VLAN Fundamentals: Network Segmentation and Security

After diving deep into routing protocols, we're exploring VLANs (Virtual LANs) - a critical concept for modern network design and security.

Why VLANs Are Necessary

Traditional Network Limitations

Without VLANs, a single switch creates one large broadcast domain:

• Security Risk: All devices can see all traffic
• Performance Issues: Broadcast storms affect entire network
• Management Difficulty: No logical separation of departments
• Scalability Problems: Limited growth options

VLAN Benefits

• Security: Isolate sensitive departmental traffic
• Performance: Smaller broadcast domains
• Flexibility: Easy to reorganize network logically
• Management: Simplified network administration

VLAN Concepts Explained

The Train Analogy

Think of your network as a train with different compartments:

• Oxford Department: Yellow compartment (VLAN 10)
• Cambridge Department: Blue compartment (VLAN 20)
• Westminster Department: Red compartment (VLAN 30)

Without VLANs: Everyone can move between compartments freely With VLANs: You can only enter compartments through proper doors (switch ports)

VLAN Types

Data VLAN

• Purpose: User-generated traffic
• Best Practice: Keep separate from management traffic
• Security: Isolates sensitive data

Management VLAN

• Purpose: Network management and monitoring
• Common ID: VLAN 1 (default)
• Best Practice: Use separate from user data VLANs

Native VLAN

• Purpose: Carries untagged traffic for backward compatibility
• Default: VLAN 1
• Security Risk: Native VLAN 1 can enable VLAN hopping attacks

Blackhole VLAN

• Purpose: Unused ports assigned to dummy VLAN
• Security: Prevents unauthorized access
• Configuration: VLAN 99 (commonly used)

VLAN Configuration Lab

Basic VLAN Creation

Switch>en
Switch#conf t
Switch(config)# vlan 10
Switch(config-vlan)# name Oxford
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name Cambridge
Switch(config-vlan)# vlan 30
Switch(config-vlan)# name Westminster
Switch(config-vlan)# exit

Port Assignment to VLANs

Switch(config)# interface range fa0/1 - 15
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit

# Assign ports 16-23 to VLAN 20
Switch(config)# interface range fa0/16 - 23
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20

Verifying VLAN Configuration

Switch#show vlan brief

Expected Output:

VLAN Name                             Status    Ports
---- -------------------------------- --------- -----
10   Oxford                            active    Fa0/1-Fa0/8
20   Cambridge                          active    Fa0/16-Fa0/23
30   Westminster                        active    Gi0/1
1    default                              active    
99   Blackhole                           active    

VLAN Trunking

What is a Trunk?

A trunk port carries traffic for multiple VLANs between switches using 802.1Q tagging.

Trunk Configuration

# On both switches
Switch(config)# interface gig0/1
Switch(config-if)# switchport mode trunk

Verifying Trunk Status

Switch#show interfaces trunk

Inter-VLAN Routing

Router-on-a-Stick Configuration

Router>en
Router#conf t
Router(config)# interface gig0/0/1
Router(config-if)# no shutdown
Router(config-if)# exit

# Create subinterfaces for each VLAN
Router(config)# interface gig0/0/1.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gig0/0/1.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gig0/0/1.30
Router(config-subif)# encapsulation dot1q 30
Router(config-subif)# ip address 192.168.30.1 255.255.255.0
Router(config-subif)# exit

SVI (Switch Virtual Interface)

Switch(config)# interface vlan 99
Switch(config-if)# ip address 192.168.99.2 255.255.255.0
Switch(config-if)# exit

Switch(config)# ip default-gateway 192.168.99.1

Native VLAN Configuration

Changing Native VLAN

Switch(config)# interface gig0/1
Switch(config-if)# switchport trunk native vlan 30

Important: Native VLAN must match on both trunk ends.

VLAN Security Best Practices

VLAN Hopping Prevention

1. Don't use VLAN 1 as native VLAN
2. Use different native VLAN from default
3. Configure consistent native VLAN on trunks

Access Control

# Port security configuration
Switch(config)# interface fa0/1
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky

Real-World VLAN Design

Department-Based VLANs

VLAN 10: Management (Network Admins)
VLAN 20: Engineering (Developers, IT)  
VLAN 30: Finance (Accounting, Executives)
VLAN 40: Guest (Visitors, Contractors)

Voice VLAN Considerations

# Voice VLAN configuration
Switch(config)# vlan 50
Switch(config-vlan)# name Voice
Switch(config)# exit

Switch(config)# interface range fa0/1 - 8
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 50
Switch(config-if-range)# switchport voice vlan 50
Switch(config-if-range)# mls qos trust cos 5

Troubleshooting VLANs

Common Issues

1. VLANs Not Communicating

   • Check: Trunk configuration
   • Verify: Native VLAN settings
   • Check: Router subinterface configuration

2. Native VLAN Issues

   • Check: Mismatched native VLANs
   • Verify: Trunk encapsulation

3. Access Port Problems

   • Check: VLAN membership
   • Verify: Port mode configuration
   • Check: STP blocking ports

Advanced VLAN Concepts

Private VLANs

• Purpose: Isolated groups within regular VLAN
• Use Case: Multi-tenant environments
• Configuration: Requires switch supporting private VLANs

Q-in-Q

• Purpose: Prioritize voice/video traffic
• Configuration: Layer 2 and Layer 3 Q-in-Q
• Implementation: 802.1p priority tagging

Key Takeaways

1. VLANs provide logical network segmentation without physical changes
2. Trunking enables multi-VLAN communication between switches
3. Security is enhanced through traffic isolation and access control
4. Proper planning prevents common VLAN configuration errors

VLANs are essential for modern network design, providing both security and flexibility that flat networks cannot match.

---

VLANs complete our switching fundamentals. Next: DHCP and network services automation!