Page 144

The Benefits of Virtual LANs

103

By using VLANs and creating multiple broadcast groups, administrators

now have control over each port and user. Users can no longer just plug their
workstation into any switch port and have access to network resources. The
administrator controls each port and whatever resources it is allowed to use.

Because groups can be created according to the network resources a user

requires, switches can be configured to inform a network management sta-
tion of any unauthorized access to network resources. If inter-VLAN com-
munication needs to take place, restrictions on a router can also be
implemented. Restrictions can also be placed on hardware addresses, proto-
cols, and applications.

Flexibility and Scalability

VLANs also add more flexibility to your network by limiting or adding only
the users you want in the broadcast domain regardless of their physical loca-
tion. Layer 2 switches read frames only for filtering; they do not look at the
Network layer protocol. This can cause a switch to forward all broadcasts.
However, by creating VLANs, you are essentially creating separate broad-
cast domains. Broadcasts sent out from a node in one VLAN will not be for-
warded to ports configured in a different VLAN. By assigning switch ports
or users to VLAN groups on a switch--or group of connected switches
(called a switch-fabric)--you have the flexibility to add only the users you
want in the broadcast domain regardless of their physical location. This can
stop broadcast storms caused by a faulty network interface card (NIC) or an
application from propagating throughout the entire internetwork.

When a VLAN gets too big, you can create more VLANs to keep the

broadcasts from consuming too much bandwidth. The fewer users in a
VLAN, the fewer are affected by broadcasts.

The Collapsed Backbone and the VLAN

To understand how a VLAN looks to a switch, it's helpful to begin by first
looking at a traditional collapsed backbone. Figure 3.2 shows a collapsed
backbone created by connecting physical LANs to a router.

www.sybex.com