All language subtitles for 16 - Switching - Understanding VLANs and Trunks-eng

>> Jeremy: You ever have one of
those stories that never get old?

Like you can tell it to 50 people
and the 51st person it's just

as good of a story when you tell it.

Like I had a cat back in the day that
I didn't want to jump over the wall.

And my roommate -- this is like 15 years
ago -- my roommate at the time thought,

well, I've got this brilliant idea.

Let's tie a hammer around the
cat, you know, with a little rope.

You know, not tight, you know, it wasn't, like,
choking the cat yet, but just tie a hammer,

because then it would weigh too much and
it wouldn't be able to jump over the wall.

Or so we thought.

Now I'll save you the rest of the details,
but it involved holes in walls, broken glass.

It was, at the time, horrific, but
now one of the funniest stories.

VLANs are that way.

VLANs are one of those concepts that
once you get it, it never gets old.

For me to explain VLANs, I'm
like, oooh-oooh-oooh, really?

And I hope that by the time you get
them, you're going to be like, oh, man,

I want to tell my friends
what VLANs make possible.

Take core switching, switching fundamentals,
and put them in a box, it's done.

We're now going to talk about how we
can enhance our network using VLANs.

We'll look at how normal switching
happens, and then compare it to what happens

when we add VLANs into the mix, and
then what scenarios they make possible.

So before we talk about how
VLANs enhance the network,

let's review what the foundation
is that we're working with.

When you have a normal switch
-- any switch is this way --

you will have multiple collision domains.

And you remember, collision domains
mean how many people can send

and receive at the same time.

If we're using full duplex, which we are, which
is equal to the number of ports on that switch.

So if I have a switch with --
well, what is this, one, two,

three, four, five, six -- six ports.

I have six collision domains.

That's normal.

It's one broadcast domain, which really means
how far does a broadcast go before it's stopped?

And in a switch, it's one.

The whole switch to where when
somebody sends a broadcast,

it will go out all active ports
except the one that sent it.

It's not just going to send
the broadcast back to you.

It'll go out all active ports
and everybody receives it.

So it's considered one broadcast domain.

No matter how big that is, if you link
another switch and another switch,

it's still one broadcast domain,
because one broadcast will go here,

here, go out all ports, here, out.

And that's one of the big scalability issues
that we have is the more we grow this thing,

the more broadcast starts weighing us down.

Also, a switch equals a network, or a subnet.

Essentially, when we have one
switch before we hit a router,

let's say over here is our
router, this defines the network.

This is all one network, one subnet, you know,
everybody on here -- if this is 192.168.1.0/24,

so everybody's IP address begins with 192.168.1,
this one might be 50, this one might be 60, 61,

or 51, whatever my pen writes, you know.

They're all one network, but also
now, they're all one failure domain.

So if something really bad happens where this
guy starts, you know, sending a broadcast storm,

you know, to where -- and that happens --
where this guy just starts going berserk.

His network card is going crazy, you know.

This whole network can be impacted,
because it is all one network.

And we have completely limited security.

Because usually, Layer 2, which is what
switches work at, is not a secure zone.

Like if I'm plugged into a port, I'm
assuming the port next to me is trusted,

and there's limited, very limited security
that I can put between those ports.

So if this guy is a malicious user
that happened to plug into my network,

he pretty much has full access to that device.

And we rely on maybe firewalls on
that device to try and protect them,

but usually in corporations,
firewalls on the PCs are limited,

because they assume the corporate
network is trusted.

So now let's talk about VLANs.

How do VLANs enhance our
normal switch operations?

Well, let's start off up here.

I like using colors to represent VLANs,
because it's just more visual, easier to see.

So let's say that we create two different VLANs.

We'll call it the blue VLAN, which colors is
what I use as kind of a descriptor, but really,

VLANs are represented by numbers.

So let's just say the blue
VLAN is VLAN 10, right?

And then we also come up with a red
VLAN, and the red VLAN is VLAN 20.

VLAN numbers can range from 1 to
4,096, so you can have just a ton

of different VLANs that are available to you.

So when I split my network up into VLANs.

Like let's just look at this switch right here.

I say these ports are blue.

This port is blue.

If you could kind of get the mental image.

If we're comparing it to the red ports, right
there, get the mental image in your head

that says it's as if you could take that
switch over your knee and you do kind of one

of those ahhh chop, Judo chop that
thing into two different pieces.

And we took all of these blue ports and they
kind of snapped off and became their own switch,

and all of these red ports, and they
snapped off and became their own switch.

Logically, that's what VLANs do.

It separates our groups of users, or our
devices that are attached to the network

into completely separate networks.

It segments the broadcast domains.

So if the blue computer sends a broadcast,
it only comes out the blue ports.

Now, let me go beyond this.

It can even transcend switches to where
these blue ports get the broadcast

and these blue -- oh, he's down there.

These blue ports get the broadcast.

So it comes out all those ports.

And if the red guy sends a broadcast,
only the red ports get the broadcast.

So it kind of segments that.

We get a subnet correlation to where when we
split into VLANs, we split our IP subnets.

Now this is a big concept to catch.

The blue VLAN is now a new network.

So it is identified now at Layer
3 at our IP addressing layer

as a completely different network.

So maybe before we did VLAN, like I showed
on the last slide, everybody was 192.168.1.0,

but now I say, OK, well the blue VLAN, well
maybe the blue VLAN stays 192.168.1.0/24.

Now remember, with slash-24, that means
this, this and this represent the network.

It's the same thing as saying 255, 255, 255, 0.

And IP addressing is coming up, don't worry.

So we say slash-24.

But then the red VLAN is
going to be 192.168.2.0/24.

It has to be.

It's a completely different subnet.

Different network.

So these guys are now in a completely
different zone than these guys.

They are completely segmented.

That gives us a full level of access control,
to where I can say, OK, blue cannot access red,

but, you know, and when we get into moving
data between VLANs, I can say, well,

the red can access blue, but
maybe only these devices.

Whereas when we're at Layer 2, meaning we
don't have VLANs, everything's connected

to a normal switch, as I mentioned, it's very
difficult to try and pull a stunt like that.

VLANs also help with quality of service, because
it's way easy to say the red VLAN has priority.

Totally easy configuration
and quality of service.

Whereas if everybody is a member of the
same VLAN, it's a normal switch like we saw

on the last slide, it's very difficult,
it can be very difficult to say, well,

you get quality of service, but you guys don't.

So you, now quality of service, I should stop
assuming everybody's like, well, what's that?

Quality of service says you're
more important than somebody else.

That's not very nice.

Well, it kind of is, depending
on what you're talking about.

Maybe the blue guys are people
that surf the web all day.

Yeah, you hire those kind of people, right?

Or the blue guys are normal day-to-day users,

whereas the red guys, those
are your executive team.

Or even better yet, those are your IP phones.

And we always want our IP phones, our voice-over
IP traffic to have priority over the blue.

Very difficult if the IP phones are
in the same network as the blue guys.

To really say, OK, well --
because they're the same network.

It's hard to identify them.

Whereas if I have a completely
different network, I can say, well,

simple enough, prioritize the red guys.

And the switch is really easy to identify that
and the routers can really easy identify that,

because they're on completely separate networks.

So this is good.

Now let me ask you a question.

Let me do this.

No. I'm just going to drag this off.

Gone. OK, so if the blue guys send a
broadcast, and as I mentioned it comes

out all the blue ports, and even down here,
and the red guys send a broadcast and it comes

out all the red ports, even down here,
then here's my -- I'm going purple on you.

What VLAN does that belong to?

What VLAN does that, and that, and that.

I notice they're kind of a white port.

What VLAN are they in?

The right answer is all of them,
because Cisco calls those trunks.

A trunk port.

A trunk port, and by the
way, trunk is a Cisco term.

Trunk carries all VLANs all the time.

So -- well, put a little
asterisk by "all the time."

Because we can restrict that.

But a trunk, you know, when I set
up a trunk, it will automatically,

from the minute I configure
it, carry the red VLAN,

I think we said that was
VLAN 20, and the blue VLAN.

Red VLAN and the blue VLAN.

So usually, I mean, if these are all 100
megabits per second ports, usually you'd want

that guy to be maybe 1000 megabits per second.

Those are your bottlenecks, because
they're carrying a lot of traffic.

They have a lot of work to do.

Now I just said that trunk is a Cisco word.

Only Cisco uses that word.

Other vendors use the term tagged port.

I hear that all the time, and a 3Com
switch, or 3Com got bought by HP,

so HP switches, Juniper switches.

Everybody else uses the term tagged.

And I have to admit, I kind of
like that word a little better.

A trunk is -- you're kind of like, OK?

What's that?

We have to assign a definition to it.

But a tagged port really identifies what it is.

Because when a frame comes into the
switch -- now, let me tell you this.

A computer has no idea what a VLAN even is.

It doesn't know that it's part of a VLAN.

All it knows is it's got an IP address
and when it sends stuff, it communicates.

You know, things ping back.

It can communicate.

So a computer has no idea what VLAN it's on.

So when it sends a frame into the switch, and
the switch says, OK, you're on the blue VLAN,

what it will do before it ever
sends it to another switch is take

that data -- so let me give a scenario.

Let's say that this guy up here,
192.168.1.50 pings this guy

down here, who's 192.168.1.51, right?

So I have a ping message that's sent.

So it sends that ping into the switch,
the switch realizes because it looks

at the Mac address in the header, and it goes,
oh, well, that Mac address is out this port,

and down this port, and I'm
going to get it to that guy.

So it looks at the Mac address
to figure that out.

Well, it needs to let this
switch know what VLAN it's on.

And this switch needs to let this
switch know what VLAN it's on.

So when the switch sends this frame
out a tagged port, it does just that.

It puts a little tag in the header
that says this belongs to VLAN 10.

I don't know why I always
think of this when I describe

that tagging process, but
have you ever gotten shims?

What's that?

You go to Home Depot and, you know, you've
got the refrigerator that's not quit level

and it kind of rocks back and forth?

You just go to Home Depot, grab a shim.

They're like these little triangle pieces
of wood that you buy a whole pack of them,

because everything in my house is not level.

Like my chair wiggles back
and forth, my desk wiggles.

So you go in my house, and like shims --
I've got them in my back pocket all the time.

Everything's got a shim under
it to make it level.

I think of that when I think of this little tag.

It's like putting a little shim, chunk, in the
header of that packet, so that when it comes

down here -- like, for instance, maybe
it's not a ping, maybe it's a broadcast.

And when that broadcast comes down
to that switch, it has to know, OK,

only these ports get that broadcast.

Well, how's it going to know that?

Well, it's looking at the shim.

It's looking at the tag that was put in the
packet header and it goes, oh, you're VLAN 10.

OK, all these ports are in VLAN
10, so they're going to get it.

And when it comes down here,
he's looking at the shim.

He's looking at the little tag saying,
oh, VLAN 10, only these ports get it.

So the switches are able to
make intelligent decisions.

Now I told you that a computer has no idea
what a VLAN is, so you better believe before

that switch sends that ping or that broadcast to
that computer, it actually yanks the shim out.

It's like, OK, well, if I send you a packet,
or frame, that has a shim in the header,

you're going to go, what is this?

All right?

This must be a messed up packet.

I'm going to drop it.

So this is a switch-to-switch thing.

This little tagged port.

So what Cisco calls trunk, everybody else
calls tag because it's really what's happening,

is it's putting these little
labels on the header.

OK, last thing I want to discuss

in this conceptual VLAN nugget
is what do you do with them?

I mean, getting the concept, like the
last slide is good, where you're like, OK,

I can separate the blue and the red.

I get that.

So it's more secure and all that.

But give me something practical, Jeremy.

What do people do?

Well, I would say this, by
far, is not a cumulative list,

but I would say probably the most common
things people do with VLANs are right here.

Lower right, let's start there.

Like type segmentation.

Almost everybody does this.

Grouping things together
that are of the same kind.

I mean, it helps with security.

Like, for instance, let's say OK,
all the servers are over there.

All of the accounting users are over there.

You know, you kind of group
-- it's good for security,

but also it just makes sense
as your network grows.

As your network grows, it does get more and
more inefficient if it's one big network,

because remember, broadcasts
start accumulating up.

You get more and more of them, things
have to process those broadcasts

and things just get slower and
slower and slower and less efficient.

So what most people will do is start
grouping together, this is where it starts.

Grouping together common
departments or common things.

I'll give you an example.

One of the most bizarre networks I walked into,
I'm trying to think of how to explain this

without revealing exactly what it was.

In Arizona, we have -- I can't.

We have separate governments.

So we have the United States of
America and then there are groups

where they have their own
government within Arizona.

So I was actually brought out to consult
on one of these little sub-area networks

and literally I walked in and the government
building, you know, it's a small little area,

the government building, the police department,
the school, the school library and --

there was one other thing --
oh, a water treatment plant

for waste treatment, all of it was one network.

So let me give you the paradigm
that I walked into.

I could go to a library computer
and ping and actually try

to access a computer in the police department.

I'm pausing just to let that soak in.

That's the kind of network I walked in on.

And I saw that and I was like, wow.

You know, I'm trying to think of, like,
how do I convey just how scary that is?

And I'm like, that's scary.

There's nothing else that
could come out of my mouth.

And that was the first thing that we did is
go into the like type segmentation, I mean,

this was kind of the network type where we have
the government building, and then over here,

maybe Building B is the police
department, over here is the library,

you know, all this kind of stuff.

They were all connected with
fiber optic cable in between them,

and that was the first thing that we did.

We said -- OK, now ignore
all this stuff for now.

But we said, OK, Building A, that's VLAN 10.

Building B, that's VLAN 20.

So immediately I'm putting up security
boundaries and making it more efficient

because now broadcasts in the police
department don't come over to the library,

don't go over to the government
building, and all that kind of stuff.

It's like type segmentation.

And it just kind of feels good.

I don't know how else to say it.

You know, my wife homeschools all of
our -- we have 4 kids right now --

and one of the first things
that she starts doing is putting

like we get all these little colored
balls, right, and red ones and blue ones,

and she kind of mixes them up
and the kids are like, eww.

It doesn't feel good.

There's blue balls with the
red balls and the green balls.

And the first task they have to
do is like put them all in order.

It's kind of like put all the green
balls with the green balls, the red --

and you get done and you just look
at the kid and they just glow.

They're like, look what I've done.

It feels good to look at.

And I know it sounds funny
to make that comparison here.

That's what you'll feel like.

You're like, look what I've done.

The police department is all
in their own little spot.

They don't go anywhere.

It makes sense to you and it just feels logical.

OK, server virtualization.

Let me jump over there.

You know, when I'm talking about VLANs, like
I said, there are a huge amount of things

that I could give you, but a lot
of it crossed the technology lines.

And that's why putting practical
examples is sometimes difficult

because I know sometimes I may
explain something and be like,

I have no idea what server virtualization is.

So let me give you the fly-by view.

Servers have become bigger, bigger,
bigger, better, faster all the time.

That's just the way of things.

And what somebody realized a
long time ago is, you know what?

Most of the time a server, you know,
physically, is just sitting there.

I mean you look at its -- you know, if you're
looking at it like a utilization graph,

it's processor is like [computer sounds].

Because it just sits there
and gives people files.

I mean, that's what it does.

But the processor has way
more capacity than that.

In memory utilization, you know,

it's like here's the total and
it's like [computer sounds].

I mean, it's like memory utilization's low.

So what somebody came along and decided
to do, and this is, by the way, VMware,

Microsoft with their knockoff hyper -- I didn't
say knockoff, I meant innovation, Hyper-V.

You know, there's all kinds
of different virtualization.

As a matter of fact, you can go download one
for free called, what is it called, Virtual.

VirtualBox.

Right? And you can actually run
virtualization on your own workstation for free.

I think Sun, Sun Micro?

Somebody started doing this for free.

So this is all virtualization.

What it allows you to do is take that
one physical box and start splitting it

to multiple servers, to where I actually run --
it's like I have one operating system on here

that is, we'll say Windows
Server 2012, you know.

It's running.

This is our core server.

And then over here I've got a little, maybe,

accounting server that our
accounting department runs.

It's Windows 2003.

Just an old server they use for file storage.

And then over here I've got maybe a voice-over
IP server than runs our phone system.

So I can use one physical box
because of the resource capacity

to run all of those different servers.

But here's the dilemma.

I've got phones that are on their
own VLAN and they can only, I mean,

they need to talk to the server and
it needs to be on their network,

and then over here is the accounting
department, and maybe they want --

and I'm just coming up with this as I go, right?

And so the accounting department,
they want a server in their network

to store their files on and
communicate with, there.

Well, what we can do with server
virtualization is set up this link --

now this is heavy, hang with me -- as a trunk.

So remember, what does a trunk do?

Carry all VLAN.

So let's say accounting is VLAN 10,
voice is VLAN 20, and these servers,

whatever they are, is VLAN 50, right?

So this switch can actually send all the
VLAN traffic, so the accounting department,

the voice phones, and everything like
that, even though they're separated.

Like accounting can't actually get to the phones
and the servers can't actually get there --

I can actually send all of those
packets tagged to the server and just

about every virtualization solution,
VMware, Hyper-V, all that kind of stuff,

they can all say, I'm going to look at that
VLAN header and then I can assign, you know,

like I can assign this server within
this box to VLAN -- what did I say -- 20.

So now, as packets come in tagged with VLAN 20,
it'll say, oh, you're able to reach that server.

Did I say accounting?

I meant voice.

As voice packets come in tagged with
VLAN 20, they can reach the voice server.

As accounting packets come in,
and they're tagged VLAN 10,

they can reach the accounting server.

Because within this server, I assign
that server -- that sounds funny --

within this physical server, I assign
this logical server to VLAN 10.

And so I can separate, even within one box,

all the different servers,
making it totally efficient.

That's great to be able to do that.

Last example.

Up here I've got Unified Network and Wi-Fi.

So what I can do is, let's say, you
know, I've got common departments.

Like I've got this accounting group, but just
because of how our company grew, you know,

we kind of filled up this little 2000
square foot building to start off with

and we immediately bought
the building next to it,

which was 6000 square feet,
you know, to allow for growth.

And then we outgrew that one really
quick and had to buy another, you know,

the next little 3000 square
foot building next to it.

And so just kind of how our building grew,
we've got accounting people sitting right here

and we ran out of chairs so
some had to sit over here.

Well, using VLANs, we can have a unified network
to where even though I've got accounting people

in this building, I can have these guys,
accounting people, that are on the same network

and have the same permissions applied to them.

Because I can send that VLAN across all of
these links, which would be my trunk links.

Wi-Fi. So handy.

Wi-Fi is becoming like an
everywhere kind of thing.

Everybody is on the wireless network.

You might have an iPad.

Let's say you've got an iPad that you're
walking around with, watching a YouTube video,

and in here you actually
have a wireless access point,

and over in this building you have a
wireless access point and all that.

Well, we want people, you know, as this
iPad, as I'm walking, watching this video

as I'm walking -- or even more
relevant, they have wireless IP phones.

You know, to where maybe I'm talking
on a phone call connected to Wi-Fi,

roaming between these different buildings.

Well, if I don't use VLANs,
then every building that I come

to might end up being a different network.

And if that happens, my call is
severed if I'm talking on the phone.

My YouTube video, or whatever I'm watching,
stops on the iPad, because it loses connection

as it moves from one building to another.

But with VLANs, I can send that same VLAN across
all the buildings and allow it be segmented

so it's efficient, and yet at the same time,
stay unified to where Wi-Fi stays the same

as I move and I don't lose connections
as I move from one building to the next.

Think of those VLAN uses
as the tip of the iceberg.

I can't tell you how many times I'm
in a conversation with somebody,

whether it's at a data center or, you know, at a
corporate network or wherever and they're like,

man, we've just got to figure
out how to do this.

And I can't tell you the number of times where
I've looked at them like, oh, totally possible.

We've got to use the VLANs.

Just use our VLANs in the right way.

We can separate that business from that one.

We can make sure that their
traffic doesn't mix with theirs.

I mean, just the uses of VLANs
are literally, I mean, endless.

There are situations that even I -- after
dealing with VLANs for a decade and beyond --

haven't run into yet that I know,
I'm like, a VLAN would solve that.

So VLANs give you such flexibility
and capability wherever you are.

So let's review.

We have seen in here the
view of a normal switch.

You know, what it looks like without VLANs.

Everything's kind of flat.

Everybody can talk to everything.

No security.

Then we added in the VLANs and the trunks.

VLANs being your way of separating it.

Did I ever tell you what a VLAN stands for?

How did I get here?

Virtual LAN.

It's Virtual Local Area Network,
because it's virtually

as if I'm creating a new network altogether.

So VLANs separating our networks into
different groups and then a trunk,

which allows you to carry all of those tags,
all of those identifiers between your switches,

so we can have a unified network

to where everything supports the same
VLANs within our campus, all right?

Within our infrastructure.

And then we saw some examples
of what VLANs make possible.

So from here, we're going to
start picking up on the config.

For now, I hope this has been informative for
you, and I'd like to thank you for viewing.