Virtual LANs (VLANs)

• >A VLAN has the technical properties of a physical layer two network without the physical constraints.
• >Hosts in one VLAN cannot communicate with hosts in another without using a router or some other layer three device to route traffic between the two.
• >Like any physical network, a VLAN represents a single broadcast domain.
• >VLANs are not dependent on dedicated physical connections: member hosts can be located on any switch where that VLAN is available and trunked, and a host can even belong to several VLANs.

VLAN tagging

Using VLANs adds a 32-bit (4 byte) sub header to Ethernet frames where necessary — typically internally within a switch and across switch-to-switch links (trunks) that carry multiple VLANs. That header is called a VLAN tag, and it identifies which VLAN the frame belongs to.

VLAN trunking

1. >Access mode (untagged mode)
   • >Single VLAN on the port.
   • >When sending and receiving frames to and from the connected host, no tag is used.
   • >A tag may still be added if the frames cross a trunk port.
2. >Trunk mode (tagged mode)
   • >Multiple VLANs on a single port.
   • >Each frame being sent or received carries a tag to identify the VLAN it belongs to.
   • >A trunk port on each switch serves as a passage between them, identifying every VLAN used in the network.

Expand

Note: we could actually not use a trunk (and therefore VLAN tagging), but instead we'd need to use a dedicated port on each switch for every VLAN used across the two — which would be very wasteful. In the example above we'd use three ports per switch instead of just one.