Instructor: The next major concept that we need to cover
is that of a virtual local area network,
also known as a VLAN.
Now we talked about switch ports
all being on a single broadcast domain,
and to break them up,
we have to use a layer three switch or a router to do that.
Well, VLANs allow you to break out certain ports
to be used for different broadcast domains
just like you would if you had a virtual router.
Now before VLANs, we had to use additional routers
and cables and switches
to separate out our different departments
and our different functions and our different subnets.
But with the advent of a VLAN with layer three switching,
you can have this inside of layer three switching
or even some layer two switches.
This allows you to have a different logical network
that share the same physical hardware.
This is going to provide you with a lot of additional security
and efficiency that you don't get with using everything
in a single broadcast domain on a standard layer two switch.
Now back before we had VLANs,
you had diagrams that look like this.
Let's say I had the IT department
and the human resource department
and I wanted to keep them separate for security.
Well, if I wanted to do that,
I had to plug them into different switches
and then have different routers
and be able to route the traffic between those two networks.
Now if I had the IT and the HR on floors one and two,
I might have to have switch one
and switch three on the second floor
and switch two and switch four on the bottom floor.
And so now, I had to double the equipment
to maintain this logical separation.
And in this case, I also had physical separation too
'cause I had four different switches for those two floors
and those two departments.
Now with virtual local area networks or VLANs,
I can consolidate all of that into just two switches,
one for the first floor and one for the second floor.
And then, I can logically separate out the traffic
into each of those virtual networks.
Notice that the IT department is cabled into the switch,
and logically, it trunks down from switch one
into switch two and then down into our router
and it keeps everything logically separated
as shown by this color scheme.
Now even with these different switch ports
and they're in different LANs,
they're also going to be in the same physical hardware though
and they're riding the exact same cable.
That's how you can see this purple and blue cable
going from a switch two down to the router,
it's actually only one cable, but logically in this diagram,
they are going to be two separate logical cables, right?
But in real life, it is really one cable.
This is the idea of doing VLAN trunking.
And to do this, we use this protocol called VLAN trunking,
known as 802.1q.
Now this is what happens when we merge
all that data onto a single cable, we call it a trunk.
Now, since we have multiple VLANs
and they're all going over the same cable,
we have to have a way to identify them.
This again is reducing the amount
of physical infrastructure, cables
and switches and routers that we need
while still giving us the logical separation that we desire.
Now the way we identify the different VLANs
that are going over this trunk is by using an electronic tag
that is four bytes long
and it's called our four byte identifier.
Now there are two pieces to that.
We have the TPI and the TCI.
The TPI is the tag protocol identifier
and the TCI is the tag control identifier.
When you have one VLAN and it's left untagged,
that becomes your native VLAN,
also referred to as VLAN zero.
Now you can see the packets here on the screen,
and again, you don't have to memorize
the way these packets are laid out.
This is just a graphical depiction
to show you what 802.1q actually looks like
in the real world.
What you really need to know about VLANs
is that they are great for security,
and if you're using VLAN trunking,
your 802.1q is your standard for VLANs.