61
3.5 VLAN
A VLAN is a group of devices that can be located anywhere on a network, but which communicate as if they are on
the same physical segment. With VLANs, User can segment User network without being restricted by physical
connections—a limitation of traditional network design. With VLANs User can segment User network into:
•
Departmental groups
—User could have one VLAN for the marketing department, another for the finance
department, and another for the product development department.
•
Hierarchical groups
—User could have one VLAN for directors, another for managers, and another for general staff.
•
Usage groups
—User could have one VLAN for email users and another for multimedia users.
Benefits of VLANs
The main benefit of VLANs is that they provide a network segmentation system that is far more flexible than
traditional networks. Using VLANs also provides User with three other benefits:
•
VLANs ease the relocation of devices on networks:
With a VLAN setup, if a host originally on the Marketing VLAN,
is moved to a port on another part of the network, and retains its original subnet membership, User only needs to
specify that the new port is on the Marketing VLAN. User does not need to do any re-cabling.
•
VLANs provide extra security:
Devices within each VLAN can only communicate with other devices on the same
VLAN. If a device on the Marketing VLAN needs to communicate with devices on the Finance VLAN, the traffic must
pass through a routing device or Layer 3 switch.
•
VLANs help control traffic:
VLANs increase the efficiency of User network because each VLAN can be set up to
contain only those devices that need to communicate with each other.
This switch also has
private VLAN
functions; it helps to resolve the primary VLAN ID shortage, client ports’ isolation
and network security issues. A private VLAN partitions the Layer 2 broadcast domain of a VLAN into subdomains,
allowing User to isolate the ports on the switch from each other. A subdomain consists of a primary VLAN and one or
more secondary VLANs. All VLANs in a private VLAN domain share the same primary VLAN. The secondary VLAN ID
differentiates one subdomain from another. The secondary VLANs may either be isolated VLANs or community
VLANs. A host on an isolated VLAN can only communicate with the associated promiscuous port in its primary VLAN.
Hosts on community VLANs can communicate among themselves and with their associated promiscuous port but
not with ports in other community VLANs. The Private VLAN provides
primary
and
secondary VLAN
within a single
switch.
TERMS
DESCRIPTION
Primary VLAN
The uplink port is usually the primary VLAN. A primary VLAN contains promiscuous ports
that can communicate with lower Secondary VLANs.
Secondary VLAN
The client ports are usually defined within secondary VLAN. The secondary VLAN includes
Isolated VLAN and Community VLAN. The client ports can be isolated VLANs or can be
grouped in the same Community VLAN. The ports within the same community VLAN can
communicate with each other.
