Static VLANs

Introduction

VLANs are usually created by the network administrator, assigning each port of every switch to a VLAN. Depending on the network infrastructure and security policies, the assignment of VLANs can be implemented using two different methods: Static or Dynamic memberships - these two methods are also known as VLAN memberships.

Each of these methods have their advantages and disadvantages and we will be analysing them in great depth to help you decide which would best suite your network.

Depending on the method used to assign the VLAN membership, the switch may require further configuration, but in most cases it's a pretty straight forward process. This page deals with Static VLANs while Dynamic VLANs are covered next.

Static VLANs

Static VLAN membership is perhaps the most widely used method because of the relatively small administration overhead and security it provides. With Static VLANs, the administrator will assign each port of the switch to one VLAN. Once this is complete, they can simply connect each device or workstation to the appropriate port.

The picture below depicts an illustration of the above, where 4 ports have been configured for 4 different VLANs:

The screenshot above shows a Cisco switch (well, half of it :>) where ports 1, 2, 7 and 10 have been configured and assigned to VLANs 1, 5, 2 and 3 respectively.

At this point, we should remind you that these 4 VLANs are not able to communicate between each other without the use of a router as they are treated as 4 separate physical networks, regardless of the network addressing scheme used on each of them. However, we won't provide further detail on VLAN routing since it's covered later on.

Static VLANs are certainly more secure than traditional switches while also considerably easy to configure and monitor. As one would expect, all nodes belonging to a VLAN must also be part of the same logical network in order to communicate with one another. For example, on our switch above, if we assigned network 192.168.1.0/24 to VLAN 1, then all nodes connecting to ports assigned to VLAN 1 must use the same network address for them to communicate between each other, just as if this was an ordinary switch.

In addition, Static VLANs have another strong point - you are able to control where your users move within a large network. By assigning specific ports on your switches throughout your network, you are able to control access and limit the network resources to which your users are able to use.

A good example would be a large network with multiple departments where any network administrator would want to control where the users can physically connect their workstation or laptop and which servers they are able to access.

The following diagram shows a VLAN powered network where the switches have been configured with Static VLAN support.

The network diagram might look slightly complicated at first, but if you pay close attention to each switch, you will notice that it's quite simple - six switches with 6 VLANs configured- one VLAN per department, as shown. While each VLAN has one logical network assigned to it, the IT department has, in addition, placed one workstation in the following departments for support purposes: Management, R&D, and HR department.

The network administrator has assigned Port 1 (P1) on each department switch to VLAN 5 for the workstation belonging to the IT department, while the rest of the ports are assigned to the appropriate VLAN as shown in the diagram.

This setup allows the administrator to place any employee in the IT department, anywhere on the network, without worrying if the user will be able to connect and access the IT department's resources.

In addition, if a user in any of the above departments e.g the Management department, decided to get smart by attempting to gain access to the IT department's network and resources by plugging his workstation to Port 1 of his department's switch. He surely wouldn't get far because his workstation would be configured for the 192.168.1.0 network (VLAN 1), while Port 1 requires him to use a 192.168.5.0 network address (VLAN 5). Logically, he would have to change his IP address to match the network he is trying to gain access to, and in this case this would be network 192.168.5.0.

Summary

To sum up, with Static VLANs, we assign each individual switch port to a VLAN. The network addresses are totally up to us to decide. In our example, the switches do not care what network address is used for each VLAN as they totally ignore this information unless routing is performed (this is covered in the InterVLAN routing page). As far as the switches are concerned, if you have two ports assigned to the same VLAN, then these two ports are able to communicate between each other as it would happen on any normal layer 2 switch.

Dynamic Vlan

Dynamic VLANs

Introduction

Dynamic VLANs were introduced to grant the flexibility and complexity(!) that Static VLANs did not provide. Dynamic VLANs are quite rare because of their requirements and initial administrative overhead. As such, most administrators and network engineers tend to prefer Static VLANs.

Dynamic VLANs

Dynamic VLANs, as opposed to Static VLANs, do not require the administrator to individually configure each port, but instead, a central server called the VMPS (VLAN Member Policy Server). The VMPS is used to handle the on-the-spot port configuration of every switch participating on the VLAN network.

The VMPS server contains a database of all workstation MAC addresses, along with the associated VLAN the MAC address belongs to. This way, we essentially have a VLAN-to-MAC address mapping:

The above diagram works as an aim to help us understand the mapping relationship that exists in the VMPS server. As shown, each MAC address, which translates to a host on the network, is mapped to a VLAN, allowing this host to move inside the network, connecting to any switch that is part of the VMPS network and maintain its VLAN configuration.

You can now start to imagine the initial workload involved when configuring a VMPS server for a network of over 300 workstations:)

As one would expect, the above model works very well and also requires the switches to be in constant contact with the VMPS server, requesting configuration information everytime a host connects to a switch participating in the VLAN network. Of course, there is a lot more information we can use to configure the VMPS database, but we won't be covering that just as yet.

Like all network services offered, Cisco has cleverly designed this model to be as flexible as our network might require. For example, you are able to connect more than one host on one dynamically configured port, as long as all hosts are part of the same VLAN:

 

The diagram above shows us a VLAN capable switch that has been configured to support Dynamic VLANs. On port No.5, we have connected a simple switch (not VLAN aware) from which another 4 workstations are connected.

As mentioned previously, this type of configuration is valid and therefore supported, but it also has its restrictions and limitations.

One of the restrictions, which by the way can also be considered as a semi-security feature, is that all workstations connected to the same port, must be configured in the VMPS server as part of the same VLAN, otherwise the port is

most likely to shut down as a security precaution.

To consider the limitations of this configuration: if the switch detects more than 20 active hosts (20 MAC addresses) on the port, it will once again shut it down, leaving the workstations without any network connection. When this happens, the port that shuts down will return into an isolated state, not belonging to any VLAN.

The fact is that Dynamic VLANs are really not suitable for every network, even though they allow a great deal of flexibility and security. If you consider the advantage one single feature of Dynamic VLANs can provide you with, then it might be all you need to implement them.

Because each host connected to the switch is checked against the VMPS database for its VLAN membership before the port is activated and assigned to a VLAN, this gives the network administrator the ability to ensure no foreign host is able to walk up to a wall socket and simply plug their workstation to access the network, if his MAC address is not stored in the VMPS database. For a large scale network, this could be considered an ACE card under your sleeve.

Choosing Correct Switches

One important factor we haven't yet mentioned is that you cannot run the VMPS server on a Cisco Catalyst 2900 or 3500 series. The Catalyst 4500 and upwards are able to act as a VMPS, and at the time of writing, this switch has reached its end of retail life. For those who have dealt with Cisco Catalyst switches in the past, you would know that a Catalyst 4500 is not the type of switch you would use in a 20 or 50 node network!

The Catalyst 4500, 6500 series, are switches designed for enterprise networks, as such, they are built to be modular, easily expandable depending on your needs, and lastly, fully redundant because you can't have your core backbone switch failing when all other switches and network equipment are directly connected to it.

We've added a few pictures of the Catalyst 6500 series for you to admire :)

You can clearly see the slots available that allow the Catalyst switches to expand and grow with your network. In the likely event you require more ports as your network expands, you simply buy a Fastethernet blade (some people call them 'slices') and insert it into an available slot!

Dynamic VLANs & FallBack VLANs

Another very interesting and smart feature Dynamic VLANs support is the fallback VLAN. This neat feature allows you to automatically configure a port to a VLAN specially created for workstations whose MAC address is not in the VMPS server. Consider company visitors or clients who require specific or restricted access to your network, they can freely connect to the network and have Internet access, alongside with limited rights on public directories.

In the event the fallback VLAN has not been configured and the MAC address connected to the switch's port is unknown, the VMPS server will send an 'access-denied' response, blocking access to the network, but the port will remain active. If the VMPS server is running in 'secure-mode', it will proceed and shutdown the port as an additional security measure.

The above diagram represents a portion of a large scale network using a Cisco 6500 Catalyst as the core switch. The switch has been configured to support Dynamic VLANs, therefore a VMPS server has been configured inside the switch, alongside with a DHCP server for each created VLAN. The administrator has already assigned the 3 workstations MAC addresses to the VLANs shown and also created the fallback VLAN for any MAC address that does not exist in the database.

Now consider this interesting scenario: One morning a visitor arrives in the office and requires Internet connection so he can demonstate a new product to the management. As an administrator, you've already configured a fallback VLAN with a DHCP server activated for the VLAN, pushing the necessary settings to the clients so they may obtain Internet access services.

The visitor finds a free RJ-45 socket on the wall, which connects to a Catalyst 3550 switch nearby, and plugs in his laptop. Before the user is allowed to access the network, the Cisco 3550 switch checks the laptop's MAC address and reads 4B:63:3F:A2:3E:F9. At this point, the port is blocked, not allowing the laptop computer to send or receive data. The Cisco 3550 switch sends the MAC address to the 6500 Catalyst switch which is acting as the VMPS server and it checks for an entry that matches the specified MAC address but is unable to find one.

Naturally, it determines that this a visitor, so it creates an entry for that MAC address to the fallback VLAN and sends the information back to the Cisco 3550 switch. The switch will then enable access to the port our visitor is connected to by configuring the port to the fallback VLAN.

If the visitor's computer is configured to obtain an IP Address automatically, it will do so, once the operating system has booted. When this happens, the visitor's DHCP request will arrive to the 6500 Catalyst switch and its DHCP server will send the requested information, enabling the client (our visitor) to configure itself with all the parameters required to access the VLAN. This will also mean our visitor is now able to access the Internet!

Finishing, if the computer is not configured for DHCP, the client must be advised with the correct network settings or asked to enable automatic IP configuration in their network properties.

Summary

The past pages could be considered as an 'eye-opener' for people who are new to the VLAN concept, and at the same time a 'quick-overview' for those who are well aware of their existence! We hope all your questions to this point have been answered, if not, they are most likely too advanced and will surely be answered in the pages that follow.

Static Vs Dynamic Vlan

Static VLAN vs Dynamic VLAN 

Virtual Local Area Network (VLAN) is a set of ports selected by the switch as belonging to the same broadcast domain. Typically, all ports carrying traffic to a particular subnet address would belong to the same VLAN. Static VLANs are VLANs that are manually configured by providing a name, VLAN ID (VID) and port assignments. Dynamic VLANs are created by storing the hardware addresses of host devices in a database so that the switch can assign the VLAN dynamically at any time when a host is plugged in to a switch. VLANs allow you to group users depending on the logical function rather than their physical location.

What is Static VLAN?

Static VLANs which are also known as Port-based VLANs are created by manually assigning ports to a VLAN. When a device is connected to a port it automatically assumes the VLAN that the port is assigned to. If the user changes the port and still needs to access the same VLAN, the network administrator has to manually assign the port to the VLAN. Static VLANs are generally used to reduce broadcast and to increase the security. Since static VLANs have a small administrative overhead and provide good security than traditional switches, they are widely used. Another strong point of static VLANs is the ability to control where the user moves within a large network. By assigning specific ports on the switches in the network, the network administrators can control access and limit the network resources that can be used by the users.

What is Dynamic VLAN?

As mentioned earlier, dynamic VLANs are created by assigning the host to a VLAN when a host is plugged in to a switch using hardware addresses stored in a database. Dynamic VLANs use a central server called VMPS (VLAN Membership Policy Server). VMPS is used to handle port configurations of every switch on the VLAN network. VMPS server holds a database that contains MAC addresses of all workstations with the VLAN it belongs to. This provides a VLAN-to-MAC address mapping. This mapping scheme allows the hosts to move inside the network and connect to any switch, which is part of the VMPS network and still maintain its VLAN configuration. Initial workload required for configuring the VMPS is large hence dynamic VLANs are quite rare. When a host is connected to a switch, it is checked against the VMPS database for its VLAN membership before the port is activated and assigned to a VLAN. This prevents a foreign host accessing a network by simply plugging in a workstation to a wall socket.

What is the difference between Static VLAN and Dynamic VLAN?

Main difference between static VLANs and dynamic VLANs is that the static VLANs are configured manually by assigning ports to a VLAN while dynamic VLANs use a database that stores a VLAN-to-MAC mapping to determine the VLAN that a particular host is connected to. This provides more flexibility in dynamic VLANs allowing the hosts to move within the network as opposed to static networks. But configuring the VMPS server that contains the VLAN-to-MAC mapping requires lot of initial work. Due to this overhead network administrators tend to prefer static VLANs.

Max Vlans

Switch Model	Maximum VLANs Supported	VLAN Trunking Supported
Catalyst 2912 XL, Catalyst 2924 XL & Catalyst 2924C XL	64	yes
Catalyst 2900 LRE XL	250	yes
Catalyst 2912M and Catalyst 2924M modular	250	yes
Catalyst 3500 XL & 3550	250	yes

VLANS

- Flat network -- when a broadcast reaches all segments of a network (in a Layer-2 switched network). If a router is present, a broadcast is confined to the originating segment.
- VLANs -- logically grouped switch ports. Without a router, there can be no communication between VLANs.
- VLAN basic features:
- A VLAN can group several broadcast domains into multiple logical subnets.
- Network adds, moves, and changes are achieved by configuring a port into the appropriate VLAN.
- A group of users needing high security can be put into a separate VLAN.
- VLANs can be considered independent from their physical or geographic location.
- Broadcast Control -- broadcast-intensive applications can be placed in a separate VLAN, so they don't put a load on the rest of the network.
- Security -- Administrators have full control over every switch port. In addition, switches can be configured to notify a management station of any unauthorized access.
- Flexibility and Scalability -- Users can be added to a specific VLAN, regardless of their physical location. Also, a VLAN can be split into more VLANs, if necessary.
- VLAN 1 is an administrative VLAN. Cisco recommends you use it for administrative purposes only. So, usable VLANs start from 2.
- Static VLANs -- Each switch port is statically assigned to a particular VLAN, and this relationship never changes. This is how usually VLANs are set up. Monitoring is easy.
- Dynamic VLANs -- All MAC addresses are initially entered into a centralized VLAN management application. Then, when a host is plugged into a switch, VLAN association happens automatically.
- VLAN Management Policy Server (VMPS) -- contains the VMPS database maps, containing MAC addresses and their association with VLANs.
- Types of VLAN links:
- Access links -- Each switch port has a single native VLAN (access link). Whatever machine is connected to this port is unaware of the network design. It can ONLY communicate with machines on the same VLAN.
- Trunk links -- 100Mbps (FastE) or 1000Mbps (GigE). They can carry multiple VLANs (1 to 1005). Switches are "trunked" together via the trunk links. A server can be attached to a trunk link in order to be a direct member of 2 or more VLANs.
- Switch fabric -- a group of switches sharing the same VLAN information.
- Frame tagging -- each frame is assigned a tag, called a "VLAN ID" or a "color". When the frame reaches the destination port, the switch removes this ID, thus making the process transparent to the connected machines.
- VLAN Identification Methods:
- Inter-Switch Link (ISL) -- proprietary to Cisco switches, used for FastE or GigE links only. ISL routing can be used on a switch port, router interfaces, or server interface cards.
- IEEE 802.1q -- a standard method that inserts a field into the frame to identify the VLAN. IEEE 802.1q must be used if you are trunking between a Cisco switch an a different brand of switch.
- LAN emulation (LANE) -- used to communicate multiple VLANs over ATM.
- 802.10 (FDDI) -- proprietary to Cisco devices -- used for sending VLAN information over FDDI.
- 80/20 rule -- 80 percent of the data traffic should stay on the local segment, while 20 percent or less can cross a segmentation device.
- A trunked server can be on multiple VLANs simultaneously, so there is no need for a router to access this server.
- Inter-Switch Link (ISL) Protocol -- provides low-latency, full wire-speed performance, in contrast to FastE, which uses either half- or full-duplex mode:
- When using ISL, the original frame is encapsulated with a new 26-byte ISL header, plus a 4-byte frame check sequence (FCS) field. Only ISL-aware devices can read the frame, which can be as large as 1522 bytes (larger than the max 1518 byte frame on an Ethernet segment).
- ISL NICs are used in trunked servers. This eliminates the need for a router.
- ISL VLAN information is added to a frame only if the frame is forwarded out a port configured as a trunk link. This information is removed when the frame reaches an access link.
- VLAN Trunk Protocol (VTP) -- allows centralized VLAN management. An administrator can add, delete, and rename VLANs. VTP is NOT Cisco proprietary. Features:
- Consistent VLAN configuration across all switches in the network.
- VLANs can be trunked over mixed networks, like Ethernet to ATM LANE or FDDI.
- Accurate tracking and monitoring of VLANs.
- Dynamic reporting of added VLANs to all switches.
- Plug-and-Play VLAN adding.
- A VTP server uses a VTP domain. A switch can only be in one VTP domain. A VTP domain can be used if you have more than one switch. However, if all your switches are using a single VLAN, there is no need for VTP.
- VTP transparent mode -- switches forward VTP information through trunk ports, but do NOT accept information updates, or update their VTP databases.
- Passwords can be set up with VTP to prevent unauthorized adding of switches to a VTP domain, but this can be time-consuming.
- Switches detect VLAN information within a VTP advertisement, and then listen on their trunk ports for additional updates.
- VTP updates include a VLAN ID, 802.10 SAID fields, or LANE information.
- VTP updates are sent out as revision numbers that are the notification plus 1. Anytime a switch sees a higher revision number, it knows the received information is more current, and the switch will overwrite its current database.
- VTP Modes of Operation:
- Server -- default for all Catalyst switches -- the switch can update VTP information and push it to the whole VTP domain. At least one server is needed per VTP domain.
- Client -- receives information from a VTP server. None of the ports on a client switch can be added to a VLAN without information from the VTP server, which notifies the switch of the new VLAN.
! Hint -- if you want a switch to become a server, make it a client first. After it receives all VLAN information, change it to a server.
- Transparent -- switches in transparent mode do not participate in the VTP domain, but they still forward VTP advertisements. They can add and delete VLANs, but those VLANs are unique per switch, they don't propagate in the VTP domain.
- Server and Transparent configuration is saved in NVRAM, while client configuration is not saved in NVRAM.
- VTP Pruning -- only send broadcast, multicast, unicast information to trunk links that absolutely need this information. VTP Pruning preserves bandwidth:
- If switch A does not have any ports configured for VLAN 5, and a broadcast is sent throughout VLAN 5, that broadcast will not pass the trunk port of switch A.
- By enabling pruning on a VTP server, you enable it for the entire domain. By default, VLANs 2-1005 are pruning-eligible. VLAN 1 cannot prune, as it is the administrative VLAN.
- Routing between VLANs -- there are several possibilities:
- A router that has an interface for each VLAN.
- A router that supports ISL routing and has at least a FastE interface -- the least expensive one is the 2600 series. 1600, 1700, and 2500 series do not support ISL routing.
- A Route Switch Module (RSM) for a 5000 series switch. The RSM can support up to 1005 VLANs and runs on the backplane of the switch.
- "Router-on-a-stick" -- Router connecting all Vlans together allowing for inter-vlan communication, using only one router interface.
-all ports on a switch are members of vlan 1, by default' 

What is VLAN -VLAN TUTORIAL FOR BEGINNERS What is VlAN, VLAN fundas, VLAN basics, VLAN for beginners