One switch, several LANs
Every port on a new switch is in the same LAN, so a broadcast from any PC reaches every other PC. A VLAN (virtual LAN) splits the switch into separate LANs: ports in VLAN 10 only hear other ports in VLAN 10, as if they were on a switch of their own.
| Benefit | Why |
|---|---|
| Smaller broadcast domains | ARP and DHCP broadcasts stay inside one VLAN |
| Security | Sales PCs can't reach HR PCs directly; traffic between VLANs has to go through a router or firewall that can filter it |
| Flexibility | Group people by job, not by where their desk is: a VLAN can span many switches |
| Separate traffic types | Voice, data, management and guest traffic in their own VLANs |
Remember: One VLAN = one broadcast domain = one IP subnet. Devices in different VLANs need a router (module 9) to talk.
VLAN numbers
| Range | Use |
|---|---|
| 1 | The default VLAN: every port starts here. Can't be deleted or renamed |
| 2 - 1001 | Normal range: your VLANs |
| 1002 - 1005 | Reserved for old Token Ring and FDDI |
| 1006 - 4094 | Extended range |
A brand-new switch has every port in VLAN 1:
In NetLab
▶ SW1 SW1>enable SW1#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Gi0/1, Gi0/2 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup
Tip: Best practice: don't use VLAN 1 for users, put unused ports in an unused VLAN and shut them down, and keep switch management in its own VLAN.