Upon completion of this tutorial, you should be able to:
Virtual LANs (VLANs) are a fundamental technology for modern Ethernet networks, allowing a single physical switch to be partitioned into multiple logical broadcast domains. This tutorial covers the motivation for VLANs, their benefits, the IEEE 802.1Q tagging standard, port types (access and trunk), native VLAN, inter-VLAN routing, and security considerations. VLANs are essential for network segmentation, performance optimization, and security enforcement in enterprise and data-center environments.
A VLAN is a logical grouping of network devices that allows them to communicate as if they were on the same physical network, even if they are not. VLANs are configured on switches and operate at Layer 2.
Motivations for VLANs:
IEEE 802.1Q is the standard for VLAN tagging. It adds a 4-byte tag to the Ethernet frame between the source MAC address and the EtherType/Length field.
802.1Q Tag Structure:
The tag increases the maximum frame size to 1522 bytes (or 1524 with some implementations).
Some switches support General ports (Cisco's "dynamic" or "trunk" with negotiation), but access/trunk is the common distinction.
Basic steps to configure a VLAN on a switch:
VLANs can be static (port-based) or dynamic (based on MAC address or user authentication via 802.1X).
Hosts in different VLANs cannot communicate directly; they need a Layer 3 device (router or Layer 3 switch).
Example: VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The router or Layer 3 switch has an IP in each subnet and routes between them.
VLAN hopping is an attack where an attacker sends tagged frames or uses a double-tagging attack to gain access to a VLAN they shouldn't. Mitigations:
Common issues:
Tools: show vlan, show interfaces trunk, show interfaces status, and ping/traceroute for connectivity.
Question 1: What is the primary purpose of a VLAN?
(b) To create a logical broadcast domain within a physical network. VLANs segment broadcast domains.
Question 2: How many bits are used for the VLAN ID in the 802.1Q tag?
(b) 12. The VLAN ID is 12 bits, allowing 4096 VLANs.
Question 3: Which of the following is a valid 802.1Q tag field?
(a) TPID (0x8100). TPID identifies the tag.
Question 4: What type of port is used to connect an end-user PC to a switch?
(b) Access port. Access ports are for end devices.
Question 5: What is the default native VLAN on most switches?
(b) VLAN 1. This is the default native VLAN.
Question 6: Which device is required for hosts in different VLANs to communicate?
(c) Router or Layer 3 switch. Inter-VLAN routing requires Layer 3.
Question 7: The 802.1Q tag is inserted between which fields in an Ethernet frame?
(b) Source MAC and EtherType/Length. The tag is placed after the source MAC.
Question 8: What is a trunk port?
(b) A port that carries traffic for multiple VLANs with tagging. Trunks carry tagged frames for multiple VLANs.
Question 9: Which of the following is a benefit of VLANs?
(b) Reduced broadcast traffic. VLANs contain broadcasts.
Question 10: In the 802.1Q tag, what does the PCP field stand for?
(a) Priority Code Point. It is used for Class of Service (CoS) priority.
Question 11: What is the maximum number of VLANs that can be created with 802.1Q?
(c) 4094. VLANs 0 and 4095 are reserved, so 1–4094 are available.
Question 12: What is a native VLAN?
(b) The VLAN that carries untagged traffic on a trunk port. Native VLAN frames are not tagged.
Question 13: Which of the following is a security best practice regarding VLANs?
(b) Set the native VLAN to an unused VLAN. This prevents VLAN hopping attacks.
Question 14: In router-on-a-stick, how is routing between VLANs implemented?
(b) The router uses a single interface with multiple subinterfaces, each tagged with a VLAN. Each subinterface corresponds to a VLAN.
Question 15: What is the purpose of VLAN pruning?
(b) To restrict which VLANs are allowed on a trunk link. Pruning reduces unnecessary broadcast traffic.
Question 16: What is a Private VLAN (PVLAN) used for?
(a) To prevent hosts within the same VLAN from communicating with each other (in some cases). PVLANs provide port-level isolation.
Question 17: How does a switch handle an untagged frame received on a trunk port?
(b) It associates the frame with the native VLAN. Untagged frames on trunk ports are assigned to the native VLAN.
Question 18: Which VLAN is the default management VLAN on Cisco switches?
(b) VLAN 1. Cisco switches use VLAN 1 as the default management VLAN.
Question 19: What is a Voice VLAN?
(b) A VLAN dedicated to VoIP traffic, often configured on access ports with IP phones. Voice VLANs provide QoS and separate voice from data.
Question 20: What happens if two switches on a trunk link have different native VLANs?
(b) VLAN hopping can occur, and untagged frames may be misdirected. This is a security risk.
Question 21: Which of the following is a method of inter-VLAN routing?
(a) Router-on-a-stick. This uses subinterfaces on a router.
Question 22: What is the size of the 802.1Q tag in bytes?
(b) 4. The tag is 4 bytes: 2-byte TPID and 2-byte TCI.
Question 23: In a double-tagging VLAN hopping attack, what does the attacker do?
(a) Sends a frame with two 802.1Q tags to bypass switch security. This exploits native VLAN misconfiguration.
Question 24: What is the command to create a VLAN on a Cisco switch?
(b) vlan 10. This enters VLAN configuration mode.
Question 25: What is the role of a Switched Virtual Interface (SVI)?
(a) To provide Layer 3 routing for a VLAN on a multilayer switch. SVIs act as virtual routers for VLANs.
Question 26: What is the default administrative state of a newly created VLAN on a Cisco switch?
(a) Active. By default, VLANs are active and operational.
Question 27: How can you verify which VLANs are allowed on a trunk port?
(b) show interfaces trunk. This shows trunk information including allowed VLANs.
Question 28: What is the primary advantage of using a Layer 3 switch over router-on-a-stick for inter-VLAN routing?
(a) Higher routing speed (wire-speed). Layer 3 switches route using hardware ASICs, faster than software-based router-on-a-stick.
Question 29: Which of the following is NOT a VLAN type defined in IEEE 802.1Q?
(d) VLAN 4096. VLAN 4096 does not exist; valid IDs are 1–4094.
Question 30: What is the purpose of the CFI bit in the 802.1Q tag?
(a) It indicates whether the frame is canonical format (Ethernet) or not (Token Ring). CFI is used for Ethernet/Token Ring compatibility; it is set to 0 for Ethernet.
Question 31: When a switch port is configured as an access port, how does it treat frames it receives?
(b) It accepts only untagged frames and assigns them to the access VLAN. Access ports typically strip tags on outgoing frames and receive untagged frames.
Question 32: What does the command "switchport access vlan 10" do?
(b) Assigns the access port to VLAN 10. This sets the port's access VLAN.
Question 33: How many bytes does the 802.1Q tag add to the standard Ethernet frame?
(b) 4. It adds 4 bytes, increasing the frame size.
Question 34: Which of the following is a valid reason to implement VLANs in a campus network?
(a) To increase the number of broadcast domains. VLANs create multiple smaller broadcast domains.
Question 35: What is a VLAN trunking protocol (VTP) used for?
(a) To propagate VLAN configurations between switches. VTP is a Cisco proprietary protocol.
Exercise 1: VLAN Creation and Assignment
On a switch, you need to create VLAN 20 (name "Sales") and assign ports 5-8 to this VLAN. Write the IOS commands to accomplish this.
vlan 20
name Sales
exit
interface range fastEthernet 0/5-8
switchport mode access
switchport access vlan 20
end
Exercise 2: Trunk Configuration
You need to configure a trunk link between Switch A (port Gi0/1) and Switch B (port Gi0/1). Both are Cisco switches. The trunk should allow VLANs 10, 20, 30. Also, set the native VLAN to VLAN 99. Write the commands.
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
end
Exercise 3: Inter-VLAN Routing (Router-on-a-Stick)
A router interface Gi0/0 is connected to a trunk port on a switch. VLAN 10 has subnet 192.168.10.0/24, VLAN 20 has subnet 192.168.20.0/24. Configure the subinterfaces on the router for router-on-a-stick.
interface gigabitEthernet 0/0
no ip address
interface gigabitEthernet 0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
end
Exercise 4: VLAN Membership Verification
You have a switch and need to verify which VLAN a specific port belongs to. What command would you use?
show interfaces status or show interfaces gigabitEthernet 0/1 switchport to see
VLAN membership.
Exercise 5: Troubleshooting Trunk
Two switches are connected via a trunk. Hosts in VLAN 10 can communicate across the trunk, but hosts in VLAN 20 cannot. What could be the problem?
Possible issues: VLAN 20 not created on one of the switches, trunk not allowing VLAN 20, or native VLAN
mismatch causing tagging issues. Check show vlan and show interfaces trunk.
Exercise 6: Native VLAN Security
Why is it recommended to change the native VLAN from VLAN 1 to an unused VLAN? Provide a brief explanation.
VLAN 1 is the default native VLAN and is also the default management VLAN. Attackers can exploit this to launch VLAN hopping attacks (e.g., double tagging). Changing the native VLAN to an unused VLAN reduces this risk.
Exercise 7: VLAN Design
A company has 100 employees in Engineering, 50 in Sales, and 20 in HR. They want separate VLANs for each department. Propose a VLAN scheme (VLAN IDs and subnets).
VLAN 10: Engineering, subnet 192.168.10.0/24 (up to 254 hosts). VLAN 20: Sales, subnet 192.168.20.0/24. VLAN 30: HR, subnet 192.168.30.0/24. VLAN 99: Management, subnet 192.168.99.0/24.
Exercise 8: Layer 3 Switch SVI Configuration
On a multilayer switch, create SVIs for VLAN 10 and VLAN 20 with IP addresses 10.0.10.1/24 and 10.0.20.1/24 respectively, and enable IP routing.
ip routing
interface vlan 10
ip address 10.0.10.1 255.255.255.0
no shutdown
interface vlan 20
ip address 10.0.20.1 255.255.255.0
no shutdown
Exercise 9: VLAN Pruning
Why would you prune VLANs on a trunk link? Provide an example.
Pruning reduces unnecessary broadcast and multicast traffic on trunks. For example, if VLAN 30 exists only on Switch A, you can prune it from the trunk to Switch B, preventing broadcasts of VLAN 30 from crossing the link.
Exercise 10: Voice VLAN Configuration
An access port connects to an IP phone and a PC. The phone should be on VLAN 100 (voice), PC on VLAN 10 (data). How would you configure this on a Cisco switch?
interface fastEthernet 0/1
switchport mode access
switchport access vlan 10
switchport voice vlan 100
Exercise 11: VLAN Hopping Attack
Explain how a double-tagging VLAN hopping attack works and how to prevent it.
An attacker sends a frame with two VLAN tags. The first switch strips the outer tag (native VLAN) and forwards the frame with the inner tag, allowing access to a different VLAN. Prevention: set native VLAN to an unused VLAN, disable trunking on access ports, and use VLAN ACLs.
Exercise 12: Managing VLANs across Switches
If you manually create VLANs on each switch, what are the potential pitfalls? How can VTP help?
Manual creation can lead to inconsistencies (different VLAN IDs, missing VLANs). VTP (VLAN Trunking Protocol) automatically propagates VLAN configuration across switches, ensuring consistency. However, VTP has its own security risks and is often replaced by manual configuration or scripting in modern networks.
Exercise 13: VLAN and Subnet Correlation
Is it mandatory for each VLAN to have its own IP subnet? Why or why not?
Yes, typically each VLAN uses a different subnet because IP addressing is hierarchical. Devices in the same VLAN should be in the same IP subnet to communicate directly. If two VLANs had overlapping subnets, routing would be problematic.
Exercise 14: Access Port Behavior
What happens when a tagged frame arrives on an access port?
Typically, the switch drops the tagged frame (unless it is a voice VLAN with special configuration). Access ports expect untagged frames.
Exercise 15: VLAN Deletion
How do you delete a VLAN on a switch? What happens to the ports assigned to that VLAN?
Use no vlan 10. Ports assigned to the deleted VLAN become inactive (they may be put into a
"suspended" state or assigned to the default VLAN, depending on the switch).
Exercise 16: Trunk Native VLAN Mismatch
Switch A has native VLAN 1, Switch B has native VLAN 99. What is the result on the trunk link?
Untagged frames from Switch A (VLAN 1) will be interpreted as VLAN 99 on Switch B, causing traffic to be placed in the wrong VLAN. This can create a security hole and cause connectivity issues.
Exercise 17: Inter-VLAN Routing with a Layer 3 Switch
Explain the advantage of using a Layer 3 switch over a traditional router for inter-VLAN communication in a large campus network.
Layer 3 switches route at wire speed using ASICs, providing much higher throughput and lower latency than a router (which routes in software). They also simplify the topology by integrating switching and routing in one device.
Exercise 18: VLAN and DHCP
How does a DHCP server serve clients in multiple VLANs?
DHCP relay (IP helper-address) is configured on the router or Layer 3 switch. The relay forwards DHCP broadcasts from clients in a VLAN to a central DHCP server, using the appropriate subnet.
Exercise 19: Port Security and VLANs
How can port security be used in conjunction with VLANs to enhance security?
Port security limits the number of MAC addresses per port, preventing unauthorized devices. It can also be configured to shut down a port if a violation occurs. This prevents MAC flooding and ensures only authorized devices connect to specific VLANs.
Exercise 20: Troubleshooting Missing VLAN
A host in VLAN 30 cannot communicate with the gateway. The switch has VLAN 30 configured, but the host's port is in VLAN 30. What could be the issue with the switch trunk to the router?
The trunk connecting the switch to the router might not be allowing VLAN 30. Check the allowed VLAN list on the trunk and ensure the router's subinterface for VLAN 30 is correctly configured.
Homework 1: Describe the differences between static VLANs and dynamic VLANs. Compare the advantages and disadvantages of each approach.
Static VLANs: ports are manually assigned to a VLAN. Advantages: simple, predictable, secure. Disadvantages: administrative overhead when moving devices. Dynamic VLANs: membership is based on MAC address, protocol, or user authentication (802.1X). Advantages: flexibility, automatic assignment. Disadvantages: requires additional infrastructure (RADIUS, VMPS), more complex.
Homework 2: Explain the concept of VLAN tagging and why it is necessary for trunk links. What is the difference between 802.1Q and ISL (Cisco proprietary)?
VLAN tagging identifies which VLAN a frame belongs to on a trunk. 802.1Q is the IEEE standard, uses a 4-byte tag inserted after the source MAC. ISL (Inter-Switch Link) is Cisco proprietary, encapsulates the entire frame with a 26-byte header and a trailer. 802.1Q is the industry standard; ISL is obsolete.
Homework 3: Design a VLAN topology for a medium-sized enterprise with three departments: Engineering (100 hosts), Marketing (50 hosts), and Finance (30 hosts). Include a management VLAN and a guest VLAN. Specify VLAN IDs, subnets, and inter-VLAN routing method.
VLAN 10: Engineering, 192.168.10.0/24. VLAN 20: Marketing, 192.168.20.0/24. VLAN 30: Finance, 192.168.30.0/24. VLAN 99: Management, 192.168.99.0/24. VLAN 200: Guest, 192.168.200.0/24. Use a Layer 3 switch for inter-VLAN routing, with SVIs for each VLAN. Configure DHCP relay for guest VLAN.
Homework 4: Describe the "Native VLAN" security risks and how to mitigate them. Provide a step-by-step guide to secure a trunk.
Risks: VLAN hopping via double tagging or DTP (Dynamic Trunking Protocol) attacks. Mitigations: set
native VLAN to an unused VLAN (e.g., 999), disable DTP on access ports (set to access), use the command
switchport trunk native vlan 999, and explicitly allow only required VLANs on trunks.
Homework 5: Compare "Router-on-a-stick" and Layer 3 switching for inter-VLAN routing. Discuss the performance, scalability, and cost implications.
Router-on-a-stick: uses a single physical interface with subinterfaces. Cost-effective for small networks, but the router becomes a bottleneck (software routing). Layer 3 switch: hardware-based, high performance, supports wire-speed routing. More expensive but scalable for large networks. Layer 3 switching is preferred for campus networks.
Homework 6: What is a Private VLAN (PVLAN) and in what scenarios would you use it? Explain the types: primary, isolated, and community VLANs.
PVLANs provide port-level isolation within a VLAN. Primary VLAN: the main VLAN. Secondary VLANs: isolated (ports cannot communicate with each other, only with promiscuous ports) and community (ports can communicate with each other and promiscuous ports). Used in DMZ, hosting environments, or ISP networks to isolate customers.
Homework 7: Explain the concept of a Voice VLAN and how it supports IP telephony. What protocols are used for detection (CDP, LLDP-MED)?
A Voice VLAN is dedicated to VoIP traffic. It provides QoS (priority) and separates voice and data traffic. IP phones use CDP (Cisco Discovery Protocol) or LLDP-MED to signal their VLAN requirement to the switch, which then places the phone traffic into the specified voice VLAN.
Homework 8: How does a switch treat a frame with an 802.1Q tag when the tag's VLAN ID is not allowed on the trunk port?
The switch drops the frame. Trunks have an allowed VLAN list; frames from VLANs not on the list are discarded.
Homework 9: Describe the process of VLAN propagation using VTP (VLAN Trunking Protocol). What are the VTP modes (Server, Client, Transparent) and their functions?
VTP propagates VLAN configurations across switches. Server mode: can create/delete VLANs and propagates updates. Client mode: receives updates but cannot create VLANs. Transparent mode: forwards VTP messages but does not participate; can locally create VLANs. VTP is useful but can cause widespread issues if misconfigured.
Homework 10: What is VLAN pruning and how does it improve network performance? How is it implemented on a trunk?
VLAN pruning restricts which VLANs are allowed on a trunk, reducing broadcast and multicast traffic. It
is implemented using the switchport trunk allowed vlan command to specify only the needed
VLANs.
Homework 11: Explain the concept of "VLAN hopping" and describe the two common attack methods (switch spoofing and double tagging). How can you prevent them?
Switch spoofing: attacker pretends to be a switch and negotiates a trunk. Prevention: disable DTP on access ports, set ports to access mode. Double tagging: attacker sends a frame with two tags. Prevention: change native VLAN to unused VLAN, ensure native VLAN is not used for user traffic.
Homework 12: In a large network, you have multiple switches. Why is it important to use a consistent VLAN naming and numbering scheme? Provide an example.
Consistent naming/numbering reduces confusion and errors when managing the network. Example: VLAN 10 = Engineering, VLAN 20 = Sales, VLAN 30 = HR. This allows quick identification across all switches.
Homework 13: What is the purpose of the "shutdown" VLAN (VLAN 1, or any VLAN) in a switch? How does it affect ports?
The shutdown command disables a VLAN. Ports in a shutdown VLAN will not forward traffic. It is used to decommission a VLAN without deleting it.
Homework 14: Describe how you would troubleshoot a scenario where a user in VLAN 10 cannot ping a user in VLAN 20, but both users can ping their default gateways.
Check inter-VLAN routing: ensure the router or Layer 3 switch has routes between the subnets. Verify ACLs are not blocking traffic. Check that the gateway IPs are correct and the routing table has entries. Ensure the hosts have the correct subnet masks and default gateways.
Homework 15: What is the difference between an SVI (Switched Virtual Interface) and a routed port on a Layer 3 switch? When would you use each?
SVI is a virtual interface for a VLAN, used for routing between VLANs. A routed port is a physical port configured as a Layer 3 interface (like a router interface), used for connecting to routers or other networks. SVIs are used for inter-VLAN routing; routed ports are used for WAN or uplink connections.
This tutorial covered Virtual LANs (VLANs) and the IEEE 802.1Q standard:
In the next tutorial, we will explore the Spanning Tree Protocol (STP) and LAN redundancy.