- [Narrator] One way to identify a local area network
is to say that all the devices in the same LAN
have a common layer three IP network address, and that
they also are all located in the same
layer 2 broadcast domain.
A virtual LAN, or VLAN, is another name
for a layer 2 broadcast domain.
VLANs are controlled by the switch.
The switch also controls which ports are associated
with the VLANs.
We often take for granted layer 2 in the network
because it just works.
Address resolution protocol or "ARP",
and layer 2 forwarding on ethernet,
are all proven technologies that work very well.
The CCNP security and CCIE security certifications are built
with the presumption that candidates would have some
of the fundamentals of routing and switching.
With this knowledge, your understanding of the details
about VLANs, trunking, and inter-VLAN routing is presumed.
However, so that you absolutely understand
these fundamental concepts,
this lesson will begin with the review.
It is important to make sure that the basics are
in place so that you can fully understand the discussion
about protecting layer 2 in the last section of this lesson,
which covers the really important stuff.
That section focuses on just a few
layer 2 related security vulnerabilities
and explains exactly how to mitigate threats at layer 2.
If you are currently comfortable with VLANs,
trunking, and routing between VLANs,
you might want to jump to the next lesson.
In a previous lesson, you learned
that VLANs can be used to segment your network
and are assigned to switch ports,
as well as wireless clients to enforce policy.
In this lesson, you will also learn about several
security challenges when protecting layer 2 networks,
VLAN assignment, and trunking protocols.
However, you must understand the basics
of how VLANs and trunking operate
before you can learn how to secure these features.
This section reviews how VLANs and trunking are configured
and how they operate.
This diagram serves as a reference
for the discussion going forward.
You might want to screenshot this page
or take a moment to make a simple drawing of the topology.
You'll want to refer to this illustration
often during this discussion.
So what is a VLAN?
One way to identify a local area network
is to say that all devices in the same LAN
have a common layer 3 IP network address
and they also are all located in the same
layer 2 broadcast domain.
A virtual LAN, or VLAN,
is another name for layer 2 broadcast domain.
VLANs are configured on the switch.
The switch also controls which ports are associated
with the VLANs.
In the diagram here,
the switches are in their default configuration.
All ports by default are assigned to VLAN 1.
And that means all the devices, including the two users
and the router, are all in the same
broadcast domain or VLAN.
As you start adding hundreds of users,
you might want to separate groups
of users into individual subnets
and associated individual VLANs.
To do this, you assign the switch ports to the VLAN,
and then any device that connects
to that specific switch port is a member of that VLAN.
Hopefully all the devices that connect
to the switch ports that are assigned
to the given VLAN also have a common IP network
address configured so that they can communicate
with other devices in the same VLAN.
Often dynamic host configuration protocol, or DHCP,
is used to assign IP addresses
from a common subnet range to the devices in a given VLAN.
If you want to move the two users in the diagram
to a new common VLAN, you create the VLAN on the switches
and then assign the individual access ports
that connect the users to the network-
to that new VLAN as shown in the example here.
In the example, interface GigabitEthernet 2 of switch one
is configured as an access port
and assigned to VLAN 10.
Interface GigabitEthernet 2 of switch two is configured
as an access port interface and assigned to VLAN 20.
You can do a quick verification
of the newly created VLANs and associated ports
with the "show VLAN" brief command,
as demonstrated here.