1. VLAN definition
What is a VLAN? Let's look at an example: a company has sales, the R&D, finance and other departments, and if we don't separate VLAN, all computers are plugged into the same switch, so if there is any computer radio message (such as a bomb window, device search, a fault warning), all the equipment will receive the message. If a company has a lot of equipment, the broadcast packets are prone to flooding, and the Internet will experience lag. More dangerously, sales computers can access the financial server directly, and there is a risk of data leaks.
Vlan definition is called virtual lans, the same physical switch, which is logically cut into several isolated small local area network. Physically: all equipment connect to the same switch;
Logically: the R&D, finance, sale departments operate independently as "small networks", and by default, they cannot see each other or communicate with each other.
The main benefits of dividing VLAN are:
1.1 Reduce the broadcast domain and reduce the network lag;
1.2 The broadcast will only be transferred in the same VLAN, not the entire LAN message, and the flow of traffic;
1.3 Security isolation to prevent unauthorized access;
For example, the financial server is VLAN10, the sales server is VLAN20, normally, the sales terminal is unable to access the financial equipment and avoid the risk of leaks.
1.4 Operate flexible, without physical limitation
Each independent network does not require a separate switch to be configured and the equipment can be placed in the same network by configuration, such as all the company's cameras, which helps understand the vlan definition and vlan meaning in practical network segmentation scenarios.
2. The relationship between VLAN, IP subnet and gateway
VLAN, it only controls whether the devices can receive the broadcast signals from each other. It does not handle the IP address communication. It merely performs logical isolation.
IP subnet, It is used to allocate network segments to the devices, such as 192.168.1.0/24, 192.168.2.0/24, and the same subnet device can communicate directly.
The gateway is a bridge between different VLAN and different subnets, without the gateway, and the isolated VLAN will never be able to access each other.
General pairing rule: One VLAN corresponds to an independent IP subnet, and the subnet gateway serves as the exit point for cross-VLAN communication.
3.What are Access Port and Trunk Port
3.1The access port: only belong to one VLAN and data transmission and reception do not carry labels;
For example: the data from the terminal computer enters the switch, and the switch automatically applies the corresponding VLAN label. When the data was sent back from the switch, the tag was removed and the terminal computer was unaware of the existence of VLAN.
Use scenarios: monitor cameras, office PC, and wireless AP access ports.
3.2 trunk port: it simultaneously carries data for multiple VLANs, and distinguishes different networks through 802.1Q tags.
For example, the data of different VLAN transmit over the link by the exclusive tag, and the switch is forwarded to the access port based on the label.
Use scenarios: two switches are cascaded, and the switches are connected to the core three-layer switch and the firewall.
4. Practical operation summary
First, plan the VLAN according to the requirements,
For example, we divide the device type into three categories respectively, finance, office and monitoring. VLAN10 is for finance, VLAN20 is for office, VLAN30 is for monitoring, each VLAN is assigned an independent network segment;
Set the port connected to the terminal to "Access" and assign it to the corresponding VLAN;
Configure the interconnected ports of the switch as "Trunk", allowing all the required VLANs to pass through;
Use a three-layer switch/firewall to configure the gateways for each VLAN.
5. Summary
VLAN is used to isolate network partitions. The Access port connects to terminals, while the Trunk port connects to switches.
Devices within the same VLAN can communicate directly, but devices in different VLANs must rely on a three-layer gateway for forwarding.
Reasonable division of vlan definitionguided VLANs can not only solve the problems of broadcast storms, but also isolate important data. It is an essential basic configuration for configuring vlans on a switch in office, monitoring, and alloptical networking.
6.The advantages of Rayin Technology
As a manufacturer of independent R&D of industrial communication equipment, Rayin Technology can provide free technical evaluation service, help you match the function of the project. If you need a complete product plan and technical white paper, welcome to visit our website: ww.szwrayin.com.
