Day 16: VLANs Part 1

1. A LAN is defined as a single broadcast domain, including all devices within that broadcast domain. This is more specific than simply saying it's a group of devices in a single location.

2. A broadcast domain is the group of devices that will receive a broadcast frame sent by any one of its members. When a device sends a frame with the destination MAC address FFFF.FFFF.FFFF, all devices in that broadcast domain will receive it.

3. Routers do not forward broadcast frames, which means routers separate broadcast domains. Each router interface creates a boundary for a broadcast domain.

4. Switches flood broadcast frames out all interfaces except the one it was received on. This means switches do not separate broadcast domains by default.

5. VLANs are used to logically separate end hosts at Layer 2, creating multiple broadcast domains on a single switch. This eliminates the need to purchase separate physical switches for each department or group.

6. VLANs are configured on switch interfaces, not on the end hosts themselves. The end host connected to a switch interface becomes part of whatever VLAN that interface is assigned to.

7. Switches will not forward traffic between VLANs, including broadcast and unknown unicast traffic. Traffic must pass through a router to travel between VLANs, which is called inter-VLAN routing.

8. An access port is a switchport that belongs to a single VLAN and typically connects to end hosts like PCs. Access ports give end hosts access to the network.

1. Forgetting that switches are Layer 2 devices - Switches don't look at IP addresses; they only see MAC addresses. Even if you configure different subnets, the switch doesn't know or care.

2. Confusing subnet separation with VLAN separation - Putting devices in different subnets does NOT prevent Layer 2 broadcast flooding. You need VLANs for Layer 2 separation.

3. Forgetting default VLANs - When asked how many VLANs exist after creating X VLANs, remember to add the 5 default VLANs (1, 1002, 1003, 1004, 1005).

4. Router interface counting for broadcast domains - Each router interface is part of a separate broadcast domain. A point-to-point link between two routers is still a broadcast domain.

5. Thinking switches forward between VLANs - Switches NEVER forward traffic directly between VLANs. A router is required.

6. Forgetting VLAN auto-creation - Assigning an interface to a non-existent VLAN creates that VLAN automatically.

• "Routers Route, Switches Switch (within VLAN)" - Routers separate broadcast domains; switches extend them unless VLANs are configured.

• "5 + X = Total VLANs" - 5 default VLANs plus any you create equals total VLANs.

• "All Fs = All Friends" - FFFF.FFFF.FFFF goes to all devices (broadcast).

• "Layer 2 = VLAN, Layer 3 = Subnet" - VLANs separate at Layer 2, subnets at Layer 3. You need BOTH for proper segmentation.

• "Access = One, Trunk = Many" - Access ports carry one VLAN, trunk ports carry multiple.

Scenario: A network has 2 routers connected to each other, each router has 2 switches connected, no VLANs configured.

Calculation:

• Router 1 to Switch 1 = 1 broadcast domain

• Router 1 to Switch 2 = 1 broadcast domain

• Router 1 to Router 2 = 1 broadcast domain

• Router 2 to Switch 3 = 1 broadcast domain

• Router 2 to Switch 4 = 1 broadcast domain

• Total = 5 broadcast domains

Scenario: Configure interfaces G1/0-G1/3 for Engineering (VLAN 10)

SW1(config)# interface range g1/0 - 3

SW1(config-if-range)# switchport mode access

SW1(config-if-range)# switchport access vlan 10

VLAN Configuration Commands

Switch> enable

Switch# configure terminal

Switch(config)# no vlan <vlan_id>

Switch(config)# exit

Switch# write memory (or copy running-config startup-config)

Example: no vlan 10 to remove VLAN 10. 

Method 2: Delete All VLANs (Factory Reset for VLANs)

Switch> enable

Switch# delete flash:vlan.dat

Delete filename [vlan.dat]? (Press Enter to confirm)

Delete flash:/vlan.dat? [confirm] (Press Enter to confirm)

Switch# reload

Note: This command deletes the vlan.dat file, which stores all VLAN info, effectively removing all configured VLANs and port assignments, requiring a reload. 

The group of devices which will receive a broadcast frame (destination MAC FFFF.FFFF.FFFF) sent by any one of its members.

FFFF.FFFF.FFFF

It floods the frame out all interfaces EXCEPT the interface it was received on.

It does NOT forward it. The router receives the frame but doesn't send it to other networks.

Virtual LAN - A method to logically divide a Layer 2 broadcast domain into multiple separate broadcast domains on a single switch.

1) Improve network performance (reduce unnecessary broadcast traffic)

2) Improve network security (limit who receives broadcast/unknown unicast traffic)

VLANs are configured on switch interfaces. The end host connected to that interface becomes part of that VLAN.

VLAN 1 - All interfaces are assigned to VLAN 1 by default.

VLAN 1, 1002, 1003, 1004, and 1005 (5 VLANs total)

FDDI and Token Ring (legacy technologies, not needed for CCNA)

A switchport that belongs to a single VLAN and usually connects to end hosts like PCs.

A switchport that carries traffic for multiple VLANs.

The switch automatically creates the VLAN.

The process of routing traffic between different VLANs using a router (switches cannot forward traffic directly between VLANs).

No, NEVER. Traffic must go through a router for inter-VLAN routing.

show vlan brief

switchport mode access

switchport access vlan 10

vlan 10

name ENGINEERING

Use the interface range command. Example: interface range g1/0 - 3

8 VLANs (5 default + 3 created)

Because switches are Layer 2 devices - they only look at MAC addresses, not IP addresses. Subnets are Layer 3.

Layer 2 (Data Link Layer)

Only devices in VLAN 10 (the switch floods the broadcast only to interfaces in the same VLAN).

1 broadcast domain (all devices connected to the switch plus the router's interface)

Yes, even a point-to-point connection with only two devices is technically a broadcast domain.

It's best practice to explicitly configure settings rather than rely on autonegotiation of port type.

"% Access VLAN does not exist. Creating vlan [number]."

By limiting broadcast and unknown unicast traffic to only devices within the same VLAN, preventing unauthorized devices from receiving sensitive network traffic.