Unit 5. Switches and VLANs [PDF]

More documents

Recommendations

Info

Introduction This unit outlines the importance of network switches, especially as the improve network security, and also allow for faster communications than traditional connection devices, such as hubs. A switch enhances the security of a network as it allows for a direct connection between two devices, where no other devices on the switch can listen to the connection. They also enhance security as a switch can be programmed to create a virtual LAN (vLAN), where nodes which connect to one vLAN can be isolated from other vLANs. Thus a device may connect to the same network switch, but connect to a different network than other devices which also connect to the same switch. A vLAN can span access one or more switches, which aids the configuration of the network. vLANs vLANs are a new technology, which uses software to define a broadcast domain, rather than any physical connections. In a vLAN a message transmitted by one node is only received by other nodes with a certain criteria to be in the domain. It is made by logically grouping two or more nodes and a vLAN-initialized switching device, such as intelligent switches (which use the MAC address to forward data frames) or routers (which use the network address to route data packets). The important concept with vLANs is that the domain is defined by software, and not by physical connections. There are two methods that can define the logical grouping of nodes within a vLAN: • Implicit tagging. This uses a special tagging field which is inserted into the data frames or within data packets. It can be based upon the MAC address, a switch port number, protocol, or another parameter by which nodes can be logically grouped. The main problem with implicit tagging is that different vendors create different tags which make vendor interoperability difficult. This is known as frame filtering. • Explicit tagging. This uses an additional field in the data frame or packet header. This can also lead to incompatibility problems, as different vendor equipment may not be able to read or process the additional field. This is known as frame identification. It is thus difficult to create truly compatible vLANs until standards for implicit and explicit tags are standardized. One example of creating a vLAN is to map ports of a switch to create two or more virtual LANs. For example, a switch could connect to two servers and 16 clients. The switch could be configured so that eight of the clients connected to one server through a vLAN, and the other eight onto the other server. This setup is configured in software, and not by the physical connection of the network. Figure 4 shows a possible implementation where nodes 1 to 8 create a vLAN through the switch with SERVER1, and nodes 9 to 16 create a vLAN with SERVER2. The switch would map ports to create the vLANs, where the two networks are now independent broadcast domains (network segments), and will only receive the broadcasts from each of their virtual LANs. Normally a switch would connect any one of its ports to another port, and allow simultaneous connection. In this case, the switch allows for multiple connections onto a segment. Now, with the vLAN, data frames transmitted on one network segment will stay within that segment and are not transmitted to the other vLAN. 82 Computer Networks – CO33006
Figure 1 Creating a vLAN by mapping ports of a switch SERVER1 SERVER2 Switch (creates a vLAN for for the two networks) vLAN1 vLAN2 1 8 9 16 Advantages of vLANs The main advantages of using vLAN are: • Creation of virtual networks. Just as many organizations build open-plan offices which can be changed when required, vLANs can be used to reconfigure the logical connections to a network without actually having to physically move any of the resources. This is especially useful in creating workgroups where users share the same resources, such as databases and disk storage. • Ease of administration. vLANs allow networks to be easily configured, possibly at a distance from the configured networks. In the past reconfiguration has meant recabling and the movement of networked resources. With vLANs the resources can be configured with software to setup the required network connections. • Improved bandwidth usage. Normally users who work in a similar area share resources. This is typically known as a workgroup. If workgroups can be isolated from other workgroups then traffic which stays within each of the workgroups does not affect other workgroups. A vLAN utilizes this concept by grouping users who share information and configuring the networked resources around them. This makes much better usage of bandwidth than workgroup users who span network segments. The amount of broadcast traffic on the whole network is also reduced, as broadcasts can be isolated within each of the workgroups. A typical drain on network bandwidth is when network servers broadcast their services at regular intervals (in Novell NetWare this can be once every minute, and is known as the Service Advertising Protocol). With vLANs these broadcasts would be contained within each of the vLANs that the server is connected to. • Microsegmentation. This involves dividing a network into smaller segments, which will increase the overall bandwidth available to networked devices. • Enhanced security. vLANs help to isolate network traffic so that traffic which stays within a vLAN will not be transmitted outside it. Thus it is difficult for an external Unit 5: Switches and VLANs 83
Page 1: Aims The aims of this unit are to:
Page 5 and 6: VLAN broadcasts vLANs rely on broad
Page 7 and 8: to the vLAN. Node A can then commun
Page 9 and 10: 1 Go into the privileged mode by ty
Page 11 and 12: 2 Determine the commands that can b
Page 13 and 14: What are the messages shown Enablin
Page 15 and 16: myhost# config t myhost(config)# in

Unit 5. Switches and VLANs [PDF]

Create successful ePaper yourself

Delete template?

Save as template?