Content

| 2.1 |  | VLAN Basics |
| 2.1.1 |  | Describe a VLAN |

A VLAN is a group of hosts with a common set of requirements that communicate as if they were attached to the same wire, regardless of their physical location. A VLAN has the same attributes as a physical LAN, but it allows for end stations to be grouped together even if they are not located on the same LAN segment.

Networks that use the campus-wide or end-to-end VLANs logically segment a switched network based on the functions of an organization, project teams, or applications rather than on a physical or geographical basis. For example, all workstations and servers used by a particular workgroup can be connected to the same VLAN, regardless of their physical network connections or interaction with other workgroups. Network reconfiguration can be done through software instead of physically relocating devices.

Cisco recommends the use of local or geographic VLANs that segment the network based on IP subnets. In Figure , each wiring closet switch is on its own VLAN or subnet and traffic between each switch is routed by the router. Both examples in Figure and Figure do not show the entire network model. The reasons for the Distribution Layer 3 switch and examples of a larger network using both the campus-wide and local VLAN models will be discussed later.

A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. Ports on a switch can be grouped into VLANs in order to limit unicast, multicast, and broadcast traffic flooding. Flooded traffic originating from a particular VLAN is only flooded out ports belonging to that VLAN, including trunk ports.

Any switch port can belong to a VLAN. Unicast, broadcast, and multicast packets are forwarded and flooded only to stations in the same VLAN. Each VLAN is a logical network, and packets destined for stations that do not belong to the same VLAN must be forwarded through a router or routing device. Each VLAN can also run a separate instance of the Spanning-Tree Protocol (STP). The technology that allows Cisco switches to support an independent implementation of STP for each VLAN is called Per-VLAN spanning tree (PVST).

VLANs are created to provide the segmentation services traditionally provided by routers in LAN configurations. VLANs address scalability, security, and network management issues. Routers in VLAN topologies provide broadcast filtering, security, address summarization, and traffic flow management. By definition, switches may not bridge IP traffic between VLANs. This would violate the integrity of the VLAN broadcast domain. Normally, IP traffic is routed between VLANs.

Virtual LANs are essentially Layer 2 constructs, and IP subnets are Layer 3 constructs. In a campus LAN employing VLANs, a one-to-one relationship often exists between VLANs and IP subnets. It is possible to have multiple subnets on one VLAN, and in some cases one subnet may be spread across multiple VLANs. Such cases are the exception however, not the rule. Virtual LANs and IP subnets provide an example of independent Layer 2 and Layer 3 constructs that often map to one another. This correspondence is useful during the network design process. Several key issues need to be considered when designing and building scalable multilayer switched internetworks. These issues will be examined later in this module.