Connecting LANs and Virtual LANs (VLANs)

1. Network Connecting Devices and the OSI Model

When Local Area Networks (LANs) grow or need to interconnect, specific hardware devices are employed. These devices operate at different layers of the OSI model:

  OSI Layer           Interconnection Device
+-------------------+---------------------------------------------------+
| 7. Application    |                                                   |
| 6. Presentation   |  GATEWAY (Protocol Converter across all layers)   |
| 5. Session        |                                                   |
+-------------------+---------------------------------------------------+
| 4. Transport      |  TRANSPORT GATEWAY / FIREWALL                     |
+-------------------+---------------------------------------------------+
| 3. Network        |  ROUTER / LAYER 3 SWITCH                          |
+-------------------+---------------------------------------------------+
| 2. Data Link      |  BRIDGE / LAYER 2 SWITCH                          |
+-------------------+---------------------------------------------------+
| 1. Physical       |  REPEATER / HUB                                   |
+-------------------+---------------------------------------------------+

2. Detailed Breakdown of Interconnecting Devices

A. Repeater & Hub (Layer 1 - Physical)

Repeater: Regenerates attenuated electrical or optical signals to extend the maximum cable distance without inspecting headers or filtering packets.
Hub (Multi-port Repeater): Broadcasts incoming electrical signals from one port to all other connected ports.
Limitation: All ports share one single collision domain and one broadcast domain.

B. Bridge & Layer 2 Switch (Layer 2 - Data Link)

Bridge: Segments a LAN into smaller collision domains, filtering traffic based on 48-bit hardware MAC addresses via a dynamic forwarding table.
Layer 2 Switch (Multi-port Bridge):
- Uses hardware ASICs for wire-speed forwarding.
- Microsegmentation: Every switch port forms its own dedicated collision domain.
- Supports Full-Duplex transmission with zero collisions.
- Switching methods:
  1. Store-and-Forward: Verifies 32-bit CRC before forwarding (error-free, slightly higher latency).
  2. Cut-Through: Forwards as soon as the 6-byte destination MAC address is read (minimum latency, allows corrupt frames).
  3. Fragment-Free: Reads 64 bytes (collision window) before forwarding.

C. Router (Layer 3 - Network)

Forwards packets across independent subnets using Logical IP Addresses.
Runs routing protocols (OSPF, RIP, BGP) to calculate optimal packet paths.
Breaks Broadcast Domains: Routers do not forward Layer 2 broadcasts (FF:FF:FF:FF:FF:FF) across interfaces.

Device Comparison Summary:

Device	Operating OSI Layer	Forwards Based On	Divides Collision Domain?	Divides Broadcast Domain?
Hub / Repeater	Layer 1	Electrical signal / bits	No (1 shared domain)	No (1 shared domain)
Switch / Bridge	Layer 2	MAC Address (48 bits)	Yes (1 per port)	No (1 shared domain)
Router	Layer 3	IP Address (32/128 bits)	Yes (1 per port)	Yes (1 per interface)

3. Virtual Local Area Networks (VLANs)

A Virtual LAN (VLAN) is a logical grouping of network devices that behave as if they are connected to the same physical wire, regardless of their physical location across switches.

                    VLAN IMPLEMENTATION (Logical Segmentation)
                     +----------------------------+
                     |        SWITCH CHASSIS      |
                     +----------------------------+
                      /       \          /       \
                  Port 1    Port 2    Port 3    Port 4
                    |         |         |         |
                 [Host A]  [Host B]  [Host C]  [Host D]
                 \______/  \______/  \______/  \______/
                  VLAN 10   VLAN 20   VLAN 10   VLAN 20
                 (Engineering) (HR)  (Engineering) (HR)

Key Advantages:

Broadcast Containment: Broadcast traffic from one VLAN does not flood other VLANs, preserving bandwidth.
Enhanced Security: Traffic between different VLANs is isolated at Layer 2; unauthorized snooping between departments is blocked.
Cost Efficiency & Mobility: Users can move desks anywhere in a building while remaining on their departmental VLAN without rewiring.

4. Trunking and IEEE 802.1Q Frame Tagging

  [ Switch 1 ] ================= (Trunk Link) ================= [ Switch 2 ]
  VLAN 10 & 20           Carries tagged frames for               VLAN 10 & 20
                         both VLAN 10 and VLAN 20

Access Port: Carries traffic for only one specific VLAN (connects to end-user PCs; frames are untagged).
Trunk Port: Carries traffic for multiple VLANs across switches.

IEEE 802.1Q Tag Structure:

Inserts a 4-byte VLAN Tag into the standard Ethernet frame:

 Tagged 802.1Q Ethernet Frame:
 +----------+----------+-------------+-----------+---------------+---------+
 | Dest MAC | Src MAC  | 802.1Q Tag  | Type/Len  | Data Payload  |   FCS   |
 |  6 bytes | 6 bytes  |   4 bytes   |  2 bytes  | 46-1500 bytes | 4 bytes |
 +----------+----------+-------------+-----------+---------------+---------+
                           |
       +-------------------+-------------------+
       | TPID (2 bytes)    | TCI (2 bytes)     |
       |  0x8100           | Pri (3b) | DEI(1b)| VID (12 bits) |
       +-------------------+-------------------+

TPID (Tag Protocol Identifier - 2 bytes): Fixed value 0x8100.
Priority (3 bits - 802.1p): 8 Quality of Service (QoS) traffic classes.
VID (VLAN ID - 12 bits): Supports up to $2^{12} = 4096$ VLANs ( $1 - 4094$ usable).

5. Inter-VLAN Routing

Because each VLAN is an independent Layer 2 broadcast domain, communicating between different VLANs requires a Layer 3 device:

Router-on-a-Stick: A single physical trunk cable connects the switch to a router with logical sub-interfaces (e.g., fa0/0.10 and fa0/0.20).
Multilayer / Layer 3 Switch: Switches packets between VLANs internally at hardware line rate using Switch Virtual Interfaces (SVIs).

6. Key Exam Questions & Takeaways

How does a switch separate collision domains while sharing a broadcast domain?
- Each switch port buffers frames and maintains a dedicated full-duplex link to the connected host (own collision domain). However, broadcast frames (FF:FF:FF:FF:FF:FF) are flooded out all active ports, meaning all ports belong to the same broadcast domain unless segmented by VLANs.
What is IEEE 802.1Q frame tagging?
- A standard that inserts a 4-byte header containing a 12-bit VLAN Identifier (VID) into the Ethernet frame so that switches across trunk links can route each frame to its appropriate VLAN.
Can two computers in different VLANs on the same physical switch communicate directly?
- No. By definition, VLANs isolate Layer 2 broadcast domains. Inter-VLAN communication strictly requires a Layer 3 routing mechanism.

Connecting LAN and Virtual LAN