VLANs

Why segment, access and trunk ports, the 802.1Q tag, the native VLAN and routing between VLANs with subinterfaces or a layer 3 switch.

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

VLAN: what is it?
Show the answer
A virtual local network: a group of ports on one or several switches that forms its own broadcast domain, separate from the others.
A broadcast sent in a VLAN reaches only the ports of that VLAN. Each VLAN usually gets its own IP subnet.
Why split a company's flat network of 300 hosts into VLANs?
- To shrink broadcast domains and isolate departments
- To double each port's throughput by separating the departments' traffic
- So that departments reach each other without going through a router
- To encrypt each department's traffic on the company's cables
Show the answer
To shrink broadcast domains and isolate departments
Every broadcast (ARP, DHCP…) reaches all hosts of the same domain: with 300 hosts, that is noise for everyone and a wide attack surface. VLANs cut that domain by department without rewiring. They encrypt nothing, and a router is then needed to go from one department to another.
On a Cisco switch, the switchport mode command followed by … sets an access port, and followed by … a trunk port.
Show the answer
On a Cisco switch, the switchport mode command followed by access sets an access port, and followed by trunk a trunk port.
For an access port, switchport access vlan 20 then chooses its VLAN; for a trunk, switchport trunk allowed vlan 10,20 chooses the ones it lets through.