VIRTUAL LOCAL AREA NETWORK(VLAN)

VIRTUAL LOCAL AREA NETWORK(VLAN)

A VLAN is a logical grouping of network users and resources connected to administratively defined ports on switch. When you create  VLANS, you're given the ability to create smaller broadcast domain within a layer2 switched inter-network by assigning different ports on the switch to different sub networks. A VLAN is treated like its own subnet or broadcast domain.

By default, hosts in a specific VLAN cannot communicate with hosts that are members of another VLAN, so even inter communication among different VLANs is also possible by creating trunk port on switch and sub-interfaces on routers.

If you create VLAN many network related problems in Layer 2 can be solved.

Here's short list of ways VLANs simplify network management.

•  Network adds, moves, and changes are achieved with ease by just configuring aport into the appropriate VLAN.
• A group of users that need an unusually high level of security can be put into its own VLAN so that users outside of the VLAN can't communicate with them.
• As a logical grouping of users by function, VLANs can be considered independent from their physical or geographic locations.
• VLANs greatly enhance network security.
• VLANs increase the number of broadcast domains while decreasing their size.

 Ports in the VLANs are Access ports and Trunk ports.
Access ports: It belongs and carries traffic of only one VLAN.
Trunk Port: It carries multiple VLANs at a time. A trunk link is a 100 or 1000 Mbps point-to-point link between two switches, between switch and router, or even between a switch and server, and it  carries the traffic of multiple VLANs from 1 to 4,094 at a time(though it's really only up to 1005 unless you're going with extended VLANs)

Creating a VLAN in Switch
Syntax:
Switch(Config)#vlan <vlan no>
Switch(Config)#name <vlan name>
 Moving interfaces under VLAN
Syntax
Switch(config)#interface fastethernet <interface no>
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan <vlan no>

Trunk port configuration
Syntax
Switch(config)#interface fastethernet <interface no>
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan <all/vlan nos>

Verification commands
Switch#show vlan
Switch#show interface trunk

VLAN TRUNKING PROTOCOL(VTP)

The basic goals of VLAN Trunking Protocol(VTP) are to manage all configured VLANs across a switched inter-network and to maintain consistency throughout that network VTP allows you to add, delete, and rename VLANs- information that is then propagated to all other switches in the VTP domain.
Features of VTP:

• Consistent VLAN configuration across all switches in the network
• VLAN trunking over mixed networks, such as Ethernet to ATM LANE or even FDDI
• Accurate tracking and monitoring of VLANs.
• Dynamic reporting of added VLANs to all switches in the VTP domain.
• Plug and play VLAN adding.

A VTP has three modes of configuration.

1. Server
2. Client 
3. Transparent

A server mode always sends the update to clients and Client mode simply accepts the Server information and update in its database. Whereas Transparent will not take any update from server, but bypass the update from Server to it's next Client.

Configuring VTP
Switch(config)#vtp domain <name>
Switch(config)#vtp password <password>
Switch(config)#vtp mode <Server/Client/Transparent>
Verification Commands
Switch#show vtp status
Switch#show vtp password

INTER-VLAN ROUTING

• It is the process to communicate one VLAN to another VLAN.
• We need a router
• Each VLAN should be configured with different IP networks.
• Based on VLANs should create sub-interfaces on the router(maximum 4.3 billion sub-interfaces can create on one physical interface)
• On which interface router has connected that port should be trunk port.

Steps for switch configuration

1. Create VLANs
2. Moving ports under VLAN
3. Creating Trunk

Router Configuration
Router(config)#interface ethernet <0.1/0/0.1>
Router(config-if)#encapsulation dot1q <vlan no>
Router(config-Subif)#ip address <ipaddress> <subnetmask>
Router(config-subif)#no shutdown
Router(config-subif)#exit

Port Security
Port security is used to control network access based on the following.

1. Mac Address
2. Number of Mac address per port.

If any violation takes place the following actions can be configured.

• Shutdown
• Restrict
• Protect
• Violation

Shutdown:- The port becomes error disabled and the port LED turns off.
Protect:- Frames with unknown source MAC address are dropped. It does not notifies that a security violation has occurred.
Restrict:- Frames with unknown source address are dropped it gives a notification (log message) that security violation has occurred.
Steps for configuring port security
Switch(config)#interface fastethernet <interface no>
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-secuirty maximum <value>
Switch(config-if)# switchport port-security mac-address <mac-address/sticky>
Switch(config-if)# switchport port-security violation {protect/restrict/shutdown}

Verification command
Switch# show port-security

To be continued.....