Professional Documents
Culture Documents
Why VLANs?
Layer 2: devices on one VLAN cannot communicate with users on another VLAN without the use of routers and network layer addresses Advantages
Help control broadcasts (primarily MAC-layer broadcasts) Switch table entry scaling Improve network security Help logically group network users
VLAN basics
VLAN configuration issues:
A switch creates a broadcast domain VLANs help manage broadcast domains VLANs can be defined on port groups, users or protocols LAN switches and network management software provide a mechanism to create VLANs
VLANs help control the size of broadcast domains and localize traffic. VLANs are associated with individual networks. Devices in different VLANs cannot directly communicate without the intervention of a Layer 3 routing device.
Trunking: History
An example of this in a communications network is a backbone link between an MDF and an IDF A backbone is composed of a number of trunks.
VLAN Trunking
Conserve ports when creating a link between two devices implementing VLANs Trunking will bundle multiple virtual links over one physical link by allowing the traffic for several VLANs to travel over a single cable between the switches.
Trunking Operation
Manages the transfer of frames from different VLANs on a single physical line Trunking protocols establish agreement for the distribution of frames to the associated ports at both ends of the trunk Two mechanisms frame filtering frame tagging
Frame Filtering
Frame Tagging
A frame tagging mechanism assigns an identifier, VLAN ID, to the frames
Easier management Faster delivery of frames
Frame Tagging
Each frame sent on the link is tagged to identify which VLAN it belongs to. Different tagging schemes exist Two common schemes for Ethernet frames
802.1Q: IEEE standard Encapsulates packet in an additional 4-byte header ISL Cisco proprietary Inter-Switch Link protocol Tagging occurs within the frame itself
Inter-VLAN Routing
If a VLAN spans across multiple devices a trunk is used to interconnect the devices. A trunk carries traffic for multiple VLANs. For example, a trunk can connect a switch to another switch, a switch to the inter-VLAN router, or a switch to a server with a special NIC installed that supports trunking. Remember that when a host on one VLAN wants to communicate with a host on another, a router must be involved.
Why Tunnel?
Security
E.g., VPNs
Flexibility
Topology Protocol
MPLS Overview
Main idea: Virtual circuit
Packets forwarded based only on circuit identifier
Source 1
Destination
Source 2
Label-switched paths (LSPs): Paths are named by the label at the paths entry point At each hop, label determines:
Outgoing interface New label to attach
Secure VPNs
Encryption of entire network stack between endpoints
Layer 3 VPNs
CE B1
P1
10.2/16
VPN B/Site 2
BGP to exchange routes
PE1
CEA1
PE3 P3
CEB3
VPN A/Site 1
Isolation: Multiple logical networks over a single, shared physical infrastructure Tunneling: Keeping routes out of the core
Isolation: Keeping different VPNs from routing traffic over one another
Constrained distribution of routing information Multiple virtual forwarding tables
Customer 1
Site 3
Forwarding
PE and P routers have BGP next-hop reachability through the backbone IGP Labels are distributed through LDP (hop-by-hop) corresponding to BGP Next-Hops
Two-Label Stack is used for packet forwarding Top label indicates Next-Hop (interior label) Second level label indicates outgoing interface or VRF (exterior label)
Corresponds to LSP of BGP next-hop (PE)
Layer 2 Header
Label 1
Label 2
IP Datagram
Step 2: BGP next-hop lookup, add corresponding LSP (also at site VRF)
Label 1 Label 2 IP Datagram