Tills and guests on one switch
One office switch connects the tills, the staff PCs and a box for guest wifi. A guest laptop should never see a till.
Buying three switches costs money and wall space. A VLAN splits one switch into several separate ones, using only settings.
By the end of this lesson
Note
I can keep two groups of hosts apart on one switch.
Key words
| Word | What it means | Example |
|---|---|---|
| Broadcast domain | all the devices that hear each other's broadcasts | |
| VLAN | a virtual LAN: one switch acting as several separate ones | VLAN 10 |
| Access port | a switch port that belongs to one VLAN, for one device | |
| Trunk port | a switch port that carries several VLANs between switches or to a router | |
| Tag | a label on a frame that names its VLAN | |
| Router on a stick | one router cable that carries every VLAN |
The cells students fill in are left blank in this preview.
One switch is one broadcast domain
A switch passes a broadcast out of every port. So every device on a plain switch hears every other.
That is called a broadcast domain. Devices in the same one can reach each other with no router.
A VLAN cuts the switch into several broadcast domains.
Meet the switch, the router and the hosts
vlanlab statusShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Read the switch's VLAN table
sudo ip netns exec sw bridge vlan showShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Ask across the switch, with no router
sudo ip netns exec h20 arping -c 2 -I eth0 10.10.0.100Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
What the three answers say
Every port is in VLAN 1. The VLAN table has one line for each of the four ports and one for the bridge itself, br0. The hosts belong to two address ranges, but the switch treats them as one group.
The arping asks "who has this address?" straight across the switch. The server answers both times, with its own hardware address. Nothing separates the two groups yet.
Access ports and trunk ports
An access port belongs to one VLAN. The device plugged into it knows nothing about VLANs.
A trunk port carries several VLANs on one cable. To keep them apart, each frame gets a tag that names its VLAN. The standard for this is called 802.1Q.
Worked example: a port table
| Port | Plugged into | Mode | VLANs |
|---|---|---|---|
| 1 | Till one | Access | 10 |
| 2 | Till two | Access | 10 |
| 3 | Staff PC | Access | 20 |
| 4 | Guest wifi box | Access | 30 |
| 5 | The router | Trunk | 10, 20, 30 |
The cells students fill in are left blank in this preview.
A router joins the VLANs
Devices in different VLANs cannot talk through the switch. If they must talk, a router has to sit between them.
One cable is enough. It is a trunk, and the router gives it one subinterface for each VLAN. Each subinterface has the gateway address of its VLAN.
This is a router on a stick.
Worked example: a packet across VLANs
| Step | Where | Tag |
|---|---|---|
| 1 | Staff PC sends to its gateway | None |
| 2 | Switch sends it to the router | VLAN 20 |
| 3 | Router finds the till's network and sends it back | VLAN 10 |
| 4 | Switch hands it to the till | None |
The cells students fill in are left blank in this preview.
Read where h10 sends other networks
sudo ip netns exec h10 ip routeShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Try to reach the other VLAN
sudo ip netns exec h10 ping -c 2 -W 1 10.20.0.11Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Look at the router's one cable
sudo ip netns exec r1 ip -br addr show dev eth0Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A common mistake
Warning
Many people think hosts in different VLANs can still reach each other through the switch. The switch never crosses a VLAN. A router must join them, and a rule on that router can still block the traffic.
Going further: a third group
The shop adds door cameras. They go in VLAN 40, on port 6, with the network 10.40.0.0/24.
Write the new and changed rows of the worked port table. Say what gateway address the router's new subinterface needs.
Then add the rows to PORTS in a copy of the tests. Check with can_talk that a camera reaches a till only through the router.