Original subtitles

>> Jeremy: You ever have one of those stories that never get old?

Like you can tell it to 50 people and the 51st person it's just

as good of a story when you tell it.

Like I had a cat back in the day that I didn't want to jump over the wall.

And my roommate -- this is like 15 years ago -- my roommate at the time thought,

well, I've got this brilliant idea.

Let's tie a hammer around the cat, you know, with a little rope.

You know, not tight, you know, it wasn't, like, choking the cat yet, but just tie a hammer,

because then it would weigh too much and it wouldn't be able to jump over the wall.

Or so we thought.

Now I'll save you the rest of the details, but it involved holes in walls, broken glass.

It was, at the time, horrific, but now one of the funniest stories.

VLANs are that way.

VLANs are one of those concepts that once you get it, it never gets old.

For me to explain VLANs, I'm like, oooh-oooh-oooh, really?

And I hope that by the time you get them, you're going to be like, oh, man,

I want to tell my friends what VLANs make possible.

Take core switching, switching fundamentals, and put them in a box, it's done.

We're now going to talk about how we can enhance our network using VLANs.

We'll look at how normal switching happens, and then compare it to what happens

when we add VLANs into the mix, and then what scenarios they make possible.

So before we talk about how VLANs enhance the network,

let's review what the foundation is that we're working with.

When you have a normal switch -- any switch is this way --

you will have multiple collision domains.

And you remember, collision domains mean how many people can send

and receive at the same time.

If we're using full duplex, which we are, which is equal to the number of ports on that switch.

So if I have a switch with -- well, what is this, one, two,

three, four, five, six -- six ports.

I have six collision domains.

That's normal.

It's one broadcast domain, which really means how far does a broadcast go before it's stopped?

And in a switch, it's one.

The whole switch to where when somebody sends a broadcast,

it will go out all active ports except the one that sent it.

It's not just going to send the broadcast back to you.

It'll go out all active ports and everybody receives it.

So it's considered one broadcast domain.

No matter how big that is, if you link another switch and another switch,

it's still one broadcast domain, because one broadcast will go here,

here, go out all ports, here, out.

And that's one of the big scalability issues that we have is the more we grow this thing,

the more broadcast starts weighing us down.

Also, a switch equals a network, or a subnet.

Essentially, when we have one switch before we hit a router,

let's say over here is our router, this defines the network.

This is all one network, one subnet, you know, everybody on here -- if this is 192.168.1.0/24,

so everybody's IP address begins with 192.168.1, this one might be 50, this one might be 60, 61,

or 51, whatever my pen writes, you know.

They're all one network, but also now, they're all one failure domain.

So if something really bad happens where this guy starts, you know, sending a broadcast storm,

you know, to where -- and that happens -- where this guy just starts going berserk.

His network card is going crazy, you know.

This whole network can be impacted, because it is all one network.

And we have completely limited security.

Because usually, Layer 2, which is what switches work at, is not a secure zone.

Like if I'm plugged into a port, I'm assuming the port next to me is trusted,

and there's limited, very limited security that I can put between those ports.

So if this guy is a malicious user that happened to plug into my network,

he pretty much has full access to that device.

And we rely on maybe firewalls on that device to try and protect them,

but usually in corporations, firewalls on the PCs are limited,

because they assume the corporate network is trusted.

So now let's talk about VLANs.

How do VLANs enhance our normal switch operations?

Well, let's start off up here.

I like using colors to represent VLANs, because it's just more visual, easier to see.

So let's say that we create two different VLANs.

We'll call it the blue VLAN, which colors is what I use as kind of a descriptor, but really,

VLANs are represented by numbers.

So let's just say the blue VLAN is VLAN 10, right?

And then we also come up with a red VLAN, and the red VLAN is VLAN 20.

VLAN numbers can range from 1 to 4,096, so you can have just a ton

of different VLANs that are available to you.

So when I split my network up into VLANs.

Like let's just look at this switch right here.

I say these ports are blue.

This port is blue.

If you could kind of get the mental image.

If we're comparing it to the red ports, right there, get the mental image in your head

that says it's as if you could take that switch over your knee and you do kind of one

of those ahhh chop, Judo chop that thing into two different pieces.

And we took all of these blue ports and they kind of snapped off and became their own switch,

and all of these red ports, and they snapped off and became their own switch.

Logically, that's what VLANs do.

It separates our groups of users, or our devices that are attached to the network

into completely separate networks.

It segments the broadcast domains.

So if the blue computer sends a broadcast, it only comes out the blue ports.

Now, let me go beyond this.

It can even transcend switches to where these blue ports get the broadcast

and these blue -- oh, he's down there.

These blue ports get the broadcast.

So it comes out all those ports.

And if the red guy sends a broadcast, only the red ports get the broadcast.

So it kind of segments that.

We get a subnet correlation to where when we split into VLANs, we split our IP subnets.

Now this is a big concept to catch.

The blue VLAN is now a new network.

So it is identified now at Layer 3 at our IP addressing layer

as a completely different network.

So maybe before we did VLAN, like I showed on the last slide, everybody was 192.168.1.0,

but now I say, OK, well the blue VLAN, well maybe the blue VLAN stays 192.168.1.0/24.

Now remember, with slash-24, that means this, this and this represent the network.

It's the same thing as saying 255, 255, 255, 0.

And IP addressing is coming up, don't worry.

So we say slash-24.

But then the red VLAN is going to be 192.168.2.0/24.

It has to be.

It's a completely different subnet.

Different network.

So these guys are now in a completely different zone than these guys.

They are completely segmented.

That gives us a full level of access control, to where I can say, OK, blue cannot access red,

but, you know, and when we get into moving data between VLANs, I can say, well,

the red can access blue, but maybe only these devices.

Whereas when we're at Layer 2, meaning we don't have VLANs, everything's connected

to a normal switch, as I mentioned, it's very difficult to try and pull a stunt like that.

VLANs also help with quality of service, because it's way easy to say the red VLAN has priority.

Totally easy configuration and quality of service.

Whereas if everybody is a member of the same VLAN, it's a normal switch like we saw

on the last slide, it's very difficult, it can be very difficult to say, well,

you get quality of service, but you guys don't.

So you, now quality of service, I should stop assuming everybody's like, well, what's that?

Quality of service says you're more important than somebody else.

That's not very nice.

Well, it kind of is, depending on what you're talking about.

Maybe the blue guys are people that surf the web all day.

Yeah, you hire those kind of people, right?

Or the blue guys are normal day-to-day users,

whereas the red guys, those are your executive team.

Or even better yet, those are your IP phones.

And we always want our IP phones, our voice-over IP traffic to have priority over the blue.

Very difficult if the IP phones are in the same network as the blue guys.

To really say, OK, well -- because they're the same network.

It's hard to identify them.

Whereas if I have a completely different network, I can say, well,

simple enough, prioritize the red guys.

And the switch is really easy to identify that and the routers can really easy identify that,

because they're on completely separate networks.

So this is good.

Now let me ask you a question.

Let me do this.

No. I'm just going to drag this off.

Gone. OK, so if the blue guys send a broadcast, and as I mentioned it comes

out all the blue ports, and even down here, and the red guys send a broadcast and it comes

out all the red ports, even down here, then here's my -- I'm going purple on you.

What VLAN does that belong to?

What VLAN does that, and that, and that.

I notice they're kind of a white port.

What VLAN are they in?

The right answer is all of them, because Cisco calls those trunks.

A trunk port.

A trunk port, and by the way, trunk is a Cisco term.

Trunk carries all VLANs all the time.

So -- well, put a little asterisk by "all the time."

Because we can restrict that.

But a trunk, you know, when I set up a trunk, it will automatically,

from the minute I configure it, carry the red VLAN,

I think we said that was VLAN 20, and the blue VLAN.

Red VLAN and the blue VLAN.

So usually, I mean, if these are all 100 megabits per second ports, usually you'd want

that guy to be maybe 1000 megabits per second.

Those are your bottlenecks, because they're carrying a lot of traffic.

They have a lot of work to do.

Now I just said that trunk is a Cisco word.

Only Cisco uses that word.

Other vendors use the term tagged port.

I hear that all the time, and a 3Com switch, or 3Com got bought by HP,

so HP switches, Juniper switches.

Everybody else uses the term tagged.

And I have to admit, I kind of like that word a little better.

A trunk is -- you're kind of like, OK?

What's that?

We have to assign a definition to it.

But a tagged port really identifies what it is.

Because when a frame comes into the switch -- now, let me tell you this.

A computer has no idea what a VLAN even is.

It doesn't know that it's part of a VLAN.

All it knows is it's got an IP address and when it sends stuff, it communicates.

You know, things ping back.

It can communicate.

So a computer has no idea what VLAN it's on.

So when it sends a frame into the switch, and the switch says, OK, you're on the blue VLAN,

what it will do before it ever sends it to another switch is take

that data -- so let me give a scenario.

Let's say that this guy up here, 192.168.1.50 pings this guy

down here, who's 192.168.1.51, right?

So I have a ping message that's sent.

So it sends that ping into the switch, the switch realizes because it looks

at the Mac address in the header, and it goes, oh, well, that Mac address is out this port,

and down this port, and I'm going to get it to that guy.

So it looks at the Mac address to figure that out.

Well, it needs to let this switch know what VLAN it's on.

And this switch needs to let this switch know what VLAN it's on.

So when the switch sends this frame out a tagged port, it does just that.

It puts a little tag in the header that says this belongs to VLAN 10.

I don't know why I always think of this when I describe

that tagging process, but have you ever gotten shims?

What's that?

You go to Home Depot and, you know, you've got the refrigerator that's not quit level

and it kind of rocks back and forth?

You just go to Home Depot, grab a shim.

They're like these little triangle pieces of wood that you buy a whole pack of them,

because everything in my house is not level.

Like my chair wiggles back and forth, my desk wiggles.

So you go in my house, and like shims -- I've got them in my back pocket all the time.

Everything's got a shim under it to make it level.

I think of that when I think of this little tag.

It's like putting a little shim, chunk, in the header of that packet, so that when it comes

down here -- like, for instance, maybe it's not a ping, maybe it's a broadcast.

And when that broadcast comes down to that switch, it has to know, OK,

only these ports get that broadcast.

Well, how's it going to know that?

Well, it's looking at the shim.

It's looking at the tag that was put in the packet header and it goes, oh, you're VLAN 10.

OK, all these ports are in VLAN 10, so they're going to get it.

And when it comes down here, he's looking at the shim.

He's looking at the little tag saying, oh, VLAN 10, only these ports get it.

So the switches are able to make intelligent decisions.

Now I told you that a computer has no idea what a VLAN is, so you better believe before

that switch sends that ping or that broadcast to that computer, it actually yanks the shim out.

It's like, OK, well, if I send you a packet, or frame, that has a shim in the header,

you're going to go, what is this?

All right?

This must be a messed up packet.

I'm going to drop it.

So this is a switch-to-switch thing.

This little tagged port.

So what Cisco calls trunk, everybody else calls tag because it's really what's happening,

is it's putting these little labels on the header.

OK, last thing I want to discuss

in this conceptual VLAN nugget is what do you do with them?

I mean, getting the concept, like the last slide is good, where you're like, OK,

I can separate the blue and the red.

I get that.

So it's more secure and all that.

But give me something practical, Jeremy.

What do people do?

Well, I would say this, by far, is not a cumulative list,

but I would say probably the most common things people do with VLANs are right here.

Lower right, let's start there.

Like type segmentation.

Almost everybody does this.

Grouping things together that are of the same kind.

I mean, it helps with security.

Like, for instance, let's say OK, all the servers are over there.

All of the accounting users are over there.

You know, you kind of group -- it's good for security,

but also it just makes sense as your network grows.

As your network grows, it does get more and more inefficient if it's one big network,

because remember, broadcasts start accumulating up.

You get more and more of them, things have to process those broadcasts

and things just get slower and slower and slower and less efficient.

So what most people will do is start grouping together, this is where it starts.

Grouping together common departments or common things.

I'll give you an example.

One of the most bizarre networks I walked into, I'm trying to think of how to explain this

without revealing exactly what it was.

In Arizona, we have -- I can't.

We have separate governments.

So we have the United States of America and then there are groups

where they have their own government within Arizona.

So I was actually brought out to consult on one of these little sub-area networks

and literally I walked in and the government building, you know, it's a small little area,

the government building, the police department, the school, the school library and --

there was one other thing -- oh, a water treatment plant

for waste treatment, all of it was one network.

So let me give you the paradigm that I walked into.

I could go to a library computer and ping and actually try

to access a computer in the police department.

I'm pausing just to let that soak in.

That's the kind of network I walked in on.

And I saw that and I was like, wow.

You know, I'm trying to think of, like, how do I convey just how scary that is?

And I'm like, that's scary.

There's nothing else that could come out of my mouth.

And that was the first thing that we did is go into the like type segmentation, I mean,

this was kind of the network type where we have the government building, and then over here,

maybe Building B is the police department, over here is the library,

you know, all this kind of stuff.

They were all connected with fiber optic cable in between them,

and that was the first thing that we did.

We said -- OK, now ignore all this stuff for now.

But we said, OK, Building A, that's VLAN 10.

Building B, that's VLAN 20.

So immediately I'm putting up security boundaries and making it more efficient

because now broadcasts in the police department don't come over to the library,

don't go over to the government building, and all that kind of stuff.

It's like type segmentation.

And it just kind of feels good.

I don't know how else to say it.

You know, my wife homeschools all of our -- we have 4 kids right now --

and one of the first things that she starts doing is putting

like we get all these little colored balls, right, and red ones and blue ones,

and she kind of mixes them up and the kids are like, eww.

It doesn't feel good.

There's blue balls with the red balls and the green balls.

And the first task they have to do is like put them all in order.

It's kind of like put all the green balls with the green balls, the red --

and you get done and you just look at the kid and they just glow.

They're like, look what I've done.

It feels good to look at.

And I know it sounds funny to make that comparison here.

That's what you'll feel like.

You're like, look what I've done.

The police department is all in their own little spot.

They don't go anywhere.

It makes sense to you and it just feels logical.

OK, server virtualization.

Let me jump over there.

You know, when I'm talking about VLANs, like I said, there are a huge amount of things

that I could give you, but a lot of it crossed the technology lines.

And that's why putting practical examples is sometimes difficult

because I know sometimes I may explain something and be like,

I have no idea what server virtualization is.

So let me give you the fly-by view.

Servers have become bigger, bigger, bigger, better, faster all the time.

That's just the way of things.

And what somebody realized a long time ago is, you know what?

Most of the time a server, you know, physically, is just sitting there.

I mean you look at its -- you know, if you're looking at it like a utilization graph,

it's processor is like [computer sounds].

Because it just sits there and gives people files.

I mean, that's what it does.

But the processor has way more capacity than that.

In memory utilization, you know,

it's like here's the total and it's like [computer sounds].

I mean, it's like memory utilization's low.

So what somebody came along and decided to do, and this is, by the way, VMware,

Microsoft with their knockoff hyper -- I didn't say knockoff, I meant innovation, Hyper-V.

You know, there's all kinds of different virtualization.

As a matter of fact, you can go download one for free called, what is it called, Virtual.

VirtualBox.

Right? And you can actually run virtualization on your own workstation for free.

I think Sun, Sun Micro?

Somebody started doing this for free.

So this is all virtualization.

What it allows you to do is take that one physical box and start splitting it

to multiple servers, to where I actually run -- it's like I have one operating system on here

that is, we'll say Windows Server 2012, you know.

It's running.

This is our core server.

And then over here I've got a little, maybe,

accounting server that our accounting department runs.

It's Windows 2003.

Just an old server they use for file storage.

And then over here I've got maybe a voice-over IP server than runs our phone system.

So I can use one physical box because of the resource capacity

to run all of those different servers.

But here's the dilemma.

I've got phones that are on their own VLAN and they can only, I mean,

they need to talk to the server and it needs to be on their network,

and then over here is the accounting department, and maybe they want --

and I'm just coming up with this as I go, right?

And so the accounting department, they want a server in their network

to store their files on and communicate with, there.

Well, what we can do with server virtualization is set up this link --

now this is heavy, hang with me -- as a trunk.

So remember, what does a trunk do?

Carry all VLAN.

So let's say accounting is VLAN 10, voice is VLAN 20, and these servers,

whatever they are, is VLAN 50, right?

So this switch can actually send all the VLAN traffic, so the accounting department,

the voice phones, and everything like that, even though they're separated.

Like accounting can't actually get to the phones and the servers can't actually get there --

I can actually send all of those packets tagged to the server and just

about every virtualization solution, VMware, Hyper-V, all that kind of stuff,

they can all say, I'm going to look at that VLAN header and then I can assign, you know,

like I can assign this server within this box to VLAN -- what did I say -- 20.

So now, as packets come in tagged with VLAN 20, it'll say, oh, you're able to reach that server.

Did I say accounting?

I meant voice.

As voice packets come in tagged with VLAN 20, they can reach the voice server.

As accounting packets come in, and they're tagged VLAN 10,

they can reach the accounting server.

Because within this server, I assign that server -- that sounds funny --

within this physical server, I assign this logical server to VLAN 10.

And so I can separate, even within one box,

all the different servers, making it totally efficient.

That's great to be able to do that.

Last example.

Up here I've got Unified Network and Wi-Fi.

So what I can do is, let's say, you know, I've got common departments.

Like I've got this accounting group, but just because of how our company grew, you know,

we kind of filled up this little 2000 square foot building to start off with

and we immediately bought the building next to it,

which was 6000 square feet, you know, to allow for growth.

And then we outgrew that one really quick and had to buy another, you know,

the next little 3000 square foot building next to it.

And so just kind of how our building grew, we've got accounting people sitting right here

and we ran out of chairs so some had to sit over here.

Well, using VLANs, we can have a unified network to where even though I've got accounting people

in this building, I can have these guys, accounting people, that are on the same network

and have the same permissions applied to them.

Because I can send that VLAN across all of these links, which would be my trunk links.

Wi-Fi. So handy.

Wi-Fi is becoming like an everywhere kind of thing.

Everybody is on the wireless network.

You might have an iPad.

Let's say you've got an iPad that you're walking around with, watching a YouTube video,

and in here you actually have a wireless access point,

and over in this building you have a wireless access point and all that.

Well, we want people, you know, as this iPad, as I'm walking, watching this video

as I'm walking -- or even more relevant, they have wireless IP phones.

You know, to where maybe I'm talking on a phone call connected to Wi-Fi,

roaming between these different buildings.

Well, if I don't use VLANs, then every building that I come

to might end up being a different network.

And if that happens, my call is severed if I'm talking on the phone.

My YouTube video, or whatever I'm watching, stops on the iPad, because it loses connection

as it moves from one building to another.

But with VLANs, I can send that same VLAN across all the buildings and allow it be segmented

so it's efficient, and yet at the same time, stay unified to where Wi-Fi stays the same

as I move and I don't lose connections as I move from one building to the next.

Think of those VLAN uses as the tip of the iceberg.

I can't tell you how many times I'm in a conversation with somebody,

whether it's at a data center or, you know, at a corporate network or wherever and they're like,

man, we've just got to figure out how to do this.

And I can't tell you the number of times where I've looked at them like, oh, totally possible.

We've got to use the VLANs.

Just use our VLANs in the right way.

We can separate that business from that one.

We can make sure that their traffic doesn't mix with theirs.

I mean, just the uses of VLANs are literally, I mean, endless.

There are situations that even I -- after dealing with VLANs for a decade and beyond --

haven't run into yet that I know, I'm like, a VLAN would solve that.

So VLANs give you such flexibility and capability wherever you are.

So let's review.

We have seen in here the view of a normal switch.

You know, what it looks like without VLANs.

Everything's kind of flat.

Everybody can talk to everything.

No security.

Then we added in the VLANs and the trunks.

VLANs being your way of separating it.

Did I ever tell you what a VLAN stands for?

How did I get here?

Virtual LAN.

It's Virtual Local Area Network, because it's virtually

as if I'm creating a new network altogether.

So VLANs separating our networks into different groups and then a trunk,

which allows you to carry all of those tags, all of those identifiers between your switches,

so we can have a unified network

to where everything supports the same VLANs within our campus, all right?

Within our infrastructure.

And then we saw some examples of what VLANs make possible.

So from here, we're going to start picking up on the config.

For now, I hope this has been informative for you, and I'd like to thank you for viewing.