Principles of modern LAN design and operation. Guido Marchetto Fulvio Risso Politecnico di Torino

Transcription

1 Priciples of moder LAN desig ad operatio Guido Marchetto Fulvio Risso Politecico di Torio 1

2 Copyright otice This set of trasparecies, hereiafter referred to as slides, is protected by copyright laws ad provisios of Iteratioal Treaties. The title ad copyright regardig the slides (icludig, but ot limited to, each ad every image, photography, aimatio, video, audio, music ad text) are property of the authors specified o page 1. The slides may be reproduced ad used freely by research istitutes, schools ad Uiversities for o-profit, istitutioal purposes. I such cases, o authorizatio is requested. Ay total or partial use or reproductio (icludig, but ot limited to, reproductio o magetic media, computer etworks, ad prited reproductio) is forbidde, uless explicitly authorized by the authors by meas of writte licese. Iformatio icluded i these slides is deemed as accurate at the date of publicatio. Such iformatio is supplied for merely educatioal purposes ad may ot be used i desigig systems, products, etworks, etc. I ay case, these slides are subject to chages without ay previous otice. The authors do ot assume ay resposibility for the cotets of these slides (icludig, but ot limited to, accuracy, completeess, eforceability, updated-ess of iformatio hereiafter provided). I ay case, accordace with iformatio hereiafter icluded must ot be declared. I ay case, this copyright otice must ever be removed ad must be reported eve i partial uses. 2

3 A view from history (1) Wide Area Networks appeared first 60s A few maiframes; ecessity to coect to them from remote Partitio their expesive cost betwee more etities Local Area Networks appeared later Ed 70 s, begiig 80s Miicomputers (ad later PCs appeared) Cost was low eough so that it was o loger eeded to access a remote maiframe Sharig resources betwee small workgroups (e.g., departmets) Maiframe still used, but for differet purposes (e.g., scietific simulatios) 3

4 A view from history (2) At the begiig, WAN ad LANs evolved idepedetly Differet protocols, egieered by differet vedors for differet purposes Decet, SNA, IP Novell, Baya Vieis, NetBeui Later we tried to coect LANs to WANs Progressive overlappig of fuctios/protocols Oe wier: IP Some overlaps still remai (e.g., addressig) 4

5 LAN importat stadards Protocols ad physical layers Structured cablig IEEE 802 EIA/TIA 568 ISO/IEC

6 LANs: IEEE ad OSI models 802.1: Higher Layers ad Maagemet Logical Lik Cotrol sublayer Medium Access Cotrol sublayer Physical layer Applicatio Presetatio Sessio Applicatio-toapplicatio commuicatio protocols Trasport Stream of data Maagemet Network Commuicatios betwee ay host MAC Logical Lik Cotrol Data Lik Commuicatios betwee hosts withi the same L2 etwork Etheret TokeRig Physical Lik-layer issues OSI model Descriptio 6

7 MAC ad LLC sublayers MAC sublayer Medium Access Cotrol solutios E.g., CSMA/CD Addressig LLC sublayer L3 protocol demultiplexig E.g., IPv4, IPv6, Advaced features Coectio orieted comuicatios at L2 Flow cotrol at L2... 7

8 Is LLC useful i moder LANs? I practice, sometimes LLC is eve ot preset E.g., Etheret DIX avoided LLC at all, although the IEEE versio supports LLC (but obody uses it) ad whe is there, most of the features are disabled E.g. WiFi No eed for those features i curret etworks E.g., flow cotrol curretly doe at L4 Itermediate devices are simpler (hece faster ad cheaper) H1 H2 Flow cotrol at L2 H3 H4 Flow cotrol at L4 8

9 LAN devices i brief L1: Repeater Hub Separate physical domais, same collisio domai L2: Bridge Switch Separate collisio domais, same broadcast domai L3: Router L3 switch Separate broadcast domais Not really specific for LANs Not covered i the curret slides 9

10 Repeater Itercoectio at the physical layer Receives ad propagates a sequece of bits Used for Itercoectig etworks havig the same MAC I.e., all ports must have the same speed E.g., Etheret 10Mbps fiber to copper Recoverig sigal degradatio (log cables), allowig larger distaces Trasport Trasport Network Network Data Lik Data Lik Physical Physical Relay Physical Physical 10

11 Repeater: example Fibre Optic cables Repeater H4 Coax cable H5 H6 H1 H2 H3 Physical domai A Physical domai B Uique collisio domai 11

12 Multiport repeaters: Hubs Hubs are multiport repeater Repeater with more tha 2 ports Required for twisted pairs ad fiber cablig (hub-ad-spoke topology) O Etheret, it allows reachig (almost) the theoretical collisio domai Overcomes limitatios of physical cables (e.g., 100m o 10BaseT) 12

13 Bridge Itroduced by DEC i 1983 (LANBridge 100) Pure software 2 ports (maily for ecoomic reasos) Itercoectio at the data-lik layer E.g. Etheret to WiFi, Etheret to Fast Etheret Differet MACs (medium access mechaism, framig) Trasport Network Data Lik Physical Relay Data-lik Data-lik Physical Physical Trasport Network Data Lik Physical 13

14 Bridge: objectives Itercoectio betwee differet LANs usig differet techologies E.g., Etheret ad WiFi I practice it is ofte impossible due to maximum frame size issues (data-lik does ot have fragmetatio) LAN extesio (total diameter) Especially useful for FastEtheret ad upper speed (200m) Collisio domai issues 14

15 Bridge: operatios Works by receivig ad re-trasmittig (later) a frame 1. Store the frame (store ad forward mode) 2. Modify the frame (e.g. Etheret to Toke Rig) 3. Sed it out Whe a frame crosses a bridge The L1 portio will be created from scratch The L2 (MAC) portio will be regeerated (e.g., MAC coversio) LLC ad upper layers will trasit uchaged Etheret DIX Preamble SFD MAC Dest. MAC Source Legth Data FCS IFG Toke Rig Startig Delimiter Access Cotrol Frame Cotrol MAC Dest. MAC Source Routig Iform. Data FCS Edig Delimiter Frame Status 15

16 Bridge: example of itercoectio B1 FDDI backboe Speed: 100Mbps FDDI frame Etheret frame B2 B3 H1 H2 H3 H4 Etheret etwork A Speed: 10Mbps Etheret etwork B Speed: 10Mbps 16

17 Bridges ad collisios (o Etheret) Store ad forward allows smarter sedig of data o output iterfaces Bridges decouples collisio from broadcast domai Collisio domai is o loger a limitatio H1 H4 H3 H6 H2 H5 17

18 Collisio ad broadcast domais (1) Collisio domai: area where a sigle istace of the access cotrol algorithm (e.g., CSMA/CD) operates I.e., the area covered by a sigle physical lik Frames are immediately propagated over all the liks (possibly through repeaters) Also called etwork segmet Broadcast domai: area where frames ca be propagated I.e., the area o which a LAN operates Ca iclude several collisio domais Frames ca be stored ad later propagated over other collisio domais 18

19 Collisio ad broadcast domais (2) Bridge Coax cable Coax cable H1 H2 H3 H4 H5 H6 Collisio domai A Collisio domai B Uique broadcast domai 19

20 Collisio ad broadcast domais (3) Repeaters exted the collisio domai I fact, it is ot actually exteded ; it allows the collisio domai to reach its theoretical limits, despite cable limitatios Bridges create differet collisio domais ad exted the broadcast domai I.e., bridges decouple broadcast domai from collisio domai This is a very importat feature of bridges, that comes out from their store ad forward mechaism 20

21 Half ad Full duplex mode Half Duplex mode Stadard operatig mode of etwork iterfaces (NICs) RX ad TX caot happe at the same time RX+TX activity is see as collisio But if we have two physical liks, do we really have a collisio? Hub1 B2 H1 H2 21

22 Full duplex Itroduced with Fast Etheret (part of 802.3x) Available wheever the other party ca temporarily store the frame, istead of repeatig (immediately) the received bits o the other ports, such as a repeater does Not just host ßà bridge Examples: host ßà host, host ßà bridge, bridge ßà bridge B1 H1 B2 B3 H2 H3 22

23 Full duplex: advatages Badwidth I theory, throughput x2 I practice, limited advatage for cliets ad servers Cliets ted to saturate dowliks, servers upliks May be iterestig for bridges o the backboe More symmetrical badwidth CSMA/CD: the real advatage No loger eeded, sice collisios are o loger possible With CSMA/CD, TX ad RX together are used to detect collisios Advatages No requiremet for mi frame size for Etheret No limits o the etwork size o Etheret (o collisio domai) 23

24 Full duplex ad switches Moder LANs are heavily based o full duplex Hub-ad-spoke topology Poit-to-poit coectios betwee hosts ad the bridge No collisio domai Multiport bridges are called switches Same fuctios, differet iteral architecture B1 H1 H2 H3 24

25 Moder LANs: Switched Etheret Moder (wired) LANs are based o full-duplex, switches, ad Etheret: Switched Etheret Today Gigabit Etheret, or eve more (10GE, 100GE) If today we say switch, we are referrig to a Etheret switch CSMA/CD o loger used Available till 1GE, the o loger defied by stadards Wireless LANs are completely differet Typically based o CSMA/CA (e.g., WiFi) Hubs are still used (e.g., WiFi exteders) Here we focus o wired Etheret-based LANs 25

26 Trasparet bridges Bridges (switches) used i Etheret LANs are called trasparet bridges Other (o trasparet) bridges have bee proposed i the past (e.g. Toke Rig etworks) No loger i use Trasparet bridges stadardized by IEEE i 802.1D Trasparecy Bridges should be plug-ad-play ad must ot require ay chage i the cofiguratio of the ed systems Performace (throughput, max distaces) may be differet from the origial etwork, but fuctioalities are the same 26

27 Trasparet bridges ad ed hosts Ed systems must operate i the same way (same frames, some format, etc) with or without bridges I details No chages at all i frames set by ed systems Same frame, same src/dst MAC address, etc There may be some chages i which frames are received No chages at all i the format of the received frame Same source/mac address, etc Data MAC src: H1 MAC dst: H2 Data MAC src: H1 MAC dst: H2 H1 Hub1 H2 H1 B1 H2 27

28 Trasparet bridges ad port addresses Each port of a bridge has a MAC level ad therefore it has a MAC address That MAC address is ever used whe forwardig data frames It is used whe frames are geerated/received by the switch itself E.g. maagemet frames H1 Bridge H3 MAC: B1 MAC: B2 H2 Data MAC Src: H1 MAC Dst: H3 Data MAC Src: H1 MAC Dst: H3 H4 28

29 Smart forwardig process Smarter forwardig rules Uicast: oly o the port toward we ca reach the destiatio (Destiatio MAC-based forwardig) Multicast, broadcast: floodig All ports except the port o which the frame has bee received (floodig) A MAC forwardig table must be available locally Filterig database (more details later) A ote about floodig Frames are set o all ports (except o the icomig port), but may ot be set at the same time (delayed forwardig) Hubs sed data i floodig at the same time (bits forwarded immediately) 29

30 New compoets i smart bridges I order to operate successfully, a smart bridge requires three additioal compoets: A local forwardig table (filterig database) Statios auto-learig (backward learig) Loop detectio (spaig tree algorithm) The ultimate goal: the bridge should be able to do its job without ay explicit cofiguratio from the etwork admi Really plug ad play By-product: stupid etwork admis believe they are really smart just because their etworks work properly 30

31 Filterig Database (1) Table with the locatio of ay MAC address foud i the etwork MAC address Destiatio port Ageig time (default expire after 300 s) Filterig database: i the old days, the smart forwardig process was perceived as a way to filter out uwated traffic from a lik H1àH3 Port1 B1 Port2 H1àH3 31 MAC Filterig Database H1 H2 MAC Port Age H3 H4 H1 H2 1 1 H3 2 H

32 Filterig Database (2) Etry types Dyamic Static Populated ad updated by the backward learig process Max etries: 2 64 K Not updated by the learig process Usually < 1K etries Old dyamic etries are purged out of the filterig database E.g., statios that do o loger exist o the etwork Default: 300 secods 32

33 Filterig database: real example Cisco-switch-1> show cam dyamic * = Static Etry. + = Permaet Etry. # = System Etry X = Port Security Etry Dest MAC Address Ports Age a-a6-44 1/ c9-10-b3-0f 1/ f8-31-1c-3b 1/ f8-31-f7-a0 1/ e7-00-e3-80 2/ a5-84-a7-a6 2/ b3-1e-b4-aa 2/ b3-1e-da-da 2/ b3-1e-dc-fd 2/4 2 33

34 Forwardig process Begi Received frame o port X Y Errors (collisio, CRC)? N MAC destiatio i DB? N Discard frame Y Y Destiatio port == X? N Forward o selected port Forward o all ports (except X) Ed 34

35 Forwardig process ad trasiet What about if a MAC address is ot preset i the Filterig Database? Bridge looks like a hub Frame duplicated o all ports except the oe o which it was received This situatio is rather commo ad it is called trasiet Bridges are plug-ad-play ad have a algorithm to lear the locatio of the hosts Backward learig (preseted later) However, at the begiig, bridges do ot kow where a host is located I this case the MAC Floodig algorithm is the oly way to go 35

36 How do we populate the filterig database? 1) By had Possible o all moder devices, but ot very hady 2) By meas of a proper algorithm Backward learig The best choice, of course 36

37 Backward learig (1) The idea If a bridge receives a frame whose source is host H1 from port P1, that host will be reachable through port P1 Topology is leared by ispectig received frames Aalysis of MAC source address The destiatio MAC address is igored by this algorithm H1 H1àH2 P1 B1 P2 H3àBcast H3 H2 H4 MAC Filterig Database MAC H1 H3 Port P1 P2 37

38 Backward learig (2) Works also i presece of multiple bridges Remote bridges lear the positio ayway, eve if the edsystem is ot coected locally Example: backward learig ad frame forwardig take together MAC Filterig Database MAC Port H1 2 H1àH2 1 H3 2 B3 38 H1 1 H1àH2 1 2 H1àH2 H1àH2 2 3 B1 B2 MAC Filterig Database MAC Filterig Database MAC Port MAC Port H1 1 H1 2 H2

39 Backward learig (3) Begi Received frame o port X Backgroud process: Discard zombies Source MAC address foud i the DB? Y N Update port ad ageig time Add ew etry i DB Ed 39

40 How do we keep the filterig DB up to date? Update the Filterig database meas Refresh Age, so that the etry keeps alive Refresh Port, so that the host is updated with the ew positio Please ote that A ed-system whose MAC address is ot i the DB is always reachable Corollary: a frame set to a o-existig host will always be forwarded i all the etwork A ed-system whose MAC address is i the DB may be ureachable At most for Agig Time, i fact 40

41 L2 etworks ad hosts mobility (1) If the ed-system geerates broadcast frame immediately No problems Filterig Database MAC Port H H2 B2 3 H3 H1 2 1 Filterig Database B1 B3 1 2 H2 à Bcast H2 MAC Port H2 2 Filterig Database H4 MAC Port H

42 L2 etworks ad hosts mobility (2) If the ed-system geerates uicast traffic immediately We may have forwardig errors H4 à H2 is correctly delivered H3 à H2 is lost Filterig Database MAC Port H2 2 H H2 B2 3 H3 H B1 Filterig Database MAC Port H2 2 H4 2 Filterig Database MAC Port H2 1 3 H4 2 B3 B Filterig Database MAC Port H2 1 2 H4 1 H2 à H4 H2 H5 H4

43 L2 etworks ad hosts mobility (3) If the ed-system does ot geerate traffic at all We may have forwardig troubles H4 à H2 is correctly delivered The frame is forwarded also to the origial destiatio H3 à H2 is lost Filterig Database MAC Port H H2 B2 3 H3 H1 2 1 Filterig Database MAC Port B1 B3 1 2 H2 H2 2 Filterig Database H4 MAC Port 43 H2 1

44 L2 etworks ad hosts mobility (4) Broadcast (multicast) frame Reaches the etire etwork, therefore all the bridges update the locatio of the curret statio Uicast frame Potetially reaches oly a portio of the etwork, hece the rest may still have the old locatio of the statio I the real world Widows host typically geerates a lot of broadcast No problems whe movig from oe place to aother UNIX servers ad virtualized hosts (e.g., Vmware) are ofte silet if ot solicited Need to wait for the agig time 44

45 L2 etworks ad hosts mobility (5) The agig time Usually eough i order to cope with maual movemets A laptop moved from office to lab Some problems may appear i specific eviromets E.g. fault-tolerat NICs We eed to react much quickly tha 5mi NIC driver has to geerate a additioal broadcast frame B1 B2 B3 B4 Primary lik Secodary lik 45 S1

46 Possible attacks to the filterig database MAC Floodig Attack Geeratio of frames with radom MAC sources Filterig database gets full Bridges will start floodig most of the frames All the oes whose destiatio address is ot preset i the DB Objectives Forces bridges to operate like hubs, so that we ca itercept traffic geerated by other statios Slows dow the etwork Some vedors give the opportuity to limit the umber of MAC addresses leart o each port 46

47 Possible attacks to the filterig database (2) Packet storms Geeratio of frames to o-existig statios Frames are always sed to the etire etwork Objective Slows dow the etwork 47

48 Bridges ad meshes Two problems Frames ca eter i a loop Backward learig o loger able to operate It s ow the time to preset the third compoet (i.e. Spaig Tree ) after the oes we preseted earlier Filterig Database ad Backward Learig 48

49 Bridges ad meshes: the loop problem H1 H1 à Bcast Broadcast frame B1 5 4 B2 Broadcast frame B3 Broadcast frame 49

50 Bridges ad meshes: the loop problem H Loop! B1 5 B2 B3 50

51 Which frames ca geerate a loop? Multicast/broadcast frames Very commo Frame to a o-existig statio MAC address ot preset i the filterig DB (e.g. o existig statio) Problem that may happe rarely (uless uder attack) IP seds a ARP before cotactig a L2 statio If the statio does ot exist, the ARP will ever get a reply ad the destiatio MAC address is ukow Therefore, o MAC frames will be set to that statio itetioally 51

52 The Broadcast Storm Massive load due to broadcast/multicast traffic o a LAN Oe of the most dagerous problems at data-lik layer No solutios, except for disablig (physically) loops E.g., detach a cable from a bridge Network operators are almost impotet i such this case Due to the lack of a time-to-live field i L2 frames L3 etworks ca tolerate trasiet loops TTL available o L3 packets Ca be used to create a low-cost traffic geerator sedig frames at lie-rate 52

53 Bridges ad meshes: the learig problem (1) H1 H1 à Bcast Broadcast frame B1 Filterig Database MAC Port 5 B2 Broadcast frame H B3 Broadcast frame 53

54 Bridges ad meshes: the learig problem (2) Backward learig problem Switches may have icosistet filterig database A etry i the filterig database may chage the port idefiitely A etry may ot able to reach a stable state Trasiet loops ca be created amog back-to-back bridges B1 forwards to B2 that forwards to B1, Larger (B1-B2-B3-B1) loops may occur as well 54

55 The Spaig Tree idea: o loops i the etwork H1 H1 à Bcast B1 B2 Broadcast frame Disabled lik B3 Broadcast frame Broadcast frame 55

56 Spaig Tree I order to avoid troubles, you must avoid loops i the physical etwork Either create loop-free etworks Discouraged; ot robust Or defie al algorithm that disables (temporarily) loops 802.1D Origial idea from Radia Perlma, Meshes detected ad disabled; the etwork becomes a tree Uique path betwee ay source ad ay destiatio Operates periodically (every secod) Decides which port set to forwardig state ad which port set to blockig state 56

57 Bridge architecture Spaig Tree Protocol Backward Learig Filterig database Forwardig process AàB 57

58 Bridges ad switches (1) Bridge Origially 2 ports, the more Software-based architecture No loger used i real etworks Still some PC-based implemetatios For research or some special purpose WiFi access poits are bridges 58

59 Bridges ad switches (2) Switch Same device, differet techology Hardware based forwardig ad learig Lookup through CAMs (Cotet Addressable Memories) Spaig Tree i software Covergece time i several secods, hece hardware implemetatio is useless Ca implemet a cut-through forwardig techology A frame ca be forwarded o the target port immediately after receivig the Destiatio MAC The destiatio port must be free at that time Faster tha store ad forward Requires all ports operatig at the same speed 59

60 Switch architecture Spaig Tree Protocol Hardware Backward Learig Filterig database Forwardig process AàB 60

61 Switch iterals Shared bus or switchig matrix Cetral CPU ad memory Port Host 1 AA-BB... 1 AA-BC... 2 AA-BD Queuig system (ofte o the output lik) IN OUT Filterig Database Full Duplex lik 61

62 Switch iterals Shared bus or switchig matrix + speed - complexity Cetral CPU ad memory + itelligece - cofiguratio - bugs Port Host 1 AA-BB... 1 AA-BC... 2 AA-BD Filterig Database + efficiet lookup - Table may become full - trasiet No CSMA/CD (Full Duplex) + speed - useful oly o some liks (e.g., itra-switch) IN OUT Queuig system (ofte o the output lik) + decouplig of differet physical speed + absorbs burst - ca drop frames 62

63 Routers L3 devices! Routers are ot trasparet with respect to MAC addresses Routers separate broadcast domais H1 Data MAC Src: H1 MAC Dst: Bcast Router1 H3 MAC: R1 MAC: R2 H2 Data MAC Src: H1 MAC Dst: R1 Data MAC Src: R2 MAC Dst: H3 H4 63

64 Routers ad broadcast domais Router Coax cable Coax cable H1 H2 H3 H4 H5 H6 Broadcast domai A Broadcast domai B Differet IP etworks o the two iterfaces of the router 64

65 L2 or L3? So far, we cocetrated o L2 Shall we stay with L2 or better movig to L3? Trasparecy L2: it does ot matter where you are; everythig works L2: it works with ay etwork protocol L3: addresses deped o your positio May parameters (e.g. firewall, access lists, etc) are bouded to your address 65

66 Oe or multiple LANs across a campus? Ok, so it s better to keep the L2 as log as we ca As far as the etwork is able to operate as a sigle L2 etity (remember scalability issues i L2 etworks!) But a sigle, gigatic LAN, or multiple LANs? Performace A sigle LAN has too much broadcast traffic (ot filtered by switches) Flooded traffic (e.g. due to frequet STP recofiguratio) Privacy, Security Do ot wat a statio to leak some iformatio out (e.g. MAC Floodig attack) Maagemet Smaller etwork, simple (ad uiform) policies Better to partitio differet users i differet LANs 66

67 Multiple LANs across a campus: how? Differet physical etworks (full separatio) N etworks = N liks + N devices Waste of resources Rack buildig 1 Rack buildig 2 LAN A Rack buildig 3 LAN A LAN B LAN A LAN B LAN B 67

68 Virtual LANs (1) Admiistratio Departmet Egieerig Departmet Admiistratio Departmet Egieerig Departmet Without VLAN With VLANs 68

69 Virtual LANs (2) Sigle physical ifrastructure Same devices, same cablig No switches i which oly a few ports are used No eed to have multiple fibers (for differet LANs) i the backboe Differet LANs Differet broadcast domais E.g., Etheret frames caot be propagated o aother VLAN No broadcast betwee LANs No MAC floodig attacks No ARP spoofig Created through a proper (logic) separatio o switches Itra-switch or iter-switch 69

70 VLAN: switch architecture VLAN 1 VLAN 2 VLAN N Backward Learig Backward Learig Backward Learig Spaig Tree Protocol Filterig database Filterig database Filterig database Forwardig process AàB 70

71 VLAN: forwardig database MAC Filterig DB (VLAN1) MAC Filterig DB (VLAN2) MAC Filterig DB (VLAN3) MAC Filterig DB (VLAN1) MAC Filterig DB (VLAN2) MAC Filterig DB (VLAN3) MAC Port MAC Port MAC Port MAC Port MAC Port MAC Port H1 1 H2 2 H3 3 H1 4 H2 4 H3 4 H4 4 H5 4 H6 4 H4 1 H5 2 H6 3 VLAN3 VLAN2 VLAN1 SW SW H1 H2 H3 H4 H5 H6 Real implemetatios: uique filterig database (usually made with a TCAM, which is a sigle etity i the etwork device) 71

72 Itercoectig VLANs (1) L2 data caot cross VLANs A Etheret statio caot sed a L2 frame to aother statio i a differet VLAN VLANs are differet broadcast domais Beware: L2 data caot cross VLANs! 72

73 Itercoectig VLANs (2) Oe-arm router Admiistratio Departmet Egieerig Departmet Admiistratio Departmet Egieerig Departmet 73

74 Itercoectig VLANs (3) A router (i.e., device operatig at layer 3) is eeded Lookup at layer 3 (e.g., IP destiatio address) A router is ofte used to eforce L3 (or eve L4/7) layer protectio (e.g. firewall) The origial L2 header is throw away ad a ew oe is created with other MAC addresses (src/dst) 74

75 VLANs ad IP addresses Broadcast caot cross the VLAN boudaries Caot use ARP to resolve the MAC address i aother VLAN IP1: /24 IP2: /24 Hosts i differet VLANs must belog to differet IP etworks Network /24 Network /24 75

76 Associate frames to VLANs (1) Problem How ca we associate frames to VLANs? VLANs o a sigle switch Simplest method: we ca mark the ports o the switch The received frame is associated to the VLAN the port belogs to Other methods exist Preseted later H2àH3 H2àH3 H1 H2 H3 H1 H2 H3 76

77 Associate frames to VLANs (2) VLAN o differet switches Problem: how to distiguish which VLAN a frame belogs to, as there is a sigle lik betwee switches? Same problem for devices that belog to differet VLANs E.g., servers, routers R1 S1ßH1 SW-1 H1àH4 H2àH5 H3àH6 H3àR1 H2ßR1 S1àH6 SW-2 S1 H1 H2 H3 H4 H5 H6 Note: the IDs i the frames are the MAC addresses of the ivolved statios 77

78 Associate frames to VLANs: taggig Required oly o liks that trasport traffic of differet VLANs Old method: Tuelig A Etheret (Toke Rig or FDDI) frame is ecapsulated ito aother Etheret frame Proprietary solutios E.g., ISL (Iter-Switch Lik) by Cisco Frame Taggig A additioal header is added to the MAC header Stadardized by IEEE 802.1Q 4 additioal bytes added to the frame Basically, VLAN-ID plus a buch of other ifo 78

79 IEEE 802.1Q Tag Ecodig (1) VLAN i Etheret ecapsulatio (default) MAC Dest. MAC Source 802.1Q Ether type Data FCS (bits) Ethertype for VLAN taggig Ether type 0x8100 User priority CFI VLAN ID MAC Dest. MAC Source Legth LLC SNAP AA AA Q etype Data (Pad) FCS VLAN i IEEE with LLC SNAP Ethertype for VLAN taggig 79

80 IEEE 802.1Q Tag Ecodig (2) MAC Dest. MAC Source Etype 0x800 Data FCS H1 LAN (backboe) H2 Frame is 4 bytes loger tha the oe geerated by H1 MAC Dest. MAC 802.1Q Source 0x8100 VLAN2 Etype 0x800 Data FCS 80

81 IEEE 802.1Q Tag Ecodig (3) It ca be ecapsulated i either Etheret (DIX) or ay lik layer usig LLC SNAP I both cases, it uses the Ethertype 0x8100 The frame has IEEE 802.1Q tag Called TPID (Tag Protocol Idetifier) PCP (Priority Code Poit) Refers to IEEE 802.1p priority CFI (Caoical Format Idicator) 1 : MAC address i o-caoical format (e.g. Toke Rig) Usually set to 0 (e.g., Etheret) 81

82 IEEE 802.1Q Tag Ecodig (4) VID (VLAN Idetifier) Values Usually, 1 refers to the default VLAN 0xFFF: reserved 0: the frame does ot belog to ay VLAN (or I do t kow which VLAN this frame belogs to) Used i case the user just wats to set the priority for her traffic Tagged Etheret frame, but VLANID = 0 (Tag is eeded oly to set the proper priority) PRI: high User data 82 Stadard Etheret frame format (o VLAN taggig)

83 Modificatio to existig MACs Mior modificatios New framig (for taggig) specified i 802.1Q Idepedet from the techology of the Medium Access Cotrol Maximum legth of the frame has to be exteded 4 bytes E.g., Etheret reaches 1522 bytes (from 1518) Miimum legth uchaged (still 64 bytes) 83

84 Lik types: Access (1) Access Liks receive ad trasmit Utagged frames Default cofiguratio (o hosts, switches, servers, routers, etc) Usually used to coect ed-statios to the etwork Hosts do ot eed to chage their frame format Icomig traffic is associated to the VLAN cofigured o the port of the switch Access ports Stadard Etheret frame format (o VLAN taggig) 84

85 Lik types: Access (2) Give the followig etwork All ports are cofigured i access mode SW-1 is cofigured with the RED VLAN o all its ports SW-2 is cofigured with the GREEN VLAN o all its ports Ca host H1 commuicate with host H4? SW-1 SW-2 H1 H2 H3 H4 Yes, because values cofigured o access ports are ot propagated outside the switch! 85

86 Lik types: Truk (1) Truk liks receive ad trasmit Tagged frames Must be cofigured explicitly Ofte used i switch-to-switch coectios ad to coect servers/routers Truk ports Tagged Etheret frames 86

87 Lik types: Truk (2) Taggig o truk ports Differet possibilities Some switches tag the traffic belogig to all VLANs Other leave the traffic belogig to VLAN 1 utagged A possible reaso of icompatibility betwee etwork devices of differet vedors 87

88 Lik types: Hybrid Hybrid liks accepts both tagged ad utagged frames Differetiates frame accordig to the type field (0x8100 or ot) Some hosts may ot be fully operatioal (e.g. Statio A caot uderstad tagged traffic directed to it) Truk liks are usually also Hybrid liks May be used o ports o which both hosts ad servers / routers / switches are coected I ay case, very ucommo owadays VLAN A Access liks VLAN-aware bridge Hybrid lik VLAN-aware bridge Access liks VLAN B VLAN B Host H1, VLAN C, VLAN-uaware Host H2, VLAN B, VLAN-aware VLAN C 88

89 Assigig hosts to VLANs Differet methods to associate devices to the proper VLAN Port-based VLANs Trasparet assigmet Per-user assigmet (802.1x) Cooperative assigmet Note: a statio ca be associated also to multiple VLANs E.g., required i case of servers, routers I this case, truk liks are required o the device Frames are tagged directly by the device Fourth assigmet method: Cofiguratio of Truk Iterfaces Ca be see as a extesio of the Cooperative Assigmet 89

90 Port-based VLANs (1) Most commo choice i curret etworks Each port ca be cofigured as either access port or truk port Each access port is associated to a sigle VLAN Each truk port is associated to a group of allowed VLANs Default: all ports i Access mode, associated to VLAN 1 Utagged Frames Utagged Frames Tagged Frames VLAN A access lik truk lik access lik VLAN B VLAN B VLAN A 90

91 Port-based VLANs (2) Completely trasparet to the user Associatio is doe o the switch Maximum compatibility, sice there is o eed to cofigure hosts Differet VLANs (e.g., privileges) depedig o the actual physical etwork socket we coect to No seamless mobility at L3 Host will chage the IP address whe moved ito aother VLAN SW-1 SW-2 H1 IP: /24 H1 IP: /24 91

92 Trasparet assigmet New criteria i trasparet assigmet Per L3 protocol (802.1v; o loger useful) Per MAC address Cofiguratio problems Keep MAC database aliged (ew host, host with ew NIC card, ) Network admiistrator has full cotrol o associatio user-vlan Allows seamless mobility Maily historical 92

93 Per user-assigmet (802.1x) 802.1x is a stadard that eables the etwork port o the switch oly if the user autheticates successfully Sice the switch kows who is attached to the port, it ca assig the proper VLAN to the user E.g., if the switch detects that user U1 coects to the switch, it eables VLAN1 Assigmet is per-user, ot per-host It looks similar to the per-port assigmet, but the colorig is doe based o the UserID SW-1 SW-2 93 User 1 o H1 User 2 o H2 User 1 o H3

94 Cooperative assigmet (1) Also kow as aarchic VLAN assigmet Users keep cotrol of the VLAN assigmet User sets the VLAN o the etwork card Allows seamless mobility User will attach always to the same VLAN aywhere i the campus What about a user joiig the wrog VLAN? Negligece or bad will Used mostly o devices tha must be part of differet VLANs E.g. routers, servers 94

95 Cooperative assigmet (2) Requires The (maual?) cofiguratio o all the PCs The usage of truk iterfaces Frames are tagged by the user, which sets the right VLAN-ID i outgoig frames I ay case, the port o the switch has to be cofigured ayway with the list of allowed VLANs Ofte we use VLAN allow all Two way of cofigurig this feature o the device etwork card Depeds if the device has to support a sigle VLAN, or it must belog to multiple VLANs 95

96 Cooperative assigmet: sigle VLAN per NIC Simple associatio of VLAN taggig to the icomig/outgoig traffic Icomig/outgoig traffic is geerated with 802.1Q taggig Oly oe VLAN-ID per NIC iterface is allowed (ad specified by cofiguratio) Allowed o almost all etwork cards (e.g., the oes we have i our PCs) We may have multiple cards i case multiple VLANs are required Barely used S1 SW-1 R1 96

97 Coop. assigmet: multiple VLANs per NIC (1) Without VLANs i the host With VLANs i the host Two etwork iterfaces We eed to create exactly Each oe with its ow IP cofiguratio the same eviromet that was available before VLANs Each oe belogs to a differet LAN We had two NICs before, we eed two NICs ow as well E.g., receives oly the broadcast associated with that VLAN S SW-1 S SW-1 97

98 Coop. assigmet: multiple VLANs per NIC (2) Requires the usage of virtual NICs Multiple virtual etwork iterfaces are created Each oe with its L3 cofiguratio (e.g. IP address) ad VLAN-ID Oly oe VLAN-ID is allowed per virtual card A maximum of N VLANs are allowed (N = umber of V-NICs) Widely used; mostly o servers ad routers Explicit support required from the NIC driver ad/or the Operatig System Importat: IP addresses associated to the iterfaces (either real or virtual) must belog to differet IP etworks S SW-1 98

99 Truk Iterfaces ad IP cofiguratio Virtual iterface Vir1.2 MAC: 00:00:00:11:11:11 VLAN 2 IP: /24 DG: /24 Virtual iterface Vir1.3 MAC: 00:00:00:11:11:11 VLAN 3 IP: /24 DG: /24 S Physical iterface If1 MAC: 00:00:00:11:11:11 Truk mode Sigle physical iterface SW-1 Sigle physical lik Each iterface has its ow cofiguratio at IP level (two differet IP etworks) Network traffic belogig to the two VLANs is separated ad set to two differet virtual iterfaces 99

100 Note: duplicated MAC addresses Please ote that duplicate MAC addresses are Very commo i moder LANs Aother commo situatio is host virtualizatio (e.g. virtual machies) Do ot cause troubles as soo as they belog to differet VLANs Virtual iterface Vir1.2 MAC: 00:00:00:11:11:11 VLAN 2 IP: /24 DG: /24 Virtual iterface Vir1.3 MAC: 00:00:00:11:11:11 VLAN 3 IP: /24 DG: /24 Switches MUST hadle the filterig databases of differet VLANs as distict etities S Physical iterface If1 MAC: 00:00:00:11:11:11 Truk mode SW-1 100

101 Assigig VLANs to truk liks (1) Necessity to kow which VLANs are hadled o a give truk lik / switch The switch eeds to create the proper umber of filterig DB How ca SW-2 kow that it will have to forward VLANs 1-3? Possibility to optimize the umber of filterig DB o the switch E.g., FilterigDB for VLANs 2,3 are ot eeded o SW4 Useful to reduce the umber of MAC etries o the switches SW-1 VLAN3 VLAN2 SW-2 VLAN1 SW-3 SW-4 H1 H2 H3 H4 H5 H6 H7 101

102 Assigig VLANs to truk liks (2) Possibility to optimize broadcast traffic Avoidig to sed broadcast/flooded traffic belogig to a VLAN o a switch where o such VLANs are preset Uicast (ot flooded) traffic is always optimized by the filterig database Useless! SW-1 SW-2 SW-3 H3 à Bcast (VLAN3) SW-4 H1 H2 H3 H4 H5 H6 H7 102

103 Assigig VLANs to truk liks (3) The idea: let each switch to kow which VLANs are active o its ports Three solutios Maual cofiguratio Proprietary mechaisms GVRP SW-1 VLAN3 VLAN2 SW-2 VLAN1 SW-3 SW-4 103

104 VLANs i the backboe: maual cofiguratio Used i most etworks Usually, VLANs are cofigured explicitly o each switch Possible problems (related to STP) i case you wat to optimize truk ports ad filter useless VLANs out What about if the lik betwee SW-1 ad SW-2 is tured off? Better to allow all VLANs o all liks ad avoid optimizatios Allowed VLANs: gree, yellow SW-2 SW-1 (Root bridge) SW-3 Allowed VLANs: gree, purple 104

105 VLANs i the backboe: GVRP It propagates ifo about required VLANs o all the switches Prues switches that are ot iterested by some VLANs from the tree of that VLAN Ca filter the broadcast traffic of some VLANs o some switches Hady (because automatic), but ot widely used It iserts a ew level of itelligece i switches Cofiguratio required New software (i.e. bugs) Is it really eeded (especially if you wat to have a robust etwork)? 105

106 VLANs ad Spaig Tree I theory, they are completely idepedet First, Spaig Tree is computed i order to disable loops The, VLANs are used o the resultig topology Uique forwardig tree for all the VLANs Almost all vedors offer Per-VLAN Spaig Tree Most vedors ca tur back to a uique STP via cofiguratio Cisco caot (Per-VLAN STP is the oly optio) SW-2 G3 P2 P3 SW-1 SW-3 G1 P1 G2 106 Allowed VLANs: gree, purple o all liks G4 G5 P4

107 VLANs ad etwork isolatio (1) Network isolatio is ot complete, eve with VLANs Although frames caot cross the border of a VLAN, liks are shared, hece a problem o a lik, caused by the traffic of oe VLAN, may affect other VLANs SW-2 H1 à Bcast SW-1 (Root bridge) H1 à Bcast SW-3 H1 107

108 VLANs ad etwork isolatio (2) For example, VLANs do ot protect from broadcast storms I fact, broadcast traffic is set o the etire etwork Except o the edge ports, sice those are assiged to a specific VLAN A truk lik may be saturated by a broadcast storm o a VLAN Other VLANS do ot receive that broadcast but the truk lik is cogested ad it may be uable to trasport the traffic of other VLANs Per-VLAN QoS may be required E.g., Roud-robi service model based o VLAN ID, which guaratees a miimum amout of badwidth to each VLAN 108

109 VLANs ad etwork switches Two types of switches VLAN-Aware: hadle tagged ad utagged frames VLAN-Uaware: do ot accept tagged frames May discard frames (if too big) Low-ed devices Availability o the market Almost all professioal products ca hadle VLAN taggig Almost all domestic products do ot have VLAN support VLANs are o loger a plug ad play techology STP is (with some limitatios) This is oe of the reasos VLANs are ot supported o domestic switches Typical users are ot skilled eough to cofigure them 109

110 Mixig VLAN-aware/uaware switches (1) H1 H2 H3 S1 VLAN A VLAN A VLAN-uaware switch STP Blocked port S2 VLAN B VLAN-aware switch VLAN B VLAN-uaware switch Problems: 1) H1-H3 caot exchage data with H4-H6 2) H1-H3 ca exchage data oly with S ) H4-H4 exchage data oly with S2 H4 H5 H6

111 Mixig VLAN-aware/uaware switches (2) VLAN-aware switch VLAN-uaware switch VLAN-uaware switches may be OK i the access side (e.g., i order to add ew ports), provided that all cliets belog to the same VLAN Corollary It is pretty commo to have VLANuaware switches i corporate etworks. Network maagers typically deploy oly professioal switches (with VLAN support) but ofte ed users have some limitatios (e.g., ecessity to attach multiple hosts o a sigle etwork socket) ad ted to sort those problems out by themselves, which usually meas they buy the cheapest switch o the market, which does ot have VLAN support. Therefore, it is importat that the etwork maager takes ito accout those situatios (eve if he does ot kow exactly where those switches may be istalled) i order to prevet possible misbehaviour of the etwork. 111

112 Cofigurig VLANs o Cisco switches (1) VLAN creatio Switch# vla database Switch(vla)#vla 2 ame Admiistratio VLAN 2 added: Name: Admiistratio Switch(vla)#exit APPLY completed. Exitig... switch# Note: the commad for addig a etry i the VLAN database chages accordig to the differet versio of the Cisco IOS ad give device i use. I more moder devices, the vla database commad ca be issued also i stadard cofiguratio mode. I others (e.g. Cisco 6500) the commad is eve differet. 112

113 Cofigurig VLANs o Cisco switches (2) VLAN port associatio Default behavior: a port is cosidered Access ad associated to a default VLAN The switch has a VLAN-uaware behavior Switch# cofigure termial Switch(cofig)#iterface FastEtheret 0/1 Switch(cofig-if)#switchport access vla 2 Switch(cofig-if)#exit Switch# show vla brief VLAN Name Status Ports default active Fa0/2, Fa0/3, Fa0/4 2 Admiistratio active Fa0/1 113

114 Cofigurig VLANs o Cisco switches (3) Cofiguratio of the truk port Switch# cofigure termial Switch(cofig)# iterface FastEtheret 0/2 Switch(cofig-if)# switchport mode truk Switch(cofig-if)# switchport truk allowed vla add 1,2 [or all ] Switch(cofig-if)# exit Switch# 114

115 Etheret LAN desig (1) VLAN-uaware switch Iteret truk liks 115 Data ceter (CED)

116 Etheret LAN desig (2) VLAN-uaware switch Iteret L3 switches 116 Data ceter (CED)

117 Coclusios Moder wired LANs are based o Switched Etheret Star topology with full-duplex liks Collisio domai o loger exists No eed for CSMA/CD Fault tolerace give by redudacy + Spaig Tree Protocol Wide adoptio of VLANs Traffic isolatio Broadcast domai size reductio Routers required for both iteral ad exteral commuicatios L3 closer to the users L3 switches 117