🖧 VLAN (Virtual Local Area Network)

 

🖧 VLAN (Virtual Local Area Network)

🧠 Top 5 Key Points

  1. Logical Network Segmentation:
    VLANs divide a physical network into multiple logical networks, thus breaking broadcast domain.

  2. Improved Security:
    Devices in different VLANs cannot communicate unless explicitly allowed via a router or Layer 3 switch.

  3. Reduces Broadcast Domains:
    Each VLAN is its own broadcast domain, minimizing unnecessary traffic.

  4. Better Management:
    Departments (HR, Sales, IT, etc.) can be grouped into different VLANs without changing physical cabling.

  5. Requires VLAN Tagging (802.1Q):
    VLAN information is carried between switches using 802.1Q trunking.

  6. VLAN Benefits:
    Improved security by isolating sensitive systems 
    Reduced broadcast traffic and better performance
    Smaller broadcast domains mean less unnecessary traffic and bandwidth saved..
    Easy to troubleshoot.

  7.  Trunk can carry traffic for up to 4094 VLAN IDs ( ie 4094 subinterfaces )..

  8. Complete Flow

    PC1
    (No Tag)
       |
       |
    Access Port (VLAN 10)
       |
    Switch
       |
    Adds VLAN 10 Tag
       |
    Trunk
       |
    Router
    Reads VLAN Tag
    Routes Packet
    Adds VLAN 20 Tag
       |
    Trunk
       |
    Switch
    Removes VLAN Tag
       |
    Access Port
       |
    PC2
    (No Tag)

⚙️ Technical Notes

FeatureDescription
OSI LayerLayer 2 (Data Link)
StandardIEEE 802.1Q
Device TypeManaged Switch or Layer 3 Switch
VLAN Range1–4094
Default VLANVLAN 1

🧰 Packet Tracer VLAN Lab

🎯 Goal:

Create three VLANs (10, 20, 30) on a switch, assign PCs to them, and verify connectivity.

🖥️ Network Topology

           +------------------------+
           |        Switch (S1)     |
           +------------------------+
                 |      |      |
               PC1    PC2    PC3

               HR     Sales   IT

VLAN Plan

VLAN ID    VLAN Name    Department    Connected PC            IP Address
10    HRHR Dept    PC1        192.168.10.10
20    SALESSales Dept    PC2                                192.168.20.10
30    ITIT Dept    PC3        192.168.30.10

🪜 Configuration Steps

🔹 On the Switch (S1)

enable
conf t
vlan 10
 name HR
vlan 20
 name SALES
vlan 30
 name IT
exit

🔹 Assign Ports to VLANs

Assume:

  • PC1 → FastEthernet 0/1

  • PC2 → FastEthernet 0/2

  • PC3 → FastEthernet 0/3

interface range fa0/1
 switchport mode access
 switchport access vlan 10
exit

interface range fa0/2
 switchport mode access
 switchport access vlan 20
exit

interface range fa0/3
 switchport mode access
 switchport access vlan 30
exit

🔹 Verify VLAN Configuration

show vlan brief

➡ Confirms VLAN IDs, names, and assigned ports.

🔹 Set IP Addresses on PCs

PCVLANIP AddressSubnet Mask
PC110192.168.10.10255.255.255.0
PC220192.168.20.10255.255.255.0
PC330192.168.30.10255.255.255.0

(Configure via Desktop → IP Configuration tab in Packet Tracer)

💡 Testing

Try pinging between PCs:

  • PC1 → PC2 (should fail — different VLANs)

  • PC1 → PC3 (should fail)
    ✅ Same VLAN pings succeed (if trunk and router configured later).

🚦 Optional: Inter-VLAN Routing

To allow communication between VLANs, use a Router-on-a-Stick configuration:

🖧 Router-on-a-Stick (Inter-VLAN Routing) Lab

This lab extends your existing VLAN lab by allowing PCs in different VLANs to communicate using a Router-on-a-Stick (ROAS) configuration.

🎯 Goal

Configure Router-on-a-Stick so that:

  • PC1 (VLAN 10) can communicate with PC2 (VLAN 20)
  • PC2 (VLAN 20) can communicate with PC3 (VLAN 30)
  • All VLANs communicate through a single router interface

🖥️ Network Topology

                 Router R1
                   Gig0/0
                      │
             802.1Q Trunk Link
                      │
             +----------------+
             |    Switch S1   |
             +----------------+
              │      │      │
            Fa0/1  Fa0/2  Fa0/3
              │      │      │
            PC1    PC2    PC3

          VLAN10 VLAN20 VLAN30

📋 VLAN & IP Addressing Plan

VLAN IDVLAN NameDepartmentDeviceIP AddressDefault Gateway
10HRHRPC1192.168.10.10/24192.168.10.1
20SALESSalesPC2192.168.20.10/24192.168.20.1
30ITITPC3192.168.30.10/24192.168.30.1

Step 1 – Create VLANs on Switch

enable
configure terminal

vlan 10
 name HR

vlan 20
 name SALES

vlan 30
 name IT

exit

Step 2 – Assign Access Ports

PC1

interface fa0/1
switchport mode access
switchport access vlan 10
exit

PC2

interface fa0/2
switchport mode access
switchport access vlan 20
exit

PC3

interface fa0/3
switchport mode access
switchport access vlan 30
exit

Step 3 – Configure Trunk Port

Assume the router is connected to FastEthernet0/24.

interface fa0/24
switchport mode trunk
switchport trunk allowed vlan 10,20,30
exit

Step 4 – Configure Router

Enable the physical interface.

enable
configure terminal

interface g0/0
no shutdown
exit

Configure Subinterface for VLAN 10

interface g0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

Configure Subinterface for VLAN 20

interface g0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

Configure Subinterface for VLAN 30

interface g0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

Step 5 – Configure PC IP Addresses

PCIP AddressSubnet MaskDefault Gateway
PC1192.168.10.10255.255.255.0192.168.10.1
PC2192.168.20.10255.255.255.0192.168.20.1
PC3192.168.30.10255.255.255.0192.168.30.1

Step 6 – Verify Switch

Check VLANs

show vlan brief

Expected

VLAN 10  HR      Fa0/1
VLAN 20  SALES   Fa0/2
VLAN 30  IT      Fa0/3

Check Trunk

show interfaces trunk

Expected

Port      Mode      Encapsulation   Status

Fa0/24    on        802.1Q          trunking

Step 7 – Verify Router

show ip interface brief

Expected

Gig0/0          unassigned    up

Gig0/0.10       192.168.10.1  up

Gig0/0.20       192.168.20.1  up

Gig0/0.30       192.168.30.1  up

Step 8 – Test Connectivity

Ping Default Gateway

From PC1

ping 192.168.10.1

Ping Different VLAN

From PC1

ping 192.168.20.10

Expected

Reply from 192.168.20.10

From PC1

ping 192.168.30.10

Expected

Reply from 192.168.30.10

All PCs should now communicate successfully.

  • Create subinterfaces on a router.

  • Use 802.1Q encapsulation to handle multiple VLANs on one trunk port.


Verify Trunk Port (Most Important)

show interfaces trunk

Example output:

Port        Mode         Encapsulation  Status    Native vlan
Fa0/24      on           802.1q         trunking  1

Port        Vlans allowed on trunk
Fa0/24      10,20,30

Port        Vlans in spanning tree forwarding state
Fa0/24      10,20,30

✅ If you see Encapsulation: 802.1Q, the switch is tagging frames for the VLANs on the trunk.

🧠 Learning Summary

ConceptDescription
VLANVirtual LAN — separates network logically
BenefitSecurity, scalability, and efficiency
Broadcast DomainEach VLAN = 1 broadcast domain
Trunk LinkCarries multiple VLANs (802.1Q tagging)
Router on a StickEnables inter-VLAN communication

🗺️ Teaching Tip

“VLANs let you separate a single switch into multiple smaller virtual switches — like dividing one big office into smaller secure departments without adding new hardware.”


Technically, you should not have different VLANs in the same IP subnet.

The purpose of VLANs is to create separate Layer 2 broadcast domains, while an IP subnet represents a single Layer 3 network. Normally, there is a 1:1 relationship:

One VLAN ↔ One IP subnet

Normal Design

VLAN 10 → 192.168.10.0/24

VLAN 20 → 192.168.20.0/24

VLAN 30 → 192.168.30.0/24

Each VLAN has its own:

  • Broadcast domain
  • IP subnet
  • Default gateway

What if two VLANs use the same subnet?

Example:

VLAN 10
PC1 = 192.168.10.10

VLAN 20
PC2 = 192.168.10.20

Both PCs are in 192.168.10.0/24, but they are in different VLANs.

Now PC1 wants to send data to PC2.

PC1 thinks:

"192.168.10.20 is in my subnet, so I'll use ARP to find its MAC address."

It sends an ARP broadcast.

But here's the problem:

VLAN 10  -----------------X----------------  VLAN 20
           ARP broadcast cannot cross VLANs

VLANs block Layer 2 broadcasts, so PC2 never receives the ARP request.

Result:

  • ❌ PC1 cannot learn PC2's MAC address.
  • ❌ Communication fails. 

 

Comments

Post a Comment

Popular posts from this blog

🌐 NAT (Network Address Translation)

Image
  🌐 NAT (Network Address Translation) 🧠 Top 6 Key Points Translates Private IPs to Public IPs: NAT converts internal (private) IP addresses into a single or multiple public IPs so that devices inside a LAN can access the Internet. Conserves Public IP Addresses: NAT allows multiple internal hosts to share one public IP, saving global address space. Improves Security: Internal IPs remain hidden from the outside world, reducing attack exposure. Types of NAT: Static NAT: One-to-one mapping (internal ↔ public).  ( Server) Dynamic NAT: Many-to-many mapping (pool of public IPs).  (  PAT (NAT Overload): Many-to-one mapping (most common).  Configured on Routers: NAT runs on routers at the boundary between private and public networks , translating IPs for outbound/inbound traffic. NAT Type Used Today 6 Common Use Static NAT ✅ Yes  (limited use 7 Publishing internal servers with a dedicated public IP Dynamic NAT ⚠️ Rarely L...
Read more

🛰️ OSPF (Open Shortest Path First)

  🛰️ OSPF (Open Shortest Path First) 🧠 Top 5 Key Points about OSPF Link-State Protocol → OSPF shares detailed information about network topology (not just hop count). Metric: Uses cost , calculated based on bandwidth (higher bandwidth = lower cost). Fast Convergence: Quickly detects and adapts to network changes. Supports VLSM & CIDR: Fully classless , allowing subnet flexibility. Area-Based Design: Supports hierarchical networks (Area 0 = Backbone, others connect to it). ⚙️ Additional Notes Works at Layer 3 (Network Layer) of the OSI model. Uses Dijkstra’s SPF (Shortest Path First) algorithm. Multicast addresses: 224.0.0.5 → All OSPF routers 224.0.0.6 → Designated Router (DR) and Backup DR OSPF uses Link-State Advertisements (LSAs) to exchange topology information. Each LSA type has a specific purpose. Here's a practical explanation of LSA Types 1–7 . 1. Type 1 – Router LSA Generated by: Every OSPF router Flooded within...
Read more