Module 9 VLANS and Trunk

Native VLAN

Special VLAN whose traffic goes across the 802.1q trunk without a VLAN tag

What is the process of inserting the VLAN frame into the layer 2 frame called?

Tagging or Encapsulation

What inserts the VLAN Tag into the Frame

The Trunk Port

What is a switch Trunk Port

This port is used to transfer traffic for different VLANS and Devices, The port sets unique identifier tags on the FRAME using Either 802.1Q or ISL encapsulation protocols

How does a Trunk Port identify what VLAN the frame belongs to?

Trunk port adds a VLAN tag to the Frame to indicate what VLAN the frame belongs to.

What is the process of traversing different VLAN traffic over the trunk is called?

Trunking

VLAN ID

Unique ID to identify the Virtual Network

Endpoints connected to a switch have what logical barrier to protect themselves from other endpoints connected to the switch

VLAN

What VLAN is an Access Port on by Default

VLAN 1

By Default, what VLAN is the Native VLAN?

VLAN 1, the native VLAN be be changed to anything we like

What is a VLAN

Virtual Network on a switch that represents a broadcast domain, Logical network that can group devices/users regardless of different physical locations.

Three facts about Default VLAN 1

We cannot change it, we cannot delete it, Not intended as Standard Data VLAN

Does the same Trunk protocol need to be used on both Trunk Ports on either end?

Yes

What do you configure on the Switch to enable inter-VLAN routing

switchport Mode Trunk

What is a switch Access Port

-When port is used to connect an end device. Interface must be configured as an Access Port. - Access Ports transport traffic to and from the VLAN to which they are assigned

What are the two Switchport Modes

1 - Access, 2- Trunk

Benefits of VLANS

1 - Security/Segmentation, 2-Performance Improvement by reducing size of broadcast domain , 3- Simplicity of network management operations and maintenance

What is the purpose of Native VLAN

1) Backward compatibility with old devices that don't support VLANs, 2) Native VLAN used by switch to carry specific control and management protocol traffic like CDP (Cisco Discovery Protocol), VTP (VLAN Trunking Protocol), STP (Spanning Tree Protocols) or other network mgmt Traffic. 3) Useful for VoIP

What modes can DTP run in?

1- Dynamic Auto, 2- Dynamic Desirable

What are the 4 fields on the VLAN Tag

1- Trigger:Frame to a VLAN, 2- Qualityof Service, 3- 1 Bit flag. Always 0 for ethernet switches 4 - VLAN ID (1-4094)

What is the Valid VLAN ID range for sending data?

1-1005

Valid ID ranges for Vlans

1-1005, Extended 1006 - 4094

What are other default VLANS

1002: fddi-default, 1003 token-ring-default, 1004 fddinet-default, 1005 trnet-default

What is the default Trunk Protocol today

802.1q

What are other names for a Trunk

802.1q Link or Dot1q Link

What does inter VLAN Routing require to take place

A Layer 3 device to encapsulate and decapsulate

Whose responsibility is it to create and manage VLANs?

A Switch

Dynamic Desirable DTP

Allows DTP negotiation packets to be sent to the destination switch

What side of the Trunk does the Native VLAN need to be defined on?

Both sides of the Trunk

What type of VLAN traffic doesn't need VLAN tag to go over the Trunk

CDP, VTP, STP etc.

CLI: show vlan brief

Command shows VLAN details

CLI: switchport mode trunk allow vlan [vlan-id]

Command to allow certain VLANs to pass through the Trunk

CLI: switchport trunk native vlan [vlanid]

Command to change the Native VLAN

CLI: vlan vlan-id | name [name]

Command to create a VLAN, Names are arbitrary

CLI: switchport mode access | switchport access vlan [vlanid] | switchport voice vlan [vlan-id]

Command to define a port as a Voice VLAN

CLI: switchport mode access | switchport nonegoiate

Command to disable DTP

CLI: switchport mode access | switchport access vlan [vlan-id]

Command to enable Access mode and assign port to VLAN

CLI: show interfaces switchport

Command to show Port interface information

What creates a Trunk

Configurations of switch ports on both ends of the link. Trunk Port in Cisco world or "Tagged" port otherwise; Configuring TRUNK ports

Dynamic Auto DTP

Default for each port. Does nothing until receives request. Does not negotiate

What are the different types of VLANS

Default: 1 and 1002-1005, Data: 2-1001, Voice: VoIP , Management: VLAN 1 uses Layer 3 interface called SVI. Used for remote connections via SSH and Telnet, Native: forwards untagged traffic such as DTP and CDP

What is best practice regarding assigning Native VLAN number?

Do NOT leave it as VLAN 1. Make it something like 777 or 666 etc.

What type of attack can be mitigated by using Native VLAN

Double Tagging Attacks

What is DTP

Dynamic Trunking Protocol by Cicsco to create Trunk Links automatically. It can be turned off. DTP automatically negotiates for packets between switches. When switches reach "Agreement", the trunk is established.

CLI: switchport mode trunk

Enable Trunk Mode on Port

Which is more secure, first assign VLAN to a port, then enable Access Mode, or enable Access mode then assign and then a VLAN

First enable Access mode, then assign the port to the VLAN

What is the name of a Frame that contains VLAN information

IEEE 802.1q

What is an older Trunk Protocol

ISL (inter-switch-link)

What is a Trunk

It enables Devices on different Devices but the same VLAN to be able to communicate

What layer to VLANS operate in?

Layer 2

Router on a Stick

Layer 3 device to enable inter VLAN routing. Single physical connection bc switch and router. One physical interface on the router but many logical subinterfaces ...one per VLAN. Each subinterface is configured as default gateway for it's VLAN.

Is a LAN Logical of Physical division between local networks

Logical

Error message with mismatched Native VLANs defined

NATIVE_VLAN_MISMATCH

Can users on VLAN 10 access data on VLAN 20?

No

Do devices on an Access port have any idea about the VLAN

No. Devices are not aware of their VLAN or that they belong to one.

Access Port ("Untagged" in non-cisco world) does what

Port that sends and expects traffic with NO VLAN tag because it carries traffic only for 1 VLAN.

How does the Trunk allow communication between different switches or router?

Provides VLAN ID for frames traversing between switches

What command can be used to assign multiple ports to a VLAN simultaneously?

Range