VLAN Configuration and Port Assignment

This guide covers Virtual Local Area Networks (VLANs), exploring logical LAN segmentation, frame tagging standard structures, switch port properties, and hands-on implementation of inter-VLAN routing.

1. Introduction to Connecting Devices and LAN Segmentation

Before examining logical networks, we must understand the physical and logical boundaries established by legacy connecting devices at different layers of the OSI model:

text

+------------------+-----------------------------------------------------------+
| OSI Layer        | Primary Connecting Device                                 |
+------------------+-----------------------------------------------------------+
| Layer 1 (Physical)| Passive Hubs, Active Hubs, Repeaters                     |
| Layer 2 (Data)   | Bridges, Multi-port Layer 2 Switches                      |
| Layer 3 (Network)| Routers, Layer 3 (Multi-layer) Switches                   |
+------------------+-----------------------------------------------------------+

Historically, Repeaters and Hubs operated purely at the physical layer. A repeater regenerates the incoming electrical signal but does not inspect or filter frames; it maintains a single Collision Domain and a single Broadcast Domain.

Bridges and Layer 2 Switches inspect Layer 2 Frame Headers (MAC addresses) to build dynamic filtering tables. A switch segments a network into separate collision domains per port. However, it still maintains a single Broadcast Domain across all its interfaces:

text

[ Flat Switch Topology: Single Broadcast Domain ]
 
        +-----------------------+
        |     Layer 2 Switch    |
        +-----------------------+
         /     |         \     \
        /      |          \     \
     [PC-1]  [PC-2]     [PC-3]  [PC-4]
     <-------------------------------+>
         Single Broadcast Domain (Default)

In a flat Layer 2 network topology with $N$ hosts, if each host sends $B$ broadcast frames per second, the total broadcast traffic received by each network node is:

$\text{Broadcast Traffic received per Host} = (N - 1) \times B$

As $N$ scales upward, the overhead of handling broadcast packets (e.g., ARP queries, DHCP discoveries) can degrade end-host performance and consume substantial link bandwidth. To prevent this, network administrators partition the physical topology into smaller, isolated Broadcast Domains using Virtual LANs.

2. Fundamentals of Virtual Local Area Networks (VLANs)

A Virtual Local Area Network (VLAN) is a logical local area network configured by software rather than physical wiring.

text

[ Logical VLAN Segmentation on a Single Switch ]
 
                  +------------------------+
                  |  Switch (VLAN Enabled) |
                  +------------------------+
                   /      \        /      \
               VLAN 10  VLAN 10  VLAN 20  VLAN 20
                 /          \    /          \
              [PC-1]      [PC-2][PC-3]     [PC-4]
              \________________/ \________________/
                  Broadcast          Broadcast
                  Domain A           Domain B

By assigning switch interfaces to distinct logical groups, a single physical switch can act as multiple, completely isolated logical switches.

2.1 The Mathematical Benefit of Broadcast Domain Subdivision

If we segment a flat network of $N$ hosts into $K$ distinct VLANs of equal size, the broadcast overhead per node drops from $(N-1)B$ to:

$\text{VLAN Broadcast Overhead} = \left( \frac{N}{K} - 1 \right) \times B$

This mathematical reduction demonstrates why VLAN logical division scales large enterprise campuses.

2.2 IEEE 802.1Q Frame Tagging

When frames must travel across multiple switches, the switches need a way to track which VLAN a frame belongs to. The industry-standard protocol for this is IEEE 802.1Q.

A standard Ethernet II frame is modified by inserting a 4-byte (32-bit) tag between the Source MAC Address and the EtherType/Length fields:

text

Standard Ethernet II Frame:
+-----------+-----------+-----------+-------------------+-----------+
| Dest MAC  | Src MAC   | Type/Len  |      Payload      |    FCS    |
|  (6B)     |  (6B)     |  (2B)     |    (46-1500B)     |   (4B)    |
+-----------+-----------+-----------+-------------------+-----------+
 
IEEE 802.1Q Tagged Frame:
+-----------+-----------+===================+-----------+-----------+-----------+
| Dest MAC  | Src MAC   | 802.1Q VLAN Tag   | Type/Len  |  Payload  |  New FCS  |
|  (6B)     |  (6B)     |     (4 Bytes)     |  (2B)     | (46-1500B)|   (4B)    |
+-----------+-----------+===================+-----------+-----------+-----------+

The 4-byte 802.1Q VLAN Tag is structured as follows:

text

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|       TPID (0x8100)           | PCP |D|          VID          |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Tag Protocol Identifier (TPID) [16 bits]: Always set to 0x8100 to indicate that the frame is 802.1Q tagged.
Priority Code Point (PCP) [3 bits]: Used for Quality of Service (QoS) prioritization (defines CoS levels $0$ through $7$ ).
Drop Eligible Indicator (DEI) [1 bit]: Used to indicate frames that may be dropped during network congestion.
VLAN Identifier (VID) [12 bits]: Specifies the exact VLAN ID.

Since the VID is $12$ bits long:

$\text{Maximum VLAN IDs} = 2^{12} = 4096$

VLAN IDs range from $0$ to $4095$ :

0 and 4095: Reserved.
1: Default Native VLAN (cannot be deleted).
2 to 1001: Normal range VLANs.
1002 to 1005: Reserved for legacy networks (FDDI, Token Ring).
1006 to 4094: Extended range VLANs (stored in the active configuration, not the vlan.dat database file).

3. Switch Port Types: Access vs. Trunk Ports

Switch ports operate in different modes depending on the connected device.

text

       [Access Port]                       [Trunk Port]                      [Access Port]
[PC-1] -------------> [Switch 1] =============================> [Switch 2] -------------> [PC-2]
        (Untagged)                (IEEE 802.1Q Tagged Multiplex)            (Untagged)

3.1 Access Ports

An Access Port is assigned to a single, specific VLAN.
It connects to end-user devices (PCs, servers, printers) configured with standard Network Interface Cards (NICs) that do not understand 802.1Q headers.
The switch strips the 802.1Q tag before transmitting a frame out of an access port.

3.2 Trunk Ports

A Trunk Port is a point-to-point link configured to carry traffic for multiple VLANs simultaneously.
It connects switches together or connects a switch to a router.
It uses 802.1Q tagging to keep frames from different VLANs isolated over the shared link.
Native VLAN: A trunk port has a designated Native VLAN (default is VLAN 1). Any frame belonging to the Native VLAN is sent untagged across the trunk. If an untagged frame is received on a trunk port, it is assigned to the Native VLAN.

4. Step-by-Step Cisco Switch VLAN Configuration

This section provides the Cisco IOS command sequence to configure VLANs and assign access and trunk ports.

text

Topology Setup:
  - VLAN 10 (SALES): Ports Fa0/1, Fa0/2
  - VLAN 20 (IT)   : Ports Fa0/3, Fa0/4
  - Trunk Link     : Port Fa0/5

Step 1: Global VLAN Creation and Naming

First, define the VLAN databases globally on the switch:

ios

! Enter privileged EXEC mode
Switch>enable
! Enter global configuration mode
Switch#configure terminal
 
! Create and name VLAN 10
Switch(config)#vlan 10
Switch(config-vlan)#name SALES
Switch(config-vlan)#exit
 
! Create and name VLAN 20
Switch(config)#vlan 20
Switch(config-vlan)#name IT
Switch(config-vlan)#exit

Step 2: Assign Access Ports Individually or in Bulk

Configure interfaces Fa0/1 through Fa0/4 as access ports and assign them to their respective VLANs.

Individual Assignment:

ios

! Assign Interface Fa0/1 to VLAN 10
Switch(config)#interface FastEthernet0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#exit

Bulk Assignment Using the range Command: Using interface range is more efficient for configuring multiple ports at once:

ios

! Configure ports Fa0/1 and Fa0/2 for VLAN 10
Switch(config)#interface range FastEthernet0/1 - 2
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 10
Switch(config-if-range)#exit
 
! Configure ports Fa0/3 and Fa0/4 for VLAN 20
Switch(config)#interface range FastEthernet0/3 - 4
Switch(config-if-range)#switchport mode access
Switch(config-if-range)#switchport access vlan 20
Switch(config-if-range)#exit

Step 3: Configure the Trunk Port

Configure interface Fa0/5 to carry traffic for both VLANs to an upstream switch or router:

ios

! Access interface Fa0/5
Switch(config)#interface FastEthernet0/5
! Set interface mode to trunk
Switch(config-if)#switchport mode trunk
! Optional: Limit trunk to only required VLANs for safety
Switch(config-if)#switchport trunk allowed vlan 10,20
Switch(config-if)#exit

Step 4: Verification Commands

To verify your VLAN configuration, use the following commands in privileged EXEC mode:

ios

! Display all configured VLANs and their assigned ports
Switch#show vlan brief
 
! Display trunk status, native VLAN, and allowed VLANs
Switch#show interfaces trunk

5. Inter-VLAN Routing: The Router-on-a-Stick (ROAS) Paradigm

Because different VLANs belong to different Layer 3 subnets, they cannot communicate directly at Layer 2. A Layer 3 routing device must route packets between them.

A common, cost-effective way to do this is Router-on-a-Stick (ROAS). In this design, a single physical interface on a router is split into multiple logical sub-interfaces, with each sub-interface acting as the default gateway for a specific VLAN.

text

                       +------------+
                       |   Router   |
                       +------------+
                             ||  Physical Port: Fa0/0
                             ||  Logical Sub-interfaces:
                             ||   - Fa0/0.10 (Gateway for VLAN 10)
                             ||   - Fa0/0.20 (Gateway for VLAN 20)
                             ||
                             ||  802.1Q Trunk Link
                             ||
                       +------------+
                       |  Switch 1  |
                       +------------+
                        /          \
                VLAN 10 /            \ VLAN 20
                       /              \
                    [PC-1]           [PC-2]
                 192.168.1.10     192.168.2.10

5.1 Host IP Configuration Matrix

To support this setup, hosts must be configured with IP addresses in their respective VLAN subnets, using the corresponding router sub-interface as their default gateway:

| Device | VLAN | IP Address | Subnet Mask | Default Gateway | | :--- | :--- | :--- | :--- | :--- | | PC-1 | VLAN 10 | 192.168.1.10 | 255.255.255.0 | 192.168.1.1 | | PC-2 | VLAN 10 | 192.168.1.20 | 255.255.255.0 | 192.168.1.1 | | PC-3 | VLAN 20 | 192.168.2.10 | 255.255.255.0 | 192.168.2.1 | | PC-4 | VLAN 20 | 192.168.2.20 | 255.255.255.0 | 192.168.2.1 |

5.2 Router Sub-Interface Configuration Steps

The physical interface on the router must be enabled without an IP address, and the logical sub-interfaces must be configured with 802.1Q encapsulation and IP addresses:

ios

! Enter privileged EXEC and global configuration
Router>enable
Router#configure terminal
 
! Enable the physical link (do not assign an IP address here)
Router(config)#interface FastEthernet0/0
Router(config-if)#no shutdown
Router(config-if)#exit
 
! --- Configure Sub-interface for VLAN 10 ---
Router(config)#interface FastEthernet0/0.10
! Set encapsulation to 802.1Q for VLAN 10
Router(config-subif)#encapsulation dot1Q 10
! Assign the default gateway IP address for VLAN 10
Router(config-subif)#ip address 192.168.1.1 255.255.255.0
Router(config-subif)#exit
 
! --- Configure Sub-interface for VLAN 20 ---
Router(config)#interface FastEthernet0/0.20
! Set encapsulation to 802.1Q for VLAN 20
Router(config-subif)#encapsulation dot1Q 20
! Assign the default gateway IP address for VLAN 20
Router(config-subif)#ip address 192.168.2.1 255.255.255.0
Router(config-subif)#exit

5.3 Communication Flow and Packet Inspection

When PC-1 ( $192.168.1.10$ ) pings PC-3 ( $192.168.2.10$ ), the following process occurs:

Subnet Assessment: PC-1 determines that $192.168.2.10$ is on a different subnet and sends the packet to its default gateway ( $192.168.1.1$ ).
Ingress and Tagging: The packet arrives at switch port Fa0/1. The switch maps the incoming traffic to VLAN 10 and adds an 802.1Q tag with VID = 10.
Trunk Transmission: The switch forwards the tagged frame out of its trunk port Fa0/5 toward the router.
Router Demultiplexing: The router receives the frame on physical interface Fa0/0. It identifies the VID = 10 tag and passes the payload to logical sub-interface Fa0/0.10.
Route Lookup: The router strips the Layer 2 header, inspects the destination IP ( $192.168.2.10$ ), and performs a route lookup. It finds that the destination subnet ( $192.168.2.0/24$ ) is directly connected via sub-interface .

Summary

VLANs logically divide a single physical Layer 2 switch network into multiple, isolated broadcast domains.
The IEEE 802.1Q protocol adds a 4-byte tag to the Ethernet frame header on trunk links to preserve VLAN identification across devices.
Access Ports carry untagged traffic for a single VLAN, whereas Trunk Ports multiplex traffic from multiple VLANs over a single link.
Router-on-a-Stick (ROAS) routes traffic between VLANs by using logical sub-interfaces on a single physical router interface, with each sub-interface serving as a default gateway for its respective VLAN.

Assessed progress

VLAN Configuration and Port Assignment

VLAN Configuration and Port Assignment

1. Introduction to Connecting Devices and LAN Segmentation

2. Fundamentals of Virtual Local Area Networks (VLANs)

2.1 The Mathematical Benefit of Broadcast Domain Subdivision

2.2 IEEE 802.1Q Frame Tagging

3. Switch Port Types: Access vs. Trunk Ports

3.1 Access Ports

3.2 Trunk Ports

4. Step-by-Step Cisco Switch VLAN Configuration

Step 1: Global VLAN Creation and Naming

Step 2: Assign Access Ports Individually or in Bulk

Step 3: Configure the Trunk Port

Step 4: Verification Commands

5. Inter-VLAN Routing: The Router-on-a-Stick (ROAS) Paradigm

5.1 Host IP Configuration Matrix

5.2 Router Sub-Interface Configuration Steps

5.3 Communication Flow and Packet Inspection

Summary

Key Concepts

Virtual Local Area Network (VLAN)

Access Port

Trunk Port

IEEE 802.1Q

Router-on-a-Stick (ROAS)

Quick Check

Computer Networks

Computer Networks