2.2.6 VLANs, Trunks & QinQ

VLANs, Trunks & QinQ

• VLANs, trunk connections, and Q-in-Q (a more advanced version of VLANs) are important topics in traditional or hybrid networking.

Physical Network Segment

• A physical network segment consists of eight devices connected to a single layer two capable device (switch).
• Each LAN is a shared Broadcast Domain
• Frames addressed to all FFs (broadcast) will be broadcast on all ports, reaching all devices.
• Adding more devices increases broadcast traffic, which doesn't scale well
• Switches improve performance by creating separate collision domains for each port, reducing retransmissions.

Segmenting Networks

• A local network can have distinct user groups, such as game testers, sales, and finance.
• Separate device groups are preferred for larger businesses, creating network segments for normal devices, servers, security systems, CCTV, IoT devices, and IP telephony.
• It is challenging to achieve this segmentation with only a physical network.
• To separate groups, devices can be placed on different floors or buildings with their own switches.
• Each building becomes its own broadcast domain because the switches aren't connected.
• This setup is suitable if groups don't need to communicate across domains.
• The switches have no layer two communications between them without connections.
• Connecting switches creates a larger broadcast domain, reverting to the drawbacks of a single network.
• Physical networking is complicated when staff members change groups but not buildings.
• Physically running new cables can solve this problem manually
• This manual solution does not scale well; therefore, virtual LANs (VLANs) are required.

VLANs and the OSI Model

• A regular Ethernet frame includes source and destination MAC addresses, and a payload for data.
• The source MAC address is from the device creating/sending the frame.
• The destination MAC address is a specific (unicast) address or all FFs (broadcast).
• Broadcast frames are viewed by all devices on the layer two network.
• Standard frames lack the ability to isolate devices into different groups.
• The 802.1Q (.1Q) standard modifies the frame format by adding a 32-bit field.
• This new field increases the frame size.
• Twelve bits of this field are used to store values from 0 to 4,095, identifying the VLAN ID (VID).
• 0 signifies no VLAN, and 1 is typically used for the management VLAN.
• The 802.1Q allows over 4,000 VLANs in a layer 2 physical network enabling creation of multiple Virtual LANs

Use Cases and 802.1AD

• It creates over 4,000 different broadcast domains in the same physical network
• Create VLANs for CCTV, servers, game testing, and guests.
• The possibilities are endless
• Businesses with multiple sites can use VLANs for each site and connect them via a dedicated WAN.
• When multiple sites each require VLAN 1337, and so does the communication provider, 802.1AD (Q-in-Q), also known as provider bridging or staggered VLANs comes into play.
• QinQ adds another VLAN ID field to the frame to solve conflicts of same VLAN ID's
• The original VLAN field is the C-TAG (customer tag).
• The added VLAN field is the S-TAG (service tag).
• Using .1Q allows VLANs from different customers with the same VLAN ID to traverse the network
• Large complex networks typically use Q-in-Q, while smaller networks and cloud platforms like AWS use .1Q.

VLAN Ports and Tagging

• 802.1Q is configured so that Ports and switches are defined as either access ports or Trunk ports.
• Each access port generally has one specific VLAN ID (VID) associated with it.
• A Trunk Port conceptually has all VLAN ID's associated with it.
• Assign finance team devices to VLAN 20 and game testing devices to VLAN 10.

VLAN Operation and Communication

• Buildings are separated by broadcast domains if their switches are disconnected
• Two laptops on the finance team connect to switch number 1, and two laptops on the game tester team connect to switch number 2.
• VLAN Capable networks have two types of ports
• Access Ports
• Trunk Ports
• End devices connect to access ports.
• Access ports use standard Ethernet, so frames are not VLAN tagged.
• When a frame enters the switch, the egress port adds the VLAN the frame is assigned.
• After exiting, it's tagged with VLAN 10 (for the orange VLAN).
• Switches must forward broadcasts out every port it did not originate from.
• For VLANs, this forwarding is different.
• First, forwarding is to any other access ports on the same VLAN, with tagging removed.
• The devices connected to these access ports won't understand VLAN tags.
• After, it can forward to trunk ports.
• Trunk ports connect two .1Q-capable devices and forward all frames, including VLAN tags.

VLAN Frame Handling

• VLAN Frames are forwarded to Switch 1 as VLAN10
• The .1Q Frames are forwarded only to Access ports on the same VLAN, or Trunk Ports.
• Frames for Unicast MAC addresses will either be forwarded to an access port in the same VLAN or broadcast if the MAC address is not known.
• Frames are forwarded to all devices connected to access ports on that VLAN and removed.
• Frames forwarded through trunk ports are tagged with VLAN 20 (Finance).
• Each device on the VLAN is isolated without communication between.
• Without a Layer 3 Device, each VLAN cannot communicate with each other

VLAN Summary Points

• VLANs allows creation separate layer two network segments,
• Traffic is isolated within VLANs, with no frames leaving the boundary without a router.
• VLANs can create isolated customer networks
• Connecting to VPC's using Direct Connect
• In AWS, separate broadcast domains are created with VLAN tagging
• If 802.1Q is mentioned => its VLANs
• VLAN stacking or provider bridging, or 802.1AD, or Q-in-Q, => Nested VLANs are present using a combination of customer and service tags
• QinQ must be understood to pass networking exams