Understanding VLANs and Network Segmentation
Virtual Local Area Networks are logical subdivisions of a physical network. VLANs operate independently even though devices share the same physical switch infrastructure.
How VLANs Work
VLANs use VLAN ID tagging to mark frames with a logical group number. Switches process traffic based on these logical groupings, not just physical port assignments. Each VLAN creates a separate broadcast domain, meaning devices in different VLANs cannot communicate without a router or multilayer switch.
Key Benefits of VLANs
- Improved security by isolating sensitive departments
- Reduced broadcast traffic congestion
- Simplified network management and flexibility
- Easy device assignment regardless of physical location
VLAN Assignment Methods
Static VLANs assign ports manually to specific VLAN numbers. This is the most common approach for the CCNA exam. Dynamic VLANs use protocols like VMPS to automatically assign ports based on MAC addresses or usernames.
VLAN Numbering Rules
VLANs 1-1005 store in the VLAN database on the switch. VLANs 1006-4094 store only in the running configuration. VLAN 1 is the default VLAN and cannot be deleted. This distinction matters for the CCNA exam.
Access Ports vs. Trunk Ports
Access ports belong to a single VLAN and carry only traffic for that VLAN. Use these for end devices like computers and printers. Trunk ports carry traffic for multiple VLANs simultaneously. Use these for switch-to-switch connections. Understanding when to use each port type is crucial for exam success and real networking.
VLAN Trunking Protocol and Configuration
VLAN trunks are connections between switches that carry traffic for multiple VLANs. Trunking protocols add special headers to identify which VLAN each frame belongs to.
Trunking Protocols
IEEE 802.1Q is the industry standard protocol. It is widely supported across vendors and adds a 4-byte VLAN tag to each frame. ISL (Inter-Switch Link) is Cisco proprietary and encapsulates the entire frame, adding more overhead than 802.1Q. The CCNA exam focuses heavily on 802.1Q.
Native VLAN Concept
The native VLAN is the untagged VLAN on a trunk port. Both switches must configure matching native VLANs, or connectivity breaks. By default, native VLAN is VLAN 1, but you can change it. Mismatched native VLANs cause VLAN hopping vulnerabilities and dropped frames.
Essential Trunk Configuration Commands
- switchport mode trunk (enables trunking)
- switchport trunk encapsulation dot1q (specifies 802.1Q)
- switchport trunk allowed vlan (defines which VLANs traverse the trunk)
- switchport trunk native vlan (sets the untagged VLAN)
Dynamic Trunking Protocol (DTP)
DTP automatically negotiates trunk formation between switches. The modes are on (always forms trunks), off (never forms trunks), desirable (attempts to form), and auto (passively accepts). DTP mismatches cause trunks to fail. The CCNA exam tests troubleshooting trunks that fail due to DTP or encapsulation conflicts.
Practice configuring multiple VLAN scenarios on switch simulators. This helps you internalize trunk configuration and troubleshoot real issues.
Inter-VLAN Routing and Communication
Devices in different VLANs cannot communicate by default because each VLAN is a separate broadcast domain. Inter-VLAN routing enables communication between VLANs using a Layer 3 device.
Router-on-a-Stick Method
This approach uses a single physical link between the switch and router. The link is configured as a trunk carrying multiple VLAN subinterfaces. Each subinterface represents a different VLAN with its own IP address serving as the default gateway.
Example configuration: Router(config-subif)# encapsulation dot1q 10 assigns VLAN 10 to that subinterface. This method is cost-effective for small networks but creates a bandwidth bottleneck since all inter-VLAN traffic crosses a single link.
Multilayer Switch Approach
Multilayer switches (Layer 3 switches) route traffic between VLANs internally at Layer 3. They contain both switching ASICs for Layer 2 and routing engines for Layer 3 operations. This approach provides superior performance and eliminates the bandwidth bottleneck.
SVI Configuration
Multilayer switches use Switched Virtual Interfaces (SVIs) to represent the Layer 3 presence of a VLAN. Create SVIs with the interface vlan command and enable IP routing globally with ip routing. SVIs are logical interfaces, while physical interfaces operate at Layer 2.
Choosing Between Methods
Use router-on-a-stick for small networks with light inter-VLAN traffic. Use multilayer switches for larger networks or high-traffic environments. The CCNA exam expects you to configure both scenarios and understand the trade-offs. Practice both methods on simulators to reinforce your understanding.
Spanning Tree Protocol and Preventing Network Loops
Spanning Tree Protocol (STP) prevents logical loops in redundant network topologies. When multiple switches connect in a mesh for redundancy, frames can circulate indefinitely and destabilize the network. STP automatically detects and blocks redundant paths.
How STP Works
STP uses Bridge Protocol Data Units (BPDUs) to communicate topology information. The protocol elects a root bridge based on bridge priority and MAC address. Each switch then calculates its root port (lowest cost to reach root) and designated ports (ports that forward on each segment). All other ports are blocked to prevent loops.
STP Port States
- Disabled: Administratively shut down
- Blocking: Does not forward frames, listens for BPDUs (20 seconds)
- Listening: Hears BPDUs and prepares to forward (15 seconds)
- Learning: Learns MAC addresses but doesn't forward data (15 seconds)
- Forwarding: Actively forwards data frames and BPDUs
Total convergence time is typically 30-50 seconds (20 + 15 + 15). Only listening and learning states last their full duration.
Improvements to STP
Rapid Spanning Tree Protocol (RSTP) improves convergence to just a few seconds by introducing new port roles. Multiple Spanning Tree Protocol (MSTP) enables different spanning trees for different VLAN groups, providing better load balancing.
Exam Preparation Tips
Practice calculating path costs and identifying the root bridge in various topologies. Use network simulators to observe STP convergence in real-time. Understand how topology changes affect the spanning tree and port state transitions.
Switch Security, Port Security, and VLAN Best Practices
Switch security protects network infrastructure from unauthorized access and attacks. Understanding these features is essential for production network deployment.
Port Security Configuration
Port security limits the MAC addresses allowed on a specific port. Use the switchport port-security command to enable the feature. Specify allowed MAC addresses with switchport port-security mac-address. Set the maximum number of addresses with switchport port-security maximum.
Violation modes determine what happens when a port security limit is exceeded:
- Shutdown (default): Disables the port completely
- Restrict: Drops packets without logging
- Protect: Only drops packets, logs nothing
Sticky MAC addresses combine static and dynamic learning. They remember learned addresses even after a reboot.
Additional Security Features
Access Control Lists (ACLs) protect sensitive VLANs by controlling traffic flow between network segments. Storm control prevents broadcast storms by limiting bandwidth percentage used by broadcast traffic. BPDU guard blocks ports that receive BPDUs, preventing unauthorized switch insertion.
VLAN Best Practices
- Avoid using VLAN 1 for production traffic
- Use proper VLAN numbering schemes for organization
- Configure management VLANs for administrative access
- Implement VLAN pruning to prevent unnecessary VLAN flooding
- Ensure native VLANs match on all trunk ports
- Use BPDU guard and root guard on access port edges
Understanding how these security features interact with spanning tree and VLAN operations ensures comprehensive network protection. Configure these features on practice switches and test how they respond to violations.