This setup allows for a more secure network. In addition, network administrators now have more control over each port as well as the ability to deny the user based on the Layer 2 or Layer 3 address the user is using to access the port. Users no longer have the ability to just plug their workstation into any network port in the office and access network resources. The administrator controls each port and the resources the user may access.

The best way to design a switched network and implement VLANs is to either assign VLANs to ports based on the network resources a user requires or group them according to departments such as Engineering and Accounting. Switches can also be configured to inform a network management station of any unauthorized access to the network resources. If interVLAN communication needs to take place, a Layer 3 device such as a router is required, but it allows for restrictions to be placed on ports based on the hardware addresses, protocols, or applications.

Scaling with VLANs

A switch block consists of all the equipment found in the hierarchical network model. By taking multiple blocks and connecting them, you can create larger and larger networks. By connecting more blocks, you can create networks that are virtually unrestricted in how large they can become. The Access layer is the point in the network that connects servers, workstations, and other nodes to the network and then connects to the Distribution layer switches, which handle routing and security issues for VLAN distribution.

You need to understand many issues when configuring VLANs within a switch block. Let’s look at the concerns you need to address in determining how you should design and scale your VLAN infrastructure. We’ve already discussed access to resources and group commonality; now let’s take a look at the following:

∙VLAN boundaries

∙VLAN membership types

∙Traffic patterns flowing through the network

∙IP addressing used in the network

∙Cisco’s VLAN recommendations

VLAN Boundaries

VLANs can be broken into two different types of boundaries: local and end−to−end. A local VLAN is configured in one local geographical location. This type of VLAN is the most common and the least difficult to maintain in corporations with centralized server and mainframe blocks.

Local VLANs are designed around the fact that the business or corporation is using centralized resources, like a server farm. Users will spend most of their time utilizing these centralized resources, which are local to the users and not located on the other side of the router that connects their network to the outside world or other parts of the company.

Networks are becoming faster. Because this is the case, the Layer 3 devices in your network must be able to keep up with the number of packets being switched through the local network and out to the rest of the world. As the administrator, you must take into account the number of packets your network’s Layer 3 devices must handle or implement multiple Layer 3 devices to handle load balancing.

An end−to−end VLAN spans the entire switch fabric from one end of the network to the other. With this type of VLAN boundary, all the switches in the network know about all the configured VLANs in the network. End−to−end VLANs are configured to allow membership based on a project, a department, or many other groupings.

One of the best features of end−to−end VLANs is that users can be placed in a VLAN regardless of their physical location. The VLAN the port becomes a member of is defined by an administrator and assigned by a

92

VLAN Membership Policy Server (VMPS, discussed in the next section).

In this situation, the administrator must have very defined goals, and network planning must be more detailed so as to not create bottlenecks in the WAN. Your goal in defining an end−to−end VLAN solution must be centered around the 20/80 Rule: Maintain 20 percent of the network traffic as local, or within the VLAN, and design the WAN network to support speeds that will accommodate this use. (Just a few years ago, this rule was reversed—the administrators’ goal was to keep all the servers local and to allow only 20 percent or less of the network traffic to extend outside the local network.)

Note The ISL protocol, IEEE 802.10, IEEE 802.1, and LAN Emulation (LANE) all provide ways of sending multiple VLAN data traffic over certain physical media types, adding tagging information to frames to send data through the network, and creating trunk ports that carry VLAN data. ATM and LANE are covered in Chapter 8. Virtual Trunking Protocol (VTP) is used to let switches know about the VLANs that have been configured in the network. We will cover all of these topics in the rest of this chapter.

VLAN Membership Types

You can create two types of VLANs: static and dynamic. An administrator can configure the Access layer switches with a VLAN for each individual workgroup, and then assign each switch port to a particular VLAN. These are static VLANs; the port is assigned a VLAN number, and any device connecting to that port becomes a member of that VLAN by default.

A static VLAN is the most common and easiest in terms of administration. The switch port that you assign a VLAN association always remains in the VLAN you assign until you change the port assignment. Static VLAN configurations are easy to configure and monitor, and they work well in a network where the movement of users remains controlled. You can also use network management software such as CiscoWorks for Switched Internetworks (CWSI) to configure the ports on the switch.

A dynamic VLAN determines a node’s VLAN assignment automatically using a VLAN Membership Policy Server (VMPS) service to set up a database of Media Access Control (MAC) addresses. This database can be used for dynamic addressing of VLANs. VMPS is a MAC−address−to−VLAN mapping database that contains allowable MAC or physical addresses that are mapped to a particular VLAN. When the user boots up, the switch learns the MAC address and checks the database for the appropriate VLAN assigned to that MAC address. This process allows a switch port to remain in the same VLAN throughout the network regardless of the location at which the node resides.

It takes a lot of network management to maintain the databases of MAC addresses. Therefore, these types of VLANs are not very effective in larger networks. You can use intelligent network management software to allow you to match a VLAN number to a hardware (MAC) address, protocol, or even application address to create dynamic VLANs.

Traffic Patterns Flowing through the Network

VLANs need to be configured for optimal use through the network. If your servers do not support trunk links, you don’t want everyone outside the VLAN that the server resides in to have to route all the packets to and from a router or internal route processor. Therefore, you should place servers in the most optimal VLAN, to route the data traffic of as few VLANs as possible to and from the server. It doesn’t make sense to place your server in one VLAN and the rest of your work−stations in another.

Cisco’s VLAN Recommendations

Cisco makes certain recommendations to ensure that the switch block performs as it should. The first recommendation is that the Core layer not contain any routing and filtering policies. VLANs should not be a part of the Core layer, with the exception of those being routed along the backbone through trunk links. So, VLANs should not extend past the Distribution layer switches for interVLAN routing.

93