Vlan: Basic Knowledge of Virtual Lans

This updated guide examines Vlan: Basic Knowledge of Virtual Lans and organizes the essential facts, background, and practical takeaways in clear American English.

VLAN 1

By default, Layer 2 devices will use a default VLAN to put all the ports of that device into. In addition, there are many Layer 2 protocols such as CDP, PAgP, and VTP that need to be sent to a specific VLAN on trunk lines. It is for these purposes that the default VLAN selected is VLAN 1.

CDP, PagP, VTP, and DTP are always transmitted via VLAN 1 and this default cannot be changed. Cisco recommendations indicate that VLAN 1 should only be used for the above protocols.

Default VLAN

VLAN 1 is also called a default VLAN. Therefore, the default, native VLAN, management VLAN and user VLAN will be members of VLAN 1.

All Ethernet interfaces on the Catalyst switch are defaulted to VLAN 1. Devices attached to those interfaces will be members of VLAN 1, unless those interfaces are configured to other VLANs.

User VLANs

Simple Understanding User VLAN is a VLAN created to create a group of users regardless of geographical or logical location and separate from the rest of the original network. The switchport access vlan command is used to assign interfaces to different VLANs.

Native VLAN

A topic that is confusing is Native VLAN. The native VLAN is a VLAN with ports configured to trunk. When a switch port is configured as trunk, in the frame tag passing through that port, an appropriate VLAN number is added. All frames belonging to VLANs passing through the trunk will be tagged with 802.1q and ISL protocols, except for VLAN 1 frames. Thus, by default the frames of VLAN 1 when passing trunk lines will not be tagged.

Native VLAN

A topic that is confusing is Native VLAN. The native VLAN is a VLAN with ports configured to trunk. When a switch port is configured as trunk, in the frame tag passing through that port, an appropriate VLAN number is added. All frames belonging to VLANs passing through the trunk will be tagged with 802.1q and ISL protocols, except for VLAN 1 frames. Thus, by default the frames of VLAN 1 when passing trunk lines will not be tagged.

This capability allows 802.1Q ports to communicate with older ports without understanding 802.1Q by sending and receiving data that is not tagged directly. However, in all other cases, this is detrimental, because the packets related to the native VLAN will lose the tag.

Native VLAN is converted to another VLAN with the command:

Switch (config-if) # switchport trunk native vlan vlan-id

Note: Native VLANs should not be used as user VLANs or management VLANs.

Management VLAN

Today, most devices such as routers and switches can be accessed remotely by telnet to the device's IP address. For devices that allow remote access, we should put in a VLAN, called Management VLAN. This VLAN is independent of other VLANs such as user VLANs, native VLANs. Therefore, when the network has problems such as broadcast storms, STP and convergence, a Management VLAN allows the administrator to still have access to the devices and solve those problems.

Another factor for creating a standalone Management VLAN with VLAN users is the separation of reliable devices with untrusted devices. Thus reducing the ability of other users to gain access to those devices.

Configuring the router

When a router interface is configured in trunk link mode, the frames received from the native VLAN on that interface will not be tagged. And for frames from other VLANs there will be a tag of ISL or 802.1Q.

To configure a router's interface in trunk link mode, we must use the subinterface. Each subinterface will be configured for trunking protocol on each switch, ISL or 802.1Q. We use the following statement:

encapsulation [dot1q |isl] vlan.

When the subinterface wants to receive both native VLAN frames, it must be configured:

encapsulation [dot1q |isl] vlan.native

Note: in previous IOS versions 12.1 (3) T, to configure the native VLAN, you must configure it in the physical interface