Computer Networks

Mini Project
VLAN Segmentation

Submitted by:
Keshav 2023UCM2310
Shubham Singh Rawat 2023UCM2334
Pranjal Singh 2023UCM2338
Problem Understanding & Objective:
Problem Understanding:
In an organizational network, all connected devices belong to a single broadcast domain by
default. This means every broadcast packet sent by any device is received by all others,
leading to network congestion, reduced efficiency, and potential security risks.​
As the number of users grows in different departments such as in a college administration
system (like Admin, Faculty, and Students), the amount of unnecessary broadcast traffic
increases, slowing down communication and making network management complex.

Additionally, it becomes difficult to control access between departments or to segment the

network logically for security or administrative purposes. For instance, administrative
systems should not be directly accessible to student systems, even if departments still need to
share certain resources, such as servers or internet gateways.

To solve these issues, organizations use Virtual Local Area Networks (VLANs) to divide a
single physical network into multiple logical networks. However, since VLANs operate at
Layer 2 of the OSI model (Data Link Layer), devices in different VLANs cannot
communicate directly without a Layer 3 device (router), because VLANs divide a network
into isolated groups where devices in one group can’t directly reach those in another
without a router. A switch forwards frames only within the same VLAN based on MAC
addresses and has no awareness of IP routing across VLAN boundaries. This introduces
the need for Inter-VLAN Routing, and specifically the concept of a Router-on-a-Stick,
where a single physical router interface is virtually split into multiple subinterfaces, each
corresponding to a VLAN.

In this project, the network is further expanded using two interconnected switches, one
handling the Admin and Faculty VLANs, and another handling the Student VLAN. This
setup helps simulate physical separation between departments and the realistic propagation
of VLAN information through trunk links between switches.

Objective:
The objective of this project is to design and implement a segmented, scalable, and efficient
network using VLAN Segmentation and Router-on-a-Stick configuration.

Specifically, the project aims to:

1)​ Segment the Network Using VLANs

a)​ Create separate VLANs for Admin, Faculty, and Students to isolate
departmental traffic.
b)​ Assign unique VLAN IDs and IP subnets to each department.
 2)​ Enable Controlled Inter-VLAN Communication
a)​ Configure subinterfaces on a single router to allow routing between VLANs.
b)​ Implement 802.1Q trunking to tag VLAN traffic and ensure correct packet
delivery.
3)​ Configure and Connect Network Devices
a)​ Set access ports for end devices belonging to specific VLANs.
b)​ Use trunk ports between switches and between switches and routers for VLAN
propagation.
4)​ Understand and Verify Packet Flow
a)​ Use simulation tools to observe ARP requests, ICMP packets, and PDU flow
during ping operations.
b)​ Demonstrate how encapsulation and de-encapsulation occur as packets move
between VLANs.

Key Terms & Concepts:

VLAN:​
A VLAN is a logical partition of a physical network that groups devices into separate
broadcast domains, regardless of their physical location. Devices within the same VLAN can
communicate directly with each other, while traffic between different VLANs is blocked
unless routed. VLANs improve network efficiency, security, and management by reducing
broadcast traffic and logically segmenting departments or groups.
Example: In this project, Admin, Faculty, and Students are placed in VLANs 10, 20, and 30
respectively.

Broadcast Domain:
A broadcast domain is the range of devices that receive broadcast frames sent by any device
within that domain. Without VLANs, all devices connected to a switch are in a single
broadcast domain, meaning every broadcast is received by all devices. VLANs divide a
network into multiple broadcast domains, reducing unnecessary traffic and improving
performance.

Default Gateway:
The router IP through which devices in a VLAN send traffic destined for another VLAN or
external network.

Trunk Port:
A trunk port is a switch port that can carry traffic for multiple VLANs simultaneously. It uses
802.1Q tagging to identify which VLAN each frame belongs to, allowing multiple VLANs to
traverse a single physical connection between switches or between a switch and a router.
Example: The link between Switch1 and Switch2, or between Switch1 and the router, is
configured as a trunk to carry VLANs 10, 20, and 30.

Access Port:
An access port is a switch port configured to carry traffic for only one VLAN. It is typically
used to connect end devices like PCs or printers to the network. All untagged frames arriving
on an access port are automatically assigned to the VLAN configured on that port.
Example: PC1 in Admin VLAN 10 is connected to an access port on Switch1.

Router on a Stick:
Router-on-a-Stick is a network design where a single physical router interface is divided into
multiple subinterfaces, each assigned to a different VLAN. This allows the router to perform
inter-VLAN routing, enabling devices in different VLANs to communicate while still
maintaining logical separation.
Example: In this project, the router has subinterfaces G0/0.10, G0/0.20, and G0/0.30 for
VLANs 10, 20, and 30.

Subinterface:
A subinterface is a virtual interface on a physical router port, created to handle traffic for a
specific VLAN. Each subinterface has its own IP address, acting as the default gateway for
that VLAN. Subinterfaces allow one physical router interface to serve multiple VLANs
efficiently.
Example: G0/0.10 on the router is a subinterface for VLAN 10 (Admin) with IP
[Link].

802.1Q Encapsulation:
802.1Q is a standard that tags Ethernet frames with a VLAN ID so they can travel across
trunk links. This tagging ensures that when a frame reaches another switch or router, it is
forwarded to the correct VLAN. Without 802.1Q, VLAN information would be lost across
trunk connections.
Example: When a packet from VLAN 10 travels from Switch1 to the router, it is tagged as
VLAN 10 using 802.1Q.

ARP (Address Resolution Protocol):

ARP is a protocol used by devices to discover the MAC address corresponding to a known IP
address within a network. When a device wants to send data to another device, it broadcasts
an ARP request asking, “Who has this IP?” The device with that IP responds with its MAC
address, allowing proper frame delivery at Layer 2.
Example: PC1 sends an ARP request to find the MAC address of the router’s G0/0.10
interface before sending an inter-VLAN packet.
ICMP (Internet Control Message Protocol):
ICMP is a network-layer protocol used to send control and diagnostic messages. The most
common use is the ping command, which sends ICMP Echo Request messages to a target
device and receives Echo Replies, helping test connectivity between hosts.
Example: PC1 pings PC6 to check if inter-VLAN routing is working correctly through the
router.

PDU (Protocol Data Unit):

A PDU is a unit of data transmitted over a network at a particular layer of the OSI model. At
Layer 2 (Data Link), it is a frame; at Layer 3 (Network), it is a packet; at Layer 4 (Transport),
it is a segment or datagram. PDUs carry headers and payloads that provide addressing,
control, and routing information.

Example: When PC1 pings PC6, the ICMP message is encapsulated in a PDU that traverses
the VLANs, trunk links, and router subinterfaces.

Topology:

The network consists of two switches, one router, and six PCs divided into three VLANs —
Admin (VLAN 10), Faculty (VLAN 20), and Students (VLAN 30).

●​ Switch0 connects the Admin and Faculty PCs, while Switch1 connects the
Student PCs.
●​ The router is linked to Switch0 via a trunk port and configured with three
subinterfaces (G0/0.10, G0/0.20, G0/0.30) for inter-VLAN routing using
802.1Q encapsulation.
●​ The link between the two switches is also a trunk, allowing VLAN traffic to
pass between them.
●​ Access ports connect individual PCs to their respective VLANs.
 ●​ When devices in different VLANs communicate, traffic is sent to the router,
which routes it between VLANs and sends it back through the trunk to the
correct destination.

Note:​
A second switch was used for VLAN 30 (Students) to simulate a separate department,
though it could have been placed on the same switch without affecting functionality.

Simulation setting :

In the simulation, two ICMP communication tests were conducted to verify both
intra-VLAN and inter-VLAN connectivity:

1.​ Blue packets represent an ICMP ping from PC0 to PC1, both within the Admin
VLAN (VLAN 10). This test demonstrates that devices within the same VLAN can
communicate directly through the switch without involving the router.
2.​ Red packets represent an ICMP ping from PC0 (Admin VLAN 10) to PC5
(Student VLAN 30). This communication requires the packet to travel from Switch0
to the router via the trunk link, be routed to VLAN 30 through the corresponding
subinterface, and then sent to Switch1 and PC5. This illustrates inter-VLAN routing
using the Router-on-a-Stick configuration.
3.​ Green packets indicate ARP requests and replies, which occur before ICMP
messages are exchanged. These packets are used by devices to discover the MAC
address of the destination or default gateway. Once ARP resolution is complete,
ICMP packets follow the resolved path to complete the ping process.
Switch 0 VLAN Brief:

Switch 0 handles VLAN segmentation for the Admin (VLAN 10) and Faculty (VLAN 20)
networks.

●​ VLAN 10 and VLAN 20 are created and assigned to their respective access ports,
connecting PCs belonging to each department.
●​ A trunk port is configured on the interface connecting to the router, allowing traffic
from multiple VLANs to travel through a single physical link.
●​ The trunk port uses 802.1Q encapsulation to tag frames with their VLAN IDs so that
the router can distinguish between them.

Switch 1 VLAN Brief:

Switch 1 is added to extend the network and handle the Students VLAN (VLAN 30).
●​ VLAN 30 is created and assigned to access ports connected to student PCs.
●​ A trunk port is established between Switch 1 and Switch 0, allowing VLAN 30
traffic to reach the router via Switch 0’s trunk connection.
●​ This setup simulates physical distance or a separate section of the network for the
student area.

Note: Switches use ethernet 802.1Q encapsulation by default.

Router brief:

●​ The router performs inter-VLAN routing through subinterfaces on a single physical

interface (Gig0/0 here).
●​ Each subinterface represents a VLAN and handles routing between them using
802.1Q encapsulation.
●​ Each subinterface has its own IP address, which acts as the default gateway for that
VLAN.
●​ Show ip route: This command displays the routes known to the router, essentially the
networks it can reach and through which interfaces. Since this is a single
router-on-a-stick setup, all routes are directly connected, meaning each VLAN’s
network is reachable through its subinterface.
Configuration:
Router Configuration:

The router is configured to enable communication between different VLANs using a single
physical interface divided into subinterfaces, one for each VLAN. Each subinterface is
assigned a unique IP address that acts as the default gateway for devices within that VLAN.

●​ The encapsulation dot1Q command links each subinterface to its VLAN, allowing
VLAN-tagged traffic to be correctly identified.
●​ The router assigns an IP to each subinterface, becoming the gateway for that VLAN.
●​ When a device in one VLAN needs to reach another VLAN, the packet is sent to its
gateway (the router), which routes it to the destination VLAN through the respective
subinterface.
Switch 0 Configuration:

●​ VLAN Creation: VLAN 10 (Admin) and VLAN 20 (Faculty) are created and
assigned to respective access ports for PCs.
●​ Trunk Configuration: Two trunk links are set up, one to the router and another to
Switch1, using switchport mode trunk. The trunk links carry VLAN-tagged traffic
(10, 20, and 30) between devices and allow inter-VLAN communication via the
router.
Switch 1 configuration:

●​ It has two PCs assigned to VLAN 30 on access ports.

●​ A trunk link to Switch0 carries VLAN 30 traffic, tagged using IEEE 802.1Q
encapsulation.
Admin (VLAN 10) Configuration:

Faculty (VLAN 20) Configuration:

Students (VLAN 30) Configuration:

Explanation:
●​ Each PC is manually assigned an IP address within its VLAN’s subnet (for instance,
PC0 = [Link]).
●​ The default gateway (router subinterface IP) is extremely important, it tells the PC
where to send packets destined for devices outside its own VLAN.
●​ When a PC pings another PC in the same VLAN, traffic stays within the switch. But
when it pings a PC in a different VLAN, it goes first to the router (via the gateway),
then is routed to the target VLAN.
Output And Verification:
Ping and tracert:

Ping and Traceroute Results:

1.​ Ping from PC0 (VLAN 10 – Admin) to PC1 (VLAN 10 – Admin). This test verifies
intra-VLAN communication within the Admin department. Since both PCs belong
to the same VLAN and subnet ([Link]/24), the traffic stays within Switch0.
The switch forwards frames directly between PC0 and PC1 using MAC address
learning, therefore, no router involvement is needed.
2.​ Ping from PC0 (VLAN 10 – Admin) to PC2 (VLAN 20 – Faculty). This test checks
inter-VLAN communication through the router. Because the source (PC0) and destination
(PC2) are in different VLANs and subnets, packets cannot travel directly. Instead:
a.​ PC0 sends the packet to its default gateway ([Link]) on the router.
b.​ The router routes the packet via its VLAN 20 subinterface ([Link]).
c.​ The packet is sent to Switch0, which forwards it to PC2 in VLAN 20.
d.​ The successful ping and traceroute with two hops (PC0 → Router → PC2) confirm
that inter-VLAN routing (Router-on-a-Stick) is working correctly.

Typically, the VLAN ID is the last 12 bits of the TCI field.

The TCI field, for example 0x001e, is 16 bits long, but the VLAN ID (VID) only uses the last 12
bits. The first 4 bits are used for Priority and other indicators.

●​ VLAN ID Location: Ethernet 802.1q layer, in the TCI (0x001e) field.

Inter VLAN:

Outbound:

●​ VLAN ID Confirmation: As established, the (0x000a) TCI field decodes to a VLAN

ID of 10 (since 0x000a converts to 10 in decimal).
●​ Outbound PDU Context: Seeing this tagged frame in the "Outbound PDU Details"
means the device (the switch in this case) is sending the frame out of one of its ports.

Inbound:
●​ VLAN ID Confirmation: As established, the (0x001e) TCI field decodes to a VLAN
ID of 30 (since 0x001e converts to 30 in decimal).
●​ Inbound PDU Context: Seeing this tagged frame in the “Inbound PDU Details”
means the device (the switch in this case) is sending the frame out of one of its ports
●​ Frame Destination: When a switch adds an 802.1q tag to an outgoing frame, it is
doing so because the frame is intended for a host (or another device) that belongs to
that specific VLAN, or it is going out a trunk port. Since the ultimate destination IP is
[Link], and the frame is tagged with VLAN 30, the network infrastructure is
correctly steering the ICMP echo request toward the device associated with VLAN
30.