1. 1 CSCD 433 Network Programming Fall 2011 Lecture 5 VLAN's

2. Topics Review of Broadcast and Collision Domains VLAN's Background Relationship to Broadcast Domains Creating, operation Tagging 2

4. Unicast, Multicast, Broadcast Unicast Unicast separate transmission stream from source to destination for each recipient, example - HTTP Multicast Traffic sent to multiple recipients at same time using one transmission stream to switches, at which point data are distributed out to end users on separate lines, example – IPTV Broadcast Traffic sent out to every node on network or a portion of the network (LAN segment)‏ Broadcasts issued for address resolution when location of user or server is not known, example – DHCP uses broadcast for IP management 4

5. Collision Domain What is a collision domain? Collisions occur on Ethernet networks when... Multiple nodes on a 'network' put a signal on wire at exactly same time Collide with each other When more collisions occur, stations will have to wait longer before they can transmit data Decreases performance for all nodes in same collision domain Networks can be separated into multiple collision domains by using LAN components 5

6. Collision Domains Should Be Small The packets sent by the hosts on the same collision domain may collide with each other. 12- 6

7. Broadcast Domain - Definition What is a broadcast domain? All devices in same broadcast domain will receive broadcast frames originating from any other device within domain Broadcast frames are explicitly directed to all nodes in same network Broadcast domains are essentially Layer 2 segments, which can be extended or separated by using appropriate network components 7

8. Ethernet Hub Configuration 8 Hub creates a collision domain of all the machines connected

9. Ethernet LAN with Switch and Hub Switches separate individual computers into their own collision domain Broadcast domain all computers connected via a switch Unless configured otherwise 9

10. Broadcast Traffic You may think not much traffic is broadcast But you would be wrong!!! Which protocols? ARP, DHCP, IPX, AppleTalk, Windows NetBIOS/SMB Broadcast "service" advertisements to identify servers and the resources (files, printers, directories) they maintain Article below advocates using Wireshark to examine broadcast traffic in a LAN http://www.corecom.com/external/livesecurity/ broadcasttraffic.htm

11. How much Traffic is Broadcast? Nodes on network use broadcast packets to verify certain means of communication, advertise available services and relay routing information about remote networks which are accessible.

12. 12 Need for VLANs

13. 13 Evolution Toward Virtual LANs Olden Days… Thick cables snaked through cable ducts in buildings Every computer they passed was plugged in All people in adjacent offices were put on the same LAN Independent of whether they belonged together or not More recently… Hubs and switches changed all that Every office connected to central wiring closets Often multiple LANs (k hubs) connected by switches Flexibility in mapping offices to different LANs Group users based on organizational structure, rather than the physical layout of the building.

14. Need for Virtual LANS Also, the topology that was created by stacking hubs and switches was considered “flat”...

15. 15 If one switch is good…

16. 16 More is better

17. 17 And More..

18. 18 And More !

19. 19 What is the problem with a flat topology?

20. 20 Broadcast Domain

21. 21 Broadcast Domain

22. 22 Broadcast Domain

23. 23 VLAN's Will Create “Groups” One way to separate a flat, largish network of switches, use VLAN's What's a VLAN?

24. What is a VLAN? What exactly is a VLAN? A virtual local area network (VLAN) is a group of hosts with a common set of requirements that communicate as if they were attached to the same broadcast domain regardless of their physical location 24

25. 25 People Move, and Roles Change Organizational changes are frequent Faculty office becomes a grad-student office Graduate student becomes a faculty member Physical rewiring is a major pain Requires unplugging the cable from one port … and plugging it into another … and hoping the cable is long enough to reach … and hoping you don’t make a mistake Would like to “rewire” the building in software Came up with concept... Virtual LAN (VLAN)‏

26. 26 Why Group by Organizational Structure? Security Ethernet is a shared media Any interface card can be put into “promiscuous” mode So, isolating traffic on separate LANs improves security Load Some LAN segments are more heavily used than others E.g., researchers running experiments get out of hand … can saturate their own segment and not others Plus, there may be natural locality of communication E.g., traffic between people in the same research group

27. Traditional LAN Traditional LAN requires all users of Same requirements, Same IP subnet be connected to Same equipment Notice each switch connected to router is in its own broadcast domain 27

28. VLAN-based LAN By utilizing VLANs, same users can be spread out over various geographical locations and still remain in their same IP subnet 28

29. Virtual Local Area Networks (VLAN)‏ An example of a large network with VLANs Office building with a switch on each of the three floors A main switch connects them all An administrator would be able to maintain a list of MAC addresses, assign stations from different floors to a single VLAN, and create a VLAN for each department in the company Switches can share their MAC address table information with other switches so path to a destination can be quickly found 29

30. 30 VLAN Introduction VLANs are created to provide segmentation services traditionally provided by physical routers in LAN configurations VLANs address scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, and traffic flow management. Switches may not bridge any traffic between VLANs, as this would violate the integrity of the VLAN broadcast domain Traffic should only be routed between VLANs.

31. How VLANs Work? VLANs are identified by a number Valid ranges 1-4094 On a VLAN-capable switch, you assign ports with the appropriate VLAN number The switch only allows data to be sent between ports with same VLAN Communication between VLANs is accomplished through routing Security and filtering functions of the router can be used 31

32. 32 VLANs By creating three VLANs on this switch, this switch has essentially become three separate switches The green, blue, and yellow switch ports are isolated from each other because the switch maintains a separate bridging table for each VLAN vlan 3vlan 2 vlan 1

33. 33 VLAN-Capable Switches The switch maintains a separate bridging table for each VLAN. If frame comes in on a port in VLAN 1, switch searches the bridging table for VLAN 1 When frame is received, switch adds source address to bridging table if it is currently unknown Destination is checked so a forwarding decision can be made For learning and forwarding, search is made against address table for that VLAN only How does a VLAN capable switch function?

34. 34 Without VLANs, ARP Request would be seen by all hosts. Again, consuming unnecessary network bandwidth and host processing cycles. ARP Request Without VLANs – No Broadcast Control

35. 35 Switch Port: VLAN ID ARP Request With VLANs – Broadcast Control

36. 36 Switch Port: VLAN ID The Implications of Creating VLANs Can host 172.30.1.21 communicate with host 172.30.1.10 ?

37. 37 Switch Port: VLAN ID With VLANs Host 172.30.1.21 cannot communicate with host 172.30.1.10 Although all devices are on the same subnet, the switch has isolated the hosts in VLAN 1 from the hosts in VLAN 2 This is fine if you don’t want any communication between VLAN 1 hosts and VLAN 2 hosts

38. Benefits of VLAN's What are some benefits of VLAN's?

39. Benefits of VLANs Logically separate users on same IP subnet Improve Performance Limit size of broadcast domains and limit broadcast activity Security benefits Keep hosts separate by VLAN and limit devices that can talk to those hosts Can bump up security of a single group 39

40. Benefits of VLANs Cost savings You don’t need additional hardware and cabling Operational benefits because changing a user’s IP subnet (Broadcast Domain) is in software 40

41. References Vlans - Orbit Computer Solutions http://www.orbit-computer-solutions.com/VLAN-and- Trunking.php VLAN Tagging http://www.firewall.cx/networking-topics/vlan- networks/219-vlan-tagging.html Example of “Router on a Stick” http://www.orbit-computer-solutions.com/Router-on- a-stick-InterVLAN-Routing.php

42. Summary VLAN's provide efficient way to divide collision domains They allow flexible method of grouping people into virtual networks Allow easier management of switched networks

43. 43 New Assignment will be up... Some problems from the Book