Cisco CCNA ICND2 640-816

Switch VLANs: Understanding VLANs

by Jeremy Cioara

Start your 7-day free trial today.

This video is only available to subscribers.

A free trial includes:

  • Unlimited 24/7 access to our entire IT training video library.
  • Ability to train on the go with our mobile website and iOS/Android apps.
  • Note-taking, bookmarking, speed control, and closed captioning features.
Video Title Duration

Review: Rebuilding the Small Office Network, Part 1

Review: Rebuilding the Small Office Network, Part 2

Review: Rebuilding the Small Office Network, Part 3

Switch VLANs: Understanding VLANs

00:00:00 - We're now moving out of the review and into our first major
00:00:04 - topic of this series which is VLANs. Nothing can be bigger
00:00:08 - in the network world in the last decade than VLANs and
00:00:12 - how they've reshape our entire landscape of the network.
00:00:16 - So, to start things off will take a look at what normal switches
00:00:19 - do. Some of the challenges that we experience even in normal
00:00:22 - switch network, then we'll see how VLANs and trunks address
00:00:26 - those issues will define what VLANs are, and then we'll
00:00:29 - talk about the counterpart that goes right with them and that
00:00:31 - is trunk connections. Finally will look at the flexibility
00:00:35 - of VLANs and I present the design option of what VLANs
00:00:39 - can do for business or an organization giving you flexibility
00:00:43 - with how you use your network.
00:00:46 - With that foundation in place let me be the first to welcome
00:00:49 - you to the world of VLANs. I kind of think of VLANs like I think
00:00:53 - about my microwave oven. About two weeks ago my microwave broke
00:00:58 - down and we called the repair guy and he said my first availability is
00:01:03 - in a week and half and I was like oh yea go ahead and put us on the calendar and my
00:01:07 - wife said we'll be without a microwave oven. I said, microwave oven, who needs them
00:01:11 - right? You now we got a stove. So it's just a laziness factor. I'm telling you after about
00:01:17 - 3 days without a microwave oven, I need a microwave oven.
00:01:20 - I couldn't handle it. I called the repair guy, said don't worry about it,
00:01:23 - we're going to get a new one. we were that desperate for a microwave
00:01:26 - oven and we have a little infant to warm up to the food where to
00:01:29 - put on. It was horrible, horrible. So it's not like you can't
00:01:33 - survive without microwave ovens. In the same way it's not
00:01:36 - like networks don't work without VLANs, but they're so convenient
00:01:41 - and so powerful.
00:01:43 - you see the tie in there. That everybody uses them. What a
00:01:46 - VLAN does is logically group users. Let's get to the official information
00:01:50 - right here, it logically groups our users together.
00:01:55 - So, over here imagine that we had two groups of users in
00:01:58 - our organization, the marketing group, surrounded by pink, and
00:02:02 - the sales group surrounded by blue. So, what I can do with
00:02:07 - VLANs is actually group those people together where the blue
00:02:10 - ports are now isolated to the blue ports in that and this is
00:02:14 - the most accurate statement here. It's segments their broadcast
00:02:17 - domain. So, if a sales PC sends a broadcast it's only going to
00:02:21 - come out of the blue ports you can see we've got some blue
00:02:24 - ports on some other switches as well that will receive the
00:02:27 - broadcast and this guy down here gets to broadcast. It does
00:02:30 - not affect the pink ports and if the pink computers sends a
00:02:32 - broadcast only the pink PCs lined up receiving that. So, you completely
00:02:37 - isolate all of those broadcasts domain into two separate groups.
00:02:42 - Now, as a side note, before we get too deep into VLANs. If the
00:02:47 - blue users send a broadcast it comes out of the blue ports right?
00:02:51 - So, pink users send a broadcast it comes out all the pink ports. If that's
00:02:55 - the case? What VLAN do these ports belong to?
00:03:03 - You're probably thinking the answer is both, and that is absolutely
00:03:06 - correct that is what CISCO calls a trunk port. A trunk
00:03:12 - just think of it like the trunk of your car. If it's like mine you get everything
00:03:15 - in there, you know, and everything goes across the trunk port. So, when
00:03:19 - you were using VLANs the trunk will carry all VLAN
00:03:22 - traffic between your switches and that's what allows your VLANs
00:03:26 - to span beyond just a single switch, otherwise without
00:03:29 - trunk ports we would have a separate VLAN on all our switches
00:03:32 - that couldn't communicate. So, the VLAN segment broadcast domains
00:03:36 - it also correlates to a subnet. Actually saw a statement
00:03:41 - on CISCO's website when I was looking for some the VLAN
00:03:44 - information I thought it was great. They said a VLAN equals
00:03:47 - a broadcast domain equals a subnet.
00:03:51 - Meaning all of those things are equal terms. So, for our marketing
00:03:57 - group we would be
00:04:01 - And our sales group may be
00:04:05 - They are on separate subnets
00:04:08 - even though all you see here is a switch. Now keep in mind
00:04:13 - that when you setup VLANs and we use our VLANs in this this
00:04:16 - kind of design. These people cannot reach each other. Marketing
00:04:20 - people cannot reach sales people and vice versa and that provides
00:04:25 - a great level of access control if that's what we want. Now
00:04:28 - we'll talk about routing between VLANs and some of the
00:04:32 - upcoming videos which is something that you need to do and if
00:04:35 - you want sales people to be able to be able to talk to marketing people,
00:04:37 - you would have to get a router that's able to route between
00:04:41 - those two separate VLANs. The blue people would come in the
00:04:44 - router and exit on to the red VLANs and so on and that that's
00:04:47 - a big topic, we'll talk more about that later. The last thing that
00:04:51 - VLANs are used for is quality of service. So, I can separate
00:04:56 - the prioritize traffic from the not so prioritize. For example
00:05:01 - flush the sales and marketing picture out of your mind and imagine
00:05:05 - that the pink VLAN represented the PCs and the blue
00:05:10 - VLAN represented
00:05:12 - phones. Phones you say? Phones I say. We have nowadays
00:05:18 - IP phones that plug into a network so these IP phones
00:05:23 - have traffic that, I mean, it comes out it's very small, IP phones
00:05:27 - don't generate much traffic but that traffic has to be protected
00:05:31 - from everything else. All of the computers will step all over
00:05:35 - your IP phone traffic, I mean think, think
00:05:38 - of that IP phones traffic as a delicate little flower.
00:05:43 - it's so small and pretty and it comes into this switch and is just
00:05:46 - kind of floating along trying to get to another IP phone that's
00:05:49 - on the network somewhere and these PCs here are these football
00:05:53 - players, I can't draw that. And you know they're running all over
00:05:56 - the network trying to gobble up as much bandwidth as they can.
00:05:59 - When you pit a football player against the flower if you don't
00:06:02 - do something about it that poor flower is going to get crashed.
00:06:05 - Where am I going with this? Quality of service sometimes I lose
00:06:09 - myself. Quality of service allows me to say the flower
00:06:14 - that the VOIP or wherever my priority traffic is gets carried
00:06:18 - above all the rushing football players running around my network
00:06:22 - which is the pink VLAN, the PCs in this case. So, VLANs
00:06:25 - will allow me to logically separate them and isolate
00:06:28 - them from each other.
00:06:31 - Before we can truly understand and appreciate the benefits
00:06:34 - of VLANs we need a hit some key points of the normal switching
00:06:38 - world, review some of those key concepts. First of, if we just
00:06:41 - have this usual switch here you know any switch so you can
00:06:44 - pick up from Best Buy or any electronics store, you're automatically
00:06:49 - going to get one collision domain per port and that's a good
00:06:52 - thing, that means that every computer that's plugged into that
00:06:55 - switch can send and recive at the same time if they're operating
00:06:59 - in full duplex mode as any other. So this computer could be
00:07:03 - sending or receiving along with this one and that's okay that's
00:07:06 - a huge stride forward from the hub world where only one device
00:07:10 - plugged into the hub could send or receive at a time. Notice I said send
00:07:14 - or receive that's the half duplex world. Second piece of the
00:07:18 - switch world is that we have broadcast sent to all ports by design.
00:07:23 - when this computer sends a broadcast in the switch, the switch
00:07:26 - will send it out every single port except the port it received it
00:07:29 - on and all the devices will receive it, and that's great because
00:07:33 - broadcasts are necessary they help us locate services it helps
00:07:37 - computers advertise services and there's a whole other plethora
00:07:41 - of uses for broadcasts. But as this network grows and we plug
00:07:45 - in another switch here and another one here and link one
00:07:48 - of here, you just start getting more and more clients attach those
00:07:52 - broadcast start becoming a problem. They cause a network slowdown
00:07:57 - where everybody receives these broadcasts and starts becoming too overwhelming.
00:08:01 - Now different people will tell you different guidelines
00:08:03 - for how big the network can get. CISCO rule of thumb is once
00:08:07 - you reach 500 PCs or 500 devices on a network
00:08:11 - that's where it's time to divide up in separate networks. That's
00:08:15 - a pretty liberal amounts I've seen most people in practical
00:08:18 - use somewhere around two to three hundred PCs will segmented
00:08:22 - of and start another network. Because the broadcast will start
00:08:25 - slowing down the network and all devices that are plugged
00:08:28 - into it.
00:08:29 - Now down below that you see one subnet per LAN, meaning
00:08:32 - in the normal switching world if we have all these switches
00:08:35 - daisy chained together and I said this is the
00:08:39 - network that means all the PCs plugged
00:08:44 - into there have to start with 172.16.1.
00:08:47 - something, that's one might be.50 here, this might be.51.
00:08:50 - So, If I were to go of a lim and just say well let's let's go
00:08:54 - out and make this one
00:08:57 - or 51 slash 24 and so let's just
00:09:02 - to that that immediately this computer would be isolated from
00:09:05 - the rest even though it's plugged in to the same switch, it
00:09:09 - could not reach any one because logically speaking it thinks it's
00:09:13 - on a separate network then everybody else. So it's going to try
00:09:16 - and go to its default gateway to reach things that are in
00:09:19 - the subnet.
00:09:20 - Finally, in the normal switching world we have very limited
00:09:25 - access control, and what that means is that it's very difficult
00:09:29 - for me to restrict this computer from reaching that computer.
00:09:33 - There is virtual well, there's, there's ways to do it
00:09:37 - but they are extremely painful and involves assigning access list
00:09:41 - to a each individual port, we'll talk about access lists later
00:09:44 - on but it's just not something that's practically done. So,
00:09:48 - in a flat switch network meaning a single broadcast domain
00:09:52 - where one broadcast can reach everybody it's a very difficult
00:09:56 - nearly impossible to prevent devices from accessing each other
00:10:00 - fully. Before we go on let me just mention that a lot of
00:10:04 - the analogies you hear me use, I don't really plan they just kind of
00:10:08 - come to me as an talking. I pause the video between this
00:10:12 - and the slide in the in the last An I thought, flowers where did that come
00:10:16 - from. Hopefully it helped demonstrate the purpose of VLANs. So let's talk
00:10:21 - more about the flexibility of VLANs and why they're so powerful. With
00:10:25 - VLANs you get segmentation of users without routers, without
00:10:30 - without routers before VLANs there is just no way to separate
00:10:34 - uses apart and also one of the problems of routers is that
00:10:38 - you were limited to physical location. Let me give you an example
00:10:42 - let's say this was a network of yester year we had building A,
00:10:45 - building B and building C, and let's say it's college campus
00:10:49 - well if that were the case we would have to have routers going between
00:10:53 - these buildings that will allow them to connect together and
00:10:56 - still allow the users to be separate meaning i've got one subnet
00:11:00 - of people in this building and one subnet of people over
00:11:02 - here, if we didn't have routers between the buildings and
00:11:06 - everybody just linked up. One broadcast would flood the whole
00:11:10 - network so we were just tie routers together. Well with
00:11:15 - VLANs, we can segment our users between the buildings without even
00:11:21 - needing routers in place. I can say building B is isolated
00:11:24 - to the blue users. Building A is isolated to pink users.
00:11:28 - Now, you might see well what that blue guy doing there that some more
00:11:32 - of the flexibility of VLANs. Before if we had a blue user that
00:11:37 - was in this building, I mean maybe building A faced a flowing
00:11:42 - river, and the blue users here
00:11:47 - represents it's a college right? So it's the college of art.
00:11:50 - So let's say that one of the users from from this blue network
00:11:54 - said you know I just feel inspired when I look out the window
00:11:58 - and I see the water flowing to paint the beautiful paintings
00:12:02 - and he said I can't sit and be inspired in building B
00:12:06 - I wanna sit in building A. Well if we were in the old routed
00:12:10 - world and we wanted this user to stay on the building B subnet
00:12:13 - because maybe the red VLAN over here or the red
00:12:17 - users represent the administration and there's been some you
00:12:21 - know college of art users hacking into the administration so we wanted
00:12:24 - separate them. You see where I'm going with this? The point is that if we had
00:12:28 - the router the world the only way to get the that user in the
00:12:32 - building A on building B's network would be to run an
00:12:36 - extra long the ethernet cable, remember they go hundred meters. An extra
00:12:39 - long ethernet cable between the two buildings and plug that user in.
00:12:43 - Now that we have VLANs I can assign one port in building A
00:12:48 - to the college of art VLAN and allow that user to connect.
00:12:53 - So even though he's sitting right next to one of the college
00:12:56 - administrators he can not access their PC.
00:13:00 - The user can look out the window be inspired and be on the
00:13:03 - college of art network without having to be physically plugged
00:13:07 - into the college of art building. So that's what I mean when
00:13:10 - I see no longer limited to the physical location. You can see
00:13:13 - over here and building C we also have an IP phone that
00:13:16 - might be on you know some other VLAN that separated
00:13:19 - from everybody else and we isolate those, and we could put IP
00:13:22 - phones in every single building
00:13:25 - that everybody uses and allow those to be all on the same network
00:13:29 - that cannot be touched by the PC. That's really good because
00:13:33 - there's already programs out there that will allow you to sniff
00:13:37 - the network like tap into the network and capture the VOIP
00:13:41 - packets and assembled them into a normal WAVE file or
00:13:45 - mp3 file so I can actually it's kind of like if you come from
00:13:49 - the telephone background it's like a but set where you tap
00:13:52 - into the wires and you can hear the conversations that are
00:13:54 - going on but people can just do it from their own computers unless
00:13:59 - you separate those phones from the rest the network and that's
00:14:03 - one of the powers of VLANs. So with VLANs you also
00:14:07 - have tighter control of broadcast. One broadcast within the
00:14:10 - blue VLANs stays within the blue VLANs. Broadcast in the
00:14:14 - red VLAN or pink VLAN stays in the pink VLAN.
00:14:18 - Because of their importance to the network world all I wanted
00:14:21 - to do is we start off into the world of switch VLANs was
00:14:24 - give you a base understanding of what of a VLAN is and what
00:14:27 - trunks do will expose more of the technical details as we dig
00:14:31 - deeper in this this content. So let's review. We first saw
00:14:36 - the view of a normal switch where every single port is its own
00:14:39 - collision domain. The entire switch in all the switches that
00:14:43 - are plugged in with crossover cables are one broadcast
00:14:47 - domain. So one broadcast will go through them all and that
00:14:49 - can cause a lot of congestion the bigger it gets. Its also very difficult to
00:14:53 - control access into those normal switches of what devices can
00:14:57 - access each other is everybody's one subnet. So as we get into
00:15:01 - VLANs we see those problems solved. The VLANs are our way
00:15:05 - of segmenting the switches into separate broadcast domains
00:15:09 - or separate subnets. That gives us more control over where
00:15:12 - the broadcasts go. Gives is the ability to do quality of service
00:15:15 - and prioritize traffic and it gives us the ability to do access
00:15:19 - control as we divide people in separate subnets. The trunks
00:15:23 - are the links that are going between the switches that carry
00:15:27 - all VLAN traffic.
00:15:29 - That's where every VLAN will be allowed to traverse that trunk
00:15:32 - and that's what allows us to have multiple VLANs on one switch
00:15:36 - that can span down to VLANs on another switch. Now last
00:15:40 - but not least, we talked about the flexibility of VLANs and
00:15:43 - saw some of the possible design options where with VLANs
00:15:46 - you can actually span between buildings and have people in
00:15:49 - separate buildings that are normally on different subnets.
00:15:53 - Be a part of the same subnet. Because we've used VLANs to do our segmentation.
00:15:58 - It gives us ultimate flexibility with where our users are located
00:16:02 - because we're no longer limited to the physical location.
00:16:06 - I hope this is that informative for you and I like to thank you for viewing.

Switch VLANs: Understanding Trunks and VTP

Switch VLANs: Configuring VLANs and VTP, Part 1

Switch VLANs: Configuring VLANs and VTP, Part 2

Switch STP: Understanding the Spanning-Tree Protocol

Switch STP: Configuring Basic STP

Switch STP: Enhancements to STP

General Switching: Troubleshooting and Security Best Practices

Subnetting: Understanding VLSM

Routing Protocols: Distance Vector vs. Link State

Routing Protocols: OSPF Concepts

Routing Protocols: OSPF Configuration and Troubleshooting

Routing Protocols: EIGRP Concepts and Configuration

Access-Lists: The Rules of the ACL

Access-Lists: Configuring ACLs

Access-Lists: Configuring ACLs, Part 2

NAT: Understanding the Three Styles of NAT

NAT: Command-line NAT Configuration

WAN Connections: Concepts of VPN Technology

WAN Connections: Implementing PPP Authentication

WAN Connections: Understanding Frame Relay

WAN Connections: Configuring Frame Relay

IPv6: Understanding Basic Concepts and Addressing

IPv6: Configuring, Routing, and Interoperating

Certification: Some Last Words for Test Takers

Advanced TCP/IP: Working with Binary

Advanced TCP/IP: IP Subnetting, Part 1

Advanced TCP/IP: IP Subnetting, Part 2

Advanced TCP/IP: IP Subnetting, Part 3

Please help us improve by sharing your feedback on training courses and videos. For customer service questions, please contact our support team. The views expressed in comments reflect those of the author and not of CBT Nuggets. We reserve the right to remove comments that do not adhere to our community standards.

comments powered by Disqus

Course Features

Speed Control

Play videos at a faster or slower pace.


Pick up where you left off watching a video.


Jot down information to refer back to at a later time.

Closed Captions

Follow what the trainers are saying with ease.

Offline Training

Our mobile apps offer the ability to download videos and train anytime, anywhere offline.

Accountability Coaching

Develop and maintain a study plan with assistance from coaches.
Jeremy Cioara

Jeremy Cioara

CBT Nuggets Trainer

Cisco CCNA, CCDA, CCNA Security, CCNA Voice, CCNP, CCSP, CCVP, CCDP, CCIE R&S; Amazon Web Services CSA; Microsoft MCP, MCSE, Novell CNA, CNE; CompTIA A+, Network+, iNet+

Area Of Expertise:
Cisco network administration and development. Author or coauthor of numerous books, including: CCNA Voice 640-461 Official Cert Guide; CCNA Voice Official Exam Certification Guide (640-460 IIUC); CCENT Exam Prep (Exam 640-822); CCNA Exam Cram (Exam 640-802) 3rd Edition; and CCNA Voice 640-461 Official Cert Guide.

Stay Connected

Get the latest updates on the subjects you choose.

  © 2015 CBT Nuggets. All rights reserved. Licensing Agreement | Billing Agreement | Privacy Policy | RSS