Defined by IEEE 802.1Q standard, a VLAN divides network resources regardless of location within a broadcast domain. In large buildings where having separate switches for separate resources is not feasible, VLANs allow those resources to remain separate. By adding a small identifier to the frame header, 802.1Q allows for unparalleled control at the switch level.
Layer 2 vs. Layer 3
There are seven layers of the Open System Interconnect model that defines how computers communicate. These OSI layers relate to a specific part of the communication process: layer 1 is the “physical” layer, and relates only to the signaling standards needed to transmit an electrical signal between two adapters; layer 2 deals with switches, coordinating communications between network adapters directly connected in the same broadcast domain. Typically, all computers connected to the same physical switch reside in the same broadcast domain. When these computers want to communicate with a different network entirely, they transition to layer 3, where IP addresses are used to find a host using a router. VLANs operate at layer 2, but their utility comes into play when integrated with a layer 3 solution.
Normal Switch Function
Without 802.1Q, only routers can separate different layer 2 networks. When one computer sends a broadcast -- a frame destined for every computer on the broadcast domain -- every device connected to the same switch receives that broadcast. Broadcasts are typically used for useful services such as requesting an IP address from an available DHCP server. However, directly-connected devices are also susceptible to intrusion.
When VLANs are enabled on a switch, each port is assigned to a VLAN, and data sent from a device connected to that port gets all its data “tagged” with the VLAN ID. The default, or “native,” VLAN is “1.” Changing a port to VLAN “2” means broadcasts and frames with a destination unknown to that switch are only forwarded to other VLAN “2” ports and VLAN trunks. VLAN trunks are ports configured to forward information from all VLANs, necessary for connecting other switches or routers. Data sent from VLAN 1 to VLAN 2, and vice versa, must go through a router. The router is then configured to block or allow the communication, based on the sending station's layer 3, or IP, information. Meanwhile, the switches themselves exchange data to ensure that everyone recognizes all available VLANs.
VLANs completely change the flexibility and control of a network. Imagine a large, multistory building owned by you. Each floor has multiple offices, and you, as the building owner, have wired each floor for data use back to a central data closet, but each office is leased by a different company. You want to provide all tenants with a shared Internet plan. Without 802.1Q tagging, you would have to provide a separate switch to each office, and each switch would have to be individually connected to the ISP. With 802.1Q tagging, however, you can enable each office to communicate among itself and with the Internet connection, while keeping data separate from the other offices, by using a single switch and single router. If one office later leases the office next door, you would simply need to change the VLAN IDs of those ports.
- Comstock/Comstock/Getty Images