VLANs: what they are and why we use them

The problem: one big broadcast domain

A broadcast is a frame sent to every device on the local network. Its destination MAC address is ffff.ffff.ffff. ARP ("who has this IP address?") and DHCP ("is there a DHCP server?") both use broadcasts. A switch forwards a broadcast out of every port except the one it came in on.

A broadcast domain is the set of devices that receive each other's broadcasts. Out of the box, every port of a switch is in the same broadcast domain. In a small office that is fine. In a hospital with 600 devices, it means every PC, printer, camera and guest phone hears every broadcast, and any device can try to talk to any other device directly.

The answer: VLANs

A VLAN (virtual local area network) is a group of switch ports that behave as if they were on their own separate switch. A broadcast from a port in VLAN 10 goes only to the other ports in VLAN 10. Devices in VLAN 20 never see it. To get from one VLAN to another, traffic must go through a router or a layer 3 switch, where you can control it with rules.

Why VLANs are worth it

• Smaller broadcast domains: fewer devices hear each broadcast, so less wasted bandwidth and CPU.
• Security: guest Wi-Fi users cannot reach the billing servers, because traffic between VLANs must pass a router or firewall that checks it.
• Easier changes: moving a person to another department is a one-line config change, not a new cable.
• Better treatment for special traffic: voice and camera traffic can get its own VLAN and its own quality of service rules.

A common hospital plan: VLAN 10 STAFF, VLAN 20 GUEST-WIFI, VLAN 30 CCTV, VLAN 40 MEDICAL-DEVICES, VLAN 50 VOICE. Each VLAN normally gets its own IP subnet, for example 10.10.10.0/24 for staff and 10.10.20.0/24 for guests. One VLAN, one subnet: remember this rule.

VLAN numbers

A VLAN ID is a 12-bit number, so it can be 0 to 4095. The values 0 and 4095 are reserved, which leaves 1 to 4094 for use.

Creating VLANs and access ports

SW1(config)# vlan 10
SW1(config-vlan)# name STAFF
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name GUEST
SW1(config-vlan)# exit
SW1(config)# interface range fastEthernet 0/1 - 2
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# exit
SW1(config)# interface fastEthernet 0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20

An access port belongs to exactly one data VLAN. It sends and receives normal, untagged frames, so the PC plugged into it does not know that VLANs exist. switchport mode access fixes the port as an access port, so it will never turn into a trunk by negotiation (you will meet trunks in the next topic).

Checking your work: show vlan brief

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/4, Fa0/5, Fa0/6, Gi0/2
10   STAFF                            active    Fa0/1, Fa0/2
20   GUEST                            active    Fa0/3
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

If Gi0/1 is missing from every line, that is normal when Gi0/1 is a trunk: show vlan brief lists only access ports. Use show interfaces trunk to see trunks.

Voice VLAN: a phone and a PC on one port

Offices often plug a PC into the back of an IP phone, and the phone into the wall port. The port then carries two kinds of traffic. With switchport voice vlan 50, the switch tells the phone (using CDP or LLDP-MED) to tag its voice frames with VLAN 50, while the PC traffic stays untagged in the access VLAN. The port is still an access port.

SW1(config)# interface fastEthernet 0/10
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# switchport voice vlan 50

Common mistakes and how to fix them

• Expecting PCs in two VLANs to ping each other through the switch alone. They cannot: you need inter-VLAN routing (later in this module).
• Leaving unused ports in VLAN 1 and enabled. Best practice is to move them to an unused "parking" VLAN and shut them down, so nobody can plug in and join a real VLAN.
• Using the same subnet in two VLANs. Each VLAN needs its own subnet, or routing between them breaks.
• Forgetting switchport mode access, which leaves the port able to negotiate a trunk with whatever is plugged in.