شرح تفصيلي لل VLAN بطريقة مبسطة وجرافيك احترافي — Transcript

Full transcript

1. 0:00Welcome to a new video in the
2. 0:02Networking Basics and Concepts series
3. 0:04from IT Dose. Today, we'll discuss a
4. 0:07very important networking concept: the
5. 0:09VLAN, which stands for Virtual Local
6. 0:11Area Network. Before we talk about
7. 0:14VLANs, you must first know what a LAN
8. 0:16is. We've already discussed it in
9. 0:19detail in a previous video, where we
10. 0:20defined it as a group. Of devices like
11. 0:23computers, servers, routers, and
12. 0:25switches, all connected in the same
13. 0:27place such as a home, office, or small
14. 0:30company. Technically speaking, a LAN is
15. 0:33a single broadcast domain. What does
16. 0:36broadcast domain mean? If Samir, for
17. 0:38example, is in an apartment and starts
18. 0:41speaking loudly, everyone in the
19. 0:43apartment will hear him, but those
20. 0:46outside won't hear a thing. So, Samir
21. 0:48and the people with him in the
22. 0:49apartment are considered to be in a
23. 0:51single broadcast domain because they
24. 0:53can all hear each other. If I were to
25. 0:55send a broadcast frame, for instance,
26. 0:57with a destination MAC address
27. 0:58consisting entirely of Fs. Then that
28. 1:01frame would reach every device located
29. 1:03within that broadcast domain. Back to
30. 1:06VLANs. A VLAN is simply the act of
31. 1:09splitting a single LAN into multiple
32. 1:11LANs. This is done to reduce broadcast
33. 1:14traffic or to separate broadcast
34. 1:16domains. The simple network in front of
35. 1:18us is a LAN. In this case, we have one
36. 1:22broadcast domain because of the switch.
37. 1:25So, if device A sends a broadcast
38. 1:27message, it means all devices will
39. 1:30receive the same message. This is
40. 1:32perfectly fine if we are talking about
41. 1:34a small network like this one. A
42. 1:36network consisting of four devices. But
43. 1:38let's imagine if each of these devices
44. 1:40represented an entire department in a
45. 1:43large company, and naturally, each
46. 1:45department would contain a large number
47. 1:47of devices. If any device sent a
48. 1:49broadcast, we would have massive
49. 1:51congestion and very high traffic. This
50. 1:54would, of course, degrade the network's
51. 1:56performance and speed. Now, we have a
52. 1:58company with four departments. Sales,
53. 2:01Finance, HR, and IT. We need a way to
54. 2:05divide the broadcast domains. To reduce
55. 2:08the traffic on the network. Let's think
56. 2:11about the solutions we have. The first
57. 2:14solution that will come to mind is to
58. 2:16use a router. Since a router separates
59. 2:18networks. Each interface on the router
60. 2:20would be a network with a separate
61. 2:22broadcast domain. For example, we could
62. 2:24divide every two departments into one
63. 2:26network. In this case, we would have
64. 2:28two broadcast domains. But this would
65. 2:31obviously come with a cost. Because we
66. 2:33would need to buy a router and add more
67. 2:35cables. There is also another solution
68. 2:38better than this one. Which is to split
69. 2:40the network so each department is
70. 2:42separate. Here, we would need to get a
71. 2:44switch for every department. And then,
72. 2:46we would have a separate broadcast
73. 2:48domain for each department. Here, we
74. 2:51have significantly reduced the
75. 2:52broadcast overhead. We've also improved
76. 2:54traffic, and network performance will
77. 2:56certainly improve. But for this to
78. 2:59happen, it requires a lot of cost and
79. 3:01complex implementation. Meaning both
80. 3:03solutions we mentioned would require us
81. 3:06to buy additional hardware. What if we
82. 3:08don't want to buy anything? That is
83. 3:10when we turn to VLANs. VLANs allow us
84. 3:13to separate networks and broadcast
85. 3:15domains. Just like the second solution
86. 3:18that used four switches. But not
87. 3:20physically, rather virtually. In short,
88. 3:23I can divide the broadcast domains.
89. 3:26Here, the traffic for each department
90. 3:28will be separate from the other. It is
91. 3:30as if I have four switches inside one
92. 3:32single switch. This is done by
93. 3:35assigning specific interfaces or ports
94. 3:38to a specific VLAN. Only interfaces
95. 3:41within the same VLAN can communicate
96. 3:43with each other. In this example, for
97. 3:45instance, each department gets a VLAN
98. 3:47ID. For example, Finance gets VLAN ID
99. 3:5110, Sales gets VLAN 20, IT gets VLAN 30
100. 3:55, and finally, HR gets VLAN 40. If we
101. 3:59want to add another department, say
102. 4:02Support, all we need to do is assign
103. 4:05its interface to VLAN 50. The same
104. 4:09applies if I want to add a new server
105. 4:12for HR. In that case, all I would do is
106. 4:16assign the server's interface to VLAN
107. 4:1940 for HR. Then the HR department will
108. 4:21be able to communicate with the server
109. 4:23easily. By using the VLAN concept, we
110. 4:28can separate broadcast domains. And
111. 4:30improve network performance without
112. 4:33having to spend money, buy new
113. 4:35equipment, or redesign from scratch.
114. 4:37Not to mention that it is highly
115. 4:39scalable. Meaning I can add or remove
116. 4:41VLANs from the network easily. And of
117. 4:43course, it provides better security
118. 4:45because. I can separate networks from
119. 4:47each other and control who has access
120. 4:49and who does not. And I can also apply
121. 4:52specific rules for each VLAN network.
122. 4:55Let's understand together how traffic
123. 4:57flows with VLANs in place. In this
124. 5:00example, we have four departments. So
125. 5:02we divided our switch into four VLANs.
126. 5:04So that the network for each department
127. 5:07is isolated. If we have, for example, a
128. 5:09device from IT that wants to talk to a
129. 5:11device from HR. Of course, both are on
130. 5:15the same switch, but each is in a
131. 5:17different VLAN. In this case, the frame
132. 5:20must go to Layer 3, meaning it must go
133. 5:22to the router. Because this is
134. 5:24considered a completely different
135. 5:26network. So here, the frame will leave
136. 5:28the device in IT and go to the switch.
137. 5:31The switch will send it to the gateway,
138. 5:33which is the router. After that, the
139. 5:36router will forward the frame back to
140. 5:38the switch. And the switch will finally
141. 5:41send the frame to the destination
142. 5:43device. All switches have a default
143. 5:46VLAN. Meaning a default VLAN that
144. 5:49already exists, usually called VLAN 1,
145. 5:52and all interfaces are on this default
146. 5:55VLAN. This allows any interface to talk
147. 5:58to any other interface on the same
148. 6:01switch. And of course, we can create
149. 6:03other VLANs to segment the switch. We
150. 6:05can create up to 4094 VLANs. This is
151. 6:09because the VLAN ID ranges from 0 to
152. 6:144096, and since we don't use 0 or 4096,
153. 6:18we have from 1 to 4095 available to use
154. 6:22. Now, suppose we have two, VLAN 10 and
155. 6:26VLAN 20; naturally, interfaces on VLAN
156. 6:3010 can communicate with each other. And
157. 6:33the same for VLAN 20. We can also have
158. 6:36the same VLANs across multiple switches
159. 6:39and have them communicate. Meaning a
160. 6:42VLAN can span across more than one
161. 6:44switch. And it can have interfaces on
162. 6:46this switch and on the other switch.
163. 6:48But here we will have a problem.
164. 6:50Because interfaces only communicate
165. 6:53with those on the same VLAN. So for the
166. 6:56link between these two switches, which
167. 6:58VLAN would it belong to? Of course, if
168. 7:01we set it to VLAN 10 or 20, they won't
169. 7:04be able to communicate. So the solution
170. 7:07here is a specific type of interface
171. 7:09called a trunk. Any switch has two
172. 7:13types of ports: access ports and trunk
173. 7:16ports. All the ports we talked about,
174. 7:19which belong to a specific VLAN, are
175. 7:22called access ports. We use these to
176. 7:24connect devices to the switch. But the
177. 7:27trunk port connects switches together.
178. 7:29It can send traffic from different
179. 7:32VLANs. So how does the receiving switch
180. 7:35know which VLAN the traffic is coming
181. 7:38from? This is where the tag comes into
182. 7:40play. To understand tags, we need to go
183. 7:42back a little bit. When a device sends
184. 7:45data to another device via a switch, it
185. 7:47starts. Creating a frame. The switch
186. 7:49forwards this frame to reach the
187. 7:52destination. Here, the sending and
188. 7:54receiving devices don't know which VLAN
189. 7:56they are on. But if we have multiple
190. 7:59switches connected via a trunk port.
191. 8:02Here, the device sending the frame will
192. 8:05send it normally. But when the frame
193. 8:07reaches the first switch, before
194. 8:10sending it to the second switch via the
195. 8:13trunk port, it adds something new to
196. 8:15the frame called an 802.1 Q tag. It's
197. 8:18also called a dot1q tag. This tag is
198. 8:22four bytes long. And it contains
199. 8:24important information. Like the TPID,
200. 8:26which is the Tag Protocol Identifier.
201. 8:29This indicates that the frame contains
202. 8:32a dot1q tag and distinguishes it from
203. 8:34regular Ethernet frames. It also
204. 8:37includes something called TCI, which is
205. 8:39the Tag Control Information. And the
206. 8:42most important thing in the TCI is that
207. 8:44it contains the VLAN ID. So naturally,
208. 8:47when the second switch receives the
209. 8:48frame, it reads the tag and understands
210. 8:50which VLAN it belongs to. In short, the
211. 8:53frame leaves the device without any
212. 8:56tags. But the trunk port is what adds
213. 8:58the tag to it. That is why the trunk
214. 9:01port is called a tagged port. Whereas
215. 9:03the access port is called an untagged
216. 9:05port. There is a very important feature
217. 9:07. In the dot1q tag, which is the Native
218. 9:11VLAN. It is configured for every trunk
219. 9:13port. The switch does not add a dot1q
220. 9:17tag to frames that are on the Native
221. 9:19VLAN. Meaning, when a frame reaches the
222. 9:21trunk port without a tag, the second
223. 9:23switch assumes that the frame belongs
224. 9:25to the Native VLAN. And by default, the
225. 9:28Native VLAN is always VLAN 1. Let's
226. 9:32assume we have two devices on VLAN 1.
227. 9:35As we said, the frame leaves the sender
228. 9:37device to the switch without a tag. Now
229. 9:39, the switch will send the frame via
230. 9:42the trunk port to the other switch,
231. 9:44also without a tag. And this is because
232. 9:46it comes from the Native VLAN. When the
233. 9:48second switch receives the frame from
234. 9:50the trunk port and finds that it has no
235. 9:52tag, it will assume that this frame
236. 9:54belongs to its native VLAN, which is
237. 9:56VLAN 1. Then it will forward this frame
238. 9:58to the destination, and it will still
239. 10:00be without a tag. That is why it is
240. 10:03very important that the native VLANs on
241. 10:05all switches are the same. Let's see
242. 10:07what might happen if the native VLANs
243. 10:09are not the same. Let's assume, for
244. 10:12example, that we change the native VLAN
245. 10:14of one of these two switches. Instead
246. 10:17of VLAN 1, we will set it to VLAN 10;
247. 10:19naturally, the device will send the
248. 10:22frame to the first switch. The switch
249. 10:24will see that it belongs to the native
250. 10:27VLAN, so as we said, it will send the
251. 10:29frame without any tags to the next
252. 10:31switch via the trunk port. The second
253. 10:34switch will see that a frame has
254. 10:36arrived from the trunk with no tags, so
255. 10:39it will immediately assume it belongs
256. 10:41to its own native VLAN, which is VLAN
257. 10:4310, and here the frame will not reach
258. 10:46the destination. That is why when we
259. 10:48configure a switch and change the
260. 10:51native VLAN, you will always find it
261. 10:53gives you a warning message that the
262. 10:55native VLANs do not match. You are
263. 10:59surely asking yourself now, what is the
264. 11:01point of the native VLAN? Let me tell
265. 11:03you. We agreed before that hubs are
266. 11:06considered Layer 1 devices. Meaning all
267. 11:08they do is forward frames, as they
268. 11:11cannot understand tags. Let's assume we
269. 11:14have a hub here in the middle with a
270. 11:16computer connected to it. If I do not
271. 11:18send the frame from the native VLAN,
272. 11:20then the frame will go with the 802.1 Q
273. 11:23tag. In that case, the hub will
274. 11:24obviously reject the frame because, as
275. 11:26we said, it does not understand tags.
276. 11:28So in this case, I must send it from
277. 11:30the native VLAN so it reaches the hub
278. 11:33without a tag. Then, when it is
279. 11:34forwarded to the switch, it will assume
280. 11:36it belongs to the native VLAN. And with
281. 11:39that, we have reached the end of our
282. 11:41episode, where we talked in detail
283. 11:42about VLANs. If you liked the video,
284. 11:44please hit like, leave your opinion in
285. 11:46the comments, and don't forget to
286. 11:48subscribe to the channel so you can
287. 11:49receive everything we post.