Chapter 4

VLAN
Virtual LAN
 Plan
Definition and necessity of VLAN
Types of VLAN: Static and dynamic
Vlan Data, …
Native VLAN
Creation of VLAN
Designation of ports for a VLAN
Need for a VLAN
 Definition and necessity
LAN => includes all the
equipment in a
same broadcast Domain.

Need to have some

specific groups.

Idea: in the same LAN

physique, we are going to create
virtual groups of
sub-LAN, called: Vlan id
 Definition and necessity: in the same physical LAN, we
let's create virtual sub-LAN groups, called: Vlan id.

In a LAN, it is generally rare to do a

broadcast to all its equipment.

On the contrary, we need to have groups.

of users or equipment according to a criterion
choose (working groups, types of services)
administrative, types of equipment, ...
 Example: Workgroup without Vlan
To create broadcast groups, you need to use
physically separated switches.
Because a switch considers that all its ports are
in the same broadcast field.
Without VLAN, to create two broadcast domains,
two separate switchers must be used.
expensive if we have several broadcast domains.
 Solution: Virtual LAN: Vlan
With VLAN: a switch can configure ports for VLAN1
(Broadcast1 domain) separated from other ports for another
vlan2 (Broadcast domain 2).
Possibility to create multiple VLANs on a single switch
(software Broadcast domain separation)
Minimization of LAN costs.
 Advantages of VLANs
Safety:
Minimization of the number of switchers in a LAN.
Minimization of risks on the LAN: minimization of
names of the hosts that will have the same frame.
Security of certain hosts sending data
confidential, specific,...by putting them in a
same VLAN.

Flexibility
Flexibility to group users by department, by
working groups,...instead of separating them
physically each by a switcher.
Ease of fault diagnosis,
Limit of STP on the VLAN of the same switch.
 Type of VLAN
Static: create manually (based on @MAC)
•Dynamically: by a server (based on the
@MAC, port number, ...

VLAN ranking:
classic traffic
Voice: VoIP,..
…
 Type of vlan
Several types of VLAN are defined, based on the switching criterion and the level.
auquel il s'effectue :
Level 1 VLAN (also called Port-Based VLAN) defines
a virtual network based on the connection ports on the switch;

•Level 2 VLAN (also known as MAC VLAN, IEEE address VLAN or in

MAC Address-Based VLAN involves defining a virtual network based on
MAC addresses of the stations. This type of VLAN is much more flexible than the
VLAN by port because the network is independent of the station's location;

Level 3 VLAN: we distinguish several types of Level 3 VLANs:

The VLAN by subnet (in English Network Address-Based VLAN) associates
subnets according to the source IP address.

The VLAN by protocol (in English Protocol-Based VLAN) allows for the creation of a
virtual network by protocol type (for example TCP/IP, IPX, AppleTalk, etc.)
thus regrouping all the machines using the same protocol within a
same network
 Creation of VLAN (in a static way)
Or: Sw#vlan database
•Sw(config)#vlan (vlan-id) Sw(vlan)#vlan (vlan-id) name (NAME)
•Sw(config-vlan)#name (give a name to your vlan)
•Sw(config)#int fa0/1 (assign the port fa0/1 to the vlan id)
or well
•Sw(config)#int range fa0/1-12 (allocate a set of ports to a VLAN ID)
Sw(config-if)#switchport mode access
•Sw(config-if)#switchport access vlan (vlan id)

Id: Identifier of a VLAN, value ranging from 1 to 1005 for standard VLANs.

and 1006..4094 for extended VLANs.

Native Vlan; by default, if you do not create any VLANs, the switch(es) you are
connected will create a default VLAN with identifier 1: (VLAN001)
The VLAN identifiers that you can create (delete) range from: 2 .. 100

There are specific valves (id: 1002, ..1005) that are reserved for communication with others.
types of LAN (fiber optic, FrameRelay, FDDI,...)
Port type in vlan (access port for the end user)
Example of valn (two valns, vlan20 and valn30
 Switch#show vlan

Standard VLANs are stored in a file called: [Link]

Switch(config)#vlan 20
Switch(config-vlan)#name ADMINISTRATION
•Switch(config-vlan)#exit
Switch configuration mode exited.

•Switch#show vlan
 Assignment of ports to vlan20
Switch(config)#int fa0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 20
 Trunk mode interface

Ping between the same devices of the same VLAN on the same switch: OK,
Ping between the same devices in the same VLAN but on different switches: Failed
Problem: the link between the two switchers cannot ensure switching within a
same value on different switchers
 Trunk mode interface
Solution: configure the interfaces connecting the two switches in Trunk mode.

Make sure to check all the VLANs

 With command line (CLI)
Switch(config)#interface FastEthernet0/1
(Or abbreviated: Switch(config)#int fa0/1)
Switch(config-if)#switchport mode trunk
Switch(config-if)#switchport trunk allowed vlan 10,20

Configuration of multiple ports on the same switch in trunk mode

(example interface: fa0/1, fa0/2, and fa0/3 for vlan 10 and 20)
Switch(config)#int range fa0/1-3
Switch(config-if-range)#switchport mode trunk
•Switch(config-if-range)#switchport trunk allowed vlan 10,20
 Inter-VLAN routing
In the event that we want to exchange information between
The PCs on different VLANs need a router.
•
1erStep: Creating virtual interfaces on the router
Do not give an IP address for the router

In CLI, type:
Router(config-if)#no ip address
Router(config-if)#exit
Router(config)#interface fastEthernet 0/0.10
Creation of an interface
Router(config-subif)#encapsulation dot1Q 10 virtual for valn 10
Router(config-subif)#ip add [Link] [Link]
Router(config-subif)#no shutdown (→ no shutdown)
Router(config-subif)#exit

Do the same for all the interfaces needed for the different VLANs created.
 2thstep: assign the Gateway to
level of the different PCs of each VLAN
Go to each of the PCs and add the gateways.
All PCs in the same VLAN must have the same
gateway.
 3thstep: trunk mode of the interface
switch - Router
Change the mode of the port connecting the switch to the
router, from access mode to trunk mode.
Routing table: Router#show ip route
example for three VLANs: 10, 20, and 30
 Concept of trunk
When a frame from a neighboring switch arrives at our switch, how does it know to
Which VLAN does the received frame belong to?

If nothing is done, the switch will assume that the frame belongs to VLAN 1 configured on the
port (default VLAN 1).

It is therefore necessary to configure the switches so that each time a frame exits a port for
join another switch, we add the identifier of the VLAN to which the frame belongs.
It's the concept of Trunk!
During its spread
on multiple switches, The trunk is the mechanism that
each frame will keep allows to insert the identifier
the information of his of VLAN on a user frame.
belonging to one's
VLAN.
The destination switch
will know through which ports it
plot can to be
switched (ports
belonging to the same
VLAN.
 Concept of trunk
All the frames that will come out at this link (right or left switch) will be visible.
apply an additional label that contains the VLAN identifier (in black)
the framework).
Historically, Cisco had created its own Trunk protocol between its switches.
named ISL –Inter-Switch Link. But this feature required an inter-
interoperability with other manufacturers.
The Trunk 802.1Q standard was released and Cisco also implemented it in its switches. Hence
possibility on some Cisco switches to decide which trunk we want to use, ISL or
802.1Q.
 Port Trunk ISL
The proprietary Cisco ISL trunk has the characteristic of encapsulating the entire user frame in
a new frame, called ISL frame. Here is what an ISL frame looks like:

Since this frame has a specific format, it is mandatory to configure the

ports of the switches in front of ISL trunk.

Configuration to be performed on the ports of the interconnected switches:

Switch(config)# interface fastethernet 0/0
Switch(config-if)# shutdown
Switch(config-if)#switchport trunkencapsulation isl
Switch(config-if)#switchport mode trunk
Switch(config-if)# no shutdown

Note: a frame that arrives unencapsulated ISL on a trunk port (coming from a user)
not belonging to a VLAN), will be classified as belonging to the Native VLAN (which is
by default the same as VLAN1).
 Port Trunk 802.1Q
The standardized trunk 802.1Q does not encapsulate the entire user frame like ISL but
cut the frame and insert a tag or TAG, named TAG 802.1Q.
Here is what a user frame looks like with the addition of the TAG 802.1Q:

40

The first framework is that of the user who arrives on the switch. As soon as this
the frame is sent to a port configured in Trunk 802.1Q, the switch inserts the TAG label
(frame n°2 in the diagram).
 Port Trunk 802.1Q
The content of this TAG includes the following fields (frame no. 3 in the diagram):

•Ethertype (2Ø): allows specifying that it is an 802.1Q frame, the value

in hex 0x8100

PRI (3bits): priority field on 3 bits that allows classifying traffic

user to apply quality of service (voice, video...) to him. This
champ is also called 802.1P for COS - Class Of Service.

•CFI (1 bit) - Canonical Format Identifier: allows for compatibility of a

Ethernet network with a TokenRing network. Field to forget for the CCNA
because there is almost no Token Ring network today.

•VLAN ID–VLAN Identifier: codé sur 12bits: valeur numérique du VLAN

to which the user framework belongs. It is the most important field to
to know
 Native Vlan
Trunk ports are the links between switches that support transmission.
associated traffic with several VLANs.

An 802.1Q trunk port supports traffic from many VLANs (tagged)

traffic: identified traffic (marked), as well as traffic that does not originate from a VLAN (non-traffic
identified).

The trunk port 802.1Q places unidentified traffic on the native VLAN, which is by default the
VLAN 1 on a Cisco switch.

PVID: Port Vlan ID (meaning which VLAN ID this port is assigned to?)
When configuring a 802.1Q trunk port, its PVID is assigned the ID identifier.
the native VLAN. In other words: each port configured as a trunk will be allocated, by default,
to the native VLAN.
All untagged traffic entering or exiting a trunk port is switched based on the
PVID value.

For example, if VLAN 77 is configured as the native VLAN, the PVID will be 77 and all the
unmarked traffic is transferred to VLAN 77.
It is recommended to configure the native VLAN as a VLAN distinct from VLAN 1 and
other VLANs. In fact, it is advisable to dedicate a fixed VLAN to serve as the native VLAN.
for all Trunk ports in the LAN.
 Native Vlan
PC1 and PC2 are in VLAN 10.
PC3 and PC4 are in VLAN 20.
The traffic of the two VLANs passes through.
the Trunk link that is
configured between the two
switches.

If PC1 sends traffic to PC2,

when the data leaves the
port Gi0/1, the switch S1
tag the traffic with the VLAN
10.

When S2 receives the beacon, the

the switch removes it and
send the data to PC2.

The native VLAN must be a VLAN

different from VLAN1, like
illustrated in this figure.
 VLAN interface of unswitch
(SVI: Switch Vlan Interface)
Why define an IP address for a switch?
Normally, we don't need it because of what we ask from the switch.
it is mainly about switching the frames of the computers
between them and towards the Internet output router.

Utility: Configuring an IP address on a switch allows us

allows remote access and to configure and manage it
remotely via HTTP, Telnet, SSH, or SNMP.

Most enterprise switches are configured to be

reachable remotely by administrators.

Indeed, network administrators often need

to access the switches to open/block a physical interface
(port), it will assign a specific VLAN, configure the speed and
duplex of the interface, analyze the statistics of the switch,…
 Analogy with a router
We configure an IP address on the router to access it remotely.
the steps are:
1. identify a physical interface of the router (for example FastEthernet 0/1)
2. enter privileged mode (enable)
3. enter global configuration mode of the router (configure terminal)
4. enter the configuration mode of the physical interface in question
(interface FastEthernet 0/1)
5. define the IP address and its mask (ip address [Link] [Link])
6. electrically activate the interface (no shutdown)
7. exit physical interface mode
8. exit global configuration mode.

The steps seem logical for a router while for a switch,

there is a particular feature, it is the VLAN interface.
 The VLAN management interface
Reminder: the switch contains VLANs that are used to isolate (separate) ...
physical interfaces between them. The switch is responsible for switching the
frames between them based on their VLAN membership.
Suppose "theoretically" that the switch has an IP address without
belonging to a VLAN.
My computer is connected to this switch via a physical interface that
belongs to VLAN 10.
From my PC, I am getting the IP address of the switch.

The switch receives a frame on a physical interface that belongs to the

VLAN 10, but the IP address of the switch does not belong to any VLAN.
Does he have the right to pass on the framework?
 The administration VLAN interface
•Solution: We identify a particular VLAN (for example VLAN 1 or
peu importe) et sur ce VLAN on active uneinterface VLANqui est une sorte
of a virtual interface that can be reached from any interface
physical devices that belong to the same VLAN.

This VLAN interface will be the Switch Virtual Interface (SVI) allowing to
to administer.

For the previous example:

if the physical interface belongs to VLAN 10 and that the VLAN interface of
if the switch is VLAN 1 then the ping from my computer will fail

if the physical interface belongs to VLAN 1 and the VLAN interface of

switch is VLAN 1 then the ping from my computer to the IP address of the
switch will work
 Management vlan
A management VLAN is any VLAN configured to access the management of a
switch.

VLAN 1 is the default management VLAN. To create the management VLAN,

The virtual switch interface (SVI) of this VLAN is assigned an address
IP and a subnet mask, allowing the switch to be managed via HTTP, Telnet,
SSH or SNMP.

Since the default configuration of a Cisco switch has VLAN 1 as

Default VLAN, VLAN 1 would be a bad choice for the management VLAN.

If the native VLAN is the same as the management VLAN, there is a security risk.

The native VLAN, when used, and the management VLAN must always be one.
distinct VLAN number from any other VLAN.
 Voice VLANs
VoIP traffic requires:
Guaranteed bandwidth to ensure the
quality of the voice
Transmission priority over
other types of network traffic.
Possibility of routing around the areas
clogged with the network.
Voice VLAN is necessary
•Delay less than 150 ms on the network
to take care of the voice
To meet these requirements,
the entire network must be designed over IP (VoIP).
to support VoIP.
voice VLAN between a
switch, a phone
In this figure, VLAN 150 is designed
to route voice traffic. Cisco IP and a computer.
The student's computer PC5 is
connected to the Cisco IP phone and the
The phone is connected to the switch.
S3.

PC5 is in VLAN 20, which is used

for student data.
 Note
The name of a VLAN is an ASCII string of 1 to 32 characters.

Creation of several VLANs at the same time: S1(config)# vlan 101,102-107

•Display briefly the VLANs of a switch: S1#show vlan brief

Show the information of a single VLAN (using its ID, e.g. VLAN 20): S1#show vlan id 20
Show information of a single VLAN (using its name): S1#show vlan name L2CS

Creation of a VLAN when assigning an interface to a non-existent VLAN (e.g.: the VLAN
40 does not exist on S1) : S1(config-if)#switchport access vlan 40
% Access VLAN does not exist. Creating vlan40
 Note
Decommissioning an interface from a VLAN ID:
S1(config-if)# no switchport access vlan id

Check the assignment status of the interface fa2/1 to the VLAN:

S1#show interfaces fa2/1 switchport

The switch will display:

•Name: Fa2/1
•Switchport: Enabled
•Administrative Mode: static access
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 40 (VLAN0040)
Trunking Native Mode VLAN: 1 (default)

•Delete a vlan :S1(config)# no vlan id