Keeping groups apart on one switch (VLANs)

A college library has one switch in a cupboard. Students' laptops plug into it. So do the security cameras and the librarian's till.

Right now, any laptop can reach the cameras. Nobody wants that. Buying a second switch costs money and takes space.

There is a way to split one switch into separate groups.

A switch passes traffic from one port to another. A broadcast goes out of every port, so every device hears it.

Devices use broadcasts to find each other. So anything plugged into the same switch can find everything else, even when their addresses are in different networks.

vlanlab status

sudo ip netns exec h20 arping -c 2 -I eth0 10.10.0.100

The status shows h10 and srv in 10.10.0.0/24, and h20 in 10.20.0.0/24. They are different networks.

Yet arping from h20 gets two replies from srv, Unicast reply from 10.10.0.100. The broadcast crossed the switch to every port. h20 and srv are in one group, whatever their addresses say.

You give each port a VLAN number. The switch then only passes traffic between ports with the same number. A broadcast stays inside its own VLAN.

A port for one device is an access port in one VLAN. A trunk port carries several VLANs on one cable, such as the cable to a router. On a trunk, each piece of traffic carries a tag with its VLAN number.

sudo ip netns exec sw bridge vlan show

The table has five lines: one for the switch itself, br0, and one for each of the four ports.

Every line says 1 PVID Egress Untagged. PVID 1 means traffic arriving with no tag joins VLAN 1. Egress Untagged means it leaves with no tag. So all four ports share VLAN 1, which is why the arping worked.

Sometimes two VLANs do need to talk, for example so a laptop can use the till's printer. A switch will never do it.

Each device sends traffic for another network to its default gateway, which is a router. The router has an address in each VLAN and passes traffic between them. Its rules can then allow some traffic and block the rest.

sudo ip netns exec h10 ip route

sudo ip netns exec h10 ping -c 2 -W 1 10.20.0.11

sudo ip netns exec r1 ip -br addr show dev eth0

h10's first route says default via 10.10.0.1. Anything for another network goes to 10.10.0.1.

The ping ends with 100% packet loss. The router's cable has only an address starting fe80::, which every cable gets by itself. It has no 10.10.0.1, so nobody takes h10's traffic for VLAN 20 or anywhere else.

The library adds a VLAN for staff laptops, VLAN 50, on ports 6 and 7.

Add them to the port list in your assignment as "port6 50" and "port7 50". Use members to list each VLAN. Then write down which pairs of ports can talk directly, and which would need the router.