Overview
30.1 VLAN Concepts
30.1.1 VLAN introduction
30.1.2 Broadcast domains with VLANs and
routers
30.1.3 VLAN operation
30.1.4 Benefits of VLANs
30.1.5 VLAN types
30.2 VLAN Configuration
30.2.1 VLAN basics
30.2.2 Geographic VLANs
30.2.3 Configuring static VLANs
30.2.4 Verifying VLAN configuration
30.2.5 Saving VLAN configuration
30.2.6 Deleting VLANs
30.3 Troubleshooting VLANs
8.3.1 Overview
8.3.2 VLAN troubleshooting process
8.3.3 Preventing broadcast storms
8.3.4 Troubleshooting VLANs
8.3.5 VLAN troubleshooting scenarios
Summary
Overview
An important feature of Ethernet switching
is the ability to create virtual LANs (VLANs). A VLAN is a logical group of
network stations and devices. VLANs can be grouped by job functions or
departments, regardless of physical location of users. Traffic between VLANs is
restricted. Switches and bridges forward unicast, multicast, and broadcast
traffic only on LAN segments that serve the VLAN to which the traffic belongs.
In other words, devices on a VLAN only communicate with devices that are on the
same VLAN. Routers provide connectivity between different VLANs.
VLANs increase overall network performance
by logically grouping users and resources together. Businesses often use VLANs
as a way of ensuring that a particular set of users are logically grouped
regardless of the physical location. Organizations use VLANs to group users in
the same department together. For example, users in the Marketing department
are placed in the Marketing VLAN, while users in the Engineering Department are
placed in the Engineering VLAN.
VLANs can enhance scalability, security,
and network management. Routers in VLAN topologies provide broadcast filtering,
security, and traffic flow management.
Properly designed and configured VLANs are
powerful tools for network administrators. VLANs simplify tasks when additions,
moves, and changes to a network are necessary. VLANs improve network security
and help control Layer 3 broadcasts. However, improperly configured VLANs can
make a network function poorly or not function at all. Proper VLAN
configuration and implementation is critical to the network design process.
Cisco is taking a positive approach toward
vendor interoperability, but LANs can consist of intermixed network topologies
and device configurations. Each vendor develops its own proprietary VLAN
product and may not be entirely compatible with other VLAN products due to
differences in VLAN services.
This module covers some of the objectives
for the CCNA 640-801 and ICND 640-811 exams.
Students who complete this module should be
able to perform the following tasks:
- Define
VLANs
- List
the benefits of VLANs
- Explain
how VLANs are used to create broadcast domains
- Explain
how routers are used for communication between VLANs
- List
the common VLAN types
- Define
ISL and 802.1Q
- Explain
the concept of geographic VLANs
- Configure
static VLANs on Catalyst 2900 series switches
- Verify
and save VLAN configurations
- Delete
VLANs from a switch configuration
30.1 VLAN Concepts
30.1.1 VLAN introduction
This TI compares and contrasts traditional
switched LANs, where the physical topology is closely related to the logical
topology. Generally workstations must be grouped by their physical proximity to
a switch. VLANs allow almost complete independence of the physical and logical
topologies. Administrators can use VLANs to define groupings of workstations,
even if they are separated by switches and on different LAN segments, as one
VLAN, one collision domain, and one broadcast domain. This capability is
extremely powerful.This page will explain what a VLAN is and how it works.
A VLAN is a logical group of network
stations, services, and devices that is not restricted to a physical LAN
segment.
VLANs facilitate easy administration of
logical groups of stations and servers that can communicate as if they were on
the same physical LAN segment. They also facilitate easier administration of
moves, adds, and changes in members of these groups.
VLANs logically segment switched networks
based on job functions, departments, or project teams, regardless of the
physical location of users or physical connections to the network. All
workstations and servers used by a particular workgroup share the same VLAN,
regardless of the physical connection or location.
Configuration or reconfiguration of VLANs
is done through software. Therefore, VLAN configuration does not require
network equipment to be physically moved or connected.
A workstation in a VLAN group is restricted
to communicating with file servers in the same VLAN group. VLANs logically
segment the network into different broadcast domains so that packets are only
switched between ports that are assigned to the same VLAN. VLANs consist of
hosts or network equipment connected by a single bridging domain. The bridging
domain is supported on different network equipment. LAN switches operate bridging
protocols with a separate bridge group for each VLAN.
VLANs are created to provide segmentation
services traditionally provided by physical routers in LAN configurations.
VLANs address scalability, security, and network management. Routers in VLAN topologies
provide broadcast filtering, security, and traffic flow management. Switches do
not bridge traffic between VLANs, as this violates the integrity of the VLAN
broadcast domain. Traffic should only be routed between VLANs.
30.1
VLAN Concepts
30.1.2 Broadcast domains with VLANs and routers
This page will explain how packets are
routed between different broadcast domains.
A VLAN is a broadcast domain created by one
or more switches. The network design in Figures
and requires three separate
broadcast domains.
Figure
shows how three separate switches are used to create three separate
broadcast domains. Layer 3 routing allows the router to send packets to the
three different broadcast domains.
In Figure , a VLAN is created with one router
and one switch. Three separate broadcast domains exist. The router routes
traffic between the VLANs using Layer 3 routing. The switch in Figure ,
forwards frames to the router interfaces if certain circumstances exist:
- If
it is a broadcast frame
- If
the destination is one of the MAC addresses on the router
If Workstation 1 on the Engineering VLAN
wants to send frames to Workstation 2 on the Sales VLAN, the frames are sent to
the Fa0/0 MAC address of the router. Routing occurs through the IP address on
the Fa0/0 router interface for the Engineering VLAN.
If Workstation 1 on the Engineering VLAN
wants to send a frame to Workstation 2 on the same VLAN, the destination MAC
address of the frame is that of Workstation 2.
VLAN implementation on a switch causes
certain actions to occur:
- The
switch maintains a separate bridging table for each VLAN.
- If
the frame comes in on a port in VLAN 1, the switch searches the bridging
table for VLAN 1.
- When
the frame is received, the switch adds the source address to the bridging
table if it is currently unknown.
- The
destination is checked so a forwarding decision can be made.
- For
learning and forwarding, the search is made against the address table for
that VLAN only.
30.1 VLAN Concepts
30.1.3 VLAN operation
This page will explain the features of
different types of VLANs.
A VLAN comprises a switched network that is
logically segmented. Each switch port can be assigned to a VLAN. Ports assigned
to the same VLAN share broadcasts. Ports that do not belong to that VLAN do not
share these broadcasts. This improves network performance because unnecessary
broadcasts are reduced.
Static membership VLANs are called
port-based and port-centric membership VLANs. As a device enters the network,
it automatically assumes the VLAN membership of the port to which it is
attached.
Users attached to the same shared segment,
share the bandwidth of that segment. Each additional user attached to the
shared medium means less bandwidth and deterioration of network performance.
VLANs offer more bandwidth to users than a hub-based Ethernet shared network.
The default VLAN for every port in the switch is the management VLAN. The
management VLAN is always VLAN 1 and may not be deleted. At least one port must
be assigned to VLAN 1 in order to manage the switch. All other ports on the
switch may be reassigned to alternate VLANs.
Dynamic membership VLANs are created
through network management software. CiscoWorks 2000 or CiscoWorks for Switched
Internetworks is used to create Dynamic VLANs. Dynamic VLANs allow for
membership based on the MAC address of the device connected to the switch port.
As a device enters the network, the switch that it is connected to queries a
database on the VLAN Configuration Server for VLAN membership.
In port-based or port-centric VLAN
membership, the port is assigned to a specific VLAN membership independent of
the user or system attached to the port. When using this membership method, all
users of the same port must be in the same VLAN. A single user, or multiple
users, can be attached to a port and never realize that a VLAN exists. This approach is easy to manage because no
complex lookup tables are required for VLAN segmentation.
Network administrators are responsible for
configuring VLANs both statically and dynamically.
Bridges filter traffic that does not need
to go to segments other than the destination segment. If a frame needs to cross
a bridge and the destination MAC address is known, the bridge only forwards the
frame to the correct bridge port. If the MAC address is unknown, it floods the
frame to all ports in the broadcast domain, or VLAN, except the source port
where the frame was received. Switches are considered multiport bridges.
30.1 VLAN Concepts
30.1.4 Benefits of VLANs
This page will discuss the administrative
benefits of VLANs.
VLANs allow network administrators to
organize LANs logically instead of physically. This is a key benefit. This
allows network administrators to perform several tasks:
- Easily
move workstations on the LAN
- Easily
add workstations to the LAN
- Easily
change the LAN configuration
- Easily
control network traffic
- Improve
security
30.1 VLAN Concepts
30.1.5 VLAN types
This page will describe three basic VLAN
types that are used to determine and control VLAN membership assignments: -
- Port-based
VLANs
- MAC
address based VLANs
- Protocol-based
VLANs
The number of VLANs in a switch vary based
on several factors:
- Traffic
patterns
- Types
of applications
- Network
management needs
- Group
commonality
The IP addressing scheme is another
important consideration in defining the number of VLANs in a switch. For
example, a network that uses a 24-bit mask to define a subnet has a total of
254 host addresses allowed on one subnet. Because a one-to-one correspondence
between VLANs and IP subnets is strongly recommended, there can be no more than
254 devices in any one VLAN. It is further recommended that VLANs should not
extend outside of the Layer 2 domain of the distribution switch.
There are two major methods of frame
tagging, Inter-Switch Link (ISL) and 802.1Q. ISL is a Cisco proprietary
protocol and used to be the most common, but is now being replaced by the IEEE
802.1Q standard frame tagging.
As packets are received by the switch from
any attached end-station device, a unique packet identifier is added within
each header. This header information designates the VLAN membership of each
packet. The packet is then forwarded to the appropriate switches or routers
based on the VLAN identifier and MAC address. Upon reaching the destination
node the VLAN ID is removed from the packet by the adjacent switch and
forwarded to the attached device. Packet tagging provides a mechanism for
controlling the flow of broadcasts and applications while not interfering with
the network and applications. LAN emulation (LANE) is a way to make an
Asynchronous Transfer Mode (ATM) network simulate an Ethernet network. There is
no tagging in LANE, but the virtual connection used implies a VLAN ID.
30.2 VLAN Configuration
30.2.1 VLAN basics
This page will provide basic information
about VLANs and describe the features of an end-to-end VLAN network.
In a switched environment, a workstation
only receives traffic addressed to it. Because switches filter network traffic,
workstations in a switched environment send and receive data at full, dedicated
bandwidth. Unlike a shared-hub system where only one station can transmit at a
time, a switched network allows many concurrent transmissions within a broadcast
domain. This process does not directly affect other stations inside or outside
a broadcast domain. Figure illustrates
that communication between pairs A/B, C/D and E/F does not affect the other
station pairs.
Each VLAN must have a unique Layer 3
network or subnet address assigned to it. This enables routers to switch
packets between VLANs.
VLANs can exist either as end-to-end
networks or they can exist inside of geographic boundaries.
An end-to-end VLAN network has several
characteristics:
- VLAN
membership for users is based on department or job function, regardless of
where the users are located.
- All
users in a VLAN should have the same 80/20 traffic flow patterns.
- VLAN
membership for users should not change when they relocate within the
campus.
- Each
VLAN has a common set of security requirements for all members.
Switch ports are provisioned for each user
at the access layer. Each color
represents a subnet. Because users relocate, each switch can eventually become
a member of all VLANs. Frame tagging is used to carry information from multiple
VLANs between access layer switches and distribution layer switches.
ISL is a Cisco proprietary protocol that
maintains VLAN information as traffic flows between switches and routers. IEEE
802.1Q is an open-standard (IEEE) VLAN tagging mechanism in switching
installations. Catalyst 2950 switches do not support ISL trunking.
Workgroup servers operate in a
client/server model. For this reason, users are assigned to the same VLAN as
the server they use to maximize the performance of Layer 2 switching and keep
traffic localized.
In Figure , a core layer router is used to
route between subnets. The network is engineered, based on traffic flow
patterns, to have 80 percent of the traffic contained within a VLAN. The
remaining 20 percent crosses the router to the enterprise servers and to the
Internet and WAN.
30.2 VLAN Configuration
30.2.2 Geographic VLANs
This page will explain why geographic VLANs
have become more common than end-to-end VLANs.
End-to-end VLANs allow devices to be
grouped based upon resource usage. This includes such parameters as server
usage, project teams, and departments. The goal of end-to-end VLANs is to
maintain 80 percent of the traffic on the local VLAN.
As corporate networks move to centralize
their resources, end-to-end VLANs become more difficult to maintain. Users are
required to use many different resources, many of which are no longer in their
VLAN. This shift in placement and usage of resources require VLANs to be created
around geographic boundaries rather than commonality boundaries.
This geographic location can be as large as
an entire building or as small as a single switch inside a wiring closet. In a
geographic VLAN structure, it is typical to find the new 20/80 rule in effect.
That means that 20 percent of the traffic remains within the local VLAN and 80
percent of the network traffic travels outside the local VLAN. Although this
topology means that 80 percent of the services from resources must travel
through a Layer 3 device, this design allows networks to provide a
deterministic and consistent method to access resources.
30.2 VLAN Configuration
30.2.3 Configuring static VLANs
This page will describe the type of network
in which a static VLAN can be configured. Students will also learn how to
configure a VLAN.
Static VLANs are ports on a switch that are
manually assigned to a VLAN. This can be accomplished with a VLAN management
application or configured directly into the switch through the CLI. These ports
maintain their assigned VLAN configuration until they are changed manually.
This type of VLAN works well in networks with specific requirements:
- All
moves are controlled and managed.
- There
is robust VLAN management software to configure the ports.
- The
additional overhead required to maintain end-station MAC addresses and
custom filtering tables is not acceptable.
Dynamic VLANs do not rely on ports assigned
to a specific VLAN.
To configure VLANs on Cisco 2900 series
switches, specific guidelines must be observed:
- The
maximum number of VLANs is switch dependent.
- One
of the factory-default VLANs is VLAN 1.
- The
default Ethernet VLAN is VLAN 1.
- Cisco
Discovery Protocol (CDP) and VLAN Trunking Protocol (VTP) advertisements
are sent on VLAN 1 (VTP will be discussed in Module 9).
- The
IP address of the switch is in the VLAN 1 broadcast domain by default.
- The
switch must be in VTP server mode to create, add, or delete VLANs.
The creation of a VLAN on a switch is a
very straightforward and simple task. If an IOS command-based switch is used,
the command vlan database can be used in the Privileged EXEC mode to enter into
VLAN configuration mode. A VLAN name may also be configured, if necessary:
Switch#vlan database
Switch(vlan)#vlan vlan_number
Switch(vlan)#exit
Upon exiting, the VLAN is applied to the
switch. The next step is to assign the VLAN to one or more interfaces:
Switch(config)#interface fastethernet 0/9
Switch(config-if)#switchport access vlan
vlan_number
In the Lab Activities, students will create
VLANs and verify a basic switch configuration.
30.2 VLAN Configuration
30.2.4 Verifying VLAN configuration
This page will explain how to verify VLAN
configurations.
The commands show vlan, show vlan brief, or
show vlan id id_number can be used to verify VLAN configurations.
The following facts apply to VLANs:
A created VLAN remains unused until it is
mapped to switch ports.
All Ethernet ports are assigned to VLAN 1
by default.
Figure
shows a list of applicable commands.
Figure
shows the steps necessary to assign a new VLAN to a port on the Sydney
switch.
Figures
and list the output of the show
vlan and show vlan brief commands.
30.2 VLAN Configuration
30.2.5 Saving VLAN configuration
This page will teach students how to create
a text file of a VLAN configuration and use it for backup.
It is useful to keep a copy of the VLAN
configuration as a text file, especially when backups or audits need to be
performed.
The switch configuration settings can be
backed up to a TFTP server with the copy running-config tftp command. The
HyperTerminal text capture feature along with the commands show running-config
and show vlan can be used to capture configurations settings.
30.2 VLAN Configuration
30.2.6 Deleting VLANs
This page will teach students how to remove
a VLAN from a Cisco IOS command based switch interface. This process is similar
to the procedure that is used to remove a command from a router.
In Figure , FastEthernet 0/9 was assigned
to VLAN 300 with the command switchport access vlan 300. To remove this VLAN
from the interface, simply use the no form of the command.
The command below is used to remove a VLAN
from a switch:
Switch#vlan database
Switch(vlan)#no vlan 300
When a VLAN is deleted, all ports assigned
to that VLAN become inactive. The ports will, however, remain associated with
the deleted VLAN until assigned to a new VLAN.
30.3 Troubleshooting VLANs
30.3.1 Overview
This page will explain what students will
learn from this lesson.
VLANs are now commonplace in campus
networks. VLANs give network engineers flexibility in designing and
implementing networks. VLANs also enable broadcast containment, security, and
geographically disparate communities of interest. However, as with basic LAN
switching, problems can occur when VLANs are implemented. This lesson will show
some of the more common problems that can occur with VLANs, and it will provide
several tools and techniques for troubleshooting.
Students completing this lesson should be
able to:
- Utilize
a systematic approach to VLAN troubleshooting
- Demonstrate
the steps for general troubleshooting in switched networks
- Describe
how spanning-tree problems can lead to broadcast storms
- Use
show and debug commands to troubleshoot VLANs
30.3
Troubleshooting VLANs
30.3.2 VLAN troubleshooting process
This page will help students develop a
systematic approach that can be used to troubleshoot switch related problems.
It is important to develop a systematic approach
for troubleshooting switch related problems. The following steps can assist in
isolating a problem on a switched network:
1.Check the physical indications, such as
LED status.
2.Start with a single configuration on a
switch and work outward.
3.Check the Layer 1 link.
4.Check the Layer 2 link.
5.Troubleshoot VLANs that span several
switches.
When troubleshooting, check to see if the
problem is a recurring one rather than an isolated fault. Some recurring
problems are due to growth in demand for services by workstation ports
outpacing the configuration, trunking, or capacity to access server resources.
For example, the use of Web technologies and traditional applications, such as
file transfer and e-mail, is causing network traffic growth that enterprise
networks must handle.
Many campus LANs face unpredictable network
traffic patterns that result from the combination of intranet traffic, fewer
centralized campus server locations, and the increasing use of multicast
applications. The old 80/20 rule, which stated that only 20 percent of network
traffic went over the backbone, is obsolete. Internal Web browsing now enables
users to locate and access information anywhere on the corporate intranet.
Traffic patterns are dictated by where the servers are located and not by the
physical workgroup configurations with which they happen to be grouped.
If a network frequently experiences
bottleneck symptoms, like excessive overflows, dropped frames, and
retransmissions, there may be too many ports riding on a single trunk or too
many requests for global resources and access to intranet servers.
Bottleneck symptoms may also occur because
a majority of the traffic is being forced to traverse the backbone. Another
cause may be that any-to-any access is common, as users draw upon corporate
Web-based resources and multimedia applications. In this case, it may be
necessary to consider increasing the network resources to meet the growing
demand.
30.3 Troubleshooting VLANs
30.3.3 Preventing broadcast storms
This page will teach students how to
prevent broadcast storms.
A broadcast storm occurs when a large
number of broadcast packets are received on a port. Forwarding these packets
can cause the network to slow down or to time out. Storm control is configured
for the switch as a whole, but operates on a per-port basis. Storm control is
disabled by default.
Prevention of broadcast storms by setting
threshold values to high or low discards excessive broadcast, multicast, or
unicast MAC traffic. In addition, configuration of values for rising thresholds
on a switch will shut the port down.
STP problems include broadcast storms,
loops, dropped BPDUs and packets. The function of STP is to ensure that no
logic loops occur in a network by designating a root bridge. The root bridge is
the central point of a spanning-tree configuration that controls how the
protocol operates.
The location of the root bridge in the
extended router and switch network is necessary for effective troubleshooting.
The show commands on both the router and the switch can display root-bridge
information. Configuration of root
bridge timers set parameters for forwarding delay or maximum age for STP
information. Manually configuring a
device as a root bridge is another configuration option.
If the extended router and switch network
encounters a period of instability, it helps to minimize the STP processes
occurring between devices.
If it becomes necessary to reduce BPDU
traffic, put the timers on the root bridge at their maximum values.
Specifically, set the forward delay parameter to the maximum of 30 seconds, and
set the max_age parameter to the maximum of 40 seconds.
A physical port on a router or switch may
be part of more than one spanning tree if it is a trunk.
The Spanning-Tree Protocol (STP) is
considered one of the most important Layer 2 protocols on the Catalyst
switches. By preventing logical loops in a bridged network, STP allows Layer 2
redundancy without generating broadcast storms.
Minimize spanning-tree problems by actively
developing a baseline study of the network.
8.3 Troubleshooting VLANs
8.3.4 Troubleshooting
VLANs
This page will explain how the show and
debug commands can be used to troubleshoot VLANs. Figure illustrates the most common problems found
when troubleshooting VLANs.
To troubleshoot the operation of Fast
Ethernet router connections to switches, it is necessary to make sure that the
router interface configuration is complete and correct. Verify that an IP
address is not configured on the Fast Ethernet interface. IP addresses are
configured on each subinterface of a VLAN connection. Verify that the duplex
configuration on the router matches that on the appropriate port/interface on
the switch.
The show vlan command displays the VLAN
information on the switch. Figure , displays the output from the show vlan
command. The display shows the VLAN ID,
name, status, and assigned ports.
The show vlan displays information about
that VLAN on the router. The show vlan command followed by the VLAN number
displays specific information about that VLAN on the router. Output from the command includes the VLAN ID,
router subinterface, and protocol information.
The show spanning-tree command displays the
spanning-tree topology known to the router.
This command will show the STP settings used by the router for a
spanning-tree bridge in the router and switch network.
The first part of the show spanning-tree
output lists global spanning-tree configuration parameters, followed by those
that are specific to given interfaces.
Bridge Group 1 is executing the IEEE
compatible Spanning-Tree Protocol.
The following lines of output show the
current operating parameters of the spanning tree:
Bridge Identifier has priority 32768,
address 0008.e32e.e600 Configured hello time 2, Max age 20, forward delay 15
The following line of output shows that the
router is the root of the spanning tree:
We are the root of the spanning tree.
Key information from the show spanning-tree
command creates a map of the STP network.
The debug sw-vlan packets command displays
general information about VLAN packets received but not configured to support
the router. VLAN packets that the router is configured to route or switch are
counted and indicated when using the show vlans command.
30.3
Troubleshooting VLANs
30.3.5
VLAN troubleshooting scenarios
Network administrators can troubleshoot
switched networks proficiently after the techniques are learned and are adapted
to the company needs. Experience is the best way to improve these skills.
This page will describe two VLAN
troubleshooting scenarios that refer to the most common problems.
Each of these scenarios contains an
analysis of the problem to then solving the problem. Using appropriate specific
commands and gathering meaningful information from the outputs, the progression
of the troubleshooting process can be completed.
When having difficulty with a trunk
connection between a switch and a router, be sure to consider the following
possible causes:
Scenario
1: A trunk line cannot be established between a switch and a router
Figure
illustrates this scenario:
1.Make sure that the port is
connected and not receiving any physical-layer, alignment or
frame-check-sequence (FCS) errors. This can be done with the show interfaces
command on the switch.
2.Verify that the
duplex and speed are set properly between the switch and the router. This can
be done with the show interface status command on the switch or the show
interfaces command on the router.
3.Configure the
physical router interface with one subinterface for each VLAN that will route
traffic. Verify this with the show interfaces IOS command. Also, make sure that
each subinterface on the router has the proper encapsulation type, VLAN number,
IP address, and subnet mask configured. This can be done with the show
interfaces or show running-config IOS commands.
4.Confirm that
the router is running an IOS release that supports trunking. This can be
verified with the show version command.
Scenario
2: Dropped packets and loops
Figure
illustrates this scenario:
Spanning-tree bridges use topology change
notification Bridge Protocol Data Unit packets (BPDUs) to notify other bridges
of a change in the spanning-tree topology of the network. The bridge with the
lowest identifier in the network becomes the root. Bridges send these BPDUs any
time a port makes a transition to or from a forwarding state, as long as there
are other ports in the same bridge group. These BPDUs migrate toward the root
bridge.
There can be only one root bridge per
bridged network. An election process determines the root bridge. The root
determines values for configuration messages, in the BPDUs, and then sets the
timers for the other bridges. Other designated bridges determine the shortest
path to the root bridge and are responsible for advertising BPDUs to other
bridges through designated ports. A bridge should have ports in the blocking
state if there is a physical loop.
Problems can arise for internetworks in
which both IEEE and DEC spanning-tree algorithms are used by bridging nodes.
These problems are caused by differences in the way the bridging nodes handle
spanning tree BPDU packets, or hello packets, and in the way they handle data.
In this scenario, Switch A, Switch B, and
Switch C are running the IEEE spanning-tree algorithm. Switch D is
inadvertently configured to use the DEC spanning-tree algorithm.
Switch A claims to be the IEEE root and
Switch D claims to be the DEC root. Switch B and Switch C propagate root
information on all interfaces for IEEE spanning tree. However, Switch D drops
IEEE spanning-tree information. Similarly, the other routers ignore Router D's
claim to be root.
The result is that in none of the bridges
believing there is a loop and when a broadcast packet is sent on the network, a
broadcast storm results over the entire internetwork. This broadcast storm will
include Switches X and Y, and beyond.
To resolve this problem, reconfigure Switch
D for IEEE. Although a configuration change is necessary, it might not be
sufficient to reestablish connectivity. There will be a reconvergence delay as
devices exchange BPDUs and recompute a spanning tree for the network.
Summary
A VLAN is a group of network services not
restricted to a physical segment or LAN switch. Configuration or
reconfiguration of VLANs is done through software which makes it unnecessary to
physically connect or move cables and equipment. VLANs address scalability,
security, and network management. Routers in VLAN topologies provide broadcast
filtering, security, and traffic flow management. Traffic should only be routed
between VLANs. Switches may not bridge any traffic as this would violate the
integrity of the VLAN broadcast domain.
The primary benefit of VLANs is that they
permit the network administrator to organize the LAN logically instead of
physically. This includes the ability to move workstations on the LAN, add
workstations to the LAN, change the LAN configuration, control network traffic,
and improve security.
A VLAN is a broadcast domain created by one
or more switches. VLANs are used to create broadcast domains in order to
improve the overall performance of the network. Implementing VLANs on a switch
causes the switch to maintain a separate bridging table for each VLAN. If the
frame comes in on a port in VLAN 1, the switch searches the bridging table for
VLAN 1. When the frame is received, the switch adds the source address to the
bridging table if it is currently unknown. The switch then checks the
destination so a forwarding decision can be made. For learning and forwarding
the search is made against the address table for that VLAN only.
There are three basic VLAN memberships for
determining and controlling how a packet gets assigned., They include
port-based VLANs, MAC address based VLANs, and protocol based VLANs.
Inter-Switch Link (ISL) is a method of
frame tagging that is quickly being replaced by being replaced by 802.1Q frame
tagging. Packet tagging provides a mechanism for controlling the flow of
broadcasts and applications while not interfering with the network and
applications.
Each VLAN must have a unique Layer 3
network address assigned. This enables routers to switch packets between VLANs.
VLANs can exist either as end-to-end networks or they can exist inside of
geographic boundaries.
An end-to-end VLAN network groups users
into VLANs based on group or job function. All users in a VLAN should have the
same 80/20 traffic flow patterns. VLAN membership does not change for a user as
they physically move locations. Each VLAN has a common set of security
requirements for all members.
Static VLANs are ports on a switch that are
manually assigned to a VLAN by using a VLAN management application or by
working directly within the switch. These ports maintain their assigned VLAN
configuration until they are changed manually. Dynamic VLANs do not rely on
ports assigned to a specific VLAN. Use the show vlan, show vlan brief, or show
vlan idid_number commands to verify VLAN configuration.
A systematic approach is used for
troubleshooting issues on a VLAN. To isolate a problem, check the physical
indications, such as LED status. Start with a single configuration on a switch
and work outward. Check the Layer 1 link then check the Layer 2 link.
Troubleshoot VLANs that span several switches. Some recurring problems are due
to growth in demand for services by workstation ports outpacing the
configuration, trunking, or capacity to access server resources.
No comments:
Post a Comment