Lesson 40 - OSPF Fundamentals Part3 - RouterID and DR/BDR

There are two more notions I need to touch upon before we implement OSPF in our topology. These are: OSPF Router ID and special roles of the routers which are appointed in Broadcast and NBMA(Non-Broadcast Multiple Access) networks called Designated Router (DR) and Backup Designated Router (BDR). I thought I would do the practical implementation here as well, but I want to keep the post as short as possible.

OSPF routers exchange LSAs by flooding them to all OSPF neighbors. This flooding results in creating the same Link-State Database (LSDB) on all routers in the area. LSDB is a topology database, (kind of a "road map"), shared by all routers in the area. Then, each router runs Dijkstra's SPF algorithm to choose the best path to each destination, placing itself as a the root (starting point). The product of SPF algorithm operation is the routing table. Recall that all OSPF packets are encapsulated in the OSPF header (loot at previous post). So, LSAs are signed with the Router ID when the router originates and floods them.

So what is this Router ID in the OSPF world?

Router ID
Router ID is going to be chosen automatically unless configured manually, using the 'router-idA.B.C.D' command in OSPF configuration context. The A.B.C.D are four bytes just like an IP address representing the router ID. It can be changed at a later stage but this may require the process clearing (once the router had its ID chosen, changing it always requires this command):

R1#clear ip ospf process

Clearing the OSPF process is disruptive since the router will need to re-establish adjacency with its neighbors.

Initially, a router tries to choose its ID based on the following order of operation:

1. Router chooses numerically the highest IP address off of the loopback interface.
2. In case there is no loopback interface configured, the router is going to choose numerically the highest IP address off of the physical interface. 

Neither of these interfaces have to be enabled for OSPF.


OSPF DR/BDR 
Another concept that requires some explanation is the election of Designated Router (DR) andBackup Designated Router (BDR) elected on Broadcast and NBMA networks (such as Frame-Relay, ATM, X.25). It is a role that is valid on per link basis (Broadcast and NBMA). This means that a router can be DR on F0/0 interface (segment of the network) but BDR or DRother on F0/1 interface.

As you recall, all routers need to establish adjacency (full state) with their neighbors. Only then, are their LSDBs synchronized. The process of sending updates to a great number of neighbors in Broadcast and NBMA networks would be very inefficient as their number can be significant. The routers would create the number of adjacencies according to the following (full mesh) formula:

Number_of_Adjacencies = n(n-1)/2

where the 'n' stands for the number of routers neighbored. In case an LSU (update) is sent, there would be a number of exchanges occurring between all neighbors according to the following formula:

Number_of_LSA_Exchanges = n raised to the power of 2.

Consider the following picture.

Pic. 1 - Broadcast Network with Four Routers.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

The next picture shows in part the LSU propagation of the same failed network on R3. This is only a partial picture. This would have to be done 16 times.

Pic. 2 - Partial LSU Exchange with 4 Routers.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

This situation would be very chaotic indeed. Instead, the system on Broadcast and NBMA networks elect one representative called Designated Router which is going to be responsible for propagation of all updates on this segment. In case of the failure of DR there is going to be a Backup Designated Router elected to assume the role of DR. These roles are initially based on the highest 'priority number' assigned on the interface. The default number is 1, so in case of a tie, the highest Router ID is becoming DR and the second highest becomes the BDR. If a router's interface is set to the priority value of 0, the router automatically becomes DRother and does not participate in the election process.

---

NOTICE!
DR is the only router authorized to pass the updates on to other routers on Broadcast and NBMA networks. It must have FULL reachability to other routers on the segment. 

---

This is the reason, there are two different addresses reserved for OSPF:

• 224.0.0.5 - All OSPF enabled routers listen to this address.
• 224.0.0.6 - DR/BDR router listen to this address.

Hello packets are sent to 224.0.0.5 (unless unicast is used i.e. NBMA networks)
Updates are sent 224.0.0.5 except Broadcast and NBMA network which use 224.0.0.6 address instead.

So, in our example (pic 1, and pic.2), if R3 loses its directly connected network, it sends the update towards 224.0.0.6 (to DR/BDR), and DR is sending this back to all other routers using 224.0.0.5 address. R3 is also going to receive it, but it will silently ignore it as it is the same update (sequence number). Consider the below picture.

Pic. 3 - DR/BDR Elected on Broadcast and NBMA Networks.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

This post ends the theory aspects in relation to OSPF in one area as per CCNA requirements.

In the next post, I will finally put this OSPF knowledge into practice. Then, we will troubleshoot OSPF using the tools learned in the next one.

Lesson 30 - IPv4 Subnetting - Practice

In the previous post, I showed you three major rules used in calculating subnets. This knowledge can only be verified in practice though. Let me show you a few examples related to subnet calculations. I hope that looking at this topic from different angles is going to help you understand the concept better and feel confident when planning your IP addressing scheme. The first four questions are merely appetizers for a bigger dish: VLSM.

I am going to refer to my previous post's rules while answering the questions (rule 1, rule 2 and rule 3).

If you still do not remember the weights of all bits, you may consider using this little aid presented below (pic. 1) while calculating subnets, and converting binary network masks into decimal values.

Pic. 1- Subnet Calculation Aid.

This tool is useful before you remember all the weights from left to right and right to left.

Pic. 2 - Example of Subnet Binary-to-Decimal Conversion.

Question 1

Given the prefix 192.168.1.0/24, what should be the length of subnet mask allowing up to 9 subnets?

Answer 1

The address belongs to the class C and uses its default network mask. That leaves us with 8 bits to play with (the last byte). Before we change anything, our address and network mask converted into the binary notation look like shown below (pic. 3).

Pic. 3 - 192.168.1.0/24 in Binary.

In order to create 9 subnets we must extend the existing length of the network mask by 4 bits which allows up to 16 subnets (use calculation aid in pic. 1). If I tried to extend it by 3 bits only, the maximum subnets allowed would be only 8 subnets (rule 2 in lesson 29). So, I must use 4 bits and the result is: 192.168.1.0/28 (192.168.1.0 255.255.255.240).

Pic. 4 - The Answer to Question 1

Question 2

Given the host address 192.168.1.177/29, what are the subnet and broadcast addresses?

Answer 2

In order to determine the subnet and broadcast address of the subnet of this host address, we must look at the length of the network mask first. It is 29 bits (24+5). This tells us that the last byte of the address has 5 bits masked (subnet bits) and 3 bits unmasked (host bits). It is a good idea to look at the the last byte of the address (177) with its network mask using binary notation. Pic. 5 below shows you this clearly.

Pic. 5 - 192.168.1.177/29 in Binary.

Since we must determine the the subnet in which the host resides (177 = 10110001), the host portion of the prefix (host bits reside in the last byte) must all be set to '0'. The byte value with the host zeroed is the address of the subnet (rule 1 pkt.1 in lesson 29). This is the result:

Pic. 6 - Host Bits Zeroed = Subnet Address.

The second part of the question relates to the broadcast address of the subnet. As you remember, in order to obtain the broadcast address, you must put '1' on all host bits of the subnet/network. The subnet has already been determined (pic. 6), so let's put '1' on all bits of the host portion:

.10110111
.10110000 = 176 <- subnet address
..00000111 = 7 <- host bits set to '1'

In decimal it is: 176 + 7 = 183
The broadcast address is: 183.

The below picture illustrates it using binary numbers.

Pic. 7 - Host Bits Set to '1' = Broadcast Address.

Question 3

Given the  prefix 172.16.0.0/17, how many subnets can you create?

Answer3

This is a bit tricky isn't it? In order to answer this question, you don't need any calculator, paper or pen. You must trust the rule 2 in lesson 29. The address and its network mask (called prefix) converted into binary look like presented below:

Pic. 8 - The Number of Subnets for 172.16.0.0/17

As you see the number of bits we have extended the class B address is: 1. So, the number of subnets we can create with it is: 2 subnets, since this subnet bit can be either 1 or 0.

Pic. 9 - Questions 3 Answer

Question 4

What length of network mask would be the most optimal for router's point-to-point connection?

Answer 4

The key to this question is to understand that point-to-point connection needs only 2 host addresses (two points that are connected together). Knowing this, the rest is a piece of cake. We use rule 3 inlesson 29 to determine the length of the network mask that allows 2 host addresses. Check out the picture 10.

Pic. 10 - Calculating Point-to-Point Connection Host Addresses.

If you count ones above the optimal network mask for point-to-point connection is /30. The decimal value is: 255.255.255.252.

Question 5 - Variable Length Subnet Masking (VLSM)

It's time for a big one. Given the topology (pic. 11), calculate IP addresses for each subnet trying to optimize them according the host address requirements. The IP address you should use to create subnets is: 192.168.1.0/24. The number of host addresses in the subnets are as follows:

Subnet 1 = 46 host addresses

Subnet 2 = 16 host addresses

Subnet 3 = 10 host addresses

Subnet 4 = 2 host addresses

Subnet 5 = 2 host addresses

Pic. 11 - VLSM Topology.

Icons designed by: Andrzej Szoblik - http://www.newo.pl

As always, if you know the rules and the method, it is going to be easy thing to do. The rules have been discussed in lesson 29, so let me go about this kind of task now.

---

NOTICE!
If your design looks similar to mine (optimizing addresses to the number of host required) you muststart the calculation with the largest number of host addresses requirement and work your way down to the least number of host addresses.

---

This is one of the many methods available. It helps quickly calculate all subnet ranges without using calculator (pen and a piece of paper should do).

Step 1
Determine the length of the network mask for each subnet in question. Keep in mind we focus in on the last byte of IP address 192.168.1.0 (8 bits).
The first three bytes do not change!

Subnet 1 = 46 Host Addresses

In order to allocate 46 addresses we must use 6 host bits. Why? 5 bits will not be enough as 2 raised to the power of 5 is 32. Also, we must decrement two addresses for subnet and broadcast addresses. So using 5 bits would give you only 30 host addresses. Here we go with 6 bits then:

Pic. 12 - Subnet 1 in Binary.

Subnet 2 = 16 Host Addresses

We must repeat the same math for the remaining subnets.  How many host bits to allocate for 16 hosts (subnet 2)? We must use 5 bits. In case we wanted to use only 4 host bits, the maximum number of hosts is 14 (16 - 2).

Pic. 13 - Subnet 2 in Binary

Subnet 3 = 10 Host Addresses

We continue using the same logic.

Pic. 14 - Subnet 3 in Binary.

 Subnet 4 and 5 = 2 Host Addresses Each

On point-to-point links only 2 host addresses area needed. The most optimal network mask is /30(30 bits).

Pic. 15 - Subnet 4 and 5 in Binary.

Step 2

Now, that we know the length of network mask for each subnet, we can start calculating the IP address ranges. 

The subnet 1 address is: 192.168.1.0/26.

The value of the lowest bit in the network mask is going to be our increment used to calculate the next available subnet address. With /26 the increment value is 64 (pic. 16).

So, if we add the increment to the last byte, we get the number of our next available subnet address:

192.168.1.0 + 64 = 192.168.1.64.

From there, this next subnet address (value) - 1 is the broadcast of our current subnet:

192.168.1.64 - 1 = 192.168.1.63 (current broadcast address)

Current subnet value + 1 = the first host address:

192.168.1.0 + 1 = 192.168.1.1 (first host address of current subnet)

Current broadcast address - 1 = the last host's address:

192.168.1.63 - 1 = 192.168.1.62 (last host address of current subnet).

Look at the below pictures which illustrate this method.

Pic. 16 - Subnet 1 - IP addresses

Pic. 17 - Subnet 2 - IP addresses

Pic. 18 - Subnet 3 - IP addresses

 Pic. 19 - Subnet 4 - IP addresses

Pic. 20 - Subnet 5 - IP addresses

Now, we're ready to start talking about routing. In my next post, I will talk about a router, its functions,and  basic operation. From there, we'll start exploring routing protocols.

Lesson 29 - IPv4 Subnetting - The Rules

Now, that we have already learned a few things such as conversions between binary and decimal, how to recognize classes of IP addresses based on the 'first octet rule', and what is the purpose of the network mask, we can tackle IP subnetting.
A natural (default) network mask is used with class C of IP addresses quite often. But it is very uncommon to use class A and class B IP addresses with their natural netmask. They are often sub-netted (broken down into multiple smaller networks). This is accomplished by increasing the length of the default (natural) network mask.

---

 Incidently, the network IP addresses that use their natural (default) network mask are called                   Classful Networks.

---

But why do we create subnets to begin with?

There are many reasons why we decide to use subnets rather than classful networks. But the most important is that we want to use IP addresses efficiently since they are a scarce resource these days.

Imagine that you have a huge network to support. It uses class B network address: 172.16.0.0/16. Since the number of bits in the host portion of this address is 16 (the last two bytes are not masked), we can place 65534 hosts in a single network. Even if you used 2000 hosts still it is too much to keep them in one broadcast domain. Can you imagine that many computers sending and receiving broadcasts such as ARP requests? Well, I can imagine that, but it does not mean its efficient. In fact, broadcast traffic would pretty much kill this network. Even with thousand computers that would be way too much broadcast traffic to receive.

If we divide this huge network into multiple subnets with fewer hosts per subnet, we improve the efficiency of the system. A router will connect those subnets to allow unicast communication, but broadcasts will not be propagated between subnets as routers do not forward them. For instance: 172.16.1.0/24 subnet allows only 254 hosts in it. The broadcast will be propagated between this number of hosts rather than among one or two thousands of hosts.

Another reason for using subnets is about relates to public IP addresses that are leased to customers. ISPs do not easily give out whole classes of IP addresses (classful) to companies but rather portions of these (subnets).

Other reasons may be related to security of your hosts. Network divided into chunks with routers as gateways, give you more control as to who can 'talk' to whom.

I use terms such as broadcast or unicast. If you are not sure what these terms mean, let me present brief definitions.

Transmissions:

• Unicast - a single source host sending to a single destination host.
  Example: Src=192.168.1.1, Dst=192.168.1.2
• Broadcast - a single source host sending to all hosts in the network/subnet. Example: Src=192.168.1.1, Dst=192.168.1.255 (more on this address later in the post)
• Multicast - a single host sending to a single group of hosts (IP class D)
  Example: Src=192.168.1.1, Dst=224.10.10.10.

There are three things I would like you to remember before we delve into subnetting.

Rule 1

1. If the host bits in a given IP address are all set to '0', this is the network or subnet address.
2. If the host bits in a given IP address are all set to '1', this is the broadcast address (all hosts in the subnet/network are destination).

Rule 2

The formula used to calculate the number of available subnets given the specific length of network mask.

Pic. 1 - Number of Subnet Calculation  - Formula.

Rule 3

The formula used to calculate the number of available hosts per subnet or network given the specific network mask.

Pic. 2 - Number of Hosts Per Network/ Subnet - Formula.

Before we start using the above rules, let me show you a few examples of network, subnet and broadcast addresses based on what we have discussed in the last three posts including this one. If you do not remember the 'first octet rule', which determines the class and the default network mask of an IP address, use the following table as the reference. The number ranges of the first byte determine the classes as shown in pic. 3.

Pic. 3 - Classful Address Table.

Pic. 4 - Network (classful) Addresses and Subnet Addresses (classless).

In order to determine the number of subnet bits to use them as the exponent in the above formula (pic. 1), you must first know what is the default network mask of the IP address according to its class (pic. 3). Then, you must count the bits that were added to this default network mask. These bits allow a number of subnets to be created as per formula in pic. 1. Check out the below example.

Pic. 5 - Number of Subnet Bits (Example).

In the example (pic. 5), IP address belongs to class C since the first byte value is 192 (compare it with pic. 3). Class C uses first three bytes (24 bits) to denote the network portion of the address. Today we can say that its default network mask has the length of 24 bits (255.255.255.0). Since our network mask length is /28, we have extended the default network mask by 4 bits (bits in the green color). Thus, we get 4 subnet bits that must be used in our formula presented in pic. 1.

Pic. 6 - Number of Subnets Available - Calculation.

Using the same example: 192.168.1.0/28, how many host addresses per subnet can we use?

Pic. 5 shows us that with /28 we have 4 bits left for host (total number of bits = 32). In order to calculate the available number of host addresses we must resort to formula presented in pic. 2.

Pic. 7 - Number of Hosts Available - Calculation.

Make sure you understand how the three rules presented here work. In my next post, I'm going to show you how to use them to calculate the subnets based on different criteria such as:

• Number of subnets per IP address
• Number of hosts required in the subnet
• Number of desired host per subnet - Variable Length Subnet Masking (VLSM)

Lesson 19 - Spanning-Tree Protocol Overview

Vlans described in the previous posts are very important elements of building modern networks. Equally important piece of technology is IEEE 802.1D, commonly known as Spanning-Tree Protocol. In the following few posts, I will focus on its application and basic operation.

If your network consists of layer 2 switches that allow computers connect and exchange data, you will need to consider the design that can withstand some types of failure.


Redundant Connections 

Consider the following layer 2 design. Imagine that the SW1, SW2 and SW3 switches connect many devices and there is only a single connection between the switches like depicted in the Pic1.

Pic. 1 - Switch Topology Without Redundancy

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Should either of the links between the switches break, the communication between many devices fail. Such design creates a single point of failure. We could easily tweak this simple design to make it more resilient by adding an extra path between SW2 and SW3. The below picture shows this modified design.

Pic. 2 - Redundant Paths

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Unfortunately, creating the extra path here comes at a cost. The redundant connection (Pic. 2) between SW2 and SW3 creates a loop. The loop in turn, will create three serious problems. The last one in the list will eventually render our system unavailable. Let's see what these problems are.

Duplicate Frame Delivery

Pic. 3 - Problem 1 - Duplicate Frame Delivery

Icons designed by: Andrzej Szoblik - http://www.newo.pl 

Look at the pic. 3 and imagine SW2 and SW3 do not have the MAC address of PC3(0000.3333.3333) in their databases (CAM). This can happen if the PC3 doesn't speak for more than five minutes. This is the default time MAC address is kept in the database without refreshing it. Then, we have PC1 sending frame towards PC3. As you recall, SW2 will flood the frame out of its active ports if it does not know where PC3 is located (unknown destination MAC address). The frame travels out SW2's port F0/13 towards SW1 and out the port F0/12 towards SW3. SW2 will deliver the frame to PC3. Since SW3 floods the frame out as well, it will be sent towards SW1 out of its port F0/14. Then, SW1 obediently delivers the same copy of the frame to PC3 again.


MAC Address Table Instability
Another issue caused by the loop we have created will make switches change the MAC addresses depending on where they hear the sender. Consider pic. 4 below.

Pic. 4 - Problem 2 - MAC address table instability

Icons designed by: Andrzej Szoblik - http://www.newo.pl

Again, let us assume that none of the switches in the picture knows where PC3 is connected. This means they have not learned its MAC address yet. In our scenario, PC1 sends the frame to PC3(destination MAC: 0000.3333.3333). SW2 floods the frame out F0/12 and F0/13 ports.

Now, SW3 receives this frame sourced with 0000.1111.1111 MAC address (PC1). It learns the source MAC address and maps it to its F0/12 port where it arrived. Since SW1 does not know wherePC3 is connected (at least right now) it will flood this frame out all active ports. This way, the frame is sent out SW1's port F0/14 towards SW3. SW3, upon receiving the frame on its F0/14 port, reads the source MAC address (0000.1111.1111) and maps it to port F0/14 this time. This causes a little confusion as SW3 learned it earlier on and it was port F0/12 before. Previous mapping is removed and F0/14 becomes the outbound port for 0000.1111.1111 now.

Broadcast Storm
The last problem is really severe. It can bring our traffic to a halt. Take a look at pic. 5 below.

Pic. 5 - Problem 3 - Broadcast Storm

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In this scenario, PC1 sends a broadcast frame. SW2 upon receiving it, floods it out all its active ports. SW1 receives it on port F0/13 and floods it out of other ports. SW3 receives the broadcast frame on its F0/12 port and floods it. Then, a tad later it receives this same broadcast frame from SW1 and again it floods it out all active ports except the port it arrived on. You can write the rest of the story on your own. This broadcast is running in the loop in both directions endlessly. Well, not exactly endlessly. It is true that there is not mechanism to stop it, but all three switches in the topology will be so busy sending out this broadcast, that eventually all its resources are consumed and they stop sending anything at all. If you look at switches that experience a broadcast storm, you will notice that all their LEDs are flashing amber like a Christmas tree. In a few seconds the switches become unresponsive. An attempt to access them remotely using SSH/telnet will fail. Even console connection may refuse to accept your commands. The only way to bring the switches back to the operation is to break the loop by pulling one of those cables.

So, what can we not have redundancy in our layer 2 topology? Of course, we can.

We will run Spanning-Tree Protocol (turned on by default), which will dynamically block redundant connections creating a loop free topology. Should the primary link fail, the one that is in the blocking state will start forwarding the traffic in about 30 seconds by default. Of course, we will need something much faster than 30 seconds, but I will show you that as soon as we know how STP works.

Here I am going to give you just an overview of its operation. But the devil is in the details which we will scrutinize in my next post.

Spanning-Tree Protocol Overview
STP is a layer 2 loop prevention mechanism. Switches running this protocol use special frames called Bridge Protocol Data Unit (BPDU). These frames contain enough information to allow the switches to create a loop free topology. This magic is accomplished using three distinct phases:

1. Elect a single switch to be the root bridge machine which is the central device in the layer 2 network. This machine will have all its ports in the forwarding state (designated port role).
2. All other switches (non-root switches), will select a single path towards the root bridge. That port is called the 'root port' and will be forwarding traffic that is destined out of the switch through the root bridge. This path is the least cost (best) path towards the root.
3. All other switches will select a single path per segment in order to block stop the loop. The port that is forwarding traffic is called designated port. The port that is blocking traffic to stop the loop is called non-designated port.

I will explain all the terms and the above process in details in my next post. Meanwhile, check the pic. 6 first.

Pic. 6 - Spanning-Tree Protocol

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In the above picture, SW1 has been elected as the root bridge. SW2 uses port F0/13 as its root port (the best, or the least cost path towards the root). SW3 uses it port F0/14 as the root port. SW3blocks the port F0/12 to stop the loop. SW2 keeps sending BPDU frames originated by the root bridge (SW1) out its F0/12 port towards SW3.

Now, what is really fascinating that the loop free structure like the above is done automatically (although you want and will affect how it works), and the fact that if the communication betweenSW2 and SW1, or SW3 and SW1 is broken, the SW3 port F0/12 will be put in the forwarding state.

If you are interested in the details how STP works please read my next post (lesson 20).

Lesson 15 - VLANs Overview

Now, this is the topic I give more importance to. Not because it is harder or confusing- absolutely not, but just because it is easy and very important therefore I cannot allow myself nor you Dear readers, nor anybody else should miss this part of the "networking twist", while learning cisco fundamentals.

At this stage you should be familiar with the concepts related to TCP/IP traffic flow and switch operation. You should also feel confident about how to diagnose basic layer 2 connectivity issues. For the details please review my previous posts. In this one, I am going to extend your understanding of layer 2 technologies by introducing Virtual LANs (VLANs).

Before I introduce our main topic let's define the problem which VLANS address first. This way, it's going to be easier to understand them.

Problem With Switching
As you remember from previous lessons, each port of a switch creates its own collision domain (for details look at lesson 9 in this tutorial). In addition to that a switch can use FULL DUPLEX connectivity when connecting other devices to its ports (computers, printers, switches, routers). That allows the ports to SEND and RECEIVE streams of bits at the SAME time. This is due to the special design of a switch. Thus, the efficiency of transmission is radically increased when compared to its older cousin a hub using half-duplex connections (sending or receiving but not both at the same time).

However, switches still maintain ONE BROADCAST DOMAIN. This means that in some situations they flood frames out of all active interfaces except the one that receives the frame. The flooding occurs if either of these are true:

1. The destination MAC address of the arriving frame is unknown.
2. The destination MAC address of the arriving frame is broadcast.
3. The destination MAC address of the arriving frame is multicast.
4. A switch reaches its limit of MAC addresses learned on a port. Then all other MAC addresses can no longer be learned.

Pic. 1 - Switches maintain one broadcast domain (bottom left computer sends broadcast).

Icons designed by: Andrzej Szoblik - http://www.newo.pl

In a flat network like the one depicted above (Pic. 1), imagine a thousand computers sending broadcast traffic (e.g. ARP requests). They will be propagated everywhere as per rules described earlier. Imagine another situation in which a broken NIC (Network Interface Card =  Network Adapter) sends thousands of broadcast frames per second. Those will be flooded to all hosts interrupting them as they need to process broadcast frames. In those situations not only do we interrupt all hosts by sending frames to them, but also saturate links with garbage data unnecessarily. Why would my computer have to listen to broadcast traffic sent by HR server if I work in IT department? I do not use HR server's resources at all. Exactly!

VLANs Are Broadcast Domains

Virtual LANs are the method of creating multiple broadcast domains of smaller size in a switching infrastructure. They are commonly used solution to the above mentioned problems. By configuring VLANs on the switches you create multiple broadcast domains which are treated as separate, isolated LANs which CANNOT communicate with one another by default. This allows us to contain the broadcast/multicast/unicast traffic WITHIN a boundary of a given VLAN. 

Pic. 2 - VLANs Are Broadcast Domains

Icons designed by: Andrzej Szoblik - http://www.newo.pl

If you consider traffic in the Pic. 2, the computers in red transmit their bits onto the wire, switches will send those only to computers that are in the same VLAN, that is red in this case. For instance, if the bottom right red computer sends layer 2 broadcast (destination MAC address = FFFF.FFFF.FFFF), only computers in red VLAN are going to receive this transmission. Computers located in turquoise VLAN will NOT receive those frames anymore. This way we can segment the traffic between different hosts based on criteria such as groups of interests (workgroups), type of traffic (e.g. VoIP), type of the application used, user location, etc. So, the major benefits of using VLANs are: 

1. Broadcast/multicast traffic propagation is limited to a given VLAN (broadcast domain) where it originated.
2. Security is increased, as hosts located in different VLANs CANNOT communicate at all. The only way for them to communicate is to allocate different network/subnet addresses for VLANs and use a layer 3 device (router) to move the packets between them. The routers offer some control as to who can transmit to whom (ACLs, firewalls etc.). How to accomplish routing between VLANs I will explain in my next post.

I hope the above description sheds enough light on what VLANs are used for. Now, is the time to look at some details regarding their configuration.

VLAN Port Types

In order to segment the traffic, the hosts generating it must be assigned to the appropriate VLAN since all ports of the switch are members of VLAN 1 by default. The process of configuring that usually involves three major steps:

1. Configuring VLAN number in the switch database (optionally name of the VLAN and/or other parameters).
2. Assigning hosts to VLANs defined in step 1. There are two ways of doing that: either MAC address can be assigned to a VLAN (dynamic method), or port of the switch can be assigned to a VLAN (manual method).
3. Configuring VLAN Trunk connections between the switches. Even though, this step is optional, the majority of designs out there will need it.

The above mentioned configuration steps define two different port types VLANs can use:

1. Access Port - this type of port can be member of ONE VLAN ONLY. If a static port-to-vlan configuration is used, the port interprets all incoming frames as belonging to this specific VLAN. In case of using mac-address-to-vlan configuration the port will determine VLAN number (ID) for transmission based on the MAC address which is mapped to a specific VLAN.
2. Trunk Port - which by default belongs to ALL VLANS (1-4094). In other words, this port is capable of sending and receiving a traffic coming from different VLANs.

When is the trunk (multi VLAN) port required?

The below picture (Pic. 3) illustrates the need for it.

Pic. 3 - VLAN Port Types

Icons designed by: Andrzej Szoblik - http://www.newo.pl

The grey rectangles symbolize two switches. The colors, represents different ports assigned to different VLANs. Of course, VLANs in practice use numbers, not colors, to distinguish between themselves. When any bottom computer sends broadcast (or unicast towards another computer in the same VLAN/color connected to the upper switch), the port connecting the two switches must be trunk (multi-vlan port). In such situation w must allow all VLAN members to communicate with their peers in the same VLAN, irrespective where they are located. Both switches have yellow, red and blue members here! And according to the rules, red computers must be able to talk to all red computers located on the same and all other switches as well (yellow-to-yellow, and blue-to-blue).They are members of the same Virtual LAN after all.

In such design, in which members of the same logical network (VLAN) or broadcast domain are connected to different physical switches, the connection between them must be a trunk. Trunk ports run a special protocol called IEEE 802.1q (Cisco have also their own protocol called ISL, details of which are beyond the scope of this tutorial). This protocol is responsible for 'tagging' the frames (injecting extra information into their headers), while sending them out the trunk port.

Why?

Let me explain. Look carefully at the Pic. 3 and imagine that the computer connected  to yellow VLAN is sending broadcast towards all computers that are in the same, yellow, VLAN. The port between the switches is trunk, and as such allows ALL VLANs in and out. But the problem is that the receiving port on the upper switch gets the Ethernet frame on the port working as trunk as well. So, this port is also a MULTI-VLAN port! How does this upper, receiving, switch know which VLAN the frame is coming from? Well, it does NOT know whether the VLAN sending this broadcast was yellow, red or blue. This is where the sending (bottom) switch, using the trunk as outbound port, is going to inject extra 4 bytes into the Ethernet frame while transmitting it out. The tag will contain VLAN ID (number) of the sender. This way, the broadcast frame will have an extra information allowing the receiving switch (upper one) to recognize which VLAN it is coming from and forward this broadcast to ALL computers in the same VLAN (here yellow VLAN).

---

NOTICE!
The TAG  is stripped off on the outbound ports configured as ACCESS ones. The tag is useful only on trunk ports.

---

Before we finish this VLAN overview lesson, let me show you what information this TAG contains.

Pic. 4 - 802.1q TAG

The 802.1q tag is injected between the source MAC address and the type field in the Ethernet II header (pic. 4). It consist of two fields taking two bytes each:

1. First two byte field contains a signature of 802.1q protocol using value of 0x8100.
2. Second two byte field  contains:

• PRI - Class of Service 3 bits used by QoS, 
• Canonical bit for token ring support, 
• VLAN ID value that takes up 12 the least significant bits in the tag.

802.1q Native VLAN
There is one more thing I need to touch upon that is related to the 802.1q trunk port. That is the concept of Native Vlan. The designers of the protocol decided to send frames coming from so called 'native VLAN' out the trunk as UNTAGGED. In other words this frame does not have any tag inserted into the Ethernet header. So, frame coming from 'native VLAN' is a regular Ethernet frame. As long as the switches agree on the trunk link which VLAN is their 'native VLAN' for this trunk, a frame arriving on the trunk port without the tag is assumed to be coming from the same native VLAN the sender was transmitting. The default  'native VLAN' is VLAN 1, since this one cannot be removed from the switch. Probably the reason VLAN 1 is the 'native VLAN' by default is becuase switches originate frames such CDP, VTP, STP from this VLAN and there is no need to tag them as they are switch-to-switch communication only.

---

NOTICE!
As of the time of writing this tutorial, all ports of Cisco switches belong to VLAN 1 by default which is also the (untagged) 'native vlan'. That VLAN is not going to tag frames on trunk-to-trunk connections.

---

I am sure you realize what can happen if the two ports connecting switches use different VLAN ID for their 'native VLAN'. Yes, that can cause leaking frames between VLANs. And this is a serious security issue. So keep the same 'native VLAN' on trunk paired ports between switches.

In my next post we will look at the same concepts from the command line perspective. I will also introduce VTP protocol as well as Inter-VLAN routing.