cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
15621
Views
0
Helpful
24
Replies

VLAN Basics

Harmont12345
Level 1
Level 1

I'm reading Wendell Odom's books and I have a question regarding VLANs and trunking. As far as I understood trunking is needed when you have network which is splitted between several switches. When a host sends a broadcast it has to be delivered to all hosts from that VLAN on all switches. Switches in its turn need to know VLAN ID when packet comes from another switch. Otherwise it won't know where to deliver the broadcast.

So in short, my understanding is that trunking is needed only for delivery of broadcasts (or packets to yet unknown hosts, when packet is also flooded to all VLAN and trunk ports) between switches and only in cases when network is splitted between them.

But I also read that trunks are needed between switches and default gateways for networks which that switch services. But I don't see the reason for that. Say, you have switch1 vlanA, switch2 vlanB. There are no broadcasts between the switches. And if host from vlanA needs to deliver unicast packet to host from vlanB, then packet is routed using general rules. It is delivered to default gateway and then to the corresponding switch. Who needs to know VLAN IDs here and for what reason?

--- Nikita Andreev
3 Accepted Solutions

Accepted Solutions

I understand your concern this way - if MAC address is unique then why we need VLAN for unicast L2 packet transfer if that can be just done using destination MAC lookup.

In very simple situation it can be done, YES. But networking is not that simple now. Agree that concept of VLAN started with broadcast domain. And in the beginning each unicast is unknown unicast for switch which is sent out of all ports to get it to the destination - so this is the first use of VLAN - limit the scope for Unknown unicast.

Once it is known and the switch learnt destination MAC on its CAM it can forward packet by dest MAC and no scope limit needed as we have single destination port. But imagine switch is reloaded or CAM table age timer expired and all MAC deleted - now your unicast is unknown again - if you did not use the VLAN by that time you will flood all the ports with it until your learn the destination MAC in CAM. So it is not like - we need VLAN only for broadcast - we need it for unicast to scope the limit of outgoing ports when dest MAC is unknown. And once this VLAN is configured we can't say - tag only these unicast packets and don't tag other ones - we tag all - this is the concept.

Other thing to support VLANs for unicast - imagine that packet came to its final egress port. To that port you have IP Phone and PC connected. Those by design in different broadcast domain - so in different VLANs. PC VLAN is untagged, and voice VLAN is tagged as IP Phone can understand this encapsulation. If you packet was voice and you lost your VLAN tag already - you will send it to PC untagged even if you have correct destination MAC of IP Phone and it will be dropped on PC due to incorrect MAC.

Third situation is when egress port is connected to server hostying multiple Virtual machines. Those may share same physical MAC but server may support dot1q tagging and put those in different VLAN. SO again if you lost your VLAN tag through the switches you wont be able to reach correct server.

Thus questions of VLAN is not only about how to go from one switch to another - it is concept of packet L2 forwarding from one side to the other. Packet originated in one VLAN should always stay there if it is L2 and egress from the last switch in correct VLAN (tagged or untagged based on the device connected).

Vlan concept is further going to L3 routing as explained above in my and Alains posts.

Hope this helps.

Nik

HTH,
Niko

View solution in original post

Hi Nikita,

Your understanding is right. In this particular scenario, we don't need tagging. Hence, using access port between switches and router should make this work.

Now while packet is traversing down across trunks each switch looks up for destination MAC and if switch doesn't find it, sends it to the next trunk.

The switch will actually flood the packet to all ports in the vlan in which the packet belongs to. If that vlan is allowed in a trunk port, then the packet will be forwarded to that trunk port as well.

Hence by design, all the traffic that has to be sent through a trunk port [except for the native vlan] will be tagged. The switches are not smart enough to identify situation and use the tagging accordingly. Hence, it is upto us to design the prots. As per the switch, if it's a trunk port it uses tagging [except for the native vlan] and if it's a access port it doesn't use tagging.

Regards,

Hari

View solution in original post

Hello,

Just need to stick to one point:

Once we enabled VLAN - switch maintains the separate CAM table for it. So all destination MAC lookups done through it.

We already discussed broadcast and unknown unicats. But for known unicast switch will look into VLAN specific entries in cam table. That it populated to HW ASIC and adds speed to packets forwarding. If you don't use tags you wont find the correct entry all entries are linked to particular VLAN. Keeping the Global CAM table not linking it to VLAN is not efficient. Imagine packet coming from trunk to switch - if it is tagged it is doing simple lookup through rather short CAM table for that specific VLAN. If it had no tag  we should have used the CAM covering all VLANs - and lookup would be much longer which is not efficient.

So here it is not the questions - not to use tag if I don't want. Yes in theory packet can be sent only by destination MAC which is usually unique (BUT NOT ALWAYS as you can configure your own MAC on some interfaces ), but once you configured VLAN - you need to stick to consistency across all switches. That is how it is implemented in SW and HW and I guess it is common for all vendors. That is why tagging is important (tagging is only specific for links which pass many VLANs).

HTH

Nik

HTH,
Niko

View solution in original post

24 Replies 24

nkarpysh
Cisco Employee
Cisco Employee

Hello,

I need to add to the first part of your question in the begining. Trunk needed not only for broadcast but also unicast traffic. As it also need to be sent between the switches. Trunk is a single link carrying multiple VLANs, so even known unicast travelling across that link should be tagged with particular VLAN for the switch on other side to recognize it and send accordingly. As there can be a chance of end host connected to switch with a trunk supporting multiple VLANs - so switch should keep those VLANs tags. This is widely used in Virtual server farms.

Regarding the default gateway here it is talking about the situation when default GW is connected with a single link to a switch. E.G. switch need to send packets between VLAN 10 and VLAN20. Both have their own subnets and different default GW address due to that. But the default router hosting those default ip addresses is the same and it is connected to the switch with single link. How will it split the traffic between these two subnets coming on same link? Answer is trunk - Router can understand tagged packets and action accordingly further do the routing. It has sub-interfaces understnading tagging and those provide L3 functions to the specific VLAN.

Nik

HTH,
Niko

Trunk needed not only for broadcast but also unicast traffic. As it also need to be sent between the switches.

Do you mean "between switches and routers using other switches as transitional devices"? I thought that in this case packet travels according to MAC address tables. If host sends a unicast packet to another network, then it includes default gateway MAC in the packet and send it. When packet comes to the default gateway it sets destination host MAC and sends it to the corresponding link. As in the case when we have default network configuration with VLAN 1 and no trunks.

How will it split the traffic between these two subnets coming on same link?

The same way as in the previous case, by MAC addresses? It will send who has ARP request, get the destination host MAC address and send the packet through the link.

--- Nikita Andreev

I haven't read routing chapters yet. I guess I misunderstand something simple here. But I can't read next chapters until I understand switching. So sorry for primitive questions.

--- Nikita Andreev

Do you mean "between switches and routers using other switches as transitional devices"?


Yes between Switches (not routers). Each switch indeed maintain MAC address table - but that table is linked to VLAN. Thus packet coming on trunk is identified by VLAN first and then it will be looked through it's VLAN MAC table for next destination port. The next destination port again can be trunk -  so you need to know which tag to put on a packet.

The same way as in the previous case, by MAC addresses? It will send who has ARP request, get the destination host MAC address and send the packet through the link.

From end hosts to default GW packets would be sent to routers MAC after ARP is done. If you have single port between switch and router - how will you know that you need to send traffic for both VLANs to that single port?! By MAC table? Yes but if you don't use trunk - the only other choice is access - what VLAN out of 2 you will select as an access?! Either one you choose - you break communication for another VLAN as router wont get traffic from it. So you need link to carry both and the router on the other side need to understand this encapsulation thus it has sub-interfaces to decapsulate those packets and route in between. So it is not only where to send particular unicast - it is about how to send multiple VLANs on the same link.

Nik

HTH,
Niko

It seems that my problem is I'm not very much familiar with actual Cisco device configuration. I look at this from the point of Virtual LAN as a concept. I guess you appeal to the fact that port on Cisco switch can be either access port or trunking port. And I agree that you can't use access port as a link to another switch (or router), because access port belongs to a particular VLAN.

So the link in your example has to be somehow identified as a link to upcoming device. You can call it trunking port, uplink port or whatever. But for what reason router needs to use VLAN IDs here? Just to relabel it, so that switches then can use it for switching decisions?

--- Nikita Andreev

But for what reason router needs to use VLAN IDs here? Just to relabel it, so that switches then can use it for switching decisions?

Correct - router itself does not need the VLAN id as it cares about ip addresses. But if it sends traffi back to switch - switch now does not care about ip addresses but care about VLANs and MACs. So router need to put the correct VLAN tag sending traffi further to switch for it then to switch it correctly.

Nik

HTH,
Niko

Now I need to understand why switches care about VLAN IDs in unicast case.

From your replies I understood that when packet comes from the trunk port, switch checks if this VLAN is configured on that switch and then if the corresponding MAC is connected locally. If not, then it forwards the packet to other trunk ports. Why can't it check for MAC only? Again, no MAC - send further. How does VLAN ID change a switching decision?

Спасибо за ответы.

--- Nikita Andreev

--- Nikita Andreev

Hi,

all managed L2 switches supporting vlans from any brand have a CAM table per VLAN and they can only forward a frame from a port in  vlan X to a port in vlan X whether it is a unicast, broadcast or unknown unicast frame.

Suppose  you have 2 switches with devices in  vlans x and y and you want one device on switch A in vlan x to discuss with one device on switch B in vlan x then either you have 2 access ports betwenn the switches one in vlan x and the other in vlan y or you have a trunk between them.

if you have a trunk the receiving switch must know  which vlan the frame comes from so when it leaves the switch with sending device it will tag the frame on the trunk port and when receiving switch receives it it will strip the tag before sending to the port in correct vlan.

The default gateway is only for remote management of the switch.

Regards.

Alain.

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

you want one device on switch A in vlan x to discuss with one device on switch B in vlan x

Here we discuss a situation when each switch services its own networks. There are no networks splitted between switches.

--- Nikita Andreev

--- Nikita Andreev

I've just realized that you made a typo. Allright, then here is the question. You say:

if you have a trunk the receiving switch must know  which vlan the frame comes from

However, you tell nothing about why it needs to know it. I know that if it's a trunk port, then packet is marked using tag by design. But I want to know what lies behind this decision made by engineers of Cisco equipment.

I believe your example is wrong from the beginning. Because switches don't send packets between VLANs without a router. So the packet will be sent through trunks firstly from switch A to router and then from router to switch B. But again, the only thing switch A, switch B and router need to know to deliver a packet - is MAC address. Try to abstract from Cisco configuration. It's more of a theoretical question. "Why it is so", instead of "How it is".

--- Nikita Andreev

--- Nikita Andreev

Hi,

If you know the answers  then why are you asking questions which by the way you never rate even though some great people here have tried to answer on multiple threads you started here ?

I think it would be beneficial if you were humbler and less harsh with people trying to help you.

I never talked to you about inter-vlan routing which is done either with a router on a stick( router with subinterfaces and tagging) or with a L3 device with just configuring SVIs for each vlan  and ip routing.

trunking in Cisco parlance also know as tagging is not a Cisco feature per se.

and the receiving switch must know to what vlan the frame belongs to because it can only forward frames at L2 in one vlan so he must know which ports( trunk port or access port in this vlan) to forward frames to.

Alain.

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.

Alain, I'm sorry if I've been harsh somewhere in my posts. Never meant to be offensive in any sense. Maybe I just misunderstood your previous post.

In regards to rates, I'm new here and do not know the rules yet. I thought rates are for the resulting answer. Since I haven't received it yet, I haven't rated any posts here. I realize that my questions are little bit confusing. But I really want to understand that.

the receiving switch must know to what vlan the frame belongs to because it can only forward frames at L2 in one vlan

VLAN is a broadcast domain. By definition, switch can't send broadcast traffic between VLANs. That's the basic idea behind VLANs as I see it. If I understand you correctly and you mean:

it can only forward frames at L2 in THE SAME vlan

Then I agree with you. But I still don't understand why. Each switch can read MAC address inside a packet and forward it accordingly. I don't see the reason for using VLAN IDs here.

Once again, sorry for any inappropriate words.

--- Nikita Andreev

--- Nikita Andreev

Hi Nikita,

I understand that the scenario is, switch 1 and switch 1 are connected to a router in two different ports in the router. Switch 1 has vlan A and switch 2 has vlan B.

If the above is the scenario, we don't need trunk port any where in the network.

The trunk link comes into picture when we have one vlan spanned in multiple switches and we need communication between them. The reason we tag is to identify the vlan the traffic belongs to. Let's say, we don't look into vlan and just check the cam table to forward traffic, what will happen to the broadcast traffic? Since we are not checking the vlan information, the broadcast will be forwarded to other vlan's. This will break the concept of vlan itself, the vlan's are desined to break the broadcast between vlan's.

If I have misunderstood your question, please corrrect me and I will try to give you an exact answer.

Happy Learning,

Hari

If the above is the scenario, we don't need trunk port any where in the network.
The trunk link comes into picture when we have one vlan spanned in multiple switches and we need communication between them.
the vlan's are desined to break the broadcast between vlan's.

This is exactly how I understand it. But according to the posts above, it's not that simple, is it?

--- Nikita Andreev

--- Nikita Andreev
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: