Short Notes on VLAN (Virtual LAN)

Definition. A VLAN is a logical group of stations that communicate as if they were on the same broadcast domain, regardless of their physical location or the switch they are plugged into. VLANs are standardised by IEEE 802.1Q: one physical LAN is divided into several logical LANs by software configuration instead of by cabling.

Key points

• Broadcast containment. Each VLAN is a separate broadcast domain, so a broadcast in VLAN 10 reaches only VLAN 10 hosts. Broadcast storms and needless traffic are reduced and overall performance improves.
• Logical grouping and easy administration. Hosts are grouped by function (Accounts, Faculty, Hostel, Lab) rather than by wiring. Moving or adding a host is a switch-port configuration change, not re-cabling — administration becomes fast, cheap and error-free.
• Security / isolation. Stations in different VLANs cannot exchange frames at Layer 2. Traffic between VLANs must pass through a router or Layer-3 switch (inter-VLAN routing, e.g. router-on-a-stick with 802.1Q sub-interfaces), so guest traffic can be kept away from server traffic and access control can be applied at that point.

The 802.1Q tag

For a frame crossing a trunk link a 4-byte tag is inserted after the source MAC address:

+--------+--------+--------------+--------------+---------+-----+
| DA(6B) | SA(6B) | TPID (2 B)   | TCI (2 B)    | Payload | FCS |
|        |        | = 0x8100     |              |         |     |
+--------+--------+--------------+--------------+---------+-----+
TCI = PCP (3 bits, priority) | DEI (1 bit) | VID (12 bits)

• VID = 12 bits $\Rightarrow 2^{12} = 4096$ values; VLAN IDs 1 to 4094 are usable (0 and 4095 are reserved); VLAN 1 is the default VLAN.
• The tag adds 4 bytes, so a tagged frame may reach 1522 bytes (1518 + 4).

Port types

• Access port: belongs to exactly one VLAN; frames to/from end devices are sent untagged. PCs, printers and IP phones attach here.
• Trunk port: carries the frames of many VLANs between switches and routers, tagging each with 802.1Q. The native VLAN is carried untagged. Pruning (802.1Q-2005) removes VLANs from a trunk that does not need them, saving bandwidth.

Types of VLAN and summary

VLANs may be port-based (static, most common), MAC-based, protocol-based or dynamic/role-based. Advantages: flexibility, broadcast reduction, security, easy reconfiguration and mobility. Limitations: only 4094 VLANs are available, inter-VLAN traffic needs a router/L3 switch (extra cost), and a misconfigured trunk can leak traffic between VLANs.