Table of Contents 1 VLAN Configuration 1-1 Overview 1-1 Introduction to VLAN 1-1 VLAN Fundamentals 1-2 Types of VLAN 1-3 Introduction to Port-Based VLAN 1-3 Configuring a VLAN 1-4 Configuration Task List 1-4 Creating a VLAN 1-4 Modifying a VLAN 1-5 Modifying a Port 1-6 VLAN Configuration Examples 1-7 Configuration Guidelines 1-11 i
1 VLAN Configuration Overview Introduction to VLAN Ethernet is a network technology based on the Carrier Sense Multiple Access/Collision Detect (CSMA/CD) mechanism. As the medium is shared, collisions and excessive broadcasts are common on an Ethernet. To address the issue, virtual LAN (VLAN) was introduced. The idea is to break a LAN down into separate VLANs, that is, Layer 2 broadcast domains whereby frames are switched between ports assigned to the same VLAN. VLANs are isolated from each other at Layer 2. A VLAN is a bridging domain, and all broadcast traffic is contained within it, as shown in Figure 1-1. Figure 1-1 VLAN diagram A VLAN is logically divided on an organizational basis rather than on a physical basis. For example, all workstations and servers used by a particular workgroup can be connected to the same LAN, regardless of their physical locations. VLAN technology delivers the following benefits: Confining broadcast traffic within individual VLANs. This reduces bandwidth waste and improves network performance. Improving LAN security. By assigning user groups to different VLANs, you can isolate them at Layer 2. For hosts in different VLANs to communicate, routers or Layer 3 switches are required. Flexible virtual workgroup creation. As users from the same workgroup can be assigned to the same VLAN regardless of their physical locations, network construction and maintenance is much easier and more flexible. 1-1
VLAN Fundamentals To enable a network device to identify frames of different VLANs, a VLAN tag field is inserted into the data link layer encapsulation. The format of VLAN-tagged frames is defined in IEEE 802.1Q issued by Institute of Electrical and Electronics Engineers (IEEE) in 1999. In the header of a traditional Ethernet data frame as shown in Figure 1-2, the field after the destination MAC address and the source MAC address fields (DA&SA in the figure) is the Type field indicating the upper layer protocol type. Figure 1-2 The format of a traditional Ethernet frame IEEE 802.1Q inserts a four-byte VLAN tag before the Type field, as shown in Figure 1-3. Figure 1-3 The position and format of VLAN tag A VLAN tag comprises four fields: tag protocol identifier (TPID), priority, canonical format indicator (CFI), and VLAN ID. The 16-bit TPID field with a value of 0x8100 indicates that the frame is VLAN tagged. The 3-bit priority field indicates the 802.1p priority of the frame. The 1-bit CFI field specifies whether the MAC addresses are encapsulated in the canonical format for the receiving device to correctly interpret the MAC addresses. Value 0 indicates that the MAC addresses are encapsulated in canonical format; value 1 indicates that the MAC addresses are encapsulated in non-canonical format. The field is set to 0 by default. The 12-bit VLAN ID field identifies the VLAN the frame belongs to. The VLAN ID range is 0 to 4095. As 0 and 4095 are reserved by the protocol, the VLAN ID range available for assignment is 1 to 4094. When receiving a frame, a network device looks at its VLAN tag to decide how to handle the frame. For more information, see Introduction to Port-Based VLAN. The Ethernet II encapsulation format is used in this section. Besides this format, other encapsulation formats, including 802.2 LLC, 802.2 SNAP, and 802.3 raw, are also supported by Ethernet. The VLAN tag fields are also used in these encapsulations for VLAN identification. For a frame with multiple VLAN tags, the device handles it according to its outer-most VLAN tag and transmits its inner VLAN tags as payload. 1-2
Types of VLAN You can create VLANs based on: Port MAC address Protocol IP subnet Policy Other criteria Because the Web interface is available only for port-based VLANs, this chapter introduces only port-based VLANs. Introduction to Port-Based VLAN Port-based VLANs group VLAN members by port. A port forwards traffic for a VLAN only after it is assigned to the VLAN. Port link type Depending on the tag handling mode, the link type of a port can be one of the following three: Access. An access port belongs to only one VLAN. Usually, ports directly connected to PCs are configured as access ports. Trunk. A trunk port can be assigned to multiple VLANs to receive and send traffic for them. Usually, ports connecting network devices are configured as trunk ports to allow members of the same VLAN to communicate with each other across multiple network devices. Hybrid. A hybrid port can join multiple VLANs to receive and send traffic for them. You can configure a port connected to a network device or user terminal as a hybrid port for access link connectivity or trunk connectivity. Default VLAN By default, VLAN 1 is the default VLAN for all ports. However, you can change the default VLAN for a port as required. When doing that, follow these guidelines: Because an access port can join only one VLAN, its default VLAN is the VLAN to which it belongs and cannot be configured. Because a trunk or hybrid port can join multiple VLANs, you can configure a default VLAN for the port. A port with a default VLAN configured handles a frame as follows: Port type Access Untagged frame Tag the frame with the default VLAN tag. Actions (in the inbound direction) Tagged frame Receive the frame if its VLAN ID is the same as the default VLAN ID. Drop the frame if its VLAN ID is different from the default VLAN ID. Actions (in the outbound direction) Remove the default VLAN tag and send the frame. 1-3
Port type Trunk Hybrid Untagged frame Check whether the default VLAN is carried on the port: If yes, tag the frame with the default VLAN tag. If not, drop the frame. Actions (in the inbound direction) Tagged frame Receive the frame if its VLAN is carried on the port. Drop the frame if its VLAN is not carried on the port. Actions (in the outbound direction) Remove the tag and send the frame if the frame carries the default VLAN tag and the port permits the default VLAN. Send the frame without removing the tag if its VLAN is carried on the port but is different from the default one. Send the frame if its VLAN is carried on the port. The frame is sent with the VLAN tag removed or intact depending on your configuration. Configuring a VLAN Configuration Task List Perform the tasks in Table 1-1 to configure a VLAN: Table 1-1 VLAN configuration task list Task Remarks Creating a VLAN Modifying a VLAN Modifying a Port Required Required Select either task Configure the untagged member ports and tagged member ports of the VLAN, or remove ports from the VLAN. Creating a VLAN Select Network > VLAN > VLAN from the navigation tree to enter the page as shown in Figure 1-4. 1-4
Figure 1-4 VLAN configuration page Click Add to enter the page for creating a VLAN, as shown in Figure 1-5. Figure 1-5 Create a VLAN Table 1-2 describes the configuration items of creating a VLAN. Table 1-2 Configuration items of creating a VLAN Item Description VLAN ID ID of the VLAN to be created You can create a VLAN or a VLAN range. Return to VLAN configuration task list. Modifying a VLAN Select Network > VLAN > VLAN from the navigation tree to enter the page as shown in Figure 1-4. In the Operation column for the VLAN you want to modify, click the icon to enter the page for modifying the VLAN, as shown in Figure 1-6. 1-5
Figure 1-6 Modify a VLAN Table 1-3 describes the configuration items of modifying a VLAN. Table 1-3 Configuration items of modifying a VLAN Item Description ID Description Displays the ID of the VLAN to be modified Set the description string of the VLAN By default, the description string of a VLAN is its VLAN ID, such as VLAN 0001. Port Untagged Member Tagged Member Not A Member Set the member type of the port to be modified in the VLAN Find the port to be modified and select the Untagged Member, Tagged Member, or Not A Member option for the port: Untagged: Indicates that the port sends the traffic of the VLAN with the VLAN tag removed. Untagged: Indicates that the port sends the traffic of the VLAN without removing the VLAN tag. Not a Member: Removes the port from the VLAN. For VLAN 1, no port list is displayed on the page and you can only modify the description string. Return to VLAN configuration task list. Modifying a Port Select Network > VLAN > Port from the navigation tree to enter the page as shown in Figure 1-7. Figure 1-7 Port configuration page In the Operation column, click the port, as shown in Figure 1-8. icon for the port to be modified to enter the page for modifying the 1-6
Figure 1-8 Modify a port Table 1-4 describes the configuration items of modifying a port. Table 1-4 Configuration items of modifying a port Item Description Port Untagged Member VLAN Tagged Member VLAN Displays the port to be modified Displays the VLAN(s) to which the port belongs as an untagged member Displays the VLAN(s) to which the port belongs as a tagged member Member Type VLAN ID Untagged Tagged Not A Member Set the target member type of the port Select the Untagged, Tagged, or Not A Member radio button: Untagged: Indicates that the port sends the traffic of the VLAN with the VLAN tag removed. Untagged: Indicates that the port sends the traffic of the VLAN without removing the VLAN tag. Not A Member: Removes the port from the VLAN. Specify the VLAN to which the port belongs. Return to VLAN configuration task list. VLAN Configuration Examples Network requirements As shown in Figure 1-9: Device A is connected to Device B through port GigabitEthernet 0/1. GigabitEthernet 0/1 is a hybrid port with VLAN 100 as its default VLAN. Assign GigabitEthernet 0/1 to VLAN 2 and VLANs 6 through 50 as an untagged member, and to VLAN 100 as a tagged member. Figure 1-9 Network diagram for VLAN configuration 1-7
Configuration procedure Configure Device A Before making the following configurations, check whether GigabitEthernet 0/1 operates in router mode. If yes, change its operating mode to bridge mode (to do that, select Device Management > Interface from the navigation tree, and then find and select GigabitEthernet 0/1 to configure it accordingly); in addition, specify the security zone to which GigabitEthernet 0/1 belongs when assigned to VLAN 2, VLANs 6 to 50, and VLAN 100. # Create VLAN 2, VLANs 6 through 50, and VLAN 100. 1) Select Network > VLAN > VLAN from the navigation tree. On the page that appears, click Add and make the following configurations, as shown in Figure 1-10. Figure 1-10 Create VLANs Enter VLAN IDs 2, 6-50, and 100. Click Apply. # Configure VLAN 100 as the default VLAN of GigabitEthernet 0/1. By default, all ports are access ports and their default VLANs are all VLAN 1. Select Network > VLAN > Port from the navigation tree, click the icon corresponding to port GigabitEthernet 0/1 in the Operation column, and then make the following configurations, as shown in Figure 1-11. Figure 1-11 Configure the default VLAN of GigabitEthernet 0/1. Select the Untagged option for Member Type. 1-8
Enter VLAN ID 100. Click Apply. # Configure GigabitEthernet 0/1 as a hybrid port and assign it to VLAN 2 and VLANs 6 through 50 as an untagged member. Click the icon corresponding to GigabitEthernet 0/1 in the Operation column and make the following configurations, as shown in Figure 1-12. Figure 1-12 Assign GigabitEthernet 0/1 to VLAN 2 and VLANs 6 through 50 as an untagged member Select the Untagged option for Member Type. Enter VLAN IDs 2, 6-50. Click Apply. A dialog box appears telling you that the access port will be changed into a hybrid port. Click OK in the dialog box. # Assign GigabitEthernet 0/1 to VLAN 100 as a tagged member. Select Network > VLAN > VLAN from the navigation tree. Enter 100 in the VLAN Range text box. Click Select. The page is as shown in Figure 1-13. Figure 1-13 VLAN configuration page Click the icon corresponding to VLAN 100 in the Operation column and make the following configuration on the page shown in Figure 1-14. 1-9
Figure 1-14 Assign GigabitEthernet 0/1 to VLAN 100 as a tagged member Find GigabitEthernet 0/1 in the port list and select the Tagged Member option for it. Click Apply to end the operation. 2) Configure Device B Configure Device B as you configure Device A. Verifying the configuration # Display the port statistics of GigabitEthernet 0/1 on Device A. Select Device Management > Interface from the navigation tree. Click GigabitEthernet0/1 on the page that appears to enter the page displaying the port statistics of GigabitEthernet 0/1, as shown in Figure 1-15. 1-10
Figure 1-15 Display the port statistics of GigabitEthernet 0/1 Configuration Guidelines VLAN 1 is the default VLAN, which can be neither created nor removed manually. Some VLANs are reserved for special purposes. You can neither create nor remove them manually. You cannot manually remove dynamic VLANs. You are recommended to set the same default VLAN ID for the local and remote ports. Ensure that a port is assigned to its default VLAN. Otherwise, when the port receives frames tagged with the PVID tag or untagged frames (including protocol packets such as STP BPDUs), the port filters out these frames. As shown in Figure 1-4, on the VLAN configuration page, when you type a VLAN range in the VLAN Range box and then click Select, the table below lists the information about all the VLANs within this range, which makes the operation much easier when the device contains a large number of VLANs; after you click Delete, all VLANs within this range will be removed. 1-11