ports assigned to each VLAN:
Terry_2950#show vlan VLAN Name Status Ports ---- --------------- ------- --------- --------- ----------------- 1 default active Fa0/1, Fa0/3, Fa0/4, Fa0/5 Fa0/6, Fa0/7, Fa0/8, Fa0/9 Fa0/10, Fa0/11, Fa0/12, Fa0/13 Fa0/14, Fa0/15, Fa0/16, Fa0/17 Fa0/18, Fa0/19, Fa0/20, Fa0/21 Fa0/22, Fa0/23, Fa0/24 2 marketing active Fa0/2 3 production active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active [output truncated] Terry_2950#