2.3Switching and VLANs

When designing an office or site network, the requirement "we want to separate traffic per department, but share the cabling and hardware" is extremely common. A VLAN meets this requirement without any physical rewiring, but how to design the VLANs and how to enable communication between departments is where the designer's judgment comes in. This section covers the basic mechanics of VLANs through to the practical judgment of how to establish communication across multiple VLANs.

2.3.1VLAN fundamentals and tagged VLANs (IEEE 802.1Q)

• A VLAN (virtual LAN) is a technology that logically partitions a single physical switch into multiple broadcast domains. Hosts within the same VLAN communicate as if on the same segment, but hosts in different VLANs cannot communicate by default—which also provides a security benefit by intentionally blocking cross-department traffic.
• Tagged VLAN (IEEE 802.1Q) is the standard that inserts a tag carrying a VLAN ID (12 bits, up to 4094) into an Ethernet frame so that frames from multiple VLANs can be distinguished over a single physical link (a trunk link). It lets a single link between switches carry traffic for multiple VLANs at once.

2.3.2Trunk ports and access ports

• An access port belongs to exactly one VLAN and sends/receives untagged frames. It is used for ports where end hosts connect directly, such as PCs and printers (the host does not need to be aware of the 802.1Q tag at all).
• A trunk port carries tagged frames from multiple VLANs over a single link. It is used to connect switches to each other, or a switch to a router, sending and receiving frames with a VLAN ID tag attached. Misconfiguring it as an access port causes unintended VLAN blocking or leakage.

2.3.3Inter-VLAN routing and Layer 3 switches

• Because a VLAN is a mechanism for separating segments, communication across VLANs requires routing (inter-VLAN routing). The traditional method is router on a stick: connect a trunk to a single physical interface on a router and create multiple logical sub-interfaces (one per VLAN) to relay traffic between them.
• A Layer 3 switch integrates switching (L2) and routing (L3) functions into a single device. It has an SVI (switch virtual interface), a logical routing interface, for each VLAN, allowing inter-VLAN routing to be handled at high speed inside the switch itself, without an external router (near wire-speed performance). In large-scale, high-traffic environments, an L3 switch is preferred over router-on-a-stick.

A company's new office needs to separate three groups by department: sales (VLAN 10), development (VLAN 20), and guest Wi-Fi (VLAN 30). First, the switch ports where each department's PCs connect are configured as access ports belonging only to that department's VLAN—since the PC itself never needs to be aware of an 802.1Q tag. Next, the links connecting the switches to each other are configured as trunk ports, using IEEE 802.1Q tags to carry frames for all three VLANs over a single physical link. If an additional requirement then emerges—"guest Wi-Fi (VLAN 30) must never be able to communicate with any other internal VLAN"—the design must apply an access control list (ACL) to VLAN 30's SVI on the central Layer 3 switch that performs inter-VLAN routing, explicitly denying traffic destined for VLAN 10 or VLAN 20 (separating VLANs alone is not enough, since once routing is enabled, communication becomes possible). Suppose it further turns out that heavy day-to-day file sharing between sales and development has made the single link between the central L3 switch and an access switch a bandwidth bottleneck. The appropriate design is to add a second physical link and bundle both into one logical high-bandwidth link via link aggregation (LACP)—doubling the bandwidth while avoiding having STP block one of the links, and simultaneously gaining the redundancy that communication continues on the remaining link if one fails.

2.3.4Section summary

• A VLAN logically partitions one switch; different VLANs cannot communicate by default (routing is required)
• Access ports = one VLAN, untagged (for end hosts); trunk ports = multiple VLANs, IEEE 802.1Q tagged (for switch interconnects)
• A Layer 3 switch handles inter-VLAN routing internally via SVIs; link aggregation (LACP) bundles multiple links to gain both bandwidth and redundancy