VLAN Configuration Guide

Ethernet is a data network communication technology based on CSMA/CD (Carrier Sense Multiple Access/Collision Detection) shared communication medium. When the number of hosts is high, it can lead to serious conflicts, broadcast flooding, significant performance degradation and even network unavailability. Although LAN interconnection through switches can solve the problem of serious conflicts, it still cannot isolate broadcast packets and improve the quality of the network. VLAN (Virtual Local Area Network) is a communication technology that logically divides a physical LAN into multiple broadcast domains, allowing direct communication between hosts within a VLAN, but not between VLANs, thus limiting broadcast packets to a single VLAN.

Users between different VLANs cannot interoperate, but Layer 3 interworking between VLANs can be achieved by configuring VLAN interfaces on the switch. VLAN interface is a Layer 3 virtual interface that does not exist as a physical entity on the switch. Each VLAN corresponds to a VLAN interface, and once IP address is configured for the VLAN interface, the IP address can be used as a gateway address for network devices within the VLAN, and IP address-based Layer 3 forwarding is performed for packets that need to cross network segments.

VLAN Tag is a unique identifier for a VLAN, also known as 802.1Q Tag.

Whether an interface can be assigned to more than one VLAN is related to the link type and the interface type. Depending on the identification of VLAN frames, interfaces can be divided into three types: Access, Trunk and Hybrid.

Table 1 Access, Trunk and Hybrid

We use the simplest and most intuitive way to divide VLANs - based on interfaces. This way, VLAN members are defined according to the interfaces of the switches. After the specified interface is added to the specified VLAN, the interface can forward packets from that VLAN, thus enabling hosts within the VLAN to interoperate directly (i.e. Layer 2 interworking), while hosts between VLANs cannot interoperate directly, limiting broadcast packets to one VLAN.

VID refers to the VLAN ID. e.g. if you add a Vlan100, then the member ports that are classified to that VLAN all have a VID of 100 and they can receive packets with tag100. PVID refers to Port-base VLAN ID, which is an interface-based VLAN ID. An interface can join multiple VLANs, but can only have one PVID. When an interface receives a packet without a Tag, it is tagged with the VLAN Tag of the PVID and processed as packets for that VLAN. A physical port can only have one PVID, and when a physical port has a PVID, it must have a VID equal to the PVID, and on that VID, the physical port must be Untagged Port. e.g., if a port is added to VLAN100 in untagged mode and to VLAN200, the PVID of the port will be 100.

For different interface types, the switch handles the packets differently, as shown in the table below.

Table 2 Rules for Sending and Receiving Packets

The default setting of VLAN interface is shown in the table below.

Table 3 VLAN Default Setting

Table 4 Configure VLAN

Table 5 Configure VLAN Member Port

Table 6 Configure the IP of VLAN

Table 7 Configure the MTU of VLAN

By default, the MAC address of the interface is dynamically assigned by the system or is the same as the MAC address of the switch. This series supports users to reconfigure the MAC of physical interfaces, VLAN interfaces and link aggregation interfaces.

Table 8 Configure the MAC Address of VLAN

Table 9 Shutdown VLAN

Table 10 Disable MAC Learning for VLAN

Table 11 VLAN Display and Maintenance

#Create VLAN

#Add interfaces to VLANs

#Set the IP for VLAN interfaces

User 1 and User 2 can ping each other.

Suppose a company network has Device A connected to servers Server1 and Server2, belonging to Department 1 and Department 2 respectively, and Device B connected to users User 1 and User 2, belonging to Department 1 and Department 2 respectively. To ensure network communication security, the company requires that employees in each department can only access the servers in their own department. According to the communication principle of VLAN: same VLANs can interoperate directly, Layer 2 isolated Layer 3 interoperability between different VLANs. Therefore, User1 and Server1 are divided into the same VLAN, and User2 and Server2 are divided into the same VLAN to realize that the employees of this department can only access the servers of this department.

Configure Device A.

#Create VLAN

#Add interfaces to VLANs

Configure Device B: as above, without further ado. Configure the IP: set User1 and Server1 to the same network segment, e.g. 192.168.100.0/24, and set User2 and Server2 to the same network segment, e.g. 192.168.200.0/24.

#Check VLAN configuration.

#On User1, ping Server1 is OK, ping Server2 is not OK.

#on User2, ping Server1 is not OK, ping Server2 is OK.