VLAN Technologies

The Problem with a Flat Network

Consider a growing company in a single large office space. With a few employees, a simple network with one or two interconnected switches may work well. Every computer is connected, and devices can communicate with one another. This arrangement is known as a flat network.

As the company expands, this simple design starts to show several problems:

• Broadcast traffic and performance: In an Ethernet network, some traffic, known as broadcasts, is sent to every device in the same broadcast domain. As more devices are added, the number of broadcast frames, such as ARP requests, increases. This can lead to a "broadcast storm," where processing broadcasts limits useful data transmission. All devices on a flat network are part of the same broadcast domain.
• Lack of logical isolation: A flat network has no built-in grouping of devices. An employee in Accounting can access Engineering resources when higher-layer controls do not restrict that access. A malicious user or compromised machine can then attempt to reach services across the network.
• Organizational inflexibility: Moving an employee from Sales on the first floor to a desk on the second floor may require reconnecting the computer to a switch assigned to that department. This is expensive and time-consuming. The physical structure then limits the logical structure of the network.

The solution is to divide one broadcast domain into smaller logical domains without installing a separate switch for each group. VLANs provide this function.

What is a VLAN? Creating Logical Networks

A VLAN, or Virtual Local Area Network, is a technology that allows you to take a single physical LAN and logically segment it into multiple separate broadcast domains. Each VLAN has its own Layer 2 forwarding context, while communication between VLANs requires a Layer 3 function.

For example, ports on one switch can be assigned to Sales, Engineering, and HR VLANs. Sales and Engineering users can use adjacent outlets while their broadcasts remain in separate domains. Communication between these VLANs requires routing and appropriate access rules.

VLAN operation: port assignments and tagging

VLANs are configured in switches that assign ports and frames to the relevant domains and keep Layer 2 traffic within each VLAN. The two basic mechanisms are port assignment and frame tagging.

1. VLAN Port Assignment (Access Ports)

The most basic way to create a VLAN is by assigning each port on a switch to a specific VLAN. A port configured this way is called an access port.

• An access port belongs to only one VLAN.
• It is typically used to connect end devices like computers, printers, or IP phones to the network.
• When a frame enters an access port, the switch assumes it belongs to the VLAN assigned to that port.
• The switch will only forward that frame to other ports that are assigned to the same VLAN. At Layer 2, it will not forward it to a port belonging to a different VLAN.

Traffic from an end device usually enters without a tag, and the switch classifies it into the access VLAN. When the frame leaves through an access port, the tag is normally removed, so the endpoint does not need to process 802.1Q. A tagged frame received on an access port can be rejected when its tag does not match the configured VLAN.

The switch uses this access-VLAN context for MAC learning and Layer 2 forwarding. Access ports assigned to different VLANs therefore remain isolated on the same switch.

For example, ports 1-8 on a switch can be assigned to VLAN 10 (Sales), and ports 9-16 to VLAN 20 (Engineering). A computer on port 1 can communicate with a computer on port 5, but without inter-VLAN routing it cannot communicate with port 10, even though both devices use the same physical switch.

2. Inter-switch communication: trunks and VLAN tagging

Port assignment works on a single switch. With multiple switches, a device must identify whether a frame from Switch B belongs to VLAN 10 or VLAN 20. This is handled with trunk ports and VLAN tagging. A trunk is normally a link between network devices, and its configuration specifies the VLANs that are allowed to cross it. Limiting the allowed list prevents unrelated VLAN traffic from using the link.

• A trunk port is a port used to connect switches to other switches, routers, or servers.
• A trunk port can carry traffic for multiple VLANs at the same time, according to its allowed-VLAN configuration.
• The switch adds a tag to frames that leave the trunk as tagged traffic. The receiving switch reads the tag, identifies the VLAN, and can forward the frame to access ports in that VLAN.

The Native VLAN: Handling Untagged Traffic

In a typical 802.1Q trunk configuration, the Native VLAN identifies one VLAN for untagged traffic. It is often VLAN 1 by default, depending on the device and configuration. The key rule is:

Traffic belonging to the Native VLAN is transmitted without a VLAN tag across the trunk link in the typical configuration.

When a switch receives an untagged frame on a trunk, it assigns the frame to the Native VLAN configured for that port. On egress, traffic for this VLAN is normally sent without a tag, while traffic for other VLANs is tagged. The two ends of a trunk should use the same Native VLAN, because different values classify the same frame into different domains. This supports devices and links that do not send tags, such as older devices or hubs. In many deployments, administrators choose an unused identifier instead of the default VLAN 1 and use the same value at both ends of the trunk to reduce the risk of incorrect traffic classification.

VLAN applications

Implementing VLANs addresses flat-network limitations by dividing broadcast domains and assigning devices to logical groups.

• Performance and broadcast control: By dividing a network into smaller broadcast domains, VLANs reduce the number of frames each device has to process. A broadcast from VLAN 10 is sent to devices in VLAN 10 and not to devices in other VLANs. This reduces load on links and device CPUs.
• Traffic isolation: VLANs isolate traffic at Layer 2. Devices in different VLANs do not communicate through Layer 2 switching, while inter-VLAN routing can be enabled. A router or Layer 3 switch can then apply access-control lists or firewall rules. Finance data (VLAN 30) is not broadcast to Marketing (VLAN 40), even when they share physical switches; confidentiality requires additional access rules.
• Flexibility and scalability: VLANs separate the logical network structure from the physical layout. An employee can move a computer to another office and remain in the departmental network after the new port is assigned to the correct VLAN. This simplifies moves and changes and allows new VLANs for projects or teams without new cables.
• Simplified administration: Grouping users and devices into logical VLANs simplifies management. Depending on the device, security, QoS, and access-control policies can cover an entire VLAN instead of requiring separate configuration for every device.