What you will do
On a plain switch every computer hears every other one. A VLAN divides one switch into separate networks, so the accounts office and the visitors cannot see each other, and a router is what lets them talk when you allow it. You will look around a small network and see what is there before any VLAN. You will not build it: that is the lab's own task.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, with a small network built inside it, so it takes a little longer to come up than a container. Each Run button below types its command into the machine's terminal, one after another. If one says the machine is still starting, wait a few seconds and press it again. To watch them, or to type your own, press Open terminal on the bar.
1. Meet the machines
Everything here is built inside your one Ubuntu machine: the switch sw, the router r1 and the computers h10, h20 and srv are each a separate network namespace. vlanlab status lists them. h10 and srv have addresses starting 10.10.0, and h20 has 10.20.0, so they are meant for two networks. At the end is the switch's VLAN table: every port, p-h10 to p-r1, is in VLAN 1 and nothing else. The router has no address at all yet.
vlanlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
2. Are they really apart?
arping asks "who has this address?" straight across the switch, with no router to help. h20 is meant to be on a different network from srv, yet srv answers both times, with its own hardware address. With every port in VLAN 1 the switch passes everything everywhere. That is what the lab changes.
sudo ip netns exec h20 arping -c 2 -I eth0 10.10.0.100Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
3. Ask for the other network
Now h10 asks for h20, 10.20.0.11, which is on a different network. The packet goes to h10's gateway, 10.10.0.1, and nothing answers: no machine has that address yet. The ping prints 2 packets transmitted, 0 received, 100% packet loss.
sudo ip netns exec h10 ping -c 2 -W 1 10.20.0.11Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
4. Look at the router's one cable
A router on a stick reaches both VLANs over one cable to the switch, here eth0. It is up, and the only address on it is a link-local one starting fe80::, made by itself. It has none of the gateway addresses its hosts are looking for, and nothing to tell the two VLANs apart on that cable.
sudo ip netns exec r1 ip -br addr show dev eth0Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Now do the lab
Tip
You have found what is missing: VLANs on the switch, a subinterface for each VLAN on the router, and routing between them. Making them is the task of this lab: open README.md in your home folder with cat README.md in the terminal. It says what to do and gives none of the answers.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own with a switch, a router and three computers inside it, and a Run types into its terminal and shows what it printed. The lab itself has a check that marks the finished network by testing what each computer can and cannot reach. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.