The reception desk can see the payroll
A college has one switch. The finance office, the classrooms and the guest Wi-Fi all plug into it.
They can all hear each other. A guest laptop can shout to the finance printer and hear its reply.
You do not need three buildings to fix this. You need three separate groups inside one switch.
Key words
| Word | What it means |
|---|---|
| Switch | a device that joins devices inside one network |
| VLAN | a virtual network made inside a switch, so devices are kept apart |
| Access port | a switch port for one device, which belongs to one VLAN |
| Trunk port | a switch port that carries many VLANs to another device |
| Tag | a small label on each frame that says which VLAN it belongs to |
| Broadcast | a message sent to every device in a network |
| Gateway | the router address that devices use to leave their own network |
| Router | a device that passes data between networks |
| Firewall | a device or program that allows or blocks traffic by rules |
| Packet | a small piece of data sent over a network |
| Network | computers and devices joined so they can share data |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can configure VLANs on a switch and a router, and test that the traffic is separated and still routed.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
One switch, two virtual networks
A VLAN splits one switch into separate networks. Devices in VLAN 10 cannot talk straight to devices in VLAN 20.
Each device plugs into an access port. The port belongs to one VLAN.
The router has one cable to the switch, a trunk port. It carries both VLANs. Each frame wears a tag that names its VLAN.
Before: h20 can hear srv
sudo ip netns exec h20 arping -c 2 -I eth0 10.10.0.100A command for the lesson’s lab terminal. It is shown here and not run.
What this shows
Note
arping asks for the hardware address of 10.10.0.100 with a broadcast. srv replies. So h20 and srv are in one broadcast network, even though they should not be.
Worked example: the port plan
| Switch port | Device | VLAN | Port type |
|---|---|---|---|
| p-h10 | h10 (10.10.0.11) | 10 | Access |
| p-srv | srv (10.10.0.100) | 10 | Access |
| p-h20 | h20 (10.20.0.11) | 20 | Access |
| p-r1 | Router r1 | 10 and 20 | Trunk |
The cells students fill in are left blank in this preview.