VLANs
A VLAN is a logical group of ports that enables devices associated with it to communicate with each other over the Ethernet MAC layer, regardless of the physical LAN segment of the bridged network to which they are connected.
VLAN Description
Each VLAN is configured with a unique VID (VLAN ID) with a value from 1 to 4094. A port on a device in a bridged network is a member of a VLAN if it can send data to and receive data from the VLAN. A port is an untagged member of a VLAN if all packets destined for that port into the VLAN have no VLAN tag. A port is a tagged member of a VLAN if all packets destined for that port into the VLAN have a VLAN tag. A port can be a member of one or more VLANs.
A port in VLAN Access mode can be part of only one VLAN. If it is in General or Trunk mode, the port can be part of one or more VLANs.
VLANs address security and scalability issues. Traffic from a VLAN stays within the VLAN, and terminates at devices in the VLAN. It also eases network configuration by logically connecting devices without physically relocating those devices.
If a frame is VLAN-tagged, a four-byte VLAN tag is added to each Ethernet frame, increasing the maximum frame size from 1518 to 1522. The tag contains a VLAN ID between 1 and 4094, and a VLAN Priority Tag (VPT) between 0 and 7. See QoS Operation for details about VPT.
When a frame enters a VLAN-aware device, it is classified as belonging to a VLAN, based on the four-byte VLAN tag in the frame.
If there is no VLAN tag in the frame or the frame is priority-tagged only, the frame is classified to the VLAN based on the PVID (Port VLAN Identifier) configured at the ingress port where the frame is received.
The frame is discarded at the ingress port if Ingress Filtering is enabled and the ingress port is not a member of the VLAN to which the packet belongs. A frame is regarded as priority-tagged only if the VID in its VLAN tag is 0.
Frames belonging to a VLAN remain within the VLAN. This is achieved by sending or forwarding a frame only to egress ports that are members of the target VLAN. An egress port may be a tagged or untagged member of a VLAN.
The egress port:
VLAN Roles
VLANs function at Layer 2. All VLAN traffic (Unicast/Broadcast/Multicast) remains within its VLAN. Devices attached to different VLANs do not have direct connectivity to each other over the Ethernet MAC layer. Devices from different VLANs can communicate with each other only through Layer 3 routers. An IP router, for example, is required to route IP traffic between VLANs if each VLAN represents an IP subnet.
The IP router might be a traditional router, where each of its interfaces connects to only one VLAN. Traffic to and from a traditional IP router must be VLAN untagged. The IP router can be a VLAN-aware router, where each of its interfaces can connect to one or more VLANs. Traffic to and from a VLAN-aware IP router can be VLAN tagged or untagged.
Adjacent VLAN-aware devices exchange VLAN information with each other by using Generic VLAN Registration Protocol (GVRP). As a result, VLAN information is propagated through a bridged network.
VLANs on a device can be created statically or dynamically, based on the GVRP information exchanged by devices. A VLAN can be static or dynamic (from GVRP), but not both. For more information about GVRP, refer to the GVRP Settings section.
Some VLANs can have additional roles, including:
- Voice VLAN: For more information refer to the Voice VLAN section.
- Guest VLAN: Set in the Edit VLAN Authentication page.
- Default VLAN: For more information refer to the Configuring Default VLAN Settings section.
- Management VLAN (in Layer 2-mode systems): For more information refer to the Layer 2 IP Addressing section.
QinQ
QinQ provides isolation between service provider networks and customers' networks. The switch is a provider bridge that supports port-based c-tagged service interface.
With QinQ, the switch adds an ID tag known as Service Tag (S-tag) to forward traffic over the network. The S-tag is used to segregate traffic between various customers, while preserving the customer VLAN tags.
Customer traffic is encapsulated with an S-tag with TPID 0x8100, regardless of whether it was originally c-tagged or untagged. The S-tag allows this traffic to be treated as an aggregate within a provider bridge network, where the bridging is based on the S-tag VID (S-VID) only.
The S-Tag is preserved while traffic is forwarded through the network service provider's infrastructure, and is later removed by an egress device.
An additional benefit of QinQ is that there is no need to configure customers' edge devices.
QinQ is enabled in the VLAN Management > Interface Settings page.
VLAN Configuration Workflow
To configure VLANs:
- If required, change the default VLAN by using the Configuring Default VLAN Settings section.
- Create the required VLANs by using the Creating VLANs section.
- Set the desired VLAN-related configuration for ports and enable QinQ on an interface using the Configuring VLAN Interface Settings section.
- Assign interfaces to VLANs by using the Configuring Port to VLAN section or the Configuring VLAN Membership section.
- View the current VLAN port membership for all the interfaces in the Configuring VLAN Membership section.