A virtual local area network (VLAN) is any
broadcast domain
A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. A broadcast domain can be within the same LAN segment or it can be bridged to other LAN segments.
In ...
that is
partitioned and isolated in a
computer network
A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are ...
at the
data link layer
The data link layer, or layer 2, is the second layer of the seven-layer OSI model of computer networking. This layer is the protocol layer that transfers data between nodes on a network segment across the physical layer. The data link layer p ...
(
OSI layer 2
The data link layer, or layer 2, is the second layer of the seven-layer OSI model of computer networking. This layer is the protocol layer that transfers data between nodes on a network segment across the physical layer. The data link layer p ...
).
[IEEE 802.1Q-2011, ''1.4 VLAN aims and benefits''] In this context,
virtual, refers to a physical object recreated and altered by additional logic, within the
local area network
A local area network (LAN) is a computer network that interconnects computers within a limited area such as a residence, school, laboratory, university campus or office building. By contrast, a wide area network (WAN) not only covers a larger ...
. VLANs work by applying tags to network frames and handling these tags in networking systems – creating the appearance and functionality of
network traffic Network traffic or data traffic is the amount of data moving across a network at a given point of time. Network data in computer networks is mostly encapsulated in network packets, which provide the load in the network. Network traffic is the main c ...
that is physically on a single network but acts as if it is split between separate networks. In this way, VLANs can keep network applications separate despite being connected to the same physical network, and without requiring multiple sets of cabling and networking devices to be deployed.
VLANs allow
network administrator
A network administrator is a person designated in an organization whose responsibility includes maintaining computer infrastructures with emphasis on local area networks (LANs) up to wide area networks (WANs). Responsibilities may vary between org ...
s to group hosts together even if the hosts are not directly connected to the same
network switch
A network switch (also called switching hub, bridging hub, and, by the IEEE, MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device.
A netw ...
. Because VLAN membership can be configured through software, this can greatly simplify
network design Network planning and design is an iterative process, encompassing
topological design, network-synthesis, and network-realization, and is aimed at ensuring that a new telecommunications network or service meets the needs of the subscriber and op ...
and deployment. Without VLANs, grouping hosts according to their resource needs the labor of relocating
nodes
In general, a node is a localized swelling (a "knot") or a point of intersection (a Vertex (graph theory), vertex).
Node may refer to:
In mathematics
*Vertex (graph theory), a vertex in a mathematical graph
*Vertex (geometry), a point where two ...
or rewiring
data link
A data link is the means of connecting one location to another for the purpose of transmitting and receiving digital information (data communication). It can also refer to a set of electronics assemblies, consisting of a transmitter and a recei ...
s. VLANs allow devices that must be kept separate to share the cabling of a physical network and yet be prevented from directly interacting with one another. This managed sharing yields gains in simplicity,
security
Security is protection from, or resilience against, potential harm (or other unwanted coercive change) caused by others, by restraining the freedom of others to act. Beneficiaries (technically referents) of security may be of persons and social ...
,
traffic management
Traffic management is a key branch within logistics. It concerns the planning control and purchasing of transport services needed to physically move vehicles (for example aircraft, road vehicles, rolling stock and watercraft) and freight.
Traffi ...
, and economy. For example, a VLAN can be used to separate traffic within a business based on individual users or groups of users or their roles (e.g. network administrators), or based on traffic characteristics (e.g. low-priority traffic prevented from impinging on the rest of the network's functioning). Many
Internet hosting service
An Internet hosting service is a service that runs servers connected to the Internet, allowing organizations and individuals to serve content or host services connected to the Internet.
A common kind of hosting is web hosting. Most hosting provi ...
s use VLANs to separate customers' private zones from one other, allowing each customer's servers to be grouped in a single network segment no matter where the individual servers are located in the
data center. Some precautions are needed to prevent traffic "escaping" from a given VLAN, an exploit known as
VLAN hopping
VLAN hopping is a computer security exploit, a method of attacking networked resources on a virtual LAN (VLAN). The basic concept behind all VLAN hopping attacks is for an attacking host on a VLAN to gain access to traffic on other VLANs that woul ...
.
To subdivide a network into VLANs, one configures
network equipment
Networking hardware, also known as network equipment or computer networking devices, are electronic devices which are required for communication and interaction between devices on a computer network. Specifically, they mediate data transmission in ...
. Simpler equipment might partition only each physical port (if even that), in which case each VLAN runs over a dedicated
network cable
Networking cables are networking hardware used to connect one network device to other network devices or to connect two or more computers to share devices such as printers or scanners. Different types of network cables, such as coaxial cable, op ...
. More sophisticated devices can mark
frames through
VLAN tagging
IEEE 802.1Q, often referred to as Dot1q, is the computer network, networking standard that supports virtual local area networking (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the a ...
, so that a single interconnect (''
trunk'') may be used to transport data for multiple VLANs. Since VLANs share bandwidth, a VLAN trunk can use
link aggregation
In computer networking, link aggregation is the combining ( aggregating) of multiple network connections in parallel by any of several methods, in order to increase throughput beyond what a single connection could sustain, to provide redundan ...
,
quality-of-service
Quality of service (QoS) is the description or measurement of the overall performance of a service, such as a telephony or computer network, or a cloud computing service, particularly the performance seen by the users of the network. To quantitat ...
prioritization, or both to route data efficiently.
Uses
VLANs address issues such as
scalability
Scalability is the property of a system to handle a growing amount of work by adding resources to the system.
In an economic context, a scalable business model implies that a company can increase sales given increased resources. For example, a ...
, security, and network management. Network architects set up VLANs to provide
network segmentation
Network segmentation in computer networking is the act or practice of splitting a computer network into subnetworks, each being a network segment. Advantages of such splitting are primarily for boosting performance and improving security.
Advan ...
. Routers between VLANs filter
broadcast traffic, enhance
network security
Network security consists of the policies, policies, processes and practices adopted to prevent, detect and monitor unauthorized access, Abuse, misuse, modification, or denial of a computer network and network-accessible resources. Network securi ...
, perform
address summarization, and mitigate
network congestion
Network congestion in data networking and queueing theory is the reduced quality of service that occurs when a network node or link is carrying more data than it can handle. Typical effects include queueing delay, packet loss or the blocking of ...
.
In a network utilizing broadcasts for
service discovery
Service discovery is the process of automatically detecting devices and services on a computer network. This reduces the need for manual configuration by users and administrators. A service discovery protocol (SDP) is a network protocol that hel ...
, address
assignment
Assignment, assign or The Assignment may refer to:
* Homework
* Sex assignment
* The process of sending National Basketball Association players to its development league; see
Computing
* Assignment (computer science), a type of modification to ...
and
resolution
Resolution(s) may refer to:
Common meanings
* Resolution (debate), the statement which is debated in policy debate
* Resolution (law), a written motion adopted by a deliberative body
* New Year's resolution, a commitment that an individual mak ...
and other services, as the number of peers on a network grows, the frequency of broadcasts also increases. VLANs can help manage broadcast traffic by forming multiple
broadcast domain
A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. A broadcast domain can be within the same LAN segment or it can be bridged to other LAN segments.
In ...
s. Breaking up a large network into smaller independent segments reduces the amount of broadcast traffic each network device and network segment has to bear. Switches may not bridge network traffic between VLANs, as doing so would violate the integrity of the VLAN broadcast domain.
VLANs can also help create multiple
layer 3
In the seven-layer OSI model of computer networking, the network layer is layer 3. The network layer is responsible for packet forwarding including routing through intermediate routers.
Functions
The network layer provides the means of transfe ...
networks on a single physical infrastructure. VLANs are
data link layer
The data link layer, or layer 2, is the second layer of the seven-layer OSI model of computer networking. This layer is the protocol layer that transfers data between nodes on a network segment across the physical layer. The data link layer p ...
(OSI layer 2) constructs, analogous to
Internet Protocol
The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.
IP h ...
(IP)
subnets
A subnetwork or subnet is a logical subdivision of an IP network. Updated by RFC 6918. The practice of dividing a network into two or more networks is called subnetting.
Computers that belong to the same subnet are addressed with an identica ...
, which are
network layer
In the seven-layer OSI model of computer networking, the network layer is layer 3. The network layer is responsible for packet forwarding including routing through intermediate routers.
Functions
The network layer provides the means of transfe ...
(OSI layer 3) constructs. In an environment employing VLANs, a one-to-one relationship often exists between VLANs and IP subnets, although it is possible to have multiple subnets on one VLAN.
Without VLAN capability, users are assigned to networks based on geography and are limited by physical topologies and distances. VLANs can logically group networks to decouple the users' network location from their physical location. By using VLANs, one can control traffic patterns and react quickly to employee or equipment relocations. VLANs provide the flexibility to adapt to changes in network requirements and allow for simplified administration.
VLANs can be used to partition a local network into several distinctive segments, for instance:
* Production
*
Voice over IP
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for the delivery of speech, voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. The terms In ...
*
Network management
Network management is the process of administering and managing computer networks. Services provided by this discipline include fault analysis, performance management, provisioning of networks and maintaining quality of service. Network managem ...
*
Storage area network
A storage area network (SAN) or storage network is a computer network which provides access to consolidated, block-level data storage. SANs are primarily used to access data storage devices, such as disk arrays and tape libraries from ser ...
(SAN)
* Guest Internet access
*
Demilitarized zone
A demilitarized zone (DMZ or DZ) is an area in which treaties or agreements between nations, military powers or contending groups forbid military installations, activities, or personnel. A DZ often lies along an established frontier or bounda ...
(DMZ)
A common infrastructure shared across VLAN trunks can provide a measure of security with great flexibility for a comparatively low cost. Quality of service schemes can optimize traffic on trunk links for real-time (e.g.
VoIP
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for the delivery of voice communications and multimedia sessions over Internet Protocol (IP) networks, such as the Internet. The terms Internet t ...
) or low-latency requirements (e.g.
SAN). However, VLANs as a security solution should be implemented with great care as they can be defeated unless implemented carefully.
In
cloud computing
Cloud computing is the on-demand availability of computer system resources, especially data storage ( cloud storage) and computing power, without direct active management by the user. Large clouds often have functions distributed over mul ...
VLANs, IP addresses, and
MAC address
A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking techno ...
es in the cloud are resources that end users can manage. To help mitigate security issues, placing cloud-based virtual machines on VLANs may be preferable to placing them directly on the Internet.
Network technologies with VLAN capabilities include:
*
Asynchronous Transfer Mode (ATM)
*
Fiber Distributed Data Interface (FDDI)
*
Ethernet
Ethernet () is a family of wired computer networking technologies commonly used in local area networks (LAN), metropolitan area networks (MAN) and wide area networks (WAN). It was commercially introduced in 1980 and first standardized in 198 ...
*
HiperSockets
*
InfiniBand
InfiniBand (IB) is a computer networking communications standard used in high-performance computing that features very high throughput and very low latency. It is used for data interconnect both among and within computers. InfiniBand is also used ...
History
After successful experiments with voice over Ethernet from 1981 to 1984,
W. David Sincoskie joined
Bellcore
iconectiv is a supplier of network planning and network management services to telecommunications providers. Known as Bellcore after its establishment in the United States in 1983 as part of the break-up of the Bell System, the company's name ...
and began addressing the problem of scaling up Ethernet networks. At 10 Mbit/s, Ethernet was faster than most alternatives at the time. However, Ethernet was a broadcast network and there was no good way of connecting multiple Ethernet networks together. This limited the total bandwidth of an Ethernet network to 10 Mbit/s and the maximum distance between nodes to a few hundred feet.
By contrast, although the existing telephone network's speed for individual connections was limited to 56 kbit/s (less than one hundredth of Ethernet's speed), the total bandwidth of that network was estimated at 1 Tbit/s (100,000 times greater than Ethernet).
Although it was possible to use
IP routing
IP routing is the application of routing methodologies to IP networks. This involves not only protocols and technologies but includes the policies of the worldwide organization and configuration of Internet infrastructure. In each IP network nod ...
to connect multiple Ethernet networks together, it was expensive and relatively slow. Sincoskie started looking for alternatives that required less processing per packet. In the process, he independently reinvented
transparent bridging
A network bridge is a computer networking device that creates a single, aggregate network from multiple communication networks or network segments. This function is called network bridging. Bridging is distinct from routing. Routing allows mu ...
, the technique used in modern
Ethernet switch
A network switch (also called switching hub, bridging hub, and, by the IEEE, MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device.
A netw ...
es. However, using switches to connect multiple Ethernet networks in a fault-tolerant fashion requires redundant paths through that network, which in turn requires a
spanning tree
In the mathematical field of graph theory, a spanning tree ''T'' of an undirected graph ''G'' is a subgraph that is a tree which includes all of the vertices of ''G''. In general, a graph may have several spanning trees, but a graph that is not ...
configuration. This ensures that there is only one ''active'' path from any source node to any destination on the network. This causes centrally located switches to become bottlenecks, limiting scalability as more networks are interconnected.
To help alleviate this problem, Sincoskie invented VLANs by adding a tag to each Ethernet frame. These tags could be thought of as colors, say red, green, or blue. In this scheme, each switch could be assigned to handle frames of a single color, and ignore the rest. The networks could be interconnected with three spanning trees, one for each color. By sending a mix of different frame colors, the aggregate bandwidth could be improved. Sincoskie referred to this as a ''multitree bridge''. He and Chase Cotton created and refined the algorithms necessary to make the system feasible. This ''color'' is what is now known in the Ethernet frame as the
IEEE 802.1Q
IEEE 802.1Q, often referred to as Dot1q, is the networking standard that supports virtual local area networking (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying proce ...
header, or the VLAN tag. While VLANs are commonly used in modern Ethernet networks, they are not used in the manner first envisioned here.
In 1998, Ethernet VLANs were described in the first edition of the
IEEE 802.1Q
IEEE 802.1Q, often referred to as Dot1q, is the networking standard that supports virtual local area networking (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying proce ...
-1998 standard. This was extended with
IEEE 802.1ad
IEEE 802.1ad is an Ethernet networking standard. It is as an amendment to IEEE standard IEEE 802.1Q-1998 and was incorporated into the base 802.1Q standard in 2011. The technique specified by the standard is known as provider bridging and stac ...
to allow nested VLAN tags in service of provider bridging. This mechanism was improved with
IEEE 802.1ah-2008.
Configuration and design considerations
Early network designers often segmented physical LANs with the aim of reducing the size of the Ethernet
collision domain
In physics, a collision is any event in which two or more bodies exert forces on each other in a relatively short time. Although the most common use of the word ''collision'' refers to incidents in which two or more objects collide with great fo ...
—thus improving performance. When Ethernet switches made this a non-issue (because each switch port is a collision domain), attention turned to reducing the size of the
data link layer
The data link layer, or layer 2, is the second layer of the seven-layer OSI model of computer networking. This layer is the protocol layer that transfers data between nodes on a network segment across the physical layer. The data link layer p ...
broadcast domain. VLANs were first employed to separate several broadcast domains across one physical medium. A VLAN can also serve to restrict access to network resources without regard to physical topology of the network.
VLANs operate at the data link layer of the
OSI model
The Open Systems Interconnection model (OSI model) is a conceptual model that 'provides a common basis for the coordination of SOstandards development for the purpose of systems interconnection'. In the OSI reference model, the communications ...
. Administrators often configure a VLAN to map directly to an IP network, or subnet, which gives the appearance of involving the
network layer
In the seven-layer OSI model of computer networking, the network layer is layer 3. The network layer is responsible for packet forwarding including routing through intermediate routers.
Functions
The network layer provides the means of transfe ...
. Generally, VLANs within the same organization will be assigned different non-overlapping
network address
A network address is an identifier for a node or host on a telecommunications network. Network addresses are designed to be unique identifiers across the network, although some networks allow for local, private addresses, or locally administer ...
ranges. This is not a requirement of VLANs. There is no issue with separate VLANs using identical overlapping address ranges (e.g. two VLANs each use the
private network
In Internet networking, a private network is a computer network that uses a private address space of IP addresses. These addresses are commonly used for local area networks (LANs) in residential, office, and enterprise environments. Both the IP ...
). However, it is not possible to
route
Route or routes may refer to:
* Route (gridiron football), a path run by a wide receiver
* route (command), a program used to configure the routing table
* Route, County Antrim, an area in Northern Ireland
* ''The Route'', a 2013 Ugandan film
* Ro ...
data between two networks with overlapping addresses without delicate
IP remapping, so if the goal of VLANs is segmentation of a larger overall organizational network, non-overlapping addresses must be used in each separate VLAN.
A basic switch that is not configured for VLANs has VLAN functionality disabled or permanently enabled with a ''default VLAN'' that contains all ports on the device as members.
The default VLAN typically uses VLAN identifier 1. Every device connected to one of its ports can send packets to any of the others. Separating ports by VLAN groups separates their traffic very much like connecting each group using a distinct switch for each group.
Remote management of the switch requires that the administrative functions be associated with one or more of the configured VLANs.
In the context of VLANs, the term ''trunk'' denotes a network link carrying multiple VLANs, which are identified by labels (or ''tags'') inserted into their packets. Such trunks must run between ''tagged ports'' of VLAN-aware devices, so they are often switch-to-switch or switch-to-
router links rather than links to hosts. (Note that the term 'trunk' is also used for what Cisco calls "channels" :
Link Aggregation or Port Trunking). A router (Layer 3 device) serves as the
backbone
The backbone is the vertebral column of a vertebrate.
Arts, entertainment, and media Film
* ''Backbone'' (1923 film), a 1923 lost silent film starring Alfred Lunt
* ''Backbone'' (1975 film), a 1975 Yugoslavian drama directed by Vlatko Gilić
...
for network traffic going across different VLANs. It is only when the VLAN port group is to extend to another device that tagging is used. Since communications between ports on two different switches travel via the uplink ports of each switch involved, every VLAN containing such ports must also contain the uplink port of each switch involved, and traffic through these ports must be tagged.
Switches typically have no built-in method to indicate VLAN to port associations to someone working in a
wiring closet
A wiring cupboard is a small room commonly found in institutional buildings, such as schools and offices, where electrical connections are made. While they are used for many purposes, their most common use is for computer networking where it may ...
. It is necessary for a technician to either have administrative access to the device to view its configuration, or for VLAN port assignment charts or diagrams to be kept next to the switches in each wiring closet.
Protocols and design
The protocol most commonly used today to support VLANs is
IEEE 802.1Q
IEEE 802.1Q, often referred to as Dot1q, is the networking standard that supports virtual local area networking (VLANs) on an IEEE 802.3 Ethernet network. The standard defines a system of VLAN tagging for Ethernet frames and the accompanying proce ...
. The
IEEE 802.1 IEEE 802.1 is a working group of the IEEE 802 project of the IEEE Standards Association.
It is concerned with:
* 802 LAN/MAN architecture
* internetworking among 802 LANs, MANs and wide area networks
* 802 Link Security
* 802 overall network manage ...
working group defined this method of multiplexing VLANs in an effort to provide multivendor VLAN support. Prior to the introduction of the 802.1Q standard, several
proprietary protocol
In telecommunications, a proprietary protocol is a communications protocol owned by a single organization or individual.
Intellectual property rights and enforcement
Ownership by a single organization gives the owner the ability to place restricti ...
s existed, such as
Cisco Inter-Switch Link
Cisco Inter-Switch Link (ISL) is a Cisco Systems proprietary protocol that maintains VLAN information in Ethernet frames as traffic flows between switches and routers, or switches and switches. ISL is Cisco's VLAN encapsulation protocol and is su ...
(ISL) and
3Com
3Com Corporation was an American digital electronics manufacturer best known for its computer network products. The company was co-founded in 1979 by Robert Metcalfe, Howard Charney and others. Bill Krause joined as President in 1981. Metcalfe ex ...
's Virtual LAN Trunk (VLT). Cisco also implemented VLANs over
FDDI
Fiber Distributed Data Interface (FDDI) is a standard for data transmission in a local area network.
It uses optical fiber as its standard underlying physical medium, although it was also later specified to use copper cable, in which case it m ...
by carrying VLAN information in an
IEEE 802.10 IEEE 802.10 is a former standardization, standard for security functions that could be used in both local area networks and metropolitan area networks based on IEEE 802 Communications protocol, protocols.
802.10 specifies security association manag ...
frame header, contrary to the purpose of the IEEE 802.10 standard.
Both ISL and IEEE 802.1Q perform ''explicit tagging'' – the frame itself is tagged with VLAN identifiers. ISL uses an external tagging process that does not modify the Ethernet frame, while 802.1Q uses a frame-internal field for tagging, and therefore does modify the basic Ethernet frame structure. This internal tagging allows IEEE 802.1Q to work on both access and trunk links using standard Ethernet hardware.
IEEE 802.1Q
Under IEEE 802.1Q, the maximum number of VLANs on a given Ethernet network is 4,094 (4,096 values provided by the 12-bit field minus reserved values at each end of the range, 0 and 4,095). This does not impose the same limit on the number of IP subnets in such a network since a single VLAN can contain multiple IP subnets.
IEEE 802.1ad
IEEE 802.1ad is an Ethernet networking standard. It is as an amendment to IEEE standard IEEE 802.1Q-1998 and was incorporated into the base 802.1Q standard in 2011. The technique specified by the standard is known as provider bridging and stac ...
extends the number of VLANs supported by adding support for multiple, nested VLAN tags.
IEEE 802.1aq
Shortest Path Bridging (SPB), specified in the IEEE 802.1aq standard, is a computer networking technology intended to simplify the creation and configuration of Ethernet networks while enabling multipath routing.
It is the replacement for the ...
(Shortest Path Bridging) expands the VLAN limit to 16 million. Both improvements have been incorporated into the IEEE 802.1Q standard.
Cisco Inter-Switch Link
Inter-Switch Link (ISL) is a Cisco proprietary protocol used to interconnect switches and maintain VLAN information as traffic travels between switches on trunk links. ISL is provided as an alternative to IEEE 802.1Q. ISL is available only on some Cisco equipment and has been deprecated.
[CCNA Exploration LAN Switching and Wireless course, v 4.0, sec 3.2.3]
Cisco VLAN Trunking Protocol
VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol that propagates the definition of VLANs on the whole local area network. VTP is available on most of the
Cisco Catalyst
Catalyst is the brand for a variety of network switches, wireless controllers, and wireless access points sold by Cisco Systems. While commonly associated with Ethernet switches, a number of different types of network interfaces have been availa ...
Family products. The comparable IEEE standard in use by other manufacturers is
GARP VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
(GVRP) or the more recent
Multiple VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
(MVRP).
Multiple VLAN Registration Protocol
Multiple VLAN Registration Protocol is an application of Multiple Registration Protocol that allows automatic configuration of VLAN information on network switches. Specifically, it provides a method to dynamically share VLAN information and configure the needed VLANs.
Membership
VLAN membership can be established either statically or dynamically.
Static VLANs are also referred to as port-based VLANs. Static VLAN assignments are created by assigning ports to a VLAN. As a device enters the network, the device automatically assumes the VLAN of the port. If the user changes ports and needs access to the same VLAN, the network administrator must manually make a port-to-VLAN assignment for the new connection.
Dynamic VLANs are created using software or by protocol. With a
VLAN Management Policy Server
A VLAN Management Policy Server (VMPS) is a network switch that contains a mapping of device information to VLAN.
The primary goal of VMPS is VLAN assignment for general network management purposes, but can also be used for providing security thro ...
(VMPS), an administrator can assign switch ports to VLANs dynamically based on information such as the source MAC address of the device connected to the port or the username used to log onto that device. As a device enters the network, the switch queries a database for the VLAN membership of the port that device is connected to. Protocol methods include
Multiple VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
(MVRP) and the somewhat obsolete
GARP VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
(GVRP).
Protocol-based VLANs
In a switch that supports protocol-based VLANs, traffic may be handled on the basis of its protocol. Essentially, this segregates or forwards traffic from a port depending on the particular protocol of that traffic; traffic of any other protocol is not forwarded on the port. This allows, for example, IP and IPX traffic to be automatically segregated by the network.
VLAN cross connect
VLAN cross connect (CC or VLAN-XC) is a mechanism used to create Switched VLANs, VLAN CC uses IEEE 802.1ad frames where the S Tag is used as a Label as in
MPLS
Multiprotocol Label Switching (MPLS) is a routing technique in telecommunications networks that directs data from one node to the next based on labels rather than network addresses. Whereas network addresses identify endpoints the labels identif ...
. IEEE approves the use of such a mechanism in part 6.11 of
IEEE 802.1ad-2005.
See also
*
HVLAN {{unreferenced, date=July 2013
Hierarchical VLAN (HVLAN) is a proposed Ethernet standard that extends the use of enterprise Ethernet VLAN (802.1Q) to carrier networks. A number of developments have emerged in recent years to help bring Ethernet, a ...
, hierarchical VLAN
*
Multiple VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
,
GARP VLAN Registration Protocol
Multiple Registration Protocol (MRP), which replaced Generic Attribute Registration Protocol (GARP), is a generic registration framework defined by the IEEE 802.1ak amendment to the IEEE 802.1Q standard. MRP allows bridges, switches or other simil ...
*
Network virtualization
In computing, network virtualization is the process of combining hardware and software network resources and network functionality into a single, software-based administrative entity, a virtual network. Network virtualization involves platform vi ...
*
Private VLAN
Private or privates may refer to:
Music
* "In Private", by Dusty Springfield from the 1990 album ''Reputation''
* Private (band), a Denmark-based band
* "Private" (Ryōko Hirosue song), from the 1999 album ''Private'', written and also recorded ...
*
Software-defined networking
Software-defined networking (SDN) technology is an approach to network management that enables dynamic, programmatically efficient network configuration in order to improve network performance and monitoring, making it more like cloud computing t ...
*
Switch virtual interface
A switch virtual interface (SVI) represents a logical layer-3 interface on a switch.
VLANs divide broadcast domains in a LAN environment. Whenever hosts in one VLAN need to communicate with hosts in another VLAN, the traffic must be routed betw ...
*
Virtual Extensible LAN
Virtual Extensible LAN (VXLAN) is a network virtualization technology that attempts to address the scalability problems associated with large cloud computing deployments. It uses a VLAN-like encapsulation technique to encapsulate OSI layer 2 Ethern ...
(VXLAN)
*
Virtual Private LAN Service
Virtual Private LAN Service (VPLS) is a way to provide Ethernet-based multipoint to multipoint communication over IP or MPLS networks. It allows geographically dispersed sites to share an Ethernet broadcast domain by connecting sites through ps ...
*
Virtual private network
A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...
*
VLAN access control list A VLAN access control list (VACL) provides access control for all packets that are bridged within a VLAN or that are routed into or out of a VLAN. Unlike regular Cisco IOS access control lists that are configured on router interfaces and applied on ...
*
Wide area network
A wide area network (WAN) is a telecommunications network that extends over a large geographic area. Wide area networks are often established with leased telecommunication circuits.
Businesses, as well as schools and government entities, us ...
Notes
References
{{Reflist
Further reading
*
Andrew S. Tanenbaum
Andrew Stuart Tanenbaum (born March 16, 1944), sometimes referred to by the handle ast, is an American-Dutch computer scientist and professor emeritus of computer science at the Vrije Universiteit Amsterdam in the Netherlands.
He is the author ...
, 2003, "Computer Networks", Pearson Education International, New Jersey.
Local area networks
Network protocols