VLANs¶

Practical 3.5 vlans-annex.pdf · PDF

Your school has one Wi-Fi for students and another for teachers. Same building, same cables, maybe even the same access points. Yet your laptop cannot see the teachers' printer, and the teachers' PCs cannot see your phone. How do you make two networks out of one set of hardware, without buying anything?

Remember from Ethernet, MAC and switching: when a PC sends a broadcast (an ARP "who has this IP?", for example), every device in the LAN hears it. With three PCs nobody cares. Tramuntana Apps has twelve people, a guest Wi-Fi, a printer and test servers. Today you cut the LAN in two.

What you will learn

Explain what a VLAN is and two reasons to split one switch into several LANs
Describe the 802.1Q tag: where it goes in the frame and what the VLAN ID is
Tell an access port from a trunk port and predict where a frame goes out, tagged or untagged
Create two VLANs on a RouterOS bridge with VLAN filtering, each with its own subnet and DHCP server
Explain why two VLANs need a router to talk, and prove it with ping and traceroute
Why "VLANs make the network secure" is only half true

The problem: one LAN, everybody hears everybody¶

Draw one switch and six PCs: three from dev (marta, pau...) and three from design (joan...). Two reasons to separate them:

Reason	What goes wrong in one big LAN
Noise	Every broadcast of every PC reaches all six. The bigger the LAN, the more noise
Safety	A design laptop with malware can talk directly to the dev test servers. Nothing stands between them

The old solution: two switches and two sets of cables. Expensive, and every time somebody changes desks, somebody re-cables.

The idea: one switch, several LANs¶

A VLAN (Virtual LAN) makes one switch behave as several separate switches.

Each port belongs to a VLAN. A frame that enters in VLAN 10 can only leave through a port of VLAN 10. Different VLAN means different LAN, which means a different broadcast domain (the set of devices that hear each other's broadcasts).

Each VLAN gets its own subnet. In your group's network (G = your group number):

VLAN ID	Name	Subnet	Gateway
10	dev	`10.G.10.0/24`	`10.G.10.1`
20	design	`10.G.20.0/24`	`10.G.20.1`
1 (default)	management	`10.G.0.0/24`	`10.G.0.1`

Careful: a VLAN is not a subnet

They go in pairs, but they live on different layers. A VLAN is a layer 2 separation: who hears whose frames. A subnet is a layer 3 address range. You give each VLAN its own subnet so that a router can connect them.

The sticker: the 802.1Q tag¶

The office mailroom (we keep it all page)

Frames are envelopes moving through the office mailroom. The switch is the mailroom clerk. Each department has a colour of sticker: VLAN 10 is one colour, VLAN 20 another. The clerk only drops an envelope into a pigeonhole of the same colour as its sticker.

Follow an envelope:

A PC knows nothing about VLANs. Its frames arrive at the switch with no sticker.
The port where a PC is plugged belongs to one VLAN. When a frame comes in, the switch sticks that VLAN's sticker on it. The number it uses is the port's PVID (Port VLAN ID).
Before delivering a frame to a PC, the switch peels the sticker off. The PC never sees it.
Between two switches, or a switch and a router, one cable has to carry several VLANs. On that cable, envelopes travel with the sticker on, so the other side knows which department each one belongs to.

The real sticker is the 802.1Q tag, from the standard IEEE 802.1Q, published in 1998. It is 4 bytes inserted into the Ethernet frame right after the source MAC address:

| dst MAC | src MAC | 802.1Q tag: 0x8100 + VLAN ID | type | data ... |

Inside those 4 bytes, 12 bits are the VLAN ID: the number of the VLAN. 2¹² = 4096 values, but 0 and 4095 are reserved, so VLAN IDs go from 1 to 4094.

Access ports and trunk ports¶

An access port belongs to one VLAN and connects an end device. A trunk port carries several VLANs, with their tags, to another switch, a router or an access point.

	Access port	Trunk port
Connects to	A PC, a printer	Another switch, a router, an access point
VLANs	One	Several
Frames on the cable	Untagged (no sticker)	Tagged (sticker on)
In the RouterOS VLAN table	`untagged`, plus the port's `pvid`	`tagged`

Careful: three common mix-ups

The PC does not add the tag. It sends normal frames; the switch tags on entry and untags on delivery.
A trunk is not a faster port. Same speed. It just carries several VLANs, with tags.
The PVID does not decide what goes out. The PVID tags what comes in untagged. What goes out is decided by the VLAN table.

Be the switch¶

Try it before you configure anything. A switch has: port 1 access VLAN 10 · port 2 access VLAN 20 · port 3 access VLAN 10 · port 4 trunk for VLANs 10 and 20.

Frame	Where it leaves	Why
A broadcast from the PC on port 1	Port 3 untagged, port 4 tagged 10. Not port 2	Only ports of VLAN 10
A broadcast arriving on port 4 with tag 20	Port 2 untagged. Nothing else	Only port of VLAN 20 besides the trunk
A frame arriving on port 4 with tag 30	Dropped	VLAN 30 is not in the table
The PC on port 1 wants to reach the PC on port 2	The switch alone cannot	Different subnets: the PC sends to its gateway, and a router passes it across

That last row matters most. Two PCs on the same switch can only talk directly if they are in the same VLAN. Otherwise they need a router with a leg in each VLAN.

Two VLANs on the group router¶

Your router already has bridge-lan with 10.G.0.1/24 and DHCP, from Wired LAN with RouterOS. Now: ether2 becomes VLAN 10 (dev), ether3 becomes VLAN 20 (design), and ether4, ether5 stay in 10.G.0.0/24.

Do not saw off the branch you are sitting on

The student who clicks in WinBox is plugged into ether4, the port that does not change. And the very last step is ticking VLAN Filtering. Switch it on earlier and somebody loses access halfway.

The steps (Part A of the Exercise sheet), in WinBox:

VLAN interfaces. Interfaces → VLAN tab → +: name vlan10, VLAN ID 10, interface bridge-lan. Same for vlan20. These are the router's two new legs, one per VLAN.
Addresses. IP → Addresses: 10.G.10.1/24 on vlan10, 10.G.20.1/24 on vlan20.
DHCP. IP → DHCP Server → DHCP Setup twice: on vlan10 (pool 10.G.10.100-10.G.10.199, DNS 10.G.10.1) and on vlan20.
Access ports. Bridge → Ports → ether2 → VLAN tab → PVID 10. ether3 → PVID 20.
VLAN table. Bridge → VLANs → +: bridge bridge-lan, VLAN IDs 10, tagged bridge-lan, untagged ether2. Again for 20 with ether3.
Last. Bridge → double-click bridge-lan → VLAN tab → tick VLAN Filtering.

The same configuration in the CLI (G = 3):

/interface vlan add name=vlan10 vlan-id=10 interface=bridge-lan
/interface vlan add name=vlan20 vlan-id=20 interface=bridge-lan
/ip address add address=10.3.10.1/24 interface=vlan10
/ip address add address=10.3.20.1/24 interface=vlan20
/ip pool add name=pool-dev ranges=10.3.10.100-10.3.10.199
/ip pool add name=pool-design ranges=10.3.20.100-10.3.20.199
/ip dhcp-server
add name=dhcp-dev interface=vlan10 address-pool=pool-dev disabled=no
add name=dhcp-design interface=vlan20 address-pool=pool-design disabled=no
/ip dhcp-server network
add address=10.3.10.0/24 gateway=10.3.10.1 dns-server=10.3.10.1
add address=10.3.20.0/24 gateway=10.3.20.1 dns-server=10.3.20.1
/interface bridge port
set [find where interface=ether2] pvid=10
set [find where interface=ether3] pvid=20
/interface bridge vlan
add bridge=bridge-lan vlan-ids=10 tagged=bridge-lan untagged=ether2
add bridge=bridge-lan vlan-ids=20 tagged=bridge-lan untagged=ether3
/interface bridge set bridge-lan vlan-filtering=yes

Why tagged=bridge-lan? The bridge itself is the port that leads up to the router's legs vlan10 and vlan20. Envelopes go up to the router with the sticker on, so the router knows which leg each one belongs to.

Proving the separation¶

Unplug and replug your cable to get a new lease, then:

ip -br address                   # A: 10.3.10.199/24    B: 10.3.20.199/24    C: still 10.3.0.x
ping -c 3 10.3.20.199            # A pings B: it works -- through the router
traceroute -n 10.3.20.199        # two lines: 10.3.10.1, then 10.3.20.199
ip neigh                         # A sees the MAC of 10.3.10.1 only, never B's MAC

The last two commands are the proof:

traceroute shows a hop in the middle: the router 10.3.10.1. The packet did not go straight from A to B.
ip neigh shows the ARP table: A never learned B's MAC address. They are no longer in the same LAN, even though they are plugged into the same box.

On the router, /interface bridge vlan print shows the table with the current tagged and untagged ports.

Symptom	Most likely cause
WinBox disconnects when Filtering is ticked	The driver was on `ether2` or `ether3`, which just changed LAN. Reconnect by MAC from `ether4`
A gets no address after replugging	DHCP server on `bridge-lan` instead of `vlan10`, PVID not set, or `bridge-lan` missing from tagged
A still gets `10.3.0.x`	Filtering is not on yet, or the PVID is still 1

Careful: VLANs separate, they do not lock

"Now dev and design are isolated." No: they are separated at layer 2, and the router still passes everything between them at layer 3. The ping worked. Deciding what may cross is the firewall's job, later in this unit. Today you built the door; the lock comes with Ports and firewalls.

Trunks and the router on a stick¶

On your group router, router and switch were the same box, so you needed no trunk cable. In a normal office they are two boxes:

flowchart LR
    PC1["<b>pc1</b><br>dev"] ---|"access, untagged"| SW
    PC2["<b>pc2</b><br>design"] ---|"access, untagged"| SW
    PC3["<b>pc3</b><br>dev"] ---|"access, untagged"| SW
    SW["<b>sw1</b><br>the mailroom<br>no addresses"] ===|"trunk: VLANs 10 and 20, tagged<br>one cable"| R
    subgraph R ["r1: router on a stick"]
        V10["<b>vlan10</b><br>10.G.10.1"]
        V20["<b>vlan20</b><br>10.G.20.1"]
    end

sw1 is only a switch: three access ports and one trunk to the router.
r1 has a single cable and two legs on it, vlan10 and vlan20, each with the gateway address of its VLAN. The classic name is router on a stick.

Follow one ping from pc1 (dev) to pc2 (design), sticker by sticker: untagged into sw1 → sticker 10 → up the trunk → router leg vlan10 → routed → leg vlan20 → sticker 20 → down the trunk → sticker off → pc2. The packet crosses the same cable twice.

In the virtual lab (Part B of the Exercise sheet) you build exactly this. The switch:

/interface bridge add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3 pvid=10
add bridge=bridge1 interface=ether4 pvid=20
add bridge=bridge1 interface=ether5 pvid=10
add bridge=bridge1 interface=ether6
/interface bridge vlan
add bridge=bridge1 vlan-ids=10 tagged=ether2,ether6 untagged=ether3,ether5
add bridge=bridge1 vlan-ids=20 tagged=ether2,ether6 untagged=ether4
/interface bridge set bridge1 vlan-filtering=yes

Before the router has its legs, pc1 can ping pc3 (same VLAN) but not pc2 (Destination Host Unreachable: there is no gateway yet). Then the router on a stick:

/interface vlan add name=vlan10 vlan-id=10 interface=ether2
/interface vlan add name=vlan20 vlan-id=20 interface=ether2
/ip address add address=10.3.10.1/24 interface=vlan10
/ip address add address=10.3.20.1/24 interface=vlan20

Now pc1 reaches pc2, and traceroute shows the router in the middle.

Seeing the sticker¶

A capture on a trunk port shows the tag for real. An ARP broadcast from pc1 arrives like this in tcpdump -e -n:

... ethertype 802.1Q (0x8100), length 46: vlan 10, p 0, ethertype ARP, Request who-has 10.3.10.99 ...

ethertype 802.1Q (0x8100) is the sticker; vlan 10 is the number written on it. On an access port, the same frame shows no tag, because the switch peeled it off.

Key takeaways¶

A VLAN makes one switch behave as several: each VLAN is its own broadcast domain, with its own subnet.
The 802.1Q tag is 4 bytes after the source MAC; its 12-bit VLAN ID goes from 1 to 4094.
Access ports connect end devices, belong to one VLAN and send frames untagged; trunk ports carry several VLANs tagged. The PVID tags what comes in untagged.
On RouterOS: VLAN interfaces on the bridge, an address and DHCP per VLAN, PVIDs, the VLAN table, and VLAN filtering last.
Two VLANs talk only through a router with a leg in each: traceroute shows the hop, ip neigh shows no neighbour MAC. A router on a stick does it over one trunk cable.
VLANs separate; they do not block. A firewall decides what may cross.

Quick check¶

1. What is the 802.1Q tag?

4 bytes added to the Ethernet frame, with a 12-bit VLAN ID
12 bytes added to the Ethernet frame, with a 4-bit VLAN ID
A new frame wrapped around the original frame
An option inside the IP header of the packet

The 802.1Q tag is 4 bytes inserted after the source MAC. Its 12-bit VLAN ID gives 4096 values, of which 1 to 4094 are usable.

2. How does an access port deliver frames to the PC plugged into it?

Untagged
Tagged with the VLAN ID
Encrypted
Twice, once per VLAN

The PC knows nothing about VLANs, so the switch peels the sticker off before delivering: access ports send untagged frames.

3. What makes a port a trunk port?

It carries several VLANs, with their tags
It is faster than the other ports
It belongs to exactly one VLAN
It only connects PCs and printers

A trunk port joins switches, routers or access points and carries several VLANs on one cable. The tags tell the other side which VLAN each frame belongs to. Its speed is the same as any other port.

4. Two PCs plugged into the same switch are in VLAN 10 and VLAN 20. What do they need to talk to each other?

A router with an address in each VLAN
A longer patch cable
A second switch between them
The same PVID on both access ports

Different VLANs are different LANs with different subnets. A frame cannot cross by itself: a router with a leg in each VLAN (its gateway address) passes the packet across.

5. When do you set vlan-filtering=yes on the bridge?

Last, after the rest of the VLAN configuration
First, before creating the VLAN interfaces
Once on every port of the bridge
Never, RouterOS enables it by itself

VLAN filtering is what makes the switch obey the VLAN table. Turned on too early, ports change LAN halfway and the person configuring can lose access to the router.

6. Marta (dev) pings Joan (design) through the router and it works. Then she runs ip neigh. What does she see?

The MAC address of her gateway 10.G.10.1, but not Joan's
Joan's MAC address, because they share the same switch
Both MAC addresses, Joan's and the gateway's
No MAC addresses at all, because the ping went through a router

ip neigh is the ARP table: it only lists neighbours in the same LAN. Marta talks to the gateway, and the router talks to Joan. That is why traceroute shows the router as a hop.

7. After setting up VLANs 10 and 20, select the two statements that are true.

Broadcasts from dev no longer reach the design PCs
The router still forwards traffic between dev and design until a firewall blocks it
Dev and design are now completely isolated from each other
Each PC now adds the 802.1Q tag to its own frames

VLANs split the broadcast domain, so noise stays inside each department. But they only separate at layer 2: the router still routes between them. Blocking is the firewall's job. The tag is added by the switch, not the PC.

Next: take the network into the air — 802.11, bands, channels and WPA — in Wireless LAN.