VLAN
A virtual LAN, commonly known as a vLAN or as a VLAN, is a logically-independent network. Several VLANs can co-exist on a single physical switch.
A VLAN consists of a network of computers that behave as if connected to the same wire - even though they may actually be physically connected to different segments of a LAN. Network administrators configure VLANs through software rather than hardware, which makes them extremely flexible. One of the biggest advantages of VLANs emerges when physically moving a computer to another location: it can stay on the same VLAN without the need for any hardware reconfiguration.
Protocols and design
The IEEE 802.1Q tagging protocol dominates the VLAN world. Prior to the introduction of 802.1Q several proprietary protocols existed, such as Cisco's ISL (Inter-Switch Link, a variant of IEEE 802.10) and 3Com VLT (Virtual LAN Trunk). Some users now deprecate ISL in favor of 802.1Q.
Early network designers often configured VLANs with the aim of reducing the size of the collision domain in a large single Ethernet segment and thus of improving performance. When Ethernet switches made this a non-issue (because they have no collision domain), attention turned to reducing the size of the broadcast domain at the MAC layer. Virtual networks can also serve to restrict access to network resources without regard to physical topology of the network, although the strength of this method remains debatable as VLAN Hopping is a common means of bypassing such security measures.
Virtual LANs operate at layer 2 (the data link layer) of the OSI model. However, administrators often configure a VLAN to map directly to an IP network, or subnet, which gives the appearance of involving layer 3 (the network layer).
In the context of VLANs, the term "trunk" denotes a network link carrying multiple VLANs which are identified by labels (or "tags") inserted into their packets. Such trunks must run between "tagged ports" of VLAN-aware devices, so are often switch-to-switch or switch-to-router links rather than links to hosts. (Confusingly, the term 'trunk' also gets used for what Cisco call "channels" : Link Aggregation or Port Trunking). A router (Layer 3 switch) serves as the backbone for network traffic going across different VLANs.
On Cisco devices, VTP (VLAN Trunking Protocol) allows for VLAN domains, which can aid in administrative tasks. VTP also allows "pruning", which involves directing specific VLAN traffic only to switches which have ports on the target VLAN.
Assigning VLAN Memberships
The three ways that are in use are:
- Port-based: A switch port is manually configured to be a member of a VLAN. This method only works if all machines on the port belong to the same VLAN.
- MAC-based: VLAN membership is based on the MAC address of the workstation. The switch has a table listing of the MAC address of each machine, along with the VLAN to which it belongs.
- Protocol-based: Layer 3 data within the frame is used to determine VLAN membership. For example, IP machines can be classified as the first VLAN, and AppleTalk machines as the second. The major disadvantage of this method is that it violates the independence of the layers, so an upgrade from IPv4 to IPv6, for example, will cause the switch to fail.
References
- Andrew S. Tanenbaum, 2003, "Computer Networks", Pearson Education International, New Jersey.