03-28-2023
10:50 AM
- last edited on
06-22-2023
03:28 AM
by
Translator
Hi all, not sure if this is the best location of the community but here is my question...
Probably a easy or silly one for many but... I would love to find some more clear, simple and qualitative explanation of how Vlans do work.
All the definition and interactions and conditions of all the
Default/Native... Trunk/Access/Tag/Untagged...
difference between (presented as separate settings in many devices) :
-mode trunk/access &
-access mode vlan
-trunking native mode
creating vlans across a network
router>switch>wlan
guest vlans/isolated
and allowing shared devices across
and how better set them across devices that uses different methodologies/naming etc (confusing)...
not expecting anyone spending 1 hour writing infos, but if you have links, documents to ressources that help improve the understanding the implementation of them /issues /conflicts etc would be very welcome.
Thank you so much!
Solved! Go to Solution.
03-28-2023
10:59 AM
- last edited on
06-22-2023
03:32 AM
by
Translator
Some guidance
Trunk / Access / native vlan :
guest vlans/isolated
and allowing shared devices across
you see below good document i was referring all time - when you createing
Guest VLAN
seperate from corporate network :
https://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob30dg/GstSvc1.html
03-28-2023 03:25 PM
"I would love to find some more clear, simple and qualitative explanation of how Vlans do work."
For "how Vlans do work" are you asking about physically or logically? The former can be a bit of an unknown because proprietary techniques can provide the logical. Logical, though, might be explained, in context of what a LAN is/does as a VLAN is a Virtual LAN.
Before getting into Virtual LANs, what's a LAN? Well, LAN stands for local area network, which means a network where everything is "local", or near each other, possibly like a single floor of office building with lots of desks, each with a network node at each.
Consider early Ethernet, 10Base2 and 10Base5, each used a single cable running from node to node, in series. (One reason the network was "local".)
The other aspect of early LANs, all the nodes could directly communicate at L2. Logically, much multiple folk in the same "room" (in the [great] manner @Flavio Miranda described). LAN networks, could, and did, vary in size, but again like Flavio's description, large number of users (nodes) per room (LAN) (and/or how active/busy those people [nodes] are) does impact how well work can be conducted. I.e. number of nodes and/or activity level of nodes, directly impacts how well your network can work. To continue to work well, you often need to limit the number of nodes per LAN, but what do you do if you split your LANs and they still need to intercommunicate? The latter is provided by L3, but for our discussion, we will limit ourselves that a "LAN", is a LAN L2 segment, and not all the LAN L2 segments that might be found at one place.
The last is important. LAN might be used to refer to all the network components near each other, or it might be, and often is, used to refer to a L2 LAN segment. The latter allowing all nodes to intercommunicate, directly, using L2; Flavio's one room structure.
A VLAN is a virtual implementation of a LAN L2 segment. Ever been in a room that has large panels that can subdivide the room? Usually making two rooms where there was one, while, of course, allowing the two smaller rooms be restored to the original larger room?
That's what VLANs provide. They allow us to define multiple L2 segments on a single switch, just as if we might subdivide a room.
Much like subdividing a room, using panels, you loose some of the attributes of having a constructed room wall, but the trade-off in flexibility often makes using VLANs very attractive.
To make the distinction of LANs vs. VLANs, hopefully, clear, let's pretend I have business which has three sets of users, comprising 3 accountants, 5 engineers and 10 doing sales. Users in each group, need to share work across a network. No need, or desire, for anything beyond that. What might be your network design?
Would you perhaps suggest this business LAN (assuming all 18 folks are near each other, "local"), have 3 distinct LAN L2 segments, one for the accountants, one for the engineers and one for sales?
How would you "create" these 3 LAN L2 segments? Maybe a 4 port switch for the accountants; maybe two 4 port switches or one 8 port switch for the engineers; and, for sales, maybe a 4 port and 8 port switch, or two 8 port switches, or one 24 port switch, or some other combination.
All is great until the business hires two more accountants! Now what do we do? Well, we can replace the 4 port switch with an 8 port switch or we might connect another 4 port switch to the existing 4 port switch (BTW, the latter provides us 6 ports, as one port on each switch is used to interconnect them).
VLANs "mimic" real LANs (L2 segments). We might start with a single 24 port VLAN capable switch, and define on it 3 VLANs, one for the accountants, one for the engineers and one for sales, and assign the needed number of ports to each VLAN.
Or if the original switches were VLAN capable, when we need two more accountant ports, we connect the 4 port switch to another VLAN capable switch, with free ports, and assign some of those free ports to our accountants VLAN. I.e. just as we can extend a physical LAN L2 segment with additional switches, we can extend a logical/virtual (VLAN) L2 segment across multiple VLAN switches.
Hopefully, the prior helps you understand VLANs.
BTW, the value of VLANs, to L2 segments, is somewhat like slicing is to bread. ; )
03-30-2023 10:32 AM
Default vlan and native vlan is basically the same thing.
Tagged and untagged depends on who are on the other side. You dont sent tagged traffic to a PC cause it wouldn't understan the tag. Some servers is able to understand tags.
But, if you are transferring traffic from switch 1 to switch 2 and you want this traffic to stay on vlan X, you can use Tag in order to a switch to differentiate the traffic and hand it to the other switch in the proper vlan. This traffic will cross from a switch to another using a trunk which is a tunnel between switches where many others tagged traffic is going on.
The tag on this case works like an address and allow both device to separate the traffic accordingly.
And if you want that some specific traffic dont be tagged you just need to use a native vlan instead and no tags will be added to the traffic even though they are crossing between switches.
To define if the traffic must be tagged or not depends on the devices involved basically.
03-31-2023
03:19 PM
- last edited on
06-22-2023
05:05 AM
by
Translator
1) Normally you would connect the printer to an access port, and in your example, assign the port to VLAN 100. After doing so, L2 traffic between your 4 VLANs should not be able to intermix.
Also normally, for an access port, its frames would all be untagged, but we generally would reference such as "native" and as you've explicitly assigned port to VLAN 100, that's not the default VLAN.
I just fired up a PT 2960 switch, and get (notice already present VLANs, and their names, and port assignments):
Switch>sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/22, Fa0/23, Fa0/24
Gig0/1, Gig0/2
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
2) Again, normally we don't use the term "native" when using an access port, as also by default, it only supports one VLAN. (Most, this century, Cisco Enterprise switches, would also support a "voice VLAN" on an access port, whose frames will have tags.
3) By default, all defined VLANs will pass through a trunk. However, you can explicitly define what VLANs are allowed to use trunk. You can also (i.e. not mutually exclusive with what VLANs are allowed) define, what VLAN untagged frames belong to, i.e. the native VLAN.
4) Again, the whole point of VLANs is to isolate L2 segments. Although a trunk allows us to physically mix different VLANs on the same link, logically they are separate. A properly working VLAN will, as noted in my OP, act as if you had totally different L2 segments.
5) intervlan - please define or reference context of this word.
6) Perhaps the concept of VLANs is still unclear.
If you had VLAN switch A with VLANs 1, 3, 7 trunked to switch B also with VLANs 1 3, 7, physically, logically you have the equivalent of:
Switch A1 <link> Switch B1
Switch A3 <link> Switch B3
Switch A7 <link> Switch B7
No interconnection between LAN segments 1, 3 and 7.
BTW, if you don't have a copy of Cisco's Packet Tracer, suggest you obtain one. The price is great (free) and PT simulates much of Cisco basic router and/or switch capabilities. For example, you can define multiple switches and interconnect them.
03-31-2023 04:49 PM
Here are links to some must-see videos for you.
Default VLAN and Native VLAN at https://youtu.be/zW_-mf6v3fs by Sunny Classroom. Watch also other videos from this channel.
Networking Fundamentals playlist at https://youtube.com/playlist?list=PLIFyRwBY_4bRLmKfP1KnZA6rZbRHtxmXi by Practical Networking.
Selected videos by Keith Barker:
Layer 2 Switching & VLANs at https://www.youtube.com/live/gC2-4ZrKwZE?feature=share
802.1Q Ethernet Trunking at https://www.youtube.com/live/wr0g95w727k?feature=share
Configure Inter-VLAN Routing on Cisco Routers and Switches at https://youtu.be/jg0IECQmUjE
Enjoy
03-28-2023
10:59 AM
- last edited on
06-22-2023
03:32 AM
by
Translator
Some guidance
Trunk / Access / native vlan :
guest vlans/isolated
and allowing shared devices across
you see below good document i was referring all time - when you createing
Guest VLAN
seperate from corporate network :
https://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob30dg/GstSvc1.html
03-28-2023
11:15 AM
- last edited on
06-22-2023
03:34 AM
by
Translator
Hi
Pretty sure you are going to find your answer here. But, look, you mentioned a lot of material here and you basically need to read a book in order to address all this concepts.
I will try to help you with the first question: "I would love to find some more clear, simple and qualitative explanation of how
Vlans
do work."
Here we go. Imagine that you are in a meeting in the office with 1000 more people working around you, all of them are having different meetings and you can barely hear the people you need to hear because there are so much noise made by all this people speaking alltogether.
Then, you have the idea to move to a separated room with the people you are meeting with and suddly you realize that you can hear them now just fine because the walls of this room is filtering the noise.
That´s what Vlan is.
03-28-2023 03:25 PM
"I would love to find some more clear, simple and qualitative explanation of how Vlans do work."
For "how Vlans do work" are you asking about physically or logically? The former can be a bit of an unknown because proprietary techniques can provide the logical. Logical, though, might be explained, in context of what a LAN is/does as a VLAN is a Virtual LAN.
Before getting into Virtual LANs, what's a LAN? Well, LAN stands for local area network, which means a network where everything is "local", or near each other, possibly like a single floor of office building with lots of desks, each with a network node at each.
Consider early Ethernet, 10Base2 and 10Base5, each used a single cable running from node to node, in series. (One reason the network was "local".)
The other aspect of early LANs, all the nodes could directly communicate at L2. Logically, much multiple folk in the same "room" (in the [great] manner @Flavio Miranda described). LAN networks, could, and did, vary in size, but again like Flavio's description, large number of users (nodes) per room (LAN) (and/or how active/busy those people [nodes] are) does impact how well work can be conducted. I.e. number of nodes and/or activity level of nodes, directly impacts how well your network can work. To continue to work well, you often need to limit the number of nodes per LAN, but what do you do if you split your LANs and they still need to intercommunicate? The latter is provided by L3, but for our discussion, we will limit ourselves that a "LAN", is a LAN L2 segment, and not all the LAN L2 segments that might be found at one place.
The last is important. LAN might be used to refer to all the network components near each other, or it might be, and often is, used to refer to a L2 LAN segment. The latter allowing all nodes to intercommunicate, directly, using L2; Flavio's one room structure.
A VLAN is a virtual implementation of a LAN L2 segment. Ever been in a room that has large panels that can subdivide the room? Usually making two rooms where there was one, while, of course, allowing the two smaller rooms be restored to the original larger room?
That's what VLANs provide. They allow us to define multiple L2 segments on a single switch, just as if we might subdivide a room.
Much like subdividing a room, using panels, you loose some of the attributes of having a constructed room wall, but the trade-off in flexibility often makes using VLANs very attractive.
To make the distinction of LANs vs. VLANs, hopefully, clear, let's pretend I have business which has three sets of users, comprising 3 accountants, 5 engineers and 10 doing sales. Users in each group, need to share work across a network. No need, or desire, for anything beyond that. What might be your network design?
Would you perhaps suggest this business LAN (assuming all 18 folks are near each other, "local"), have 3 distinct LAN L2 segments, one for the accountants, one for the engineers and one for sales?
How would you "create" these 3 LAN L2 segments? Maybe a 4 port switch for the accountants; maybe two 4 port switches or one 8 port switch for the engineers; and, for sales, maybe a 4 port and 8 port switch, or two 8 port switches, or one 24 port switch, or some other combination.
All is great until the business hires two more accountants! Now what do we do? Well, we can replace the 4 port switch with an 8 port switch or we might connect another 4 port switch to the existing 4 port switch (BTW, the latter provides us 6 ports, as one port on each switch is used to interconnect them).
VLANs "mimic" real LANs (L2 segments). We might start with a single 24 port VLAN capable switch, and define on it 3 VLANs, one for the accountants, one for the engineers and one for sales, and assign the needed number of ports to each VLAN.
Or if the original switches were VLAN capable, when we need two more accountant ports, we connect the 4 port switch to another VLAN capable switch, with free ports, and assign some of those free ports to our accountants VLAN. I.e. just as we can extend a physical LAN L2 segment with additional switches, we can extend a logical/virtual (VLAN) L2 segment across multiple VLAN switches.
Hopefully, the prior helps you understand VLANs.
BTW, the value of VLANs, to L2 segments, is somewhat like slicing is to bread. ; )
03-30-2023 07:38 AM
WOW, THANK YOU SO MUCH @Joseph W. Doherty @Flavio Miranda @balaji.bandi FOR TAKING THE TIME TO GE THROUGH THIS. Helps having a better view of it.
Now what I still make confusion on sometimes (especially when using different vendors)
is all the words/settings when actually applying it to the configuration...
I get trunk and acess I think.
But then... what is the Native Vlan.... and vs the Default Vlan?
What should you allow on the Default and what instead should go via the Native one?
And tagged/untagged?
And when some vendor use like on Unifi the definition "ALL" what it stands for on a Cisco? Like all tagged? or all untagged? and is still a native one within it?
I get some of the points, but mainly trying to get some new fresh explanations above that helps in practical understand all the implications/interactions.
Thanks so much again!
03-30-2023 10:32 AM
Default vlan and native vlan is basically the same thing.
Tagged and untagged depends on who are on the other side. You dont sent tagged traffic to a PC cause it wouldn't understan the tag. Some servers is able to understand tags.
But, if you are transferring traffic from switch 1 to switch 2 and you want this traffic to stay on vlan X, you can use Tag in order to a switch to differentiate the traffic and hand it to the other switch in the proper vlan. This traffic will cross from a switch to another using a trunk which is a tunnel between switches where many others tagged traffic is going on.
The tag on this case works like an address and allow both device to separate the traffic accordingly.
And if you want that some specific traffic dont be tagged you just need to use a native vlan instead and no tags will be added to the traffic even though they are crossing between switches.
To define if the traffic must be tagged or not depends on the devices involved basically.
04-02-2023 09:26 AM
"Default vlan and native vlan is basically the same thing."
BTW, not exactly, but it can be easy to confuse the two as on a trunk, the default native VLAN is VLAN 1 and on an access port, the default VLAN is also VLAN 1. Where the two differ, also by default, an access port has just one VLAN membership, which, again by default, is VLAN 1. By default, a trunk permits ALL VLANs, it doesn't have a default VLAN, but also again, the default NATIVE VLAN will be VLAN 1. In other words, a default VLAN (access port VLAN membership) isn't the same thing as the default native VLAN (trunk port untagged frames), although, also again, both use VLAN 1 by default.
To make this distinction, hopefully, more clear, say on an access port you set it to VLAN 5, and on a trunk port you set the native VLAN to VLAN 5. On the access port, you cannot (as far as I know) not allow VLAN 5, but on a trunk port, you can disallow VLAN 5 to use it (same as you can do with all the other tagged VLANs).
04-02-2023
04:16 PM
- last edited on
06-07-2023
02:42 AM
by
Translator
One last factoid, concerning Cisco switches.
Cisco switches (the more advanced variants) often send other L2
control
frames out ports (what's sent by default, depends on port
kind [access, trunk, routed]
, and can be often be further modified by port configuration [CDP on by default for most ports {can be enabled for some others where, by default, it's off, like some tunnel ports}, DTP on by default for trunk ports, etc.]), which are often considered part of VLAN 1, but most control frames are usually
link-local
, i.e. they don't propagate to other VLAN 1 ports, as data
frames would. (NB: VTP [just v1/2?], if not "off", by default [I believe], does "transfer" across trunks, even when VLAN 1 "disallowed".) Further, on trunks, disallowing VLAN 1 generally doesn't stop their transmission or reception of control frames.
BTW, this is often why Cisco security recommendations often address how best to use "VLAN 1"; because of control frames usage
I mention the above, because when you get into Cisco VLANs, and trunks, VLAN 1 is a "special case".
03-31-2023 02:52 PM
"But then... what is the Native Vlan.... and vs the Default Vlan?"
Default VLAN is what an access port uses when you don't explicitly assign a VLAN to the port, for Cisco, it's VLAN 1.
Native VLAN, is on a Cisco trunk, what VLAN is used for frames without VLAN tags; it too defaults to VLAN 1.
BTW, other vendor "trunk" ports, might expect all frames to be VLAN tagged.
03-30-2023
02:19 PM
- last edited on
06-22-2023
03:42 AM
by
Translator
Thanks
As an exemple:
I have 4 Vlans
1- is the default
2-is the MANAGEMENT one, lets call it 100
3-is the STAFF one, lets call it 200
4-is the SYSTEMS one, lets call it 300
questions:
1) If I have a printer on 100, and want to have it reacheable across all the other then I need to make the port of the printer a TRUNK and tag networks 200 and 300.
Native network in this case is the 100 or Default?
2) I want the Chromecast to be only available to STAFF 200, so I make the port ACCESS and tagging only network/vlan 200? what is the native vlan?
3) I want a port to be the uplink between another switch or else, and want all the traffic of all networks/vlans to go through , so I set the port as Trunk and
dont tag any vlans so it is Untagged and all vlans/networks and untagged traffic will pass?
or tag all the vlans that I want to go through but any untagged traffic then will not pass?
which one is the native vlan?
4) I have an Aplle TV on 200 and want it to be reachable on 200 and 300 only. So I need to make the port TRUNK and tag only 300 to it.
Is the Native Vlan the 200 or Default?
5) how does this interact with intervlan? Do I need to have Intervlan active to do the above or is an extra option for sharing devices across vlans?
6) how does
Vlans/Trunk/Access
Native etc are affected or affect services such as Bonjour/Airplay/Multicast. Does it need to be applied to every single port or Vlans or just generally active for that specific switch we are configuring for exemple?
Thank you so much for your time guys and help although it might seem to you very basic questions.
Thanks and enjoy the weekend.
03-31-2023
03:19 PM
- last edited on
06-22-2023
05:05 AM
by
Translator
1) Normally you would connect the printer to an access port, and in your example, assign the port to VLAN 100. After doing so, L2 traffic between your 4 VLANs should not be able to intermix.
Also normally, for an access port, its frames would all be untagged, but we generally would reference such as "native" and as you've explicitly assigned port to VLAN 100, that's not the default VLAN.
I just fired up a PT 2960 switch, and get (notice already present VLANs, and their names, and port assignments):
Switch>sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11, Fa0/12
Fa0/13, Fa0/14, Fa0/15, Fa0/16
Fa0/17, Fa0/18, Fa0/19, Fa0/20
Fa0/21, Fa0/22, Fa0/23, Fa0/24
Gig0/1, Gig0/2
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
2) Again, normally we don't use the term "native" when using an access port, as also by default, it only supports one VLAN. (Most, this century, Cisco Enterprise switches, would also support a "voice VLAN" on an access port, whose frames will have tags.
3) By default, all defined VLANs will pass through a trunk. However, you can explicitly define what VLANs are allowed to use trunk. You can also (i.e. not mutually exclusive with what VLANs are allowed) define, what VLAN untagged frames belong to, i.e. the native VLAN.
4) Again, the whole point of VLANs is to isolate L2 segments. Although a trunk allows us to physically mix different VLANs on the same link, logically they are separate. A properly working VLAN will, as noted in my OP, act as if you had totally different L2 segments.
5) intervlan - please define or reference context of this word.
6) Perhaps the concept of VLANs is still unclear.
If you had VLAN switch A with VLANs 1, 3, 7 trunked to switch B also with VLANs 1 3, 7, physically, logically you have the equivalent of:
Switch A1 <link> Switch B1
Switch A3 <link> Switch B3
Switch A7 <link> Switch B7
No interconnection between LAN segments 1, 3 and 7.
BTW, if you don't have a copy of Cisco's Packet Tracer, suggest you obtain one. The price is great (free) and PT simulates much of Cisco basic router and/or switch capabilities. For example, you can define multiple switches and interconnect them.
03-31-2023 04:49 PM
Here are links to some must-see videos for you.
Default VLAN and Native VLAN at https://youtu.be/zW_-mf6v3fs by Sunny Classroom. Watch also other videos from this channel.
Networking Fundamentals playlist at https://youtube.com/playlist?list=PLIFyRwBY_4bRLmKfP1KnZA6rZbRHtxmXi by Practical Networking.
Selected videos by Keith Barker:
Layer 2 Switching & VLANs at https://www.youtube.com/live/gC2-4ZrKwZE?feature=share
802.1Q Ethernet Trunking at https://www.youtube.com/live/wr0g95w727k?feature=share
Configure Inter-VLAN Routing on Cisco Routers and Switches at https://youtu.be/jg0IECQmUjE
Enjoy
04-12-2023 02:47 PM
thanks to all again, going through all the documentation, and making the best of it! let's see what question I will come out with next
thank you @Joseph W. Doherty @KJK99 @Flavio Miranda @balaji.bandi
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide