In this lesson,
we're going to discuss virtual local area networks.
A virtual local area network, also known as a VLAN,
is a logical subdivision of a given network
that segments it into separate broadcast domains.
Unlike traditional local area networks
where the network is defined by its physical connections,
a virtual local area network allows us
to group our hosts together,
even if they are not directly connected
to the same network switch.
This logical grouping of our devices
across multiple switches
is achieved through a software configuration
rather than through hardware and cabling.
So it's going to offer us a much more flexible experience
when we're configuring our networks.
Now, VLANs are not just a feature of our networks.
They are a strategic tool
that when you utilize them correctly and efficiently,
they can transform the way your network resources
are being allocated and managed.
Now, before VLANs were used, our network administrators
had to install additional routers and cables and switches
to separate out each of the different network segments
within our organizations.
So if we wanted to have two different network segments,
one for human resources,
and another one for the information technology department,
for example, I would have to have a network
that looks something like this.
Now, let's assume that I wanted to keep
HR and IT departments' data separate
as it goes across the network
so I can maintain a higher level of security.
Well, if I wanted to do that before VLANs,
I would have to set up two sets of routers,
two sets of switches, and all those cables
to keep them physically and logically separated
from each other.
Now, this works really well
when all of our department personnel work in the same room
or the same floor, but as our departments grow in size,
we may have people spread out across different rooms
or different floors of the same building,
and this can create a lot of extra expense for us
because we now have to buy two sets
of each of these devices.
If you have four or six departments,
this incrementally increases the amount of hardware
you're going to have to buy.
Now, let's say, for example,
you have two departments like HR and IT,
and you have both HR and IT employees
working on both of your floors,
floors one and two of your building.
So now we're going to have to install four switches.
Switch one and three are going to be on the second floor,
and switch two and four are going to be on the first floor.
And this will allow us to support both of these departments
and their logical separation needs
using traditional layer two switches.
But if we can introduce VLANs into the equation
and use layer three switching between those VLANs,
we can now have different logical networks
that share the same physical hardware.
This provides us with all the additional security
and efficiencies that we want for that logical separation
because we're no longer using a single broadcast domain
like we did on a standard layer two switch
without using a VLAN.
Now, when we use these VLANs,
we can consolidate all four of those switches
into just two switches,
one for the first floor and one for the second floor.
Then we can configure two different VLANs,
one for HR and one for IT.
And this will logically separate out
each department's traffic into each of those VLANs.
Now, in this configuration,
the IT department has been cabled into the switch,
and then it logically trunks the connection down
from switch one into switch two,
and then down into our router
to keep everything logically separated.
Now, similarly, we're going to do the same exact thing
with the HR department configuration.
And you can see here in the network diagram
that we have the difference here
because of that color coding
for each of the logical connections being used
by the HR or IT department.
Now, using VLANs are different switch ports
can be configured to use different VLANs,
which are going to be these logical separation
and segmentations that we're talking about,
even though that data is still being transmitted
using the same physical hardware and the exact same cable.
Notice how there's a purple and blue cable
going from switch down to the router,
and this is just using one physical cable.
But in the diagram,
we're showing this as two logical cables.
One is purple and one is blue.
But in real life, if you walk over to this router
and this switch, you're really going to see just a single cable
going between those two devices.
And that is the whole idea of using VLAN trunking.
So I can transfer all the VLANs
between the different network infrastructure devices
using a single cable.
So let's talk about how a VLAN works.
Now, VLANs operate at layer two
or the data link layer of your OSI model.
Whenever a switch is configured to utilize a VLAN,
it's going to tag each frame of the data with a VLAN identifier
or ID as it passes through that switch.
This VLAN tag will define which VLAN
that frame is going to belong to.
Then as the frames are forwarded between switches,
these tags are going to be used to determine
the path that they're going to take
to ensure that yours is going to be confined
to its respective VAN,
which provides you with that effective segregation
of the different segments of our networks.
Now, there are many reasons for using a VLAN,
including enhanced security, improved performance,
increased management, and improved cost efficiency.
First, VLANs are going to provide us with enhanced security.
This enhanced security is achieved
by segmenting our networks into VLANs
that allows sensitive data to be isolated
for other portions of the network,
and this in turn helps reduce the risk of a data breach.
Now, since each VLAN is treated
as a separate network segment,
a router three or a layer three switch must be used
to let the traffic pass between those segments.
At each of these choke points,
we can configure access control list rules
to dictate what types of traffic can enter
or leave a given VLAN, which also gives us the ability
to better secure those network segments.
Second, VLANs provide us with improved performance.
Now, a VLAN is used to reduce the size
of a given broadcast domain,
and this helps us to decrease the amount
of unnecessary traffic being sent over that segment.
This reduction in unnecessary traffic that we have
by reducing our broadcast domain size
is going to help us to enhance
the overall performance of our networks.
Third, we have increased management.
VLANs provide us with greater control
over the management of our networks
by making it easier to implement policy changes
and to troubleshoot issues.
Since each VLAN is treated as a separate network segment,
we can have separate management controls
applied to the different VLANs
based on our specific use cases
and network administration needs.
Fourth, we have improved cost efficiency.
Now, VLANs allow us to better utilize
our existing network infrastructure
by breaking it up into smaller logical segments.
This allows us to use fewer physical switches
and other network infrastructure
by combining multiple physical switches
into a single physical switch
that contains multiple virtual local area network segments
inside of it
without having to purchase additional hardware switches
and other types of hardware infrastructure.
Now, in order for our VLANs to be effective,
our switches and our other network devices
must maintain a VLAN database
that's going to contain all the VLAN configurations
for that particular switch.
This VLAN database includes information
like the VLAN identifier, the VLAN's name,
and the maximum transmission unit size, known as the MTU.
Now, if you're using a Cisco switch,
you're going to find this VLAN database is actually stored
in a flat file called VLAN.DAT.
This VLAN database is critical
to maintaining efficient network operations
because it ensures that our VLAN configurations
are going to remain consistent and they can be deployed
across your entire network infrastructure quite easily.
Another key concept that's used with a VLAN
is the switch virtual interface.
Now, a switch virtual interface, or SVI,
is a virtual interface on a switch
that provides layer three or network layer processing
to your VLANs.
Essentially, the switch virtual interface
will allow your switch to route traffic
between different VLANs
without requiring you to buy a separate router.
By configuring a switch virtual interface for your VLAN,
your switch can handle the routing decisions
for any kind of data within that VLAN.
And this helps to enhance our network's efficiency
by minimizing the need
for installing additional routing devices into your network.
So remember, a VLAN is a logical subdivision
of a given network
that segments it into separate broadcast domains.
VLANs segment your layer two traffic
into different logical areas of your network,
and they rely on the VLAN database
and the switch virtual interface
to make routing decisions for your traffic
as it crosses between different VLANs in your network.
VLANs help us to enhance our security
by logically separating network traffic
to allow for the isolation of sensitive data and systems
from the rest of your network.
This in turn will help to reduce the risk
of unauthorized access and data breaches,
while also streamlining your network management
and improving your network performance
by dividing that larger network
into smaller, more manageable sections
by reducing the size of our broadcast domains
and reducing any additional unnecessary traffic
that's going to waste our valuable network resources
and bandwidth.