Introduction to Virtual LANs (VLANs)

A Virtual Local Area Network (VLAN) allows a physical network infrastructure to be logically partitioned into multiple distinct broadcast domains. This architecture enhances performance, security, and administrative flexibility by grouping hosts based on organizational functions rather than physical locations.

1. Physical LAN Segmentation vs. Logical Segmentation

In traditional local area networks (LANs), physical network segments correspond directly to logical broadcast domains. Every device connected to the same shared hub or Layer 2 switch structure belongs to the same broadcast domain.

The Scalability Problem of Single Broadcast Domains

As networks scale, the sheer volume of broadcast traffic (such as ARP requests, DHCP discoveries, and routing updates) increases exponentially. If $N$ represents the number of active host devices, and $B_i$ represents the broadcast generation rate of host $i$ , the total background broadcast traffic $T_{bc}$ processing load on every network interface card (NIC) can be modeled as:

$T_{bc} = \sum_{i=1}^{N} B_i$

In a large, non-segmented network, this overhead degrades overall node performance, as every CPU must interrupt its pipeline to parse frames destined for the MAC address FF:FF:FF:FF:FF:FF.

The Solution: VLANs

VLANs solve this scalability problem by restructuring the broadcast domain boundaries at Layer 2 (Data Link Layer) of the OSI model using software-driven logical boundaries. Instead of physically running separate switches and cabling for different departments (e.g., Sales, Engineering, Human Resources), network architects configure a single physical switch to act as multiple isolated logical switches.

text

       TRADITIONAL PHYSICAL LAN                     LOGICAL VLAN SEGMENTATION
       
       +-----------------------+                    +-----------------------+
       |     Layer 2 Switch    |                    |     Layer 2 Switch    |
       +---|---|---|---|---|---+                    +---|---|---|---|---|---+
           |   |   |   |   |                            |   |   |   |   |
          PC1 PC2 PC3 PC4 PC5                          PC1 PC2 PC3 PC4 PC5
          |_________________|                          |_____| |_________|
               Single                                  VLAN 10   VLAN 20
          Broadcast Domain                             (Sales)     (IT)
                                                       (Separate Broadcast Domains)

2. VLAN Membership and Structure

A switch manages its VLAN layout by classifying ports and associating physical frames with a specific VLAN ID.

Methods of Membership Determination

Static VLAN Configuration (Port-based): Ports on a switch are manually assigned to a specific VLAN by the network engineer. This is the most common and secure configuration.
Dynamic VLAN Configuration: Switch ports discover the client device's attributes (such as the device’s MAC Address or authenticated user credentials) and dynamically assign the appropriate VLAN using a centralized Management/Policy Server (e.g., RADIUS with 802.1X).

VLAN Ranges and Capacity

The Virtual LAN layout utilizes identification parameters defined by the system standard. The limits of VLAN scale are calculated using basic bitwise allocations. A standard VLAN Identifier (VID) consists of $12\text{ bits}$ :

$2^{12} = 4096 \text{ potential VLAN IDs}$

These IDs are categorized as follows:

VLAN 0 and 4095: Reserved for system use.
VLAN 1: The default native VLAN. All switch ports default to VLAN 1 upon initial boot.
VLANs 2 - 1001: Normal range VLANs used for ethernet connections.
VLANs 1002 - 1005: Reserved for legacy Token Ring and FDDI configurations.
VLANs 1006 - 4094: Extended range VLANs, utilized primarily by service providers or large-scale enterprise campuses.

3. Switch Port Modes: Access vs. Trunk Links

To transport traffic across multiple switches, switch ports must be classified into specific operating modes. These modes dictate how the switch handles incoming and outgoing frame headers.

text

               +------------------+                   +------------------+
               |  Cisco Switch A  |                   |  Cisco Switch B  |
               +--------+---------+                   +--------+---------+
                        |                                      |
                        | [Port: Trunk Mode]---------[Trunk]---| [Port: Trunk]
                        |                                      |
       +----------------+----------------+    +----------------+----------------+
       |                                 |    |                                 |
[Port: Access]                    [Port: Access]                     [Port: Access]
  (VLAN 10)                         (VLAN 20)                          (VLAN 10)
       |                                 |                                  |
    [ PC 1 ]                          [ PC 2 ]                           [ PC 3 ]

Access Ports

An Access Port is assigned to exactly one specific VLAN.

It connects directly to end-user workstations, printers, or servers that operate standard Network Interface Cards (NICs).
Any frame sent from the host device is untagged. Once the frame enters the access port, the switch assumes it belongs to the configured VLAN ID of that interface.
When a frame leaves an access port to the target host, the switch strips all VLAN metadata, delivering a standard IEEE 802.3 Ethernet frame.

Trunk Ports

A Trunk Port is a point-to-point link configured to multiplex traffic belonging to multiple VLANs across a single physical connection.

Typically used to link Switch-to-Switch, Switch-to-Router, or Switch-to-Server virtualization environments.
Maintains the logical isolation of packets across physical links by embedding routing indicators directly into the frame.

The IEEE 802.1Q Tagging Mechanism

To keep track of which frame belongs to which VLAN over a trunk link, the transmitting switch inserts a 4-byte (32-bit) header modification known as an IEEE 802.1Q Tag into the original Ethernet frame layout.

The tag is injected between the Source MAC Address and the EtherType/Length fields of the original frame:

$\text{Original Frame: } [\text{Preamble}] \to [\text{DMAC}] \to [\text{SMAC}] \to [\text{EtherType/Len}] \to [\text{Payload}] \to [\text{FCS}]$

$\text{Tagged Frame: } [\text{Preamble}] \to [\text{DMAC}] \to [\text{SMAC}] \to \mathbf{[\text{802.1Q Tag (4 Bytes)}]} \to [\text{EtherType/Len}] \to [\text{Payload}] \to [\text{FCS}]$

The $4\text{-byte}$ (32-bit) 802.1Q tag header contains the following internal fields:

| Field Name | Bit Width | Description | | :--- | :--- | :--- | | TPID (Tag Protocol Identifier) | $16\text{ bits}$ | Set to value $0x8100$ to identify the frame as 802.1Q tagged. | | PCP (Priority Code Point) | $3\text{ bits}$ | Used for Quality of Service (QoS) class prioritization (IEEE 802.1p). | | DEI (Drop Eligible Indicator) | $1\text{ bit}$ | May be used separately or in conjunction with PCP to indicate frames eligible to be dropped during congestion. | | VID (VLAN Identifier) | $12\text{ bits}$ | Specifying the exact VLAN ( $0$ to ) to which the frame belongs. |

4. Implementing VLANs on Cisco IOS Switches

Configuring VLANs and port modes is a fundamental operational task performed via the command-line interface (CLI). Below is the structured Cisco IOS configuration workflow.

Step 1: Create and Name the VLAN Databases

text

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name IT
Switch(config-vlan)# exit

Step 2: Assign Access Ports to Respective VLANs

We will configure interfaces FastEthernet 0/1 and 0/2 to belong to the SALES department (VLAN 10), and interfaces 0/3 and 0/4 to the IT department (VLAN 20).

Using the interface range command optimizes configuration efficiency:

text

Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit
 
Switch(config)# interface range fa0/3 - 4
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit

Step 3: Configure the Trunk Port Interface

To ensure that traffic from both VLAN 10 and VLAN 20 can flow to an upstream router or switch connected to interface FastEthernet 0/5, we establish a trunking relationship:

text

Switch(config)# interface fa0/5
Switch(config-if)# switchport mode trunk
Switch(config-if)# exit

5. Inter-VLAN Routing (Router-on-a-Stick)

Because each VLAN is configured as an isolated Layer 2 broadcast domain and logical IP subnet, hosts in different VLANs cannot directly communicate at Layer 2. If PC1 (VLAN 10) attempts to send an IP packet to PC3 (VLAN 20), the traffic must be routed at Layer 3 (Network Layer) through a default gateway.

One common and efficient approach to route between VLANs using limited physical ports is the Router-on-a-Stick (ROAS) design.

text

                  +------------------------+
                  |     Layer 3 Router     |
                  +-----------+------------+
                              | (Physical interface e.g., fa0/0)
                              | (Multiplexed logical sub-interfaces)
                              | 
                              | [Trunk Link]
                              | 
                  +-----------+------------+
                  |  Layer 2 Switch (fa0/5)|
                  +-----+------------+-----+
                        |            |
             (fa0/1)   |            | (fa0/3)
                        |            |
                     [ PC 1 ]     [ PC 3 ]
                     VLAN 10      VLAN 20

Host IP Allocation Model

For this routing example, the IP network design splits a class C block using typical VLSM metrics. The subnet masks are configured at a $24\text{-bit}$ boundary:

$\text{Subnet Size} = 2^{32-24} = 256 \text{ addresses (254 usable hosts)}$

VLAN 10 Subnet: $192.168.1.0/24$ (Gateway IP: $192.168.1.1$ )
VLAN 20 Subnet: $192.168.2.0/24$ (Gateway IP: $192.168.2.1$ )

Router Configuration CLI Commands

On the router, the single physical interface (e.g., FastEthernet 0/0) is enabled without an IP address. Instead, we generate logical sub-interfaces matching each VLAN parameter.

text

Router> enable
Router# configure terminal
 
! Enable the physical link, but do not bind an IP address to it
Router(config)# interface fa0/0
Router(config-if)# no shutdown
Router(config-if)# exit
 
! Configure Sub-interface for VLAN 10
Router(config)# interface fa0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.1.1 255.255.255.0
Router(config-subif)# exit
 
! Configure Sub-interface for VLAN 20
Router(config)# interface fa0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.2.1 255.255.255.0
Router(config-subif)# exit

6. Key Advantages of Implementing VLANs

The application of Virtual LAN strategies provides several immediate engineering benefits:

Enhanced Security: By localizing critical network nodes (e.g., Database servers or administrative terminals) to a dedicated secure VLAN, external users in other VLANs cannot access them without going through defined Layer 3 access control lists (ACLs) on the router.
Cost Reduction: Instead of purchasing separate, dedicated physical hubs, routers, and switches for different operational divisions, organizations can maximize the port density of existing enterprise switches, saving on capital expenditure (CAPEX) and energy requirements.
Optimized Performance and Broadcast Storm Control: Since Layer 2 broadcasts are constrained to individual VLAN interfaces, network congestion drops dramatically. Unnecessary multicast and broadcast storms are isolated to their originating VLAN, leaving other logical segments unhindered.
Simplified IT Administration: Network engineers can dynamically re-arrange logical group schemes or assign user access policies entirely through software, without physically relocating a single patch cord in the telecommunications closet.

Summary

VLAN Definition: A VLAN is a logical local area network configured via software rather than physical wiring, serving to partition a physical switch structure into distinct Layer 2 broadcast domains.
VLAN Identification Limit: Ethernet frames are identified on trunk links utilizing the IEEE 802.1Q standards, allocating $12\text{ bits}$ for the VLAN ID, resulting in a theoretical capacity of up to $4096$ distinct VLAN configurations.
Access vs. Trunk Interfaces: Switch ports are classified as access interfaces (assigned to a single VLAN and transmitting standard untagged frames to endpoints) or trunk interfaces (carrying multiplexed, tagged frames representing multiple VLANs across central network infrastructure).
Inter-VLAN Communication: Since switches segment broadcast domains at Layer 2, moving traffic between individual VLANs requires a Layer 3 routing engine.
Router-on-a-Stick (ROAS): A practical, single-cable inter-VLAN routing pattern that utilizes virtual sub-interfaces configured with 802.1Q encapsulation to act as the default gateways for multiple subnets.

Assessed progress

Introduction to Virtual LANs (VLANs)

Introduction to Virtual LANs (VLANs)

1. Physical LAN Segmentation vs. Logical Segmentation

The Scalability Problem of Single Broadcast Domains

The Solution: VLANs

2. VLAN Membership and Structure

Methods of Membership Determination

VLAN Ranges and Capacity

3. Switch Port Modes: Access vs. Trunk Links

Access Ports

Trunk Ports

The IEEE 802.1Q Tagging Mechanism

4. Implementing VLANs on Cisco IOS Switches

Step 1: Create and Name the VLAN Databases

Step 2: Assign Access Ports to Respective VLANs

Step 3: Configure the Trunk Port Interface

5. Inter-VLAN Routing (Router-on-a-Stick)

Host IP Allocation Model

Router Configuration CLI Commands

6. Key Advantages of Implementing VLANs

Summary

Key Concepts

Broadcast Domain

Virtual LAN (VLAN)

Access Port

Trunk Port

Router-on-a-Stick (ROAS)

Quick Check

Computer Networks

Computer Networks