Operation of switch for access and trunk ports

[chandra_rc16]

Hi All,

I'm practicing for my CCNA.

I understood that access ports work for only one VLAN whereas trunk ports work for multiple VLANs and switches will read the VLAN tag for the frames on this trunk ports to distinguish them. This is how trunkports/trunking works.

But how the access ports work ? Will they too have/add any VLAN information ?

What type of frame will switches send out on access ports ? Is it normal ethernet frame ?

And also i have a question depending on the below topology.

On switch0 since Fa0/4 is configured to be in VLAN2.. the switch considers all the Ethernet frames from PC1 on its Fa0/4 port as VLAN2 frames..

So on switch0 since Fa0/2 is configured to be in VLAN2... will the switch0 consider all the frames it receives on that Fa0/2 port as VLAN2 frames ?

Regards,

Chandu

[Jon Marshall]

Chandu

But how the access ports work ? Will they too have/add any VLAN information ?

What type of frame will switches send out on access ports ? Is it normal ethernet frame ?

Normal ethernet frames, no vlan ID information is added to the frame.

So on switch0 since Fa0/2 is configured to be in VLAN2... will the switch0 consider all the frames it receives on that Fa0/2 port as VLAN2 frames ?

Yes it will.

Jon

[chandra_rc16]

Thans Jon.

But how the switch will understand to which VLAN a frame belongs to... is there any field inside the ethernet frame that indicates about VLAN?

Regards,

Chandu

[Jon Marshall]

Chandu

It knows because you have allocated the port on which the frame was received into that vlan. The only reason a trunk link has tagged vlans is because the switch would not know which vlan the frame was meant to be in unless there was a vlan ID in the frame header.

Obviously the native vlan on a trunk link is usually an exception to this ie. native vlan frames are not tagged and that is why it is very important to make sure that both ends of the trunk link agree on the native vlan.

Jon

[chandra_rc16]

Thanks again Jon.

So now i made a slight change in my topology. Here is the pic.

I configured the Fa0/2 & Fa0/4 ports on switch1 to be in VLAN3.

Now as per the switch0 whatever the traffic it receives on its Fa0/2 port it will consider at VLAN2 frame, right ?

So if ping PC1(10.0.2.1/24) on switch0 from PC2(10.0.2.2/24) on switch1, it should ping.

As per our previous comments and my  understanding...

Swtich1 will consider the traffic from PC2 as VLAN3 traffic and since it doesn't have PC1's mac it will flood the frame to all the ports on switch1 which are in VLAN3, in our topology the other port in VLAN3 is Fa0/2.. so the frame however reaches fa0/2 and then pass through the link and then it will be received by Fa0/2 port of switch0 and switch0 will consider this frame as VLAN2 frame (since the frame transistion between two switches is only an ethernet frame) and then it will forward the frame to PC1. And this is working fine..

So if two vlans are able to communicate like this, is this not a security problem..

Please don't mind if my question is silly.

Regards,

Chandu

[Jon Marshall · Accepted solution]

Chandu

Correct in what you say but you should never do this on a production network.

Basically you have joined 2 vlans together and that can cause big problems when it comes to STP. You only have 2 switches but production networks have many switches interconnected to each other. STP runs per vlan (PVST+/Rapid PVST+) so by joining them together you can create very unpredicatable and unstable networks.

In addition, it could very well be a secuirty issue because you may not want users in vlan 3 talking to users in vlan 2.

Finally you are using the same IP subnet for 2 different vlans. Again this is rare in production networks and is used only for specific purposes such as transparent firewalls/load balancers etc. Generally speaking the recommendation is to use one IP subnet per vlan. 

Jon

[chandra_rc16]

And finally can i run wireshark in PT. I'm not aware of it.

Please let me know.

REgards,

Chandu

[Jon Marshall]

Chandu

And finally can i run wireshark in PT. I'm not aware of it.

Please let me know.

Sorry, i don't use PT so i have no idea to be honest. There may be a packet capture utility in the software but i couldn't say.

Perhaps post this query as a separate question.

Jon