VLAN Basics

Answered Question
Jul 8th, 2012
User Badges:

I'm reading Wendell Odom's books and I have a question regarding VLANs and trunking. As far as I understood trunking is needed when you have network which is splitted between several switches. When a host sends a broadcast it has to be delivered to all hosts from that VLAN on all switches. Switches in its turn need to know VLAN ID when packet comes from another switch. Otherwise it won't know where to deliver the broadcast.


So in short, my understanding is that trunking is needed only for delivery of broadcasts (or packets to yet unknown hosts, when packet is also flooded to all VLAN and trunk ports) between switches and only in cases when network is splitted between them.


But I also read that trunks are needed between switches and default gateways for networks which that switch services. But I don't see the reason for that. Say, you have switch1 vlanA, switch2 vlanB. There are no broadcasts between the switches. And if host from vlanA needs to deliver unicast packet to host from vlanB, then packet is routed using general rules. It is delivered to default gateway and then to the corresponding switch. Who needs to know VLAN IDs here and for what reason?

Correct Answer by nkarpysh about 4 years 8 months ago

Hello,


Just need to stick to one point:


Once we enabled VLAN - switch maintains the separate CAM table for it. So all destination MAC lookups done through it.


We already discussed broadcast and unknown unicats. But for known unicast switch will look into VLAN specific entries in cam table. That it populated to HW ASIC and adds speed to packets forwarding. If you don't use tags you wont find the correct entry all entries are linked to particular VLAN. Keeping the Global CAM table not linking it to VLAN is not efficient. Imagine packet coming from trunk to switch - if it is tagged it is doing simple lookup through rather short CAM table for that specific VLAN. If it had no tag  we should have used the CAM covering all VLANs - and lookup would be much longer which is not efficient.


So here it is not the questions - not to use tag if I don't want. Yes in theory packet can be sent only by destination MAC which is usually unique (BUT NOT ALWAYS as you can configure your own MAC on some interfaces ), but once you configured VLAN - you need to stick to consistency across all switches. That is how it is implemented in SW and HW and I guess it is common for all vendors. That is why tagging is important (tagging is only specific for links which pass many VLANs).


HTH

Nik

Correct Answer by Hari Haran S M about 4 years 8 months ago

Hi Nikita,


Your understanding is right. In this particular scenario, we don't need tagging. Hence, using access port between switches and router should make this work.

Now while packet is traversing down across trunks each switch looks up for destination MAC and if switch doesn't find it, sends it to the next trunk.


The switch will actually flood the packet to all ports in the vlan in which the packet belongs to. If that vlan is allowed in a trunk port, then the packet will be forwarded to that trunk port as well.


Hence by design, all the traffic that has to be sent through a trunk port [except for the native vlan] will be tagged. The switches are not smart enough to identify situation and use the tagging accordingly. Hence, it is upto us to design the prots. As per the switch, if it's a trunk port it uses tagging [except for the native vlan] and if it's a access port it doesn't use tagging.


Regards,

Hari

Correct Answer by nkarpysh about 4 years 8 months ago

I understand your concern this way - if MAC address is unique then why we need VLAN for unicast L2 packet transfer if that can be just done using destination MAC lookup.


In very simple situation it can be done, YES. But networking is not that simple now. Agree that concept of VLAN started with broadcast domain. And in the beginning each unicast is unknown unicast for switch which is sent out of all ports to get it to the destination - so this is the first use of VLAN - limit the scope for Unknown unicast.


Once it is known and the switch learnt destination MAC on its CAM it can forward packet by dest MAC and no scope limit needed as we have single destination port. But imagine switch is reloaded or CAM table age timer expired and all MAC deleted - now your unicast is unknown again - if you did not use the VLAN by that time you will flood all the ports with it until your learn the destination MAC in CAM. So it is not like - we need VLAN only for broadcast - we need it for unicast to scope the limit of outgoing ports when dest MAC is unknown. And once this VLAN is configured we can't say - tag only these unicast packets and don't tag other ones - we tag all - this is the concept.



Other thing to support VLANs for unicast - imagine that packet came to its final egress port. To that port you have IP Phone and PC connected. Those by design in different broadcast domain - so in different VLANs. PC VLAN is untagged, and voice VLAN is tagged as IP Phone can understand this encapsulation. If you packet was voice and you lost your VLAN tag already - you will send it to PC untagged even if you have correct destination MAC of IP Phone and it will be dropped on PC due to incorrect MAC.


Third situation is when egress port is connected to server hostying multiple Virtual machines. Those may share same physical MAC but server may support dot1q tagging and put those in different VLAN. SO again if you lost your VLAN tag through the switches you wont be able to reach correct server.



Thus questions of VLAN is not only about how to go from one switch to another - it is concept of packet L2 forwarding from one side to the other. Packet originated in one VLAN should always stay there if it is L2 and egress from the last switch in correct VLAN (tagged or untagged based on the device connected).


Vlan concept is further going to L3 routing as explained above in my and Alains posts.



Hope this helps.

Nik

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Loading.
nkarpysh Sun, 07/08/2012 - 20:19
User Badges:
  • Cisco Employee,

Hello,


I need to add to the first part of your question in the begining. Trunk needed not only for broadcast but also unicast traffic. As it also need to be sent between the switches. Trunk is a single link carrying multiple VLANs, so even known unicast travelling across that link should be tagged with particular VLAN for the switch on other side to recognize it and send accordingly. As there can be a chance of end host connected to switch with a trunk supporting multiple VLANs - so switch should keep those VLANs tags. This is widely used in Virtual server farms.


Regarding the default gateway here it is talking about the situation when default GW is connected with a single link to a switch. E.G. switch need to send packets between VLAN 10 and VLAN20. Both have their own subnets and different default GW address due to that. But the default router hosting those default ip addresses is the same and it is connected to the switch with single link. How will it split the traffic between these two subnets coming on same link? Answer is trunk - Router can understand tagged packets and action accordingly further do the routing. It has sub-interfaces understnading tagging and those provide L3 functions to the specific VLAN.


Nik

Harmont12345 Sun, 07/08/2012 - 22:08
User Badges:
Trunk needed not only for broadcast but also unicast traffic. As it also need to be sent between the switches.

Do you mean "between switches and routers using other switches as transitional devices"? I thought that in this case packet travels according to MAC address tables. If host sends a unicast packet to another network, then it includes default gateway MAC in the packet and send it. When packet comes to the default gateway it sets destination host MAC and sends it to the corresponding link. As in the case when we have default network configuration with VLAN 1 and no trunks.

How will it split the traffic between these two subnets coming on same link?

The same way as in the previous case, by MAC addresses? It will send who has ARP request, get the destination host MAC address and send the packet through the link.

Harmont12345 Sun, 07/08/2012 - 22:11
User Badges:

I haven't read routing chapters yet. I guess I misunderstand something simple here. But I can't read next chapters until I understand switching. So sorry for primitive questions.

nkarpysh Sun, 07/08/2012 - 22:51
User Badges:
  • Cisco Employee,

Do you mean "between switches and routers using other switches as transitional devices"?


Yes between Switches (not routers). Each switch indeed maintain MAC address table - but that table is linked to VLAN. Thus packet coming on trunk is identified by VLAN first and then it will be looked through it's VLAN MAC table for next destination port. The next destination port again can be trunk -  so you need to know which tag to put on a packet.



The same way as in the previous case, by MAC addresses? It will send who has ARP request, get the destination host MAC address and send the packet through the link.

From end hosts to default GW packets would be sent to routers MAC after ARP is done. If you have single port between switch and router - how will you know that you need to send traffic for both VLANs to that single port?! By MAC table? Yes but if you don't use trunk - the only other choice is access - what VLAN out of 2 you will select as an access?! Either one you choose - you break communication for another VLAN as router wont get traffic from it. So you need link to carry both and the router on the other side need to understand this encapsulation thus it has sub-interfaces to decapsulate those packets and route in between. So it is not only where to send particular unicast - it is about how to send multiple VLANs on the same link.


Nik

Harmont12345 Mon, 07/09/2012 - 00:22
User Badges:

It seems that my problem is I'm not very much familiar with actual Cisco device configuration. I look at this from the point of Virtual LAN as a concept. I guess you appeal to the fact that port on Cisco switch can be either access port or trunking port. And I agree that you can't use access port as a link to another switch (or router), because access port belongs to a particular VLAN.


So the link in your example has to be somehow identified as a link to upcoming device. You can call it trunking port, uplink port or whatever. But for what reason router needs to use VLAN IDs here? Just to relabel it, so that switches then can use it for switching decisions?

nkarpysh Mon, 07/09/2012 - 01:08
User Badges:
  • Cisco Employee,

But for what reason router needs to use VLAN IDs here? Just to relabel it, so that switches then can use it for switching decisions?

Correct - router itself does not need the VLAN id as it cares about ip addresses. But if it sends traffi back to switch - switch now does not care about ip addresses but care about VLANs and MACs. So router need to put the correct VLAN tag sending traffi further to switch for it then to switch it correctly.


Nik

Harmont12345 Mon, 07/09/2012 - 02:00
User Badges:

Now I need to understand why switches care about VLAN IDs in unicast case.


From your replies I understood that when packet comes from the trunk port, switch checks if this VLAN is configured on that switch and then if the corresponding MAC is connected locally. If not, then it forwards the packet to other trunk ports. Why can't it check for MAC only? Again, no MAC - send further. How does VLAN ID change a switching decision?


Спасибо за ответы.


--- Nikita Andreev

cadet alain Mon, 07/09/2012 - 03:30
User Badges:
  • Purple, 4500 points or more

Hi,


all managed L2 switches supporting vlans from any brand have a CAM table per VLAN and they can only forward a frame from a port in  vlan X to a port in vlan X whether it is a unicast, broadcast or unknown unicast frame.

Suppose  you have 2 switches with devices in  vlans x and y and you want one device on switch A in vlan x to discuss with one device on switch B in vlan x then either you have 2 access ports betwenn the switches one in vlan x and the other in vlan y or you have a trunk between them.

if you have a trunk the receiving switch must know  which vlan the frame comes from so when it leaves the switch with sending device it will tag the frame on the trunk port and when receiving switch receives it it will strip the tag before sending to the port in correct vlan.


The default gateway is only for remote management of the switch.


Regards.


Alain.



Don't forget to rate helpful posts.

Harmont12345 Mon, 07/09/2012 - 04:59
User Badges:
you want one device on switch A in vlan x to discuss with one device on switch B in vlan x

Here we discuss a situation when each switch services its own networks. There are no networks splitted between switches.



--- Nikita Andreev

Harmont12345 Mon, 07/09/2012 - 05:24
User Badges:

I've just realized that you made a typo. Allright, then here is the question. You say:

if you have a trunk the receiving switch must know  which vlan the frame comes from

However, you tell nothing about why it needs to know it. I know that if it's a trunk port, then packet is marked using tag by design. But I want to know what lies behind this decision made by engineers of Cisco equipment.


I believe your example is wrong from the beginning. Because switches don't send packets between VLANs without a router. So the packet will be sent through trunks firstly from switch A to router and then from router to switch B. But again, the only thing switch A, switch B and router need to know to deliver a packet - is MAC address. Try to abstract from Cisco configuration. It's more of a theoretical question. "Why it is so", instead of "How it is".



--- Nikita Andreev

cadet alain Mon, 07/09/2012 - 05:44
User Badges:
  • Purple, 4500 points or more

Hi,


If you know the answers  then why are you asking questions which by the way you never rate even though some great people here have tried to answer on multiple threads you started here ?

I think it would be beneficial if you were humbler and less harsh with people trying to help you.


I never talked to you about inter-vlan routing which is done either with a router on a stick( router with subinterfaces and tagging) or with a L3 device with just configuring SVIs for each vlan  and ip routing.

trunking in Cisco parlance also know as tagging is not a Cisco feature per se.

and the receiving switch must know to what vlan the frame belongs to because it can only forward frames at L2 in one vlan so he must know which ports( trunk port or access port in this vlan) to forward frames to.


Alain.


Don't forget to rate helpful posts.

Harmont12345 Mon, 07/09/2012 - 07:02
User Badges:

Alain, I'm sorry if I've been harsh somewhere in my posts. Never meant to be offensive in any sense. Maybe I just misunderstood your previous post.


In regards to rates, I'm new here and do not know the rules yet. I thought rates are for the resulting answer. Since I haven't received it yet, I haven't rated any posts here. I realize that my questions are little bit confusing. But I really want to understand that.

the receiving switch must know to what vlan the frame belongs to because it can only forward frames at L2 in one vlan

VLAN is a broadcast domain. By definition, switch can't send broadcast traffic between VLANs. That's the basic idea behind VLANs as I see it. If I understand you correctly and you mean:

it can only forward frames at L2 in THE SAME vlan

Then I agree with you. But I still don't understand why. Each switch can read MAC address inside a packet and forward it accordingly. I don't see the reason for using VLAN IDs here.


Once again, sorry for any inappropriate words.



--- Nikita Andreev

Hari Haran S M Mon, 07/09/2012 - 05:45
User Badges:
  • Cisco Employee,

Hi Nikita,


I understand that the scenario is, switch 1 and switch 1 are connected to a router in two different ports in the router. Switch 1 has vlan A and switch 2 has vlan B.


If the above is the scenario, we don't need trunk port any where in the network.


The trunk link comes into picture when we have one vlan spanned in multiple switches and we need communication between them. The reason we tag is to identify the vlan the traffic belongs to. Let's say, we don't look into vlan and just check the cam table to forward traffic, what will happen to the broadcast traffic? Since we are not checking the vlan information, the broadcast will be forwarded to other vlan's. This will break the concept of vlan itself, the vlan's are desined to break the broadcast between vlan's.


If I have misunderstood your question, please corrrect me and I will try to give you an exact answer.


Happy Learning,

Hari

Harmont12345 Mon, 07/09/2012 - 07:05
User Badges:
If the above is the scenario, we don't need trunk port any where in the network.
The trunk link comes into picture when we have one vlan spanned in multiple switches and we need communication between them.
the vlan's are desined to break the broadcast between vlan's.

This is exactly how I understand it. But according to the posts above, it's not that simple, is it?



--- Nikita Andreev

cadet alain Mon, 07/09/2012 - 10:09
User Badges:
  • Purple, 4500 points or more

Hi,


ok so this is rather simple, you have vlan A and vlan B on sw1 and sw2 respectively and you want a device in vlan A on sw 1 to communicate with a device in vlan B on sw 2. As both switches are L2 only you need a L3 device( router) to route the packets between the vlans which are broadcast domains but also different subnets.


To link the router and the switches you can simply indeed use an acces port on each switch going to a routed port in the corresponding subnet on the router.

Now what if you have only one switch  with multiple vlans  then you can also use 2 access ports in each vlan going to routed ports on the router if you have only 2 vlans but this is not scalable and you will be limited also by the number of routed ports available on the router.

So in this case you will use a trunk on the switch linked to physical port on the router and use subinterfaces with trunking to carry the different vlans on the same physical media.


Is it a little bit clearer now ?


Regards.


Alain.



Don't forget to rate helpful posts.

Correct Answer
nkarpysh Mon, 07/09/2012 - 19:18
User Badges:
  • Cisco Employee,

I understand your concern this way - if MAC address is unique then why we need VLAN for unicast L2 packet transfer if that can be just done using destination MAC lookup.


In very simple situation it can be done, YES. But networking is not that simple now. Agree that concept of VLAN started with broadcast domain. And in the beginning each unicast is unknown unicast for switch which is sent out of all ports to get it to the destination - so this is the first use of VLAN - limit the scope for Unknown unicast.


Once it is known and the switch learnt destination MAC on its CAM it can forward packet by dest MAC and no scope limit needed as we have single destination port. But imagine switch is reloaded or CAM table age timer expired and all MAC deleted - now your unicast is unknown again - if you did not use the VLAN by that time you will flood all the ports with it until your learn the destination MAC in CAM. So it is not like - we need VLAN only for broadcast - we need it for unicast to scope the limit of outgoing ports when dest MAC is unknown. And once this VLAN is configured we can't say - tag only these unicast packets and don't tag other ones - we tag all - this is the concept.



Other thing to support VLANs for unicast - imagine that packet came to its final egress port. To that port you have IP Phone and PC connected. Those by design in different broadcast domain - so in different VLANs. PC VLAN is untagged, and voice VLAN is tagged as IP Phone can understand this encapsulation. If you packet was voice and you lost your VLAN tag already - you will send it to PC untagged even if you have correct destination MAC of IP Phone and it will be dropped on PC due to incorrect MAC.


Third situation is when egress port is connected to server hostying multiple Virtual machines. Those may share same physical MAC but server may support dot1q tagging and put those in different VLAN. SO again if you lost your VLAN tag through the switches you wont be able to reach correct server.



Thus questions of VLAN is not only about how to go from one switch to another - it is concept of packet L2 forwarding from one side to the other. Packet originated in one VLAN should always stay there if it is L2 and egress from the last switch in correct VLAN (tagged or untagged based on the device connected).


Vlan concept is further going to L3 routing as explained above in my and Alains posts.



Hope this helps.

Nik

Harmont12345 Mon, 07/09/2012 - 20:51
User Badges:

Can you tell me if situation described below is theoretically correct?


Lets imagine that no networks are splitted. So broadcast is always limited to the switch from which this broadcast came. If this is an unknown unicast from the same network, then again it's limited to the switch where it came from and is flooded to all ports in that VLAN.


Now if it's a unicast from another network then it goes to the router through trunks. Router knows where destination network is located, sets destination MAC accordingly and sends it back. Now while packet is traversing down across trunks each switch looks up for destination MAC and if switch doesn't find it, sends it to the next trunk.


I know that each packet will be tagged here by design, since these are trunks. But in fact, none of the switches will need to use this tag in this situation. Correct?



--- Nikita Andreev

Correct Answer
Hari Haran S M Mon, 07/09/2012 - 22:12
User Badges:
  • Cisco Employee,

Hi Nikita,


Your understanding is right. In this particular scenario, we don't need tagging. Hence, using access port between switches and router should make this work.

Now while packet is traversing down across trunks each switch looks up for destination MAC and if switch doesn't find it, sends it to the next trunk.


The switch will actually flood the packet to all ports in the vlan in which the packet belongs to. If that vlan is allowed in a trunk port, then the packet will be forwarded to that trunk port as well.


Hence by design, all the traffic that has to be sent through a trunk port [except for the native vlan] will be tagged. The switches are not smart enough to identify situation and use the tagging accordingly. Hence, it is upto us to design the prots. As per the switch, if it's a trunk port it uses tagging [except for the native vlan] and if it's a access port it doesn't use tagging.


Regards,

Hari

Harmont12345 Tue, 07/10/2012 - 02:25
User Badges:
Your understanding is right. In this particular scenario, we don't need tagging.

That's what I wanted to know when I started this conversation.

The switches are not smart enough to identify situation and use the tagging accordingly.

Switches are not, but network admin is smart enough to configure link as an uplink port ( if there was such port type ). If you need VLANs, but you don't need tagging it would be rather beneficial to have such option. I conclude that Cisco simply doesn't have that feature and tag all packets no matter what, for simplicity.



--- Nikita Andreev

Harmont12345 Tue, 07/10/2012 - 02:26
User Badges:

Can someone else confirm our conclusions?



--- Nikita Andreev

Alessio Andreoli Tue, 07/10/2012 - 02:45
User Badges:
  • Silver, 250 points or more

Hi everybody,

i want just to remind a simple but important rule... We always need a tag if a val is in place AND this is a non-native VLAN AND we are using DOT1Q with its default values.


Having said this, i think that if out of the access switch there is an IP Phone (a kind of switch) and a PC, the fact with need a trunk to encapsulate Voice and Data VLANs would suggest tags here too.


have a nice day


Alessio

Correct Answer
nkarpysh Wed, 07/11/2012 - 23:10
User Badges:
  • Cisco Employee,

Hello,


Just need to stick to one point:


Once we enabled VLAN - switch maintains the separate CAM table for it. So all destination MAC lookups done through it.


We already discussed broadcast and unknown unicats. But for known unicast switch will look into VLAN specific entries in cam table. That it populated to HW ASIC and adds speed to packets forwarding. If you don't use tags you wont find the correct entry all entries are linked to particular VLAN. Keeping the Global CAM table not linking it to VLAN is not efficient. Imagine packet coming from trunk to switch - if it is tagged it is doing simple lookup through rather short CAM table for that specific VLAN. If it had no tag  we should have used the CAM covering all VLANs - and lookup would be much longer which is not efficient.


So here it is not the questions - not to use tag if I don't want. Yes in theory packet can be sent only by destination MAC which is usually unique (BUT NOT ALWAYS as you can configure your own MAC on some interfaces ), but once you configured VLAN - you need to stick to consistency across all switches. That is how it is implemented in SW and HW and I guess it is common for all vendors. That is why tagging is important (tagging is only specific for links which pass many VLANs).


HTH

Nik

Harmont12345 Sat, 07/14/2012 - 01:18
User Badges:

One more thing I realized, is that when router receives the packet and sends ARP to look for destination MAC, all switches would have to flood all ports in all VLANs for router to find it. And it would break VLAN concept in its core - broadcast traffic has to be limited to the particular VLAN.


I guess it was explained in the following post but I didn't understand it in the way I described above:


Once it is known and the switch learnt destination MAC on its CAM it can forward packet by dest MAC and no scope limit needed as we have single destination port. But imagine switch is reloaded or CAM table age timer expired and all MAC deleted - now your unicast is unknown again - if you did not use the VLAN by that time you will flood all the ports with it until your learn the destination MAC in CAM. So it is not like - we need VLAN only for broadcast - we need it for unicast to scope the limit of outgoing ports when dest MAC is unknown. And once this VLAN is configured we can't say - tag only these unicast packets and don't tag other ones - we tag all - this is the concept.



--- Nikita Andreev

Actions

This Discussion