---

Virtual Local Area Networks (VLANs)

---

1. Concept and Motivation of VLANs

A Virtual Local Area Network (VLAN) is a logical subnetwork that groups together a collection of devices from different physical LAN segments into a single broadcast domain, regardless of their physical location.

Key Motivations:

1. Broadcast Containment: Broadcast traffic from one department (e.g., ARP, DHCP) does not flood users in other departments.
2. Security: Logical isolation prevents unauthorized eavesdropping between sensitive subnets (e.g., Finance isolated from Guest Wi-Fi).
3. Cost Reduction & Flexibility: Eliminates the need to run separate physical switches and cables when teams relocate within a building.

---

2. VLAN Membership Types

Switches assign switch ports to VLANs using several mechanisms:

1. Port-Based (Static VLAN):
   • Network administrator manually assigns physical ports to a specific VLAN ID (e.g., Ports 1–8 = VLAN 10, Ports 9–16 = VLAN 20).
   • Most common, secure, and easiest to manage.
2. MAC Address-Based (Dynamic VLAN):
   • Membership is based on the 48-bit MAC address of the connected host. If a user moves their laptop to a different desk/port, the switch automatically assigns that port to the user's VLAN.
3. Protocol-Based:
   • Packets are segregated into VLANs based on the protocol carried in the Layer 3 header (e.g., IPv4 vs IPv6 vs IPX).
4. IP Subnet-Based:
   • Frames are assigned to VLANs based on the sender's Layer 3 IP subnet.

---

3. Trunking and IEEE 802.1Q Frame Tagging

When VLAN traffic must traverse across multiple interconnected switches, a Trunk Link is used.

• Access Port: Carries traffic for only one specific VLAN. Frames sent to end-user workstations are standard Ethernet frames (untagged).
• Trunk Port: Carries traffic for multiple VLANs simultaneously between switches or between a switch and a router.

IEEE 802.1Q Frame Format:

The IEEE 802.1Q standard inserts a 4-byte VLAN Tag into the standard Ethernet frame between the Source MAC Address and the Length/Type field:

• TPID (Tag Protocol Identifier - 2 bytes): Fixed value 0x8100 identifying the frame as 802.1Q-tagged.
• TCI (Tag Control Information - 2 bytes):
  • Priority (3 bits): Quality of Service (QoS / 802.1p) marking 8 priority levels (0 to 7) for voice/video.
  • DEI (Drop Eligible Indicator - 1 bit): May be dropped during network congestion.
  • VID (VLAN Identifier - 12 bits): Identifies the VLAN ($2^{12} = 4096$ possible VLANs, values $1 - 4094$ usable).

---

4. Inter-VLAN Routing

Because each VLAN is an independent Layer 2 broadcast domain and logical subnet, devices in different VLANs cannot communicate without a Layer 3 routing device.

1. Router-on-a-Stick:
   • A single physical trunk cable connects the switch to a router interface.
   • The router configures logical sub-interfaces (e.g., Gig0/0.10 and Gig0/0.20), routing traffic between VLANs across the trunk.
2. Layer 3 Switch (Multilayer Switch):
   • Modern enterprise solution that performs Inter-VLAN routing at internal backplane wire speed using SVIs (Switch Virtual Interfaces) without an external router.

---