As with many subjects, theory is great, but actually configuring a setup is priceless. Nothing can replace actual deployment when when trying to fully understanding how theory holds up. With that, what better subject matter illustrates this more than VLANs?
Hence, please find the following narrative that not only goes through the process step by step, but stops along the way to explain the theory behind the methods to ensure the understanding of what needs to be done.
Share and enjoy...
WHAT IS A VLAN?
VLAN is a network structure which allows users to communicate while in different locations by sharing one multicast domain and a single broadcast. They provide numerous networking benefits and have become popular in the market. For instance, it helps reduce administrative costs when users are geographically dispersed. The benefits are:Inexpensive
The popularity of VLANs is due to the fact that changes, adds, and moves can be attained simply by making necessary configurations on the VLAN port. Time-consuming, re-addressing, and host reconfigurations is now a thing of the past, because network configuration can be made at ease when need arises.Better management
A VLAN typically solve the scalability issues that exist in a large network by breaking the main domain into several VLAN groups or smaller broadcast configurations, thereby encourage better control of multicast traffic as well as broadcast domains.Improves network security
High-security can be positioned in different VLAN groups to ensure that non-members cannot receive their broadcasts. On the other hand, a router is added and workgroups relocated into centralized locations.Enhances performance
VLAN groups are often defined on vast criteria, making it is easy to evaluate traffic patterns on the network and associate resources and users logically. For instance, an engineer working on CAD/CAM network server can be placed into a different VLAN group that contains just the server and the engineer. The engineer performance increases without affecting other servers.Segment multiple networks
VLANs are typically used to achieve multiple purposes. They are popularly used to reduce multicast traffic. Since certain devices send out massive amounts of traffic during broadcasting, VLANs help in limiting network traffic.Better administration
VLANs facilitate grouping of multiple geographical stations. When VLAN users move to another physical location, the network does not have to be configured.It may be difficult to manage several routing protocols on VLAN since you have to use a router, a trunk and routing protocol.
Hence, submitted for your approval, please find the following, in full excruciating detail, the steps in not only connecting a conventional mini network, but creating segmented VLANs, Trunks, and VoIP to boot! Share and enjoy!
THE AGENDA OVERVIEW:
- CONFIGURING A VLAN | TRUNKING | VOIP
- CREATING VLANs
- ASSIGNING PORTS
- SETTING UP REMOTE MANAGEMENT
- SET UP AUTHENTICATION FOR REMOTE ACCESS
- INSTALL CROSSOVER CABLE TO ANOTHER SWITCH
- CHANGING CONNECTION PORT TO BE A TRUNK
- NATIVE VLAN CONFIGURATION
- VOICE VLAN CONFIGURATION
- CONFIGURE INTERFACE PORTS TO THE PHONES WITH VOICE MODE
- SET UP DHCP FOR THE PHONES
- CONFIG TELEPHONY SERVICE ON THE ROUTER
- NEED TO ASSIGN PHONE NUMBERS
CONFIGURING A VLAN | TRUNKING | VOIP
As illustrated by the diagram we have a simple layout of two PCs
and a Swich. First, we will connect both
to the switch so they are both on the same LAN.
We will cable both PCs with a “straight through” cable since we
are going from access point to a switch, otherwise a switch to switch would
require a “crossover cable”. Let’s stop
here a moment and explain what we mean…
There
are generally three main types of networking cables: straight-through,
crossover, and rollover cables. Each cable type has a distinct use, and should
not be used in place of another. So how do you know which cable to use for what
you need?
THE PURPOSE OF STRAIGHT-THROUGH CABLES
Straight-through
cables get their name from how they are made. Out of the 8 pins that exist on
both ends of an Ethernet cable, each pin connects to the same pin on the
opposite side. Review the diagram below for a visual example:
Notice how each wire corresponds
to the same pin. This kind of wiring diagram is part of the 568A standard. The
568B standard achieves the same thing, but through different wiring. It is
generally accepted to use the 568A standard as pictured, since it allows
compatibility with certain telephone hardware- while 568B doesn’t.
Straight-through cables are primarily used for connecting unlike devices. A straight-through cable is typically used in the following situations:
Use a straight-through cable when:
Straight-through cables are primarily used for connecting unlike devices. A straight-through cable is typically used in the following situations:
Use a straight-through cable when:
·
Connecting
a router to a hub
·
Connecting
a computer to a swtich
·
Connecting
a LAN port to a switch, hub, or computer
Note that some devices such as routers will have advanced circuitry, which enables them to use both crossover and straight-through cables. In general, however, straight-through cables will not connect a computer and router because they are not “unlike devices.”
THE PURPOSE OF CROSSOVER CABLES
Crossover
cables are very similar to straight-through cables, except that they have pairs
of wires that crisscross. This allows for two devices to communicate at the
same time. Unlike straight-through cables, we use crossover cables to connect
like devices. A visual example can be seen below:
Notice how all we did was switch
the orange-white and green-white wires, and then the orange and green wires.
This will enable like devices to communicate. Crossover cables are typically
used in the following situations:
Use a crossover cable when:
Use a crossover cable when:
·
Connecting
a computer to a router
·
Connecting
a computer to a computer
·
Connecting
a router to a router
·
Connecting
a switch to a switch
·
Connecting
a hub to a hub
While the rule of thumb is to use crossover cables with like devices, some devices do not follow standards. Others provide support for both types of cables. However, there is still something that both crossover and straight-through cables can’t do.
THE PURPOSE OF ROLLOVER CABLES
Rollover
cables, like other cabling types, got their name from how they are wired.
Rollover cables essentially have one end of the cable wired exactly opposite
from the other. This essentially “rolls over” the wires- but why would we need
to do such a thing? Rollover cables, also called Yost cables, usually connect a
device to a router or switch’s console port. This allows a programmer to make a
connection to the router or switch, and program it as needed. A visual example
can be seen below:
Notice
that each wire is simply “rolled over.” These types of cables are generally not
used very much, so are usually colored differently from other types of cables.
BACK TO THE CONFIG
This is
primarily due to the fact that they are both on the same segment and the same
IP network address space.
So now let’s look at the switch and investigate how we can configure
the switch to handle VLANs.
NOTE: For this exercise, we are using Packet Tracer to allow us to easily navigate and model a live network. In addition, we are using Cisco switches.
CREATING VLANS
Being Cisco, if we look at
the configuration, we see that VLAN 1 is the default and every port is assigned
to it. As a result, if we go into the switch
and enable it and type the command show vlan: 
So, we can create our own VLANs.
At the switch, we go into the Command Line Interface (CLI) and start
with the command, - “enable” which can be abbreviated as “en” the device
- and then “configure terminal“ which also can be abbreviated as “config t” – entering the configuration.
- We create a VLAN 50 by entering the command, "vlan 50"
- Notice the command prompt enters a config-vlan - then we name the Vlan for “Student” by entering, "name student"
- Then we proceed to create VLAN 99 named management by repeating the commands for it, "vlan 99"
- naming MGT, "name mgt"
- then exiting the vlan config mode with, "exit"
To confim we exit and type in the command, ‘show vlan” and see
that the VLANs are active, both 50 and 99; however, we don’t have any ports
assigned to them:
ASSIGNING PORTS
After creating a couple of VLANs, we need to assign ports to the
VLANs. So for this exercise, we will
assign PC 101 as part of the student VLAN.
We go to the CLI and enter
command
·
“Configure Terminal” and
·
go to interface fastEthernet port 10 via the command, “interface
fastEhernet 0/10”,
·
then configure the port’s mode to access port using “switchport
mode access”
·
then assign that access port to VLAN 50 with the command, “switchport
access vlan 50”
·
then exit the configuration of the interface with the command, “end”.
‘
Then type the command, “show run” which is short for show running
config…
We see
FastEthernet 0/10 is now part of vlan 50; hence, no longer can the two machines
ping each other, for they are on two different networks.
If you do a “show vlan”…
You can see that vlan 50 has the port Fa0/10 where it’s no longer
listed in the default VLAN 1. Since the
two PCs are in fact in separate networks, let’s change the IP of PC 101 to
192.168.50.101 to be consistent…
Now our network looks like:
Where we have
VLAN 50 being a typical Data VLAN and VLAN 1 is our Default. From here we can add another PC on a new VLAN
called 99 that can act as the Management (MGT) VLAN.
Notice we are mapping the IPs with their respective VLAN
assignment. Now let’s configure the
devices to operate these assignments.
We need to assign
that port on the switch. First, we must
enter the CLI and
- Type the config command “conf t”
- Now enter the configuration of interface port 24 where the Mgt PC is connected; command, “int fa0/24”
- Next we assign the connection as an access port with the command, “switchport mode access”
- Then assign the VLAN 99 to it with the command, “switchport access vlan 99”
- and then type the command “show vlan”
We see that 99 is mgt and is active.
SETTING UP REMOTE MANAGEMENT
In order to use the VLAN 99 PC as a
Management port – we have to enable telnet or SSH to allow the PC to remote
into the switch. We will have to assign
an IP address for that port. Currently,
we don’t have an IP address at that port 24.
So we proceed into the CLI of the switch…- Enter “conf t”
- Enter the config of interface VLAN 99 with the command, “interface vlan 99”
- Next type in the desired IP address and subsequent broadcast address with the command, “ip address 192.168.99.2 255.255.255.0"
- Now activate it with the command, “No shutdown”
- Then exit; “CNTL /Z”
NOTE: Now a point should be made here – when you type the command,
“show running config” at the bottom you will see that interface VLAN 1 is
already configured. However, VLAN 1 as
no IP – well, it’s generally known that you shouldn’t assign an IP to VLAN 1
because it’s the first move a hacker will try – so keeping IPs to other than
the default VLAN would be a safer bet.
SET UP AUTHENTICATION FOR REMOTE ACCESS
At this point, we must enable remote access into the switch by entering the CLI and configuring the switch:- First using the command, “Config t” to get in the configure mode
- Then entering the command that allows a Virtual terminal for Telnet, “line vty 0 15”;
- We create a password to access the Virtual Terminal with the command, “password cisco”
- Then assign the type of entrance, “login”
- In addition, we must create a password to get into configuration mode of the switch with the command, “enable secret cisco”
So now that
we have a fully enabled management PC with an assigned IP to telnet into, the
topology map now looks like:
TRUNKING
To illustrate the need of a trunk, we add another switch with
another two PCs tied to it. The PC’s are
attached to Por 5 and Port 10. Much like
different floors of a building. Hence,
we assign the associated IP addresses to suggest their VLAN assignments. That is, a 1 and a 50.
Port 1 is the same on both switches and are members of the default VLAN 1. Hence, immediately VLAN 1 members can talk to each other... So to illustrate this - we got to 192.168.1.101 and open the command line and ping 192.168.1.100...
- Next we enter configuration with "conf t"
- Then we enter the vlan configuration interface with "vlan 50"
- Then assign a name "student" to it with "name student"
CREATING THE TRUNK
What is a VLAN Trunk?
You can’t describe VLANs without mentioning trunks. It’s a known fact that you can control and segment network broadcasts with VLANs. VLAN trunking enables the movement of traffic to different parts of the network configured as a VLAN.
A trunk is a point-to-point link between two network devices that carry more than one VLAN. With VLAN trunking, you can extend your configured VLAN across the entire network. Most Cisco switches support the IEEE 802.1Q used to coordinate trunks on FastEthernet and GigabitEthernet.
To enable VLAN configured with trunk link to traffic frames between switches on the network, it made possible by a link protocol called VLAN Trunking Protocol VTP.
What is VLAN Trunking Protocol (VTP)?
VLAN Trunking Protocol (VTP) is a Cisco-proprietary link protocol, it provides a means by which Cisco
switches can exchange VLAN configuration information. In effect, VTP advertises about the existence of each VLAN based on its VLAN ID and the VLAN name.
As mentioned VTP stands for VLAN Trunking Protocol. As the name suggests it propagates VLAN definition to whole of the LAN. To accomplish this task, VTP protocol carriers VLAN information to all the switches available in the VTP domain.
VLAN packet in VTP mode is transmitted in ISL (Inter-Switch Link) frames or 802.1Q compliant frames. We know that a trunk is physical and logical connection between two switches across which network traffic travels or flows. In VLAN, responsibilities of trunk line is to function as conduit for VLANs between switches and routers as well between switches and other switches.
- VTP domain refers to one or more interconnected switches. It is formed so that VLAN configuration details can be shared easily.
- VTP Advertisements are used to distribute and synchronize VLAN configuration across the VTP domain.
VTP Modes
Following are the three VTP modes in which any switch can be configured:
- VTP Server:
- Advertise the VLAN information across the domain
- Create, delete, modify
- VTP Client:
- Stores the VLAN information from the server
- Can not create, delete, modify
- VTP Transparent:
- Forwards VTP advertisements
- Do not participate in VTP
- VTP protocol is used between switches.
- VLAN configuration is done on one switch (i.e. switch in VTP server mode).
- The VTP protocol automatically propagates VLAN information to all the switches in the domain i.e. switches with VTP client modes.Subsequently, we would take the connection and configure it to be a trunk that allows VLAN 1-99 to pass through.
EXAMPLE: Suppose you have a office with 6 floors and a switch is assigned or configured on each floors. There is VLAN configuration on each floor. Suppose it has been decided to add new department to the configuration. Without VTP protocol, system admin need to go to each of the floors and need to add new department information to switches on all the six floors. It is easy to manage manually for the office having less floors and less number of departments/users. It will become cumbersome and time consuming task to manage large number of floors. Here VTP comes in to picture.
CHANGING CONNECTION PORT TO BE A TRUNK
To accomplish this on Switch 0:
- We first enable the switch with, "en"
- Now, since we configured the switch with a password, it prompts for that...
- Next we enter configuration with "conf t"
- Then we enter the interface Port 0/1 configuration "int fa0/1"
- We configure the port as an access port with "switchport mode trunk"
- Then we assign to that port, "switchport trunk allowed vlan 1-99"
What is Dynamic Trunking Protocol (DTP)?
Dynamic Trunking Protocol (DTP) not to be confused with VTP, which distributes VLAN information to other switches, is another Cisco proprietary protocol, that when enabled and configured correctly, uses advertisements to contact the switch on the other end of the link, and auto-negotiate a switchport to either an access or trunk link. When a switchport on either end of the link is misconfigured you will end up with a broken link (see chart below). DTP is enabled by default on the Cisco switches. There are four switchport modes that DTP, Access, Trunk, Dynamic Auto, and Dynamic Desirable. The default switchport mode is Dynamic Auto. See the chart below for the results:
The following chart shows how the link will auto negotiate when DTP is enabled on both switches and different DTP modes are configured on either end of the link. When DTP is enabled by default on a switch, the default switchport mode is Dynamic Auto.
Dynamic Trunking Protocol DTP which is in Dynamic Auto as the default and auto negotiate with each other which would by default configure the port on Switch1. Hence, by virtue of Switch 0 being set to Trunk, the above table does indicate that Switch 1 would follow, but as a good practice, it's best to statically configure this to be certain. goto switch 1
- We first enable the switch with, "en"
- Next we enter configuration with "conf t"
- Then we enter the interface Port 0/1 configuration "int fa0/1"
- We configure the port as an access port with "switchport mode trunk"
- Then we assign to that port, "switchport trunk allowed vlan 1-99"
Notice the Encapsulation is 802.1q - this is the trunking protocol that provides VLAN tagging. Notice the Native VLAN is VLAN 1. This is what it defaults to.
Anyways we should check to see if the trunk is working... So we go to 192.168.50.102 and ping 192.168.50.101 and we get....
Success!
To Recap:
NATIVE VLAN
Now the Native VLAN - which relates to trunk ports. We know that the trunk uses 802.1Q standard protocol to tag the respective frames with VLAN source and destination information. If there is a legacy packet goes through that does not comply to 802.1Q then it defaults to the native VLAN.
Go to Switch 0:
- We first enable the switch with, "en"
- Now, since we configured the switch with a password, it prompts for that...
- Next we enter configuration with "conf t"
- Then we enter the trunking interface Port 0/1 configuration "int fa0/1"
- We configure the port as an access port with "switchport trunk native vlan 80"
- CTRL/Z
This is for traffic that does not support 802.1Q - Now that you did this - you need to do it for the other switch0
Go to Switch 1:
- We first enable the switch with, "en"
- Next we enter configuration with "conf t"
- Then we enter the trunking interface Port 0/1 configuration "int fa0/1"
- We configure the port as an access port with "switchport trunk native vlan 80"
- CTRL/Z
If you don't do both SPANNING tree will flag it and block the traffic. - they need the two natives to match.
VOICE VLAN
Voice VLAN vs. Data VLAN
If the only device connected to a switchport is the IP phone, then it is largely irrelevant (with respect to the IP phone operation) whether you configure the port with a:
- data VLAN (switchport access vlan data-vlan) and a separate voice VLAN (switchport voice vlan voice-vlan), or
- voice VLAN (switchport access vlan voice-vlan).
In the second case, you would normally also use the switchport voice vlan dot1p or switchport voice vlan untagged command to let the IP phone know rapidly that the voice VLAN is equal to the data VLAN, just the tagging is either allowed for QoS purposes (dot1p) or is not allowed at all (untagged).
Having a different data and voice VLAN is necessary if you expect both a PC and an IP phone to be connected to the same switchport (a PC connected to an IP phone, and the phone in turn connected to a switchport). In that case, you most probably want to keep the data communication separate from the voice communication, which is why you can define two separate VLANs on a single access port.
An advantage of using an explicit voice VLAN may be that the phone will be sending tagged frames and it will be able to use the CoS priority field in the tag to perform QoS marking. Even without the tags, though, the phone will be marking the IP packets with appropriate DSCP values, and Cisco Catalyst switches are capable of performing QoS operations based on IP DSCP field. Therefore, using the tags just for QoS purposes is not a persuasive reason. You'd use different VLANs simply because you want to have your network neat and tidy and not mix different kinds of traffic and its purpose in a single VLAN.
Now lets add VoIP to this network.
First, we need to a router to this network. We will connect a 2811 router connect it to the Switch1 with a trunk connecting Fa0/2 on the switch to Fa0/0 on the router. Meanwhile, we will connect an IP Phone to new VLAN 150.
Go to Switch 1:
CREATE THE VLAN AND NAME IT
- We first enable the switch with, "en"
- Next we enter configuration with "conf t"
- Then we enter the trunking interface Port 0/1 configuration "vlan150"
- then name the VLAN, "name voice"
CONFIGURE INTERFACE PORTS TO THE PHONES WITH VOICE MODE
- Next we enter configuration with "conf t"
- Then we enter the trunking interface Port 0/20 configuration "int fa0/20"
- We configure the port as an access port with "switchport mode access"
- We configure the port as an access port with "switchport voice vlan 150"
- CTRL /Z
SET UP THE SECOND PHONE ON PORT 21
- Then we enter the trunking interface Port 0/20 configuration "int fa0/21"
- We configure the port as an access port with "switchport mode access"
- We configure the port as an access port with "switchport voice vlan 150"
CONFIGURE THE TRUNKS TO ALLOW VLAN 150
Now we've created VLAN 150 and set Port 20 and 21 to it. We need the trunks to allow VLAN 150, so first let's go to Switch 1:
- Next we enter configuration with "conf t"
- Then we enter the trunking interface Port 0/20 configuration "int fa0/2"
- We configure the port as an access port with "switchport mode trunk"
- We configure the port as an access port with "switchport trunk allowed vlan 1-99, 150"
- We configure the port as an access port with "switchport trunk native vlan 80"
- CTRL /Z
Now we have to configure the router. However, it needs to be the gateway for all PCs on their respective networks. First, let's assign multiple gateway addresses to it.
How do we bind several gateway IPs in the router.
- We first enable the switch with, "en"
- Next we enter configuration with "conf t"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0.1"
- From there we set the encapsulation to be 802.1Q with "encapsulation dot1q 1"
- We configure the port as an access port with "ip address 192.168.1.1 255.255.255.0"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0.50"
- From there we set the encapsulation to be 802.1Q with "encapsulation dot1q 50"
- We configure the port as an access port with "ip address 192.168.50.1 255.255.255.0"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0.80"
- From there we set the encapsulation to be 802.1Q with "encapsulation dot1q 80"
- We configure the port as an access port with "ip address 192.168.80.1 255.255.255.0"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0.99"
- From there we set the encapsulation to be 802.1Q with "encapsulation dot1q 99"
- We configure the port as an access port with "ip address 192.168.99.1 255.255.255.0"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0.150"
- From there we set the encapsulation to be 802.1Q with "encapsulation dot1q 150"
- We configure the port as an access port with "ip address 192.168.150.1 255.255.255.0"
- end
Show run
Need to up the interface on the router
- Next we enter configuration with "conf t"
- Then we enter the trunking subinterface Port 0/0 configuration "int fa0/0 no shutdown"
To test Let's go to PC 192.168.50.102 place the respective gateway
Now let's test on whether it can ping it's gateway...
SET UP DHCP FOR THE PHONES
Success! Next - go to the IP phone - Change the name to IP-Phone-1 - now we need to set up DHCP so the phoneS can pick up an IP address.
What is DHCP (Dynamic Host Configuration Protocol)?
DHCP (Dynamic Host Configuration Protocol) is a protocol used to provide quick, automatic, and central management for the distribution of IP addresses within a network.
DHCP is also used to configure the proper subnet mask, default gateway, and DNS server information on the device.
Go to the router:
- Next we enter global configuration with "conf t"
- Then we enter the dhcp pool name "VOIP" configuration "ip dhcp pool VOIP"
- We configure the Network with "network 192.168.150.0 255.255.255.0"
- We configure the network for the default router gateway with "default-router 192.168.150.1"
- We configure the dhcp opltion code for the VoIP config with "option 150 ip 192.168.150.1"
- CTRL /Z
CONFIG TELEPHONY SERVICE ON THE ROUTER
Go to the router:
- Next we enter global configuration with "conf t"
- Then we enter telephony service config mode "telephony-service"
- We configure the maximum directory numbers supported "max-dn 10"
- We configure the maximum devices supported "max-ephones 10"
- We configure the network ip source address " 192.168.150.1 port 2000"
- We configure the dialing number range for auto assigning "auto assign 1 to 9"
- CTRL /Z
NEED TO ASSIGN PHONE NUMBERS
- Next we enter global configuration with "conf t"
- Then we enter telephony directory phone configuration "ephone-dn 1"
- Then we enter telephony directory phone number "number 62001"
- Then we enter telephony directory phone configuration "ephone-dn 2"
- Then we enter telephony directory phone number "number 62002"
- CTRL /Z
Check to see if the configuration is correct - go to IP-Phone-1 - confirm the number and the IP address:
Phone number indicated on device display is correct. Now let's check the IP address...
And using the Packet Tracer simulator, when you dial the other phone and it rings the other phone and when you pick up the receiver - it works!!!
In Conclusion
We hope we were able to clear up the concepts of VLANs and removed the stigma of the complexity. In short, it seams to be just a set of repeatable commands that can easily set you in the right direction of properly segmenting a more efficient Network topology.
Share and enjoy...
Share and enjoy...
___________________________________________
“Once more unto the breach, dear friends, once more;”
___________________________________________
References
- http://danscourses.com/
- https://www.orbit-computer-solutions.com/vlan-trunking-protocol-vtp/
- https://learningnetwork.cisco.com/thread/33735
- https://www.rfwireless-world.com/Terminology/VTP-vs-DTP.html
- https://community.cisco.com/t5/switching/voice-vlan-versus-data-vlan/td-p/2385559
- https://www.lifewire.com/what-is-dhcp-2625848
- http://benefitof.net/benefits-of-vlan/
______________________________________________________
“Once more unto the breach, dear friends, once more;”
We would like to thank our sponsors, for without them - our fine content wouldn't be deliverable!
About Rick Ricker
No comments:
Post a Comment
Thanks for your input, your ideas, critiques, suggestions are always welcome...
- Wasabi Roll Staff