Tuesday, December 18, 2012

Why VLANs?

VLANs, or Virtual Local Networks, are logical broadcast domains that span multiple physical LAN segments.  Each VLAN functions as a separate LAN by grouping devices by their logical function or application without regard to their physical location by the users.  VLANs are commonly used when separating networks by their department with an organization.  For example, within a company there may be a Human Resources VLAN, a Finance VLAN, an Administration VLAN.  Devices on a particular VLAN should be contained in the same subnet.  





There are several advantages of a VLAN.  VLANs allow for scalability.  Devices on a particular VLAN are not required to be connected to the same network switch.  Users cannot access hosts in other VLANs even though they may be connected to the same switch.  This provides additional security to the infrastructure.  Another advantage of VLANs is cost.  When additional users are added, it is not necessary to upgrade the network infrastructure.  The existing bandwidth is used more efficiently.  VLANs provide similar functions of subnets, like limit the size of broadcast domains, improve network performance and provides security.  So....you may think, why a VLAN and not just a subnet. 

There are also some other important difference between subnets and VLANs. A VLAN is a Layer 2 Concept (MAC address) and subnet is a Layer 3 Concept (IP address). VLANs allow for the creation of both logical and physical networks. Subnets only allow for logical networks. Since the physical network of subnets is the same for all networks, the overall bandwidth for each subnet is shared and therefore reduced. VLANs are usually easier to manage than subnets because they usually are created by their function rather than location. Within an organization, VLANs are more secure than subnets, however more vulnerable to hackers outside the network. It is best practice to have different VLANs in a network and then have a different subnet for each VLAN.

Here is a topology example of VLAN configuration. 



As you can see from the topology above, each VLAN is contained within the same subnetwork.  VLANs are named for identification and configured to assigned ports.  In order for a VLAN to communicate with a different VLAN, it must pass through the Layer 3 device. 
 

Here is an Introduction to VLANs video you may find helpful.