Lesson4 VLAN configuration
Lesson4 VLAN configuration
configurations
Switching Concepts
o A switch uses the MAC address table to forward frames to the correct
destination device.
o Example: If Device A sends a frame to Device B, the switch ensures the frame
reaches only Device B.
3. Filtering Traffic:
o A switch forwards frames only to the port where the destination device
is located, reducing unnecessary traffic on other ports.
o Example: If Device A sends a frame to Device B, the switch does not forward
the frame to Device C.
4. Loop Prevention:
Page 1 of 25
o Example: STP blocks redundant paths to avoid broadcast storms.
5. VLAN Support:
Types of Switches
1. Unmanaged Switches:
o Operate at the Data Link Layer (Layer 2) and use MAC addresses for
forwarding.
o Example: Most common type of switch.
4. Layer 3 Switches:
o Operate at both the Data Link Layer (Layer 2) and Network Layer
(Layer 3).
o Example: Used in large networks to reduce the need for separate routers.
Page 2 of 25
Switch> enable
Switch(config)# vlan 10
Switch(config-vlan)# exit
Page 3 of 25
o Switches allow networks to grow by adding more devices without
degrading performance.
3. Security:
Page 4 of 25
What is a MAC Address Table?
The MAC address table is a database stored in a switch that maps MAC
addresses (Media Access Control addresses) to the physical ports on the
switch.
Each entry in the table contains:
To view the entries of the CAM table, you can use the "show mac-address-
table" command in privileged-exec mode.
This command displays the CAM table's entries. If you use this command just after
starting the switch, it displays a blank CAM table.
Page 5 of 25
A switch adds a device MAC address in the CAM table when it receives a frame
from that device on any of its ports.
A Virtual Local Area Network (VLAN) is a logical subgroup within a local area
network (LAN) that combines a collection of devices from different physical LAN
segments into a single broadcast domain. VLANs help in segmenting networks for
improved performance, security, and management.
Page 6 of 25
Key Features of VLANs
Enhanced Security: VLANs can isolate sensitive data and resources from
unauthorized access.
VLAN ranges:
VLAN 0, 4095: These are reserved VLAN which cannot be seen or used.
VLAN 1: It is the default VLAN of switches. By default, all switch ports are in
VLAN. This VLAN can’t be deleted or edit but can be used.
VLAN 2-1001: This is a normal VLAN range. We can create, edit and delete
these VLAN.
VLAN 1002-1005: These are CISCO defaults for fddi and token rings. These
VLAN can’t be deleted.
Vlan 1006-4094: This is the extended range of Vlan.
Here is an image that shows three VLANs thereby creating networks that
are logically defined:
Page 7 of 25
Development of VLAN
LAN is also referred to as a broadcast domain. This simply means in a
situation when a user uses his/her LAN to broadcast any information, it will
be sent to every user on the LAN.
o The time taken by routers to process incoming data is much higher compared
to that taken by a bridge or a switch.
Page 8 of 25
How VLANs Work
Tagging Protocols: VLANs use tagging protocols like IEEE 802.1Q to identify
VLAN membership in Ethernet frames.
Guest Networks: Creating a separate VLAN for guest access to limit access to
the main network.
Page 9 of 25
Voice over IP (VoIP): Isolating VoIP traffic on its VLAN to ensure quality of
service (QoS).
All devices connected to the same port belong to the same VLAN.
Functions
1. Segmentation:
o Example: Ports 1-5 are assigned to VLAN 10 (Sales), and Ports 6-10 are
assigned to VLAN 20 (IT).
2. Simplified Management:
Page 10 of 25
Protocol-Based VLANs
Definition
1. Traffic Segmentation:
o Ensures that devices using the same protocol are grouped together,
improving efficiency.
3. Legacy Support:
Page 11 of 25
MAC-Based VLANs
Definition
2. Flexibility:
3. Enhanced Security:
Page 12 of 25
Configuring VLANs on switches
We will configure two VLANs in this network: VLAN-10 and VLAN-20. We will
use VLAN-10 for the network 10.0.0.0/8. We will use VLAN-20 for the network
20.0.0.0/8. We will keep one PC from each switch in a VLAN.
Access the first switch's CLI prompt. Enter global configuration mode and use
the vlan command to create a new VLAN. This command needs a VLAN number as
an argument. It checks the specified VLAN number for an existing VLAN before
creating a new VLAN. If it finds an existing VLAN having the specified number, it
does not create a new VLAN. It enters VLAN configuration mode for the existing
VLAN. If it does not find an existing VLAN having the specified number, it creates a
new VLAN and enters VLAN configuration mode for the new VLAN.
Page 13 of 25
VLAN configuration mode allows us to configure additional options such
as name and RSPAN. In a basic configuration, we do not need to configure these
options. Use the exit command to exit VLAN configuration mode.
Switch>enable
Switch#configure terminal
Switch(config)#vlan 10
Switch(config-vlan)#exit
Switch(config)#
Switch(config)#vlan 20
Switch(config-vlan)#exit
Switch(config)#
Since all three switches have PCs in these VLANs, you need to run the above
commands on all switches.
After creating VLANs, we need to assign them to the switch ports. The switchport
mode access vlan command assigns a VLAN to the switch port. It accepts a VLAN
number as an argument. It runs in the interface configuration mode of the port. It
assigns the specified VLAN number to the port. The device connected to the port
becomes a member of the specified port.
Page 14 of 25
The following commands make the device connected to port-1 a member of VLAN-
10.
Switch(config-if)#vlan 10
Switch(config-vlan)#exit
The following commands make the device connected to port-2 a member of VLAN-
20.
Switch(config-if)#vlan 20
Switch(config-vlan)#exit
Switch(config)#
A switch port can work in two modes: access and trunk. In access mode, it works
with a single VLAN. In trunk mode, it works with multiple VLANs.
Access mode is the default mode on all switch ports. If you connect an end device to
a switch port, you do not need to change the default mode. But if you connect a
switch port to another switch port, you need to change the default mode to trunk
mode on both ports.
Page 15 of 25
Change default mode to trunk mode on ports you used to connect switches. Use
the switchport mode trunk command to change the default mode. Run this command
in the interface configuration mode of the port.
Switch(config-if)#exit
Switch(config-if)#exit
Switch(config)#
Page 16 of 25
To test and verify VLAN configuration, you can check connectivity between PCs in
the same VLAN.
Click the PC icon, click Desktop, and click Command prompt. Use
the ping command to test connectivity.
PC0 is a member of VLAN-10. As we can see in the above image, it has connectivity
with PC2 and PC4. PC2 and PC4 are other members of VLAN-10.
Page 17 of 25
Similarly, you can also test connectivity between PC1, PC3, and PC5. These are
members of VLAN-20.
Page 18 of 25
Reference Materials
Cisco Switch basic Configuration | Cisco Switch Configuration Step by Step (Nice
video for practical)
https://www.youtube.com/watch?v=7dXBN8a-X2U
https://www.youtube.com/watch?v=b2Mbd3YA3Z4&t=188s
Page 19 of 25
Revision Example of VLAN Use:
Scenario: A company with three departments — HR, IT, and Sales. The network
administrator creates three VLANs to segregate traffic:
VLAN 30 (Sales): Sales staff are assigned to this VLAN, keeping their
activities separate from the HR and IT departments.
Benefits:
Security: IT and HR cannot accidentally access each other's data because their
VLANs are isolated.
Network Efficiency: Sales staff can communicate with one another without
causing congestion for HR or IT.
Background: XYZ Corporation has a large office building with four departments:
HR (Human Resources)
Finance
Sales
Page 20 of 25
IT (Information Technology)
2. Security: The HR and Finance departments handle sensitive data and need
extra security. Only authorized personnel should access certain data.
o VLAN 10 (HR): This VLAN will contain all HR-related devices such as
computers, printers, and other devices used by HR employees.
o VLAN 30 (Sales): Devices used by the sales team will be part of this
VLAN.
2. Physical Setup:
Page 21 of 25
o Access Ports: The ports that are connected to devices like computers,
printers, or IP phones will be assigned to specific VLANs (HR, Finance,
Sales, IT). Each port will belong to a single VLAN.
o Trunk Ports: The ports that connect switches and routers will be
configured as trunk ports, allowing multiple VLAN traffic to pass
through using VLAN tags (IEEE 802.1Q tagging).
VLAN Configuration Steps:
Step 1: Create VLANs on Layer 2 Switches On each Layer 2 switch, VLANs will be
created to segment the network.
bash
Switch(config)# vlan 10
Switch(config-vlan)# name HR
Switch(config)# vlan 20
Switch(config)# vlan 30
Switch(config)# vlan 40
Switch(config-vlan)# name IT
Step 2: Assign Ports to VLANs After creating the VLANs, the corresponding ports
will be assigned to each VLAN. Let's assume each department is on a specific floor,
and all the devices in each department will be connected to the same VLAN on that
floor.
bash
Page 22 of 25
Switch(config-if-range)# switchport mode access
bash
bash
Page 23 of 25
Router(config)# interface gig0/1.30
Step 5: Configure Routing If you're using a router, enable routing between these
VLANs (subnetting is automatically handled by the router for each VLAN).
bash
Router(config)# ip routing
Step 6: Verify VLAN Configuration Once the configuration is complete, use the
following commands to verify that the VLANs are properly configured:
1. Check VLAN Configuration:
bash
bash
bash
1. Security: Sensitive departments (HR, Finance) are isolated from each other
and other departments (Sales, IT), reducing the risk of unauthorized access.
Page 24 of 25
3. Simplified Management: Changes in the network can be done by adjusting
VLAN configurations rather than physically re-cabling devices.
4. Performance: Traffic in one VLAN does not interfere with traffic in another,
leading to reduced congestion.
Page 25 of 25