Technically, VLAN (virtual local area network) is also known as a virtual LAN. This technology can logically partition and isolate one or more physical LANs into multiple broadcast domains. And each broadcast domain is regarded as one VLAN. Generally, only devices under the same VLAN can communicate with each other.
Why VLAN is used? Before VLAN, there was a single broadcast domain over the specified network, which is called as LAN (local area work). Just like the following LAN application topology showed, in order to communicate with host B, host A will broadcast its ARP (address resolution protocol) request to all the switches and other hosts over the same local area network.
However, when the network is bombarded with hosts and switches, it’s likely to lead to broadcast storms. Consequently, the hosts’ CPU and the bandwidth of the whole network will be greatly consumed. To solve that, VLAN arrives.
By configuring VLANs, the network can be segmented into different broadcast domains (VLANs). Just like the above case demonstrated, the broadcast frame will be limited to be sent to the port in the same VLAN (VLAN 1 in this case) without the ports in the other VLAN (VLAN 2). In that way, the network resource and bandwidth will be hugely saved so as to improve network flexibility and performance.
VLAN Tag: It is a kind of VLAN identifier, which is encapsulated in a broadcast frame. Once a data packet enters a port of the switch in a VLAN, the VLAN tag will be encapsulated. However, when the frame with VLAN tag come out from the other port, the tag will be removed. Usually, a switch identifies packets from different VLANs according to the information contained in VLAN tags. IEEE 802.1Q adds a 4-byte VLAN tag between the source address and Length/Type fields of an Ethernet frame, as shown below.
Tagged Frame: Frame with a 4-byte VLAN tag
Untagged Frame: Frame without a 4-byte VLAN tag
Intra-VLAN communication refers to the communication of users in the same network segment and VLAN. Generally, this type of VLAN is applied into two scenarios: intra-VLAN communication through the same device and intra-VLAN communication through multiple devices. No matter what type, the whole transmission process mainly goes through the following two steps:
1. The ARP request sent from the source host: Before sending, the source host will compare its IP address with the designation’s. If the source host finds that they are in the same network segment, it will get destination host’s MAC address and fill the destination field MAC address of the frame with the obtained MAC address. However, if the source host finds that they are not in the same network segment, the broadcast packet needs to be sent to the gateway. The MAC address of gateway will be used by the source host as its destination MAC address.
2. Adding and removing VLAN tags during the communication between devices: When frames processed in a switch, VLAN tags need to be carried.
Since broadcast packets are limited in the same VLAN, hosts in different VLANs are unable to directly communicate with each other in layer 2. In real applications, the communications for hosts in different VLANs are in great demand. Therefore, inter-VLAN routing that can forward network traffic from one VLAN to another is used to solve this problem.
The working mode of inter-VLAN routing is similar to that of intra-VLAN’s. The difference is that inter-VLAN routing needs to be achieved with the help of layer 3 routing which can be realized with a router or Layer 3 switch. There are three options available in order to enable routing between different VLANs:
· Inter-VLAN Routing with Separate Physical Interfaces
This inter-VLAN routing way is to connect an additional port from each VLAN with a router. Each VLAN needs one physical port on the router, which causes the great cost of routers. Therefore, this type of inter-VLAN routing has been rarely used due to its high cost and poor scalability.
· Router-on-a-Stick Inter-VLAN Routing
This type of VLAN routing is much smarter than that of the above one, which enables one single physical interface to achieve traffic forwarding between VLANs. After configuring the connection between the router and the switch as a trunk link, the router can receive frames with VLAN tags on the trunk interface from the connected switch, and forward the routed packets out to VLAN tagged destinations via the same interface.
· Inter-VLAN Routing with Layer 3 Switch
The last method is to use layer 3 switches with routing function. Users need to create a SVI (Switch Virtual Interface) for each VLAN and configure an IP address for it. This IP address can be used for computers as their default gateway. In that way, the packets from one VLAN will be sent to the SVI to be routed to the other VLANs to realize the inter-VLAN communication.
Based on VLAN, there are various extended configurations that have been developed to facilitate network communication, such as using VLAN to implement layer 2 isolation and using a traffic policy to implement inter-VLAN access control. Typically, there are five basic VLAN types: interface-based VLAN, MAC address-based VLAN, IP subnet-based VLAN, protocol-based VLAN, and policy-based VLAN.
Port-based VLAN, also called interface-based VLAN, is a technology that enables network administrators manually assign VLANs for each switch port. It suits for a small-sized network without the need to frequently change the network infrastructure. To know more information about this technology, you can get from Port-based VLAN.
MAC address-based VLAN refers to assign VLANs according to the source MAC addresses of frames. Applying this technology can greatly improve network security and flexibility. Even if the users frequently change their physical locations, the network administrator won’t need to reconfigure VLANs.To know more information about this technology, you can get from MAC Address-based VLAN.
IP subnet-based VLAN can assign VLANs according to devices’ IP subnets. It will be an effective solution for a public network with a higher demand for mobility and simplified management and lower demand for security. With this technology, users can automatically join a new VLAN ID after their IP changed. To know more information about this technology, you can get from IP Subnet-based VLAN .
Applied for a network with multiple protocols, protocol-based VLAN can assign VLANs according to the protocol types and encapsulation formats of frames. To know more information about this technology, you can get from Protocol-based VLAN.
Policy-based VLAN works similarly like all the above methods. But it is also a combination of the above methods. It can assign VLANs according to the policies like combinations of MAC addresses and IP addresses. By the combination of policies to realize inter-VLAN access control, network security and flexibility will be greatly enhanced. To know more information about this technology, you can get from Policy-based VLAN.