The following figure shows how layer 2 switched networks are typically designed as flat networks. With this configuration, every broadcast packet transmitted is seen by every device on the network regardless of whether the device needs to receive that data or not.
By default, routers allow broadcasts to occur only within the originating network, while switches forward broadcast to all segments. Oh, and by the way, the reason it’s called a flat network is that it’s one broadcast domain, not because the actual design is physically flat.
In the following picture, we see Host A sends out a broadcast and all ports on all switches forwarding it all except the port that originally received it.
Now check out another picture below. It pictures a switched network and shows Host A sends a frame with Host D as its destination. What’s more important is that, as you can see, that frame is only forwarded out the port where Host D is located. This is a huge improvement over the old hub networks unless having one collision domain by default is what you really want. (probably not!)
Now you already know that the largest benefit you gain by having a layer 2 switched network is that it creates individual collision domain segments for each device plugged into each port on the switch. This scenario frees us from the Ethernet distance constraints, so now larger networks can be built. But often, each new advance comes with new issues. For instance, the larger the number of users and devices, the more broadcasts and packets each switch must handle.
And here’s another issue: security! This one’s real trouble because within the typical layer 2 switched internetwork, all users can see all devices by default. And you can’t stop devices from broadcasting, plus you can’t stop users from trying to respond to broadcasts. This means your security options are dismally limited to placing passwords on your servers and other devices.
But wait there’s hope! That is if you create a virtual LAN (VLAN). You can solve many of the problems associated with layer 2 switching with VLANs, as you’ll soon see. Here’s a shortlist of ways VLANs simplify network management:
- The network adds moves, and changes are achieved with ease by just configuring a port into the appropriate VLAN.
- A group of users that need an unusually high level of security can be put into its own VLAN so that users outside of the VLAN can’t communicate with them.
- As a logical grouping of users by function, VLANs can be considered independent from their physical or geographical locations.
- VLANs greatly enhance network security.
- VLANs increase the number of broadcast domains while decreasing their size.
Coming up, I’m going to tell you all about switching characteristics and thoroughly describe how switches provide us with better network services than hubs can in our networks today.
Broadcasts occur in every protocol, but how often they occur depends upon three things:
- The type of protocol
- The applications running on the internetwork
- How these services are used
Some older applications have been rewritten to reduce their bandwidth appetites, but there’s a new generation of applications that are incredibly bandwidth greedy that will consume any and all they can find. These bandwidth gluttons are multimedia applications that use both broadcasts and multicasts extensively. And faulty equipment, inadequate segmentation, and poorly designed firewalls seriously compound the problems that these broadcast intensive applications create. All of these have added a major new dimension to network design and present a bunch of new challenges for an administrator. Positively making sure your network is properly segmented so you can quickly isolate a single segment’s problems to prevent them from propagating throughout your entire internetwork is imperative! And the most effective way to do that is through strategic switching and routing.
Since switches have become more affordable lately, a lot of companies are replacing their flat hub networks with pure switched network and VLAN environments. All devices within a VLAN are members of the same broadcast domain and receive all broadcasts. By default, these broadcasts are filtered from all ports on a switch that aren’t members of the same VLAN. This is great because you get all the benefits you would with a switched design without getting hit with all the problems you’d have if all your users were in the same broadcast domain sweet!
Okay, I know. There’s always a catch, though, right? Time to get back to those security issues. A flat internetwork’s security used to be tackled by connecting hubs and switches together with routers. So it was basically the router’s job to maintain security. This arrangement was pretty ineffective for several reasons. First, anyone connecting to the physical network could access the network resources located on that particular physical LAN. Second, all anyone had to do to observe any and all traffic happening in that network was to simply plug a network analyzer into the hub. And similar to that last ugly fact, users could join a workgroup by just plugging their workstations into the existing hub. That’s about as secure as an open barrel of honey in a bear enclosure!
But that’s exactly what makes VLANs so cool. If you build them and create multiple broadcast groups, you have total control over each port and user! So the days when anyone could just plug their workstations into any switch port and gain access to network resources are history because now you get to control each port, plus whatever resources that port can access. What’s more, with the new 2960/3560 switches, this actually happens automatically! And it doesn’t end there my friends, because VLANs can be created in accordance with the network resources a given user requires, plus switches can be configured to inform network management stations of any unauthorized access to network resources. And if you need inter VLAN communication, you can implement restrictions on a router to make that happen. You can also place restrictions on hardware addresses, protocols, and applications. Now we’re talking security the honey barrel is now sealed, shrouded in razor wire, and made of solid titanium!
Flexibility and Scalability
If you were paying attention to what you’ve read so far, you know that layer 2 switches only read frames for filtering they don’t look at the Network-Layer Protocol. And by default, switches forward all broadcasts. But if you create and implement VLANs, you’re essentially creating smaller broadcast domains at layer 2.
What this means is that broadcasts sent out from a node in one VLAN won’t be forwarded to ports configured to belong to a different VLAN. So by assigning switch ports or users to VLAN groups on a switch or group of connected switches, you gain the flexibility to add only the users you want into that broadcast domain regardless of their physical location. This setup can also work to block broadcast storms caused by a faulty network interface card NIC as well as prevent an intermediate device from propagating broadcast storms throughout the entire internetwork. Those evils can still happen on the VLAN where the problem originated, but the disease will instead be quarantined to that one ailing VLAN.
Another advantage is that when a VLAN gets too big, you can create more VLANs to keep the broadcasts from consuming too much bandwidth the fewer users in a VLAN, the fewer users affected by broadcasts. This is all well and good, but you seriously need to keep network services in mind and understand how the users connect to these services when you create your VLAN. It’s a good move to try to keep all services, except for the email and internet access that everyone needs, local to all users whenever possible.
To understand how a VLAN looks to a switch, it’s helpful to begin by first looking at a traditional network. The following figure shows how a network was created by using hubs to connect physical LANs to a router.
Here you can see that each network is attached with a hub port to the router (each segment also has its own logical network number even though this isn’t obvious looking at the picture). Each node attached to a particular physical network has to match that network’s number in order to be able to communicate on the internetwork. Notice that each department has its own LAN, so if you needed to add new users, let’s say, sales, you would just plug them into the sales LAN and they would automatically be part of the sales collision and broadcast domain. This design really did work well for many years.
But there was one major flaw: what happens if the hub for Sales is full and we need to add another user to the Sales LAN? Or, what do we do if there’s no more physical space where the sales term is located for this new employee? Well, let’s say there just happens to be plenty of room in the Finance section of the building. That new Sales team member will just have to sit on the same side of the building as the Finance people, and we’ll just plug the poor soul into the hub for finance.
Doing this obviously makes the new user part of the finance LAN, which is very bad for many reasons. First and foremost, we now have a major security issue. Because the new sales employee is a member of the finance broadcast domain, the newbie can see all the same servers and access all network services that the finance folks can. Second, for this user to access the sales network services they need to get their job done, they would have to go through the router to log in to the sales server not exactly efficient!
Now let’s look at what a switch accomplishes for us. The following figure demonstrates how switches come to the rescue by removing the physical boundary to solve our problem. It also shows how six VLANs (numbered 2 through 7) are used to create a broadcast domain for each department. Each switch port is then administratively assigned a VLAN membership, depending on the host and which broadcast domain it’s placed in.
So now, if we needed to add another user to the sale VLAN (VLAN 7), we could just assign the port to the VLAN 7 regardless of where the new sales team member is physically located nice! This illustrates one of the sweetest advantages of designing your network with VLANs over the old collapsed backbone design. Now, clearly and simply, each host that needs to be in the sales VLAN is merely assigned to VLAN7. And by using the new switches with the predefined macros, we can just use CAN and smartports to configure the port to be a Desktop connection and voila! The port configuration is simply completed for us.
Notice that I started assigning VLANs with VLAN number 2. The number is irreverent, but you might be wondering what happened to VLAN1? Well, that VLAN is administrative VLAN, and even though it can be used for a workgroup, Cisco recommends that you use it for administrative purposes only. You can’t delete or change the name of VLAN1, and by default, all ports on a switch are members of VLAN 1 until you change them.
Since each VLAN is considered a broadcast domain, it’s got to also have its own subnet number (refer again to the above picture). And if you’re also using IPv6, then each VLAN must also be assigned its own IPv6 network number. So you don’t get confused, just keep thinking of VLANs as separate subnets or networks.
Now let’s get back to that “because of switches, we don’t need routers anymore” misconception. Looking at the above picture, notice that there are seven VLANs, or broadcast domains, counting VLAN 1. The nodes within each VLAN can communicate with each other but not with anything in a different VLAN because the nodes in any given VLAN “think” that they’re actually in a collapsed backbone as illustrated in the previous picture.
So what handy little tool do we need to enable the hosts in the above model to communicate to a node or host on a different VLAN? You guessed is a router! Those nodes positively need to go through a router, or some other Layer 3 device, just as when they’re configured for internetwork communication. It works the same way it would if we were trying to connect different physical networks. Communication between VLANs must go through a Layer 3 device. So don’t expect mass router extinction any time soon!