Title Page Port Based VLAN User’s Guide
NOTICE Cabletron Systems reserves the right to make changes in specifications and other information contained in this document without prior notice. The reader should in all cases consult Cabletron Systems to determine whether any such changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice.
Notice ii Port Based VLAN User’s Guide
CONTENTS CHAPTER 1 INTRODUCTION 1.1 About this Guide .......................................................................... 1-1 1.2 Document Conventions ............................................................... 1-2 1.3 Related Documents ..................................................................... 1-2 1.4 Getting Help................................................................................. 1-3 CHAPTER 2 VIRTUAL LOCAL AREA NETWORKS 2.1 Defining VLANs ................................
Contents CHAPTER 4 VLAN CONFIGURATION 4.1 Summary of VLAN Local Management........................................4-1 4.1.1 Preparing for VLAN Configuration...................................4-1 4.2 VLAN Main Menu Screen ............................................................4-2 4.3 Device/VLAN Configuration Screen .............................................4-4 4.3.1 Defining a VLAN..............................................................4-6 4.3.2 Renaming a VLAN.................................
CHAPTER 1 INTRODUCTION Welcome to the Cabletron Systems Port Based VLAN User’s Guide. This guide introduces and describes port based Virtual Local Area Network (VLAN) technology and the VLAN Local Management screens used to configure Cabletron Systems products used in port based VLAN environments. NOTE 1.1 The term “port based VLAN” will be used throughout this document to refer to prestandard IEEE 802.1Q Virtual Local Area Networks.
Chapter 1: Introduction 1.2 DOCUMENT CONVENTIONS The following conventions are used throughout this document: NOTE Note symbol. Calls the reader’s attention to any item of information that may be of special importance. In Local Management sections, Bold type indicates fields, field values, and commands that can be highlighted or selected by the user. In Local Management sections, keystrokes are shown in UPPERCASE. Italic type denotes complete book titles. 1.
Getting Help 1.4 GETTING HELP If you need additional support related to port based VLANs, or if you have any questions, comments, or suggestions concerning this manual, contact the Cabletron Systems Global Call Center: Phone (603) 332-9400 Internet mail support@ctron.com FTP Login Password ctron.com (134.141.197.
Chapter 1: Introduction 1-4 Port Based VLAN User’s Guide
CHAPTER 2 VIRTUAL LOCAL AREA NETWORKS This chapter introduces the concepts of Virtual Local Area Networks (VLANs) and discusses the central concepts of prestandard IEEE 802.1Q VLANs. 2.1 DEFINING VLANS A Virtual Local Area Network is a group of devices that function as a single Local Area Network segment (broadcast domain). The devices that make up a particular VLAN may be widely separated, both by geography and location in the network.
Chapter 2: Virtual Local Area Networks Building One S S F Building Two S S F F 1 9 A 1 trunk SmartSwitch S S Member of Sales Network 8 7 6 S F B SmartSwitch F Member of Finance Network 2263-01 Figure 2-1 Example of a VLAN In this example, the Sales and Finance workstations have been placed on two separate VLANs. In a plain Ethernet environment, the entire network is a broadcast domain, and the SmartSwitches follow the IEEE 802.1d bridging specification to send data between stations.
Types of VLANs 2.2 TYPES OF VLANS There are a number of different strategies for creating Virtual Local Area Networks, each with their own approaches to defining a station’s membership in a particular VLAN. 2.2.1 Port Based VLANs A port based VLAN switch determines the membership of a data frame by examining the configuration of the port that received the transmission or reading a portion of the data frame’s tag header. A four-byte field in the header is used to identify the VLAN.
Chapter 2: Virtual Local Area Networks 2.3 BENEFITS AND RESTRICTIONS The primary benefit of the port based VLAN technology is the localization of traffic that it provides. This function can offer improvements in security and performance to stations assigned to a VLAN. While the localization of traffic to VLANs can improve security and performance, it imposes some restrictions on network devices that participate in the VLAN.
VLAN Terms Tagged Frame A data frame that contains a Tag Header. The Tag Header can be added to the data frame by a VLAN aware switch to any frame received from a port that is a member of a VLAN. Untagged Frame A data frame that does not have a Tag Header inserted into it. Port VLAN ID (PVID) An identification that encompasses a particular switch port’s identification (port 6, module 2) and that port’s VLAN membership.
Chapter 2: Virtual Local Area Networks 2-6 Port Based VLAN User’s Guide
CHAPTER 3 VLAN OPERATION This chapter describes the operation of a VLAN switch and discusses the operations that a VLAN switch performs in response to both normal and VLAN-originated network traffic. 3.1 DESCRIPTION Port based VLAN operation is slightly different than the operation of traditional switched networking systems. These differences are due to the importance of keeping track of each transmission’s VLAN membership as it passes from switch to switch or from port to port within a switch. 3.
Chapter 3: VLAN Operation 3.3 CONFIGURATION PROCESS A VLAN requires a series of configuration steps in order to begin operating. Cabletron Systems VLAN aware SmartSwitches do not default to VLAN mode, and the VLAN operation must be configured and activated through software management. NOTE 3.3.1 The actual steps involved in VLAN configuration using Local Management are presented in Chapter 4, VLAN Configuration.
VLAN Switch Operation 3.3.4 Customizing the Port’s Egress List When the VLAN Forwarding List is fully configured, the Egress List for each port may be customized if needed. The entries in the Egress List allow traffic classified into specific VLANs to be transmitted out the port. 3.3.5 Setting the Operational Mode Once the VLANs are in place, the operation of the switch is dependent upon the method of operation specified by the Administrator.
Chapter 3: VLAN Operation Interface 1 Interface 2 A A B all Interface 3 Interface 4 2263n02 Figure 3-1 3.4.1 Inside the Switch Receiving Frames from VLAN Ports When a switch is placed in 802.1Q Operational Mode, every frame received by the switch must belong to a VLAN. Untagged Frames The switch receives a frame from Interface 1 and examines the frame. The switch notices that this frame does not currently have a VLAN tag.
VLAN Switch Operation Tagged Frames In this example, the switch receives a tagged frame from Interface 4. The switch examines the frame and notices the frame is tagged for VLAN C. This frame may have already been through a VLAN aware switch, or originated from a station capable of specifying a VLAN membership. If a switch receives a frame containing a tag, the switch will classify the frame in regard to its tag rather than the PVID for its port.
Chapter 3: VLAN Operation In Open mode, the forwarding decision is based only on the destination MAC address of the frame. As an example, assume that a frame is received by the switch depicted in Figure 3-1. This frame is a unicast untagged frame received from Interface 3. The frame is classified for VLAN B. The switch makes its forwarding decision by comparing the destination MAC address to its filtering database.
CHAPTER 4 VLAN CONFIGURATION This chapter describes the VLAN Local Management screens used to create and configure VLANs in a SmartSwitch. 4.1 SUMMARY OF VLAN LOCAL MANAGEMENT The VLAN configuration process is an extension of normal Local Management operations. A series of Local Management screens provide access to the functions and commands necessary to add, change, or delete VLANs and to assign ports to those VLANs.
Chapter 4: VLAN Configuration It may also be helpful to sketch out a diagram of your VLAN strategy. The examples provided in Chapter 5 may be useful for a depiction of the planning process. Access Local Management as described in your device’s user’s guide. Perform all required initial setup operations. Navigate to the VLAN Main Menu screen to begin VLAN configuration for the device. 4.
VLAN Main Menu Screen Figure 4-2 VLAN Main Menu Screen The following describes each menu item on the VLAN Main Menu screen: DEVICE/VLAN CONFIGURATION The Device/VLAN Configuration screen enables the user to view, add, enable, or disable VLANs within a network switch device. It also enables the user to configure attributes that apply to the entire switch and/or VLANs. Refer to Section 4.3 for additional information.
Chapter 4: VLAN Configuration 4.3 DEVICE/VLAN CONFIGURATION SCREEN The Device/VLAN Configuration screen enables the user to define operating characteristics for the switch and enables the user to add, delete, enable, and disable VLANs. The screen will display up to six VLANs simultaneously. To access the Device/VLAN Configuration screen from the VLAN Main Menu, use the arrow keys to highlight the DEVICE/VLAN CONFIGURATION menu item and press ENTER.
Device/VLAN Configuration Screen Forward Default VLAN Out All Ports (Toggle) Allows the Administrator to assign or remove the default VLAN from the Egress List for all ports. When set to YES, the default VLAN is added to the Egress List of all ports that do not already include it. When set to NO, the default VLAN is removed from the Egress List of any port that does not have the default VLAN as its PVID.
Chapter 4: VLAN Configuration 4.3.1 Defining a VLAN To define a VLAN, proceed as follows: 1. Use the arrow keys to highlight the VLAN ID field. 2. Enter the VLAN ID using a unique number between 2 and 4094. The VLAN IDs of 0, 1, and 4095 are reserved and may not be used for user-defined VLANs. If an illegal number is entered, the Event Message Line will display: ”PERMISSIBLE RANGE FOR VLAN IDS: 2 to 4095” and the field will refresh with the previous value. 3.
Device/VLAN Configuration Screen 4.3.2 Renaming a VLAN To change the name of an existing VLAN, proceed as follows: 1. Enter the VLAN ID. The VLAN Name field will automatically update to display the VLAN’s current name. 2. Use the arrow keys to highlight the VLAN Name field. 3. Type a name of up to 32 ASCII characters in the VLAN Name field. Press ENTER. If the name is valid, the Event Message Line in the upper left hand corner of the screen displays “VLAN NAME CHANGED”. 4.
Chapter 4: VLAN Configuration 4.3.4 Enabling VLANs To enable a VLAN, proceed as follows: 1. Use the arrow keys to highlight the Admin Status field of the selected VLAN. 2. Press the SPACE bar to toggle the field to display ENABLED. 3. Use the arrow keys to highlight the SAVE command at the bottom of the screen. 4. Press ENTER. The message “SAVED OK” displays. 4.3.5 Disabling VLANs To disable a VLAN, proceed as follows: 1. Use the arrow keys to highlight the Admin Status field of the selected VLAN. 2.
Device/VLAN Configuration Screen 4.3.7 Changing the Forwarding Mode To change the forwarding mode of the switch, proceed as follows: 1. Use the arrow keys to highlight the Forward Default VLAN Out All Ports field. 2. Press the SPACE bar or BACKSPACE to toggle between YES and NO. The YES selection places the default VLAN (VLAN ID=1) in the Egress Lists of all ports on the switch.
Chapter 4: VLAN Configuration 4.4 PORT ASSIGNMENT SCREEN The Port Assignment screen enables the user to select a mode of operation for each port and to assign a Port VLAN Identification (PVID) to each port. To access the Port Assignment screen from the VLAN Main Menu, use the arrow keys to highlight the PORT ASSIGNMENT menu item and press ENTER. The Port Assignment screen, Figure 4-4, displays.
Port Assignment Screen VLAN ID (Selectable) The ID number of the VLAN that is associated with the current port. This is the VLAN ID that any untagged frame will be classified into. VLAN Name (Read-Only) The name that is associated with the current VLAN ID. 4.4.1 Changing the Port Mode To change the operational mode of a port, proceed as follows. 1. Use the arrow keys to highlight the PORT MODE field for the module and port combination you wish to change. 2.
Chapter 4: VLAN Configuration 3. When the desired operational mode for the port is displayed, use the arrow keys to highlight the SAVE command at the bottom of the screen. 4. Press ENTER. The message “SAVED OK” displays. 4.4.2 Assigning a VLAN ID The Port Assignment screen also enables the user to set each port’s VLAN ID (PVID) by stepping through a list of all configured VLANs. To assign a VLAN ID to a port in this manner, perform the following steps: 1.
Port Assignment Screen 4.4.3 Paging Through the Port List To display additional port and module combinations that do not display in the current screen, use the NEXT or PREVIOUS commands at the bottom of the screen, as follows: NOTE The NEXT and PREVIOUS fields will only display if there are further Port List entries to page through. 1. To display the next screen, use the arrow keys to highlight NEXT. Press ENTER to view the entries on the next screen. 2.
Chapter 4: VLAN Configuration 4.5 VLAN FORWARDING CONFIGURATION SCREEN The VLAN Forwarding Configuration screen enables the user to view the ports included in a VLAN’s Forwarding List. The user can also define which ports to include in the VLAN’s Forwarding List. The formats of the frames (Tagged or Untagged) that a VLAN port will forward can also be specified with this screen.
VLAN Forwarding Configuration Screen Frame Type - upper part of screen (Read-Only) The format of frames (TAGGED or UNTAGGED) that the port is currently forwarding. VLAN ID (Selectable) The number of the VLAN under examination. This screen displays the Forwarding List for the VLAN ID in this field. VLAN Name (Read-Only) The name associated with the VLAN ID. ADD/DEL (Toggle) Swaps the action taken between adding a port to the Forwarding List or removing the port from the Forwarding List.
Chapter 4: VLAN Configuration 4.5.2 Paging Through VLAN Forwarding List Entries To display additional entries in the VLAN Forwarding List that do not appear on the screen, use the NEXT or PREVIOUS commands located at the bottom of the screen, as follows: 1. To display the next screen, use the arrow keys to highlight NEXT. Press ENTER to view the entries on the next screen. 2. To display the previous screen, use the arrow keys to highlight PREVIOUS. Press ENTER to view the entries on the previous screen.
VLAN Forwarding Configuration Screen 4.5.4 Deleting Forwarding List Entries To remove a port from the currently displayed VLAN Forwarding List, proceed as follows: 1. Enter the VLAN ID. 2. Enter the VLAN name. 3. Use the arrow keys to highlight the [ADD/DEL] field. 4. Press the SPACE bar to select [DEL]. Press ENTER. 5. Use the arrow keys to highlight the SAVE command at the bottom of the screen. 6. Press ENTER. The message “SAVED OK” displays. The port has been removed from the VLAN list. 4.5.
Chapter 4: VLAN Configuration 4.6 QUICK VLAN WALKTHROUGH The procedures below provide a short tutorial walkthrough that presents each of the steps necessary to configure a new VLAN and assign a port to it. You may wish to follow this walkthrough from start to finish before attempting to configure your own VLANs. This walkthrough begins at the VLAN Main Menu screen for a 6C105 chassis. Follow the instructions in your device user’s guide to navigate to this Local Management screen.
Quick VLAN Walkthrough Figure 4-6 Walkthrough Stage One We can now proceed to assign a port to this new VLAN. 8. Use the arrow keys to highlight the RETURN command at the bottom of the screen. Press ENTER. The VLAN Main Menu screen displays. Use the arrow keys to select the PORT ASSIGNMENT menu item and press ENTER. The Port Assignment screen displays. 9. Use the arrow keys to highlight the MODULE field number at the bottom of the screen.
Chapter 4: VLAN Configuration 11. Use the SPACE bar to step sequentially through the previously configured VLAN ID numbers. When the number 2 (the new VLAN ID) is displayed, the VLAN Name field updates and displays the name assigned to this VLAN, TEST VLAN. 12. Use the arrow keys to highlight the SAVE command at the bottom of the screen. Press ENTER. The PVID for Port 3 on module 2 is now configured to the TEST VLAN.
Quick VLAN Walkthrough 14. Use the arrow keys to highlight the SAVE command at the bottom of the screen. Press ENTER. Port 10 is now acting as a 1Q Trunk port and every VLAN is in its Egress List. All frame formats for this new 1Q Trunk port are set to tagged. The screen should now look like Figure 4-8. Figure 4-8 Walkthrough Stage Three Now that The TEST VLAN and the 1Q Trunk connection are set up, we can proceed to activate the TEST VLAN. 15.
Chapter 4: VLAN Configuration Figure 4-9 Final Walkthrough Stage 16. Use the arrow keys to highlight the Admin Status field of VLAN ID 2, the TEST VLAN. 17. Press the SPACE bar to toggle the field to display [ENABLED]. 18. Use the arrow keys to highlight the SAVE command at the bottom of the screen. 19. Press ENTER. The message “SAVED OK” displays. The switch activates the new VLAN. This effectively completes the configuration of a single VLAN, a VLAN port, and a 1Q Trunk port.
CHAPTER 5 EXAMPLES This chapter provides examples of how VLAN aware SmartSwitches can be configured to group users at the port level to create VLANs in existing networks. Each example presents a problem and shows how it is solved by configuring the switches using the VLAN Local Management screens. The actual procedures and screens used to configure a VLAN aware switch are covered in Chapter 4, VLAN Configuration.
Chapter 5: Examples 5.1.1 Solving the Problem To set up this switch, users will be assigned to two new VLANs, red stations to the Red VLAN, and blue stations to the Blue VLAN. The information below describes how the switch is configured to create these two VLANs and how users are assigned to them. 1. First, the switch is set for 802.1Q operation and the operational mode is set.
Example 1 4. Now that the ports have been assigned, the VLANs are enabled from the Device/VLAN Configuration screen. The switch automatically updates the Forwarding Lists for the Red and Blue VLANs and updates the Egress Lists for all the ports on the switch. 802.
Chapter 5: Examples 3. Once the frame is classified, its destination MAC address is examined. The switch discovers that the frame is a broadcast, and treats it as it would any other unknown destination MAC address. The switch forwards the frame out all ports in the Red VLAN’s Forwarding List. In this case, the frame is sent to Interfaces 2 and 3. The second frame is a unicast, where station R2 responds to station R1’s broadcast. 4.
Example 2 As shown in Figure 5-3, two companies, “Redco” and “Blue Industries”, share floors 2 and 4 in a building where the network infrastructure is supplied by the building owner. The objective is to completely isolate the network traffic of the two companies by limiting the user’s traffic through the ports of two switches, thus maintaining security and shielding the network traffic from each company.
Chapter 5: Examples 5.2.1 Solving the Problem To solve the problem in this example, the users are assigned to VLANs using Switch 4 and Switch 2 as shown in Figure 5-3. Redco users are assigned to the Red VLAN and Blue Industries users to the Blue VLAN. The following information shows how Switch 4 and Switch 2 are configured to create the two VLANs to isolate the users of the two companies from one another on the network using the existing infrastructure. Switch 4 Switch 4 is set as follows: 1.
Example 2 Switch 2 Switch 2 is set as follows: 1. The VLAN Operational Mode is set to SECURE using the Device/VLAN Configuration screen. 2. Two VLANs are added to the list of VLANs in the Device/VLAN Configuration screen. In this example they are as follows: • VLAN ID 222 with a VLAN Name of Red • VLAN ID 223 with a VLAN Name of Blue 3.
Chapter 5: Examples Redco Blue Industries User A 2 Bridge 1 Bridge 2 1 Red VLAN 4 3 Blue VLAN 4 Floor 4 2263_14 Figure 5-4 Bridge 1 Broadcasts Frames 2. Switch 4 receives the frame from Bridge 1 and immediately classifies it as belonging to the Red VLAN. After the frame is classified, Switch 4 checks the Destination Address and, upon discovering that it is a Broadcast Destination Address, forwards the frame out all ports in the Red VLAN Forwarding List. In this example, it is only port 4.
Example 2 Redco Blue Industries User A Bridge 1 Red VLAN Bridge 2 4 Blue VLAN Floor 4 Floor 3 Redco Blue Industries Bridge 4 Bridge 3 Blue VLAN 2 File Server Red VLAN Floor 2 2263_15 Figure 5-5 Transmitting to Switch 4 3. When Switch 2 receives the tagged frame on its port 2, it checks the frame’s VLAN Tag Header and determines that the frame is classified as belonging to the Red VLAN, and that the frame is a broadcast frame.
Chapter 5: Examples Floor 3 Redco Blue Industries 2 Bridge 4 Bridge 3 1 Blue VLAN 2 File Server 3 Red VLAN Floor 2 2263_16 Figure 5-6 Transmitting to Bridge 4 4. The the File Server responds with a unicast frame to User A. All switches between the File Server and User A have an entry in their respective Source Address Tables identifying which port to use for forwarding the frame to User A, MAC address “Y”, VLAN Red.
Example 3 5.3 EXAMPLE 3 This final example illustrates the use of a 1d Trunk to connect a device to a network of port based VLAN switches. It also covers the uses of the Open mode of switch operation. In this example, illustrated in Figure 5-7, a merger has taken place between Redco and Blue Industries, the companies in the previous example. The two companies have become divisions within a single corporation, Green, Inc. A third group of stations, the Green, Inc. staff, is added to the facility.
Chapter 5: Examples User B 2 Bridge 1 Bridge 2 1 Red VLAN 4 3 Blue VLAN 4 Floor 4 Floor 3 2 Bridge 4 Bridge 3 1 Blue VLAN 2 File Server 3 Red VLAN 4 Floor 2 Green, Inc. 2 1 Green VLAN 1 Mail Server 3 Floor 1 User 802.1d Legacy Bridge 802.1Q VLAN-Aware Switch Server 2263_17 Figure 5-7 Example 3 The Green, Inc. Network Administrators want to continue to separate normal network traffic between the Blue and Red VLANs, and create a new isolated VLAN for Green, Inc. users.
Example 3 5.3.1 Solving the Problem Much of the existing network configuration can remain as it was for Example 2. While a new 1Q Trunk port must be activated and configured on Switch 2, and the operational modes of the switches must be changed, there are no other real changes to the network above the first floor. Switch 4 Switch 4 is set as follows: 1. The VLAN Operational Mode is set to OPEN using the Device/VLAN Configuration screen. 2.
Chapter 5: Examples 3. One VLAN is added to the list of VLANs in the Device/VLAN Configuration screen. In this example is set as follows: • VLAN ID 224 with a VLAN Name of Green 4.
Example 3 On Switch 4, the only port eligible to receive Red VLAN frames is port 4, the 1Q Trunk. The frame is forwarded out port 4 with the Red VLAN Tag header being added, as shown in Figure 5-8. User B 2 Bridge 1 Bridge 2 1 Red VLAN 4 3 Blue VLAN 4 Floor 4 2263_18 Figure 5-8 Bridge 1 Broadcasts Frames 3. Switch 2 receives the tagged Red VLAN frame on port 2, as shown in Figure 5-10. The Tag in the frame is maintained, classifying the frame as belonging to the Red VLAN.
Chapter 5: Examples 4. When Switch 1 receives the tagged broadcast frame, it also examines the tag and classifies the frame as belonging to the Red VLAN. This broadcast frame is then sent to all ports eligible to receive Red VLAN frames. In this case only the 1d trunk, port 3, is eligible, as it is considered a member of all VLANs for forwarding purposes. The Tag is stripped from the frame and the frame is transmitted out port 3 as shown in Figure 5-10.
Example 3 The switch checks the Filtering Database for the MAC address of User B. User B’s MAC address is located, and port 2 is identified as the location of User B. The frame is checked against the Egress List for port 2. Port 2’s Egress List contains all VLANs, and is a 1Q Trunk port, so the frame is transmitted, tagged, out port 2. 7. Switch 4 receives the frame on its 1Q port and examines the frame’s Tag. The frame maintains its Default VLAN classification.
Chapter 5: Examples 5-18 Port Based VLAN User’s Guide
INDEX Numerics L 1D Trunk 4-11, 5-11 1Q Trunk 4-11, 5-4 802.
Index T Tag 2-4 Tag Header 2-4 Tagged frame 2-5, 3-5 Technical support 1-3 Trunk 2-5 U Untagged frame 2-5, 3-4 V Virtual LAN - See VLAN VLAN assigning ports 3-2 components 3-1 configuration 3-2 default VLAN 2-5 defining 3-2 definition 2-1 to 2-4 operation 3-3 terms 2-4 types 2-3 VLAN Configuration deleting 4-7 disabling 4-8 enabling 4-8 VLAN Forwarding Configuration screen 4-14 VLAN ID 2-4 assigning 4-12 VLAN Main Menu screen 4-2 VLAN name 2-4 Index-2 Port Based VLAN User’s Guide
