In this lesson, I'm going to show you
how to understand and configure VLANs.
Now for this example, I'm going to be using
a small office home office router known as a dream wall
or a dream station, depending on the model you buy.
In our particular offices, we are using one
called the Dream Wall, and you can see
the icon there displayed in the top left corner.
Now when you log into this device, you're going to see
all of this information, and this is telling you everything
about your network, including who your internet provider is,
how fast it is, what the health of your internet is,
what kind of traffic is going across your network,
and wifi and things like that.
But for this lesson, we're not worried about any of that.
We are just concerned with how we can configure VLANs.
So what we're going to do is we're going to go down here
in the bottom left corner and click on
the gear for settings, and then
click on the Networks button.
From here, you're going to see all of your VLANs
listed in this nice graphical user interface.
Currently, and by default, this system only has one VLAN,
which is the Default VLAN.
You could see here that the Default VLAN is there,
it's in the router Dion Training Offices,
and it's using a subnet address of 192.168.0.0/24.
The internet connection is going
through our primary WAN1 connection,
and there are 10 IP leases available,
which means the first 10 devices can log in
and use the Default VLAN without having
to go to any other VLANs.
Now, the next thing we want to do is we want to start creating
some VLANs for different departments that we may have
and want to put people into for that logical separation
to break up one large broadcast domain with up to 254 hosts,
which what we currently have, into much smaller
broadcast domains based on
organizational department structure.
To do this, we're just going to click on new virtual network.
Once you click on that, you're going to give it a name.
So in my case, the first one I'm going to use
is called Instructors, and I want to put
all of my instructors in here because
they should have access to things that other people may not
like the answer keys to our exams or content
that we're working on that's for an upcoming course
that we don't want anybody to see yet.
So I'm going to put all of my instructors
into this group called Instructors.
Now from here, you're going to select
which router it applies to.
In our case, it's just the Dion Training Offices router.
And then we're going to have IPv4 or IPv6,
and we're going to stay with IPv4.
From here, we have the option to autoscale our network
where it'll go up or down in size based on
the number of things that are connecting.
And this is one of the features of this particular
small office home office router,
and not all of them will support this.
For now though, I'm going to leave that as the default option
because it's going to increase or decrease in size
based on the number of clients
that are connecting to this VLAN.
Then we're going to go down here to the Advanced area,
and we're going to hit Manual.
From here, we're going to give this VLAN a number.
Now, instead of calling it two, we're going to call it 100.
Personally, I like to use things like 100, 200, 300, 400
for my different departments, and that way,
if I need to have a subdivision underneath that department,
I have room in my numbering scheme to do that.
For example, I might use this for the instructors as 100,
and then printers for the instructors as 101
and voice lines for the instructors
as our voice VLAN of 102 and things like that.
The next thing we have is isolation.
If you check this box here, it means that
everybody who's in the instructor VLAN
can only talk to people in the Instructor VLAN.
If this is not checked, then there's going to be
an open connection between your different VLANs
and you're losing that security.
So I always like to use isolation in my network
to create this as a logical isolation
between my different VLANs.
Now, this device also is a unified threat management system,
so it has a firewall and a proxy server
and content filtering all built into it.
Now here we can say none if we want
no kind of content filtering, or we could say
we want the work policies or the family policies.
In our case, this is a work environment.
So I'm going to select the work policies,
which includes blocking things like gambling and pornography
and other things that we don't want our instructors
working on when they're at work
because we want them working when they're at work
and not doing things like that.
As we scroll down, you'll see we also have things
like DHCP server, which we're going to leave in place,
and then we'll just add this to our network.
So now you can see we have two VLANs.
We have our first VLAN, which is our Default
or native VLAN, which is VLAN 1,
and then we have our instructor VLAN of VLAN 100.
Let's go ahead and add another one called Instructor VOIP,
and this will be our instructors voiceover IP lines,
and we're going to create this as VLAN 101,
and we will also give it network isolation
and call it work as our content filtering.
And then we'll add that to our group.
Now that we've done that, we'll go in here
and go to our new virtual network
and we'll give another group of people.
In this case, we're going to call it student support.
And then we're going to go ahead and select this as manual
and we'll call this 200.
And we'll also give this network isolation
and work content filtering,
and then we'll add that to our network.
Next, we'll click on New Virtual Network
and we'll call this Student Support VOIP.
And this is going to be the voice lines
for all of our student support staff.
So somebody calls our offices, they'll be able
to reach one of our service agents.
And then we'll again give that content filtering for work,
and then we'll hit Add.
Next, we'll create another department.
In this case, we're going to call this
the executive department.
And you can get the idea here as you go
and create all of your different VLANs
for all of your different ones.
And then we'll hit Add, and then we'll do the last one,
which is going to be the Executive VOIP.
And so we'll just put that in there, Executive VOIP.
And then again, we're going to hit Manual.
We'll make this one 301, and then
the network will be Network.
We'll scroll down a little bit,
and then from here, and then we'll click Add.
All right, now that we are here, we can see
all of our different VLANs and we have seven of them total.
We have our Default, our Instructors, our Instructor VOIP,
our Student Support, our Student Support VOIP,
our Executive, and our Executive VOIP.
Now from here, we haven't really done any configurations yet
except to say that we have these VLANs
and each person who is put into one of these VLANs
will only be able to access other people in those VLANs
because that's how we have the security set up
by default here with that isolation.
Now if we want to see what these VLANs look like
on the physical switch, we'll go ahead
and click on VLAN Viewer.
We're going to see the actual ports going across my switch
on the top here, and those are represented
by those numbers one, and you can see
that this is a 24-port switch.
Now, in addition to that, I have VLAN tagging listed below,
and from here, you could see which VLANs
have which ports enabled on them.
Right now, all of our ports are set up by default
to be open on all VLANs.
So any device can connect to any of our different ports
and then choose which VLAN it wants to be a part of
using different tagging and configuration.
This is a insecure way of doing things.
So what I want to do is be able to choose which devices
on which ports can go to which VLANs.
So for example, if I have an instructor's office cabled up
to port number one, I would simply click on port number one,
and then from here, I'm going to go down
and select my native VLAN for that port.
In this case, that is going to go ahead
and be the instructor one of Instructor 100.
From there, I'm going to go ahead and say
block all for all of the tagged VLAN management.
Now the way this is configured,
I can only have instructors on port one and nobody else.
Once I hit Apply, this will save that setting.
Then we can go back here to VLANs
and you'll see that that default is no longer there.
It's grayed out because it's blocked.
But on port one, we are allowing the instructors
as the native VLAN because the native now
for the Instructor VLAN or port one is VLAN 100.
And then we have all the other ones being blocked.
Now if we want it on port two to allow something
like the instructor VOIP phones,
we can do that by clicking on two
and then going here to default
and we'll select the Instructor VOIP.
Now that's going to be the default,
but if I also want to allow somebody to be an instructor
to connect their laptop to it, I can click on custom
and then select the one I want
such as Instructors, and then hit Save.
At this point, I'll apply those changes
and then we'll go back to our VLAN viewer.
Now you can see that on port two,
which is VLAN 101 is the default.
That is my default for Instructor VOIP.
But you'll also see that Instructors
is able to be used on port two.
Default is not, and all the other ones are not
because port two has been blocked
because we only configured it so that port two
can be used by default as a VOIP phone or a VOIP laptop here
by allowing this green tagging to happen.
Now, if we want to do the same thing, we can go here
to port number three and let's go ahead
and set this one to the Executive.
So we'll go ahead and scroll down to the Executive
and we'll block everybody else.
And then from there we'll hit Apply.
And then port number four, I'm going to go ahead
and make this one the executive's voice phone.
And so we'll do that right here, Executive VOIP.
And we will do a custom to also allow
the executive channel to be there as well.
And then we'll hit Apply.
And if we go here to our VLANs,
you can see now that the default is no longer available
on ports one through four.
On port one, we allow the Instructors by default.
On port two, we allow the Instructors VOIP by default
or the instructors using a tagged VLAN.
So either VLAN 100 or VLAN 101
will support on port number two.
For port number three, you'll see it's all blocked out
until we get all the way down here
to the Executives being the default.
And then we see on port four the Executive Voice
was the default, but we also allowed
Executive to be there as well.
And we can continue to do this for each
and every one of our ports.
Now, what I just showed you here was
a very, very basic overview of how to set up
a VLAN inside of a graphical user environment.
If you move on to be a full fledged network administrator
or network engineer, you are going to get into
the command line environment for your specific device,
whether that's going to be a Cisco device,
a UniFi device, a Juniper device,
a Brocade device, or any other one out there.
And each one has different configurations
that you'll be able to set up, but they're all using
the same concepts of using VLAN
and VLAN tagging on specific ports to allow
or deny traffic based on those frame tags.
So you can now have these logical networks
being created on a single physical switch,
which is exactly what we did here.
Right now, as you see this switch, you can see
that with that number one on all the other ports,
that means everybody can use those for all VLAN.
But those first four ports, which we've now assigned
as 100, 101, 300, 301, is going to be for the Instructors,
the Instructor VOIP, the Executives, and the Executive VOIP
on those four ports individually
and shown in this graphical manner.
By doing this, we're allowed to have
four different virtual networks
that are all individually segmented from each other,
and communications cannot occur across those ports
except where we have allowed them.
So on port two, for example, we are going to allow
the Instructor and the Instructor VOIP
to both be supported on port two.
So we can use either a phone or a laptop on that port.
But for port one, we can only use a laptop
because it's only going to go into the Instructor VLAN,
not the Instructor VOIP VLAN.
I hope this helps you understand a little bit more
about the configuration of a VLAN
and what it looks like in the real world.
Now for the exam, you do not need to know
how to do anything I showed you in this video.
This was just for your understanding,
so you can understand better how configuring VLANs works
in the real world on a small office home office device
like this one from UniFi.