Page 370

324

Chapter 6

Virtual LANs (VLANs)

This is why VLANs are so cool. By building them and creating multiple

broadcast groups, administrators can now have control over each port and
user! The days where users could just plug their workstations into any switch
port and gain access to network resources are history, because the adminis-
trator is now awarded control over each port and whatever resources that
port could access.

Also, because VLANs can be created in accordance with the network

resources a user requires, switches can be configured to inform a network
management station of any unauthorized access to network resources. And
if you need inter-VLAN communication, you can implement restrictions on
a router to achieve it. You can also place restrictions on hardware addresses,
protocols, and applications--now we're talking security!

Flexibility and Scalability

If you were paying attention to what you've read so far, you know that
layer-2 switches only read frames for filtering--they don't look at the
Network layer protocol. And by default, switches forward all broadcasts.
But if you create and implement VLANs, you're essentially creating smaller
broadcast domains at layer-2.

This means that broadcasts sent out from a node in one VLAN won't be for-

warded to ports configured to be in a different VLAN. So by assigning switch
ports or users to VLAN groups on a switch or group of connected switches
(called a

switch fabric

), you gain the flexibility to add only the users you want

into that broadcast domain regardless of their physical location! This setup can
also work to block broadcast storms caused by a faulty network interface card
(NIC), as well as prevent an application from propagating the storms through-
out the entire internetwork. Those evils can still happen on the VLAN where
the problem originated, but the disease will just be quarantined to that one
ailing VLAN.

Another advantage is when a VLAN gets too big, you can create more

VLANs to keep the broadcasts from consuming too much bandwidth--the
fewer users in a VLAN, the fewer users affected by broadcasts. This is well
and good, but you absolutely need to keep network services in mind and
understand how the users connect to these services when you create your
VLAN. It's a good move to try and keep all services, except for the e-mail
and Internet access that everyone needs, local to all users when possible.

To understand how a VLAN looks to a switch, it's helpful to begin by first

looking at a traditional network. Figure 6.3 shows how a network was
created by connecting physical LANs using hubs to a router.

www.sybex.com