One cable, three offices
A small business has one set of switches. Sales, Finance and Guests all plug in to them.
A guest laptop can see the Finance printer. Why? Because to the switch, all sockets are one big room.
The fix is not new cables. It is three virtual rooms on the same switch.
Key words
| Word | What it means |
|---|---|
| VLAN | Virtual LAN: a group of switch ports that act as their own separate network. |
| Switch | A device that connects computers in a building and passes data between them. |
| Subnet | A smaller block of IP addresses, used for one group of devices. |
| IP address | A number that identifies a device on a network, such as 10.10.10.5. |
| Prefix length | The /24 after an address: it says how big the subnet is. |
| Routing table | A list a router uses to decide where to send traffic. |
| VRF | Virtual routing and forwarding: several separate routing tables inside one router. |
| Trunk | A link that carries the traffic of several VLANs, each marked with its VLAN number. |
| Network | Computers and devices linked so they can share data. |
| Firewall | A gate that lets some traffic in or out and blocks the rest. |
| Encryption | Scrambling data so only a person with the right key can read it. |
| Router | A device that passes traffic between different networks. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain how VLANs, subnets and VRF separate traffic, and set up two VLANs on a lab machine.
Starter: last lesson
Have a go
Starter: last lesson
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: VLANs
A VLAN splits one physical switch into several virtual networks. Each port is given a VLAN number. Ports in VLAN 10 can talk to each other. They cannot talk to VLAN 20 at all, unless a router lets them.
A trunk link between switches carries many VLANs. Each frame is tagged with its VLAN number, from 1 to 4094.
Result: Sales, Finance and Guests are separate, with no new cables.
Run: make two VLANs on a lab machine
ip link del dummy0 2>/dev/null; ip link add dummy0 type dummy && ip link add link dummy0 name dummy0.10 type vlan id 10 && ip link add link dummy0 name dummy0.20 type vlan id 20 && ip -d link show type vlan | grep -E "^[0-9]+: dummy0\.|vlan protocol"A command for the lesson’s lab terminal. It is shown here and not run.
What you should see
Note
Two lines for dummy0.10 and dummy0.20, each with a line that names 802.1Q and its id, 10 and 20. dummy0 is a pretend network card, so nothing real is changed. 802.1Q is the standard for VLAN tags.
Cycle 2: subnets
A subnet is a block of IP addresses. Usually each VLAN gets its own subnet, such as 10.10.10.0/24 for Sales. The /24 is the prefix length. It sets how big the block is.
Traffic between subnets must go through a router. That is the place to put a firewall rule: for example, Guests may reach the internet but not Finance.