VLANs Explained

VLANs are used to segment your network.

What segmentation is

Segmentation is simply your network being divided up into multiple networks. In the example that I have right here, I have nine different laptops and they are all part of three different networks. They could be part of one network; these nine laptops is not big enough where I necessarily would need lots of networks here. But I've got it divided up into three different networks, and you can see that the network addresses for each one of these networks are different, and they are connected to a different interface on this router. So this network is divided into three segments here.

Why you would segment

So then the question is, why would we want to segment our network? One of the big reasons is for security purposes. In this case right here, maybe we've split this off into different work groups. For instance, maybe these are all the execs of the company, and this network right here is all for HR in the company, and this is all the sales. You wouldn't necessarily want each one of those departments to be able to have access to resources in other departments. So from a security standpoint we could separate out these networks, and it will help us create different limitations on the router so that way only certain traffic gets routed from one network to another. So we're really able to buckle down security and make sure that these networks are secure.

Another reason why we want to implement this is performance. Let's say one of these networks has a huge amount of machines on that network. That could bog down that network, or it could overload that network, it could create lots of broadcasts on that network, it could cause problems. So we can limit the size of our different networks and that will help with our performance of it. They're just smaller broadcast domains with these.

Another reason why we'd want to do this is perhaps manageability. Maybe it's that this is a very large network, and breaking this into smaller pieces will help us manage each one of these pieces separately. Or perhaps I am delegating control over each one of these networks to a different administrator, and so I'm able to do some delegation. So there's a bit of manageability with that.

There's also scalability, creating something that is going to be scalable. And that gets back to that security and performance and manageability, is scalability, the ability to start scaling and growing as our company grows, as whatever institution that this is a part of grows. So there's quite a few advantages of why we would want to segment our network.

A closer look at the example

Let me go a little more in depth into an example here. I mentioned in my last example this is the execs, or we'll call this the administration department. They're the ones that do all the upper level management of the company, manage the finances. Maybe you'd separate finances out separately, or maybe it's just part of this administration group. And then this right here is the sales department, so their function is just to go out there and sell different items, different products of this company. And then this one right here is the operations, so they're in charge of the manufacturing or delivering the product to the customers.

Each one of these has a specific business need, and they'll have specific resources that they'll need available to them. But maybe what you don't want is the operations and sales departments to have access to the resources inside the administration department. So what you would do is within your router you would create some boundaries within there, so that certain traffic could not go in and access those resources in the administration department. Same thing, you wouldn't want everyone to have access to necessarily the sales data. Or maybe what you have is a whole other network that's separated off to here, and it's all of the servers, and you definitely want to have some control over who is getting to those servers and what resources they're accessing on that server network. So this really allows us to kind of dial in that control of who is able to get to what resources.

The flip side of segmentation

So segmentation can definitely help out with things I've already mentioned, but there's a flip side to it also. For instance, manageability. It can make your network more manageable as your network grows, but it also introduces an extra element that you have to manage on your network.

Also security. From a security standpoint, we can segment the traffic and we can make it more secure, but we are also creating a more complex network, which could lead to some insecurity as well. So we need to make sure we roll that out carefully.

Another thing that can happen is we can have added expense to this. Notice that for these nine laptops I now have three switches rather than one switch. So there's an added expense to this because I have to have more hardware to support this. Or, in the case of what we're going to learn about soon, VLANs will create a little bit more powerful of a switch with more features.

But there's one more point that I want to get at. What gets really tricky is when we start getting multiple buildings and multiple sites involved with this, because now if I have to have three times the amount of equipment just because I have three different networks here, then it's going to cost a lot more for the hardware. It also adds to the complexity of this.

So here's an example right here. I have four buildings now, I have building A, B, C and D, and in each one of those buildings, let's say I have some people who belong to the administration department in each of those buildings, and maybe I have somebody from sales in each one of those buildings as well, and maybe I have somebody from operations in each one of those buildings as well. Now at each one of those sites, or each one of those buildings, I'm going to have to have triple the equipment. So I'm going to have to have three switches in each one of these buildings. So rather than have four switches, now I'm going to have to have 12 switches. So it only creates more issues as it grows.

But once again, VLANs can be a big answer to making sure things are manageable, things are scalable, things are secure. It reduces a lot of the complexity and it also reduces the need for a lot of this extra equipment, so we can segment the traffic without increasing our cost drastically and making things more manageable.

What a VLAN does

From a real basic level, VLANs allow us to carve out certain ports for certain networks. So here is a switch that I have right here, and what I can do is I can program the switch so that certain ports on here, let's say the first six ports on here, are part of the administration VLAN. So this is the admin VLAN right here, and they're the ones that would connect into those ports, giving them access to only those resources.

Then I could program the next, let's say, 12 ports right here, and maybe that's sales right there, and so those ports are all devoted towards sales. And then possibly the last part here, maybe I have a huge chunk of them that are devoted now towards operations, and operations now can manage their resources and gain access to their resources.

So I can carve up a switch, and it wouldn't necessarily need to be mixed like this either. They could be however I want to carve this up, I would be able to carve this up. But this is how I can create virtual local area networks on this switch. I have one piece of hardware, but I can create multiple networks on this piece of hardware and separate it out.

So what that looks like in practice now is I could have a switch at each one of these sites, and then I can take all the administration machines and add them to this switch as part of the VLAN for administration, and all of those computers would be able to talk with each other and be able to access the same resources, but not touch the other VLANs. And then let's say I have the operations connected to another VLAN here, and so now all of these machines that are connected to the operations VLAN now can speak to each other and can access the same resources. So now I have true division between each one of these networks without the added complexity of a lot of extra switches.

VLAN trunks

We do have VLAN trunks. If I were to have a switch at each one of the networks, and I had these different networks that were all connected to these switches, I would have to run a line for every single one of these networks. So now I'm going to have to run all of these extra cables to facilitate all of this. Or what I can do is I can do a trunk line, and the trunk line is just going to connect all of these pieces of equipment together but still be able to separate out one VLAN's traffic from another VLAN's traffic. These trunk lines can essentially combine the traffic onto one trunk line and get it across to another switch and then split it back out again.

Physical and logical topologies

I also want to bring out that this does create some complexity once again, in the idea that we're going to have a physical network and how a physical network is set up, and we're going to have a logical network and how a logical network is set up. So you will have two different maps explaining your network.

One of them is a physical topology, and the physical topology is going to explain how all the hardware is going to be connected together. So here we have a layer 3 switch, and it's connected to all our access switches that are out in each one of the buildings. Here I've got a wireless connected out to this annex out here, I've got building A, B and C, and then I have my machines that are physically connected into this network.

However, when I actually look at those different buildings, as I mentioned before, perhaps this is a sales machine right here and it's going to connect to the sales VLAN. Perhaps this right here is in operations and it's going to connect to the operations VLAN. Perhaps this is administration and it's going to connect to an administration. And this is another sales laptop right here. Because of that, this machine is going to connect to all the other sales machines that are on this network, and that is going to look a little different than the way it's physically set up.

So now I have this logical topology that says, okay, I have the layer 3 switch, but then I have all the administration personnel connected together on one network, I have all of operations connected on a different network, I have all of sales connected on a different network, I have all of the servers connected on a different network. So now I can show how things are actually segmented out, and from a logical communication standpoint, how machines will communicate together. I can see that it actually looks a little different than the way it's actually physically set up.

VLAN IDs

So now these VLANs, we can give them names. For instance, I have been talking about the administration network, and I've been talking about the sales network, and I've been talking about operations. These are different networks that we can set up and we can actually give them names. But most of the time we're actually going to be referencing these different VLANs by IDs, or by numbers.

So perhaps what we say is the administration network is going to be our VLAN 30. So VLAN 30 is going to be our VLAN ID for it, it's going to be 30. Sales, let's say sales is going to be 40, so that's VLAN 40, sales is going to be VLAN 40. Operations is going to be VLAN 50.

So what we're going to do is we're going to assign some sort of ID. It could be sequential, it could be 11, 12, 13, it could be 144. There are some boundaries in what these IDs can represent. But just know that we're going to label our different VLANs, and here we have administration as 30, sales is 40, operations is 50.

The default VLAN

Now, if you were to get a piece of hardware and it's not operational out of the box unless you get on there and program it, what would happen is a lot of people wouldn't know how to program it, or wouldn't be able to get it set up, or wouldn't be able to do some initial configuration on it. They would think it was broken and they would send it back to the company.

So the company has to, in this case Cisco, this Cisco switch right here, Cisco wants to send it to you in some sort of operational state where it operates. And so what it needs to do is it needs to send it to you where everything is set to the same VLAN. That is called our default VLAN. The default VLAN is the VLAN that's already set up on the switch and operational, so that way you can plug it right into your equipment and start using it right away before you do any programming to it.

So in this case right here, Cisco is going to be VLAN 1. So VLAN 1 is our default gateway. All of these ports on this switch are set up to VLAN 1 right now. If we were to set up a management interface, it would probably be on VLAN 1. And so that is the default VLAN.

The default VLAN on a Cisco switch cannot be deleted and it cannot be renamed, and so we would not be able to go in here and give it any different name. And VLAN 1 will always exist on our switches, on our Cisco devices.

So VLANs are actually pretty easy to set up on your switches. Once again, it's really already set up, because you have VLAN 1, that default, already on your switch. But what you're going to want to do is, any kind of decently sized network, you're going to want to start thinking about segmenting the network for security purposes and for the purposes of manageability, and you'll want to put some thought into how you roll that out. VLANs are what's going to actually create some of that security and create some of that segmentation.