Hey what's up guys. Welcome to CertBros! In this video we're going to be looking
at vlans okay so vlan stands for virtual
local area network using vlans we can virtually separate our LANs into
smaller chunks but why would we want to do that? Well
there are a few reasons why we might want to use VLANs
one of the main reasons is something we've already spoken about
and that is broadcast traffic. So let's remind ourselves about
broadcasts. A LAN is a single area of a network
and in this case, we have a single broadcast domain
created by our switch
if host A sends a broadcast then every device will receive it
that's fine for our 4 computer network but let's imagine each computer
represents an entire department
very quickly broadcast traffic can start to slow down our networks
and devices. So we need a way to manage all of this traffic. One way
is to add a router. This would create separate broadcast domains per interface
but it's an extra bit of hardware to purchase install
cable and manage. Another, more radical option is to physically
split the network into separate sections. This would create
broadcast domains for each department. Traffic wouldn't be sent from one
department to the other which drastically reduces our broadcast
overhead. But this option still has the issue of
needing to purchase and set up new equipment and neither one
of these options is very scalable. Say we wanted to add a
new department both options would require work to set
up and we don't want to do that. This is
where VLANs come in VLANs give us all of the benefits of
physically separating our network but with the added bonus of being able
to do this virtually. The traffic still behaves in
the same way as if it was physically split. Traffic isn't forwarded
to any other departments and it's almost like having four
miniature switches inside our single one
The way this works is by assigning interfaces to specific
VLANs. Only interfaces in the same VLAN can communicate with each other
in this example finance is yellow IT is red
Sales is green and HRis purple. I'm using colors but in reality, you will
probably use numbers such as VLAN 10 VLAN 20 etc
If we wanted to add a new finance server then we just need to assign that
interface to the finance VLAN and communication
between those two interfaces is allowed because they're on the same
VLAN
If we wanted to add a brand new marketing department
then we just create that VLAN and assign it to an interface
As you can see VLANs make it very very easy to control broadcast domains
It's also scalable. We don't need new equipment
or to re-cable everything anytime you want to make a change
okay, so that's the overview. Let's look at how this works in a bit more detail
Straight out of the box Cisco and most other switches
have a default VLAN called VLAN 1. Every interface is assigned the default
VLAN. So this means every interface can talk
to each other. From here we can start to make our own
VLANs and split up our switch. we may want to make a VLAN called VLAN
10 and another called VLAN 20
You can add up to 4094 VLANs. This is the maximum number that is
supported
So now interfaces assigned to VLAN 10 can only communicate with
other interfaces assigned to VLAN 10 and it's the same for VLAN 20.
VLANs aren't restricted to just one switch
We can have the same VLANs across multiple switches.
This makes it very versatile and scalable
But this does leave us with a problem. If interfaces can only communicate with
other interfaces in the same VLAN, which VLAN do we assign to the link between
our two switches? If we leave it as the default VLAN, VLAN
10 and VLAN 20 won't be able to send traffic. If we
assign it to one of our new VLANs then only that VLAN can send traffic
between the two switches. The solution is a special type of
interface called a trunk
So there are two types of ports on a switch, an access port
and a trunk port. When a port is assigned to a VLAN
like VLAN 10 and VLAN 20 here this is known as an access port
An access port is designed for endpoint devices
to access the network such as computers and laptops. Now a
trunk port can send traffic from different VLANs
They're used to send traffic between networking devices
This leaves us with another problem though. How does the receiving switch
know which VLAN the traffic belongs to? The whole point of a VLAN is to separate
traffic. So when a trunk sends data that could be
from VLAN 1, VLAN 10 or VLAN 20 it needs a way to
identify which VLAN that traffic belongs to
This is done by using something called a tag
To understand tags we need to take a couple of steps back
Now most devices including computers do not know what VLANs are
Some devices are VLAN aware such as ip phones
but most are not. So a computer generates a frame
as normal. When that frame arrives at a switch
it's the switch that handles the VLANs. then it's forwarded to the correct
destination. The sending computer and the receiving
computer have no idea that VLANs were used. Now
when we have multiple switches connected with a trunk port
there is an extra step. The computer sends the frame as usual but when the
switch sends a frame over the trunk port it adds a new bit of
information. This is called an 802.1q tag
802.1q is the IEEE standard. It can also be called Dot1q. This tag
is 4 bytes and it contains a few bits of information
TPID or tag protocol identifier. This is used to identify the frame as an
802.1q tagged frame. It could also be ISL but is
rarely used today. TCI or tag control information
this contains three bits of information. The priority
DEI or drop eligible indicator and most importantly
the VLAN id. This tag field is then read and removed by the receiving switch
So to recap the frame is untagged when it's sent from the computer
is tagged over the trunk port it's then sent to the destination
computer untagged and our computers are again none the
wiser. The next thing we need to talk about is
something called native VLANs. A native VLAN is configured
per trunk interface. It's the VLAN that the switch assumes the frame is on
if it arrives on a trunk port with no tag
By default the native VLAN is VLAN 1. So let's say both of our computers
are assigned to the default vlan 1.
Just like before, the frame is sent untagged to the switch
Now if a switch is sending a frame across a trunk port
that belongs to its native VLAN the frame
is not tagged. When a switch receives a frame on its trunk port without a tag
it will assume that frame belongs to its native
VLAN which in this case is VLAN 1. It will then forward that frame to the
destination, again untagged. So you might be wondering, why
we use native VLANs. And there are a few reasons why
Hubs can't read or write tags. All hubs can do is forward frames
Let's say we have a hub in the middle connected to another host
Using untagged native VLANs means we can send frames to our new host
If we didn't use native VLANs and the frame was sent tagged
then the host will just discard the frame because it doesn't understand
VLAN tags. So a native VLAN is configured per trunk
interface. This can lead to problems. For example
let's say we change one side of our trunk to have the native VLAN
of 20 instead of 1. We now have two switches with different
native VLANs. Our computer will send the frame
As before, the first switch will see the interface
is assigned to its native VLAN and then forward that frame untagged
across the trunk. Do you see the problem here? The second
switch will assume the traffic should belong to
its native VLAN, VLAN 20 and the frame will not be sent to the
destination computer on VLAN 1. Luckily in real life you will be
alerted to this type of configuration on the switch
You'll probably see a message like this saying
"native VLAN mismatch"
This video is part of our full CCNA Course
which can be found in the description. So please feel free
to go and check that out.
Don't forget to like, comment and
subscribe. The support from you guys really helps this channel grow.
other than that, thank you for watching! 👍