5

According to my understanding, the network switch will look out for the specific MAC address and then it will forward the frame so basically it doesn't broadcast the frames then why do we make VLANs? Is it to connect two distant machines or any other security related issue is handled via making VLANs?

5

According to my understanding, the network switch will look out for the specific MAC address and then it will forward the frame so basically it doesn't broadcast the frames then why do we make VLANs?

While VLAN is a tool often used to reduce the size of the broadcast domain, its major underlying goal was to partition a physical LAN device (switch, bridge) into multiple logical portions (VLANs). Think of a single physical device offering Ethernet LAN services for multiple departments within an organization. Every department would get a piece of that single physical device -- that is, some ports restricted into a VLAN. Thus one would not need to buy dedicated LAN hardware for every department.

7

Besides the unknown unicast flooding that you allude to, broadcasts are necessary to the operation of ethernet. Some protocols require broadcasts. For instance, hosts use ARP requests (broadcasts) to resolve layer-3 to layer-2 addresses. Multicasts are are flooded to every port in the broadcast domain, albeit IGMP snooping, if supported and configured, can mitigate this behavior.

VLANs do control all of the above, but beyond that, VLANs will separate by layer-3 in order to allow you to place layer-3 controls like firewalls, ACLs, QoS, etc. between VLANs.

6

There can be many reasons to split a network into VLANs.

  1. Security seggregation. You may want to filter or forbid communication between some systems on your networks.
  2. Limiting of broadcast (and effectively broadcast) traffic. The larger your L2 domain gets the more bandwidth and CPU time this eats up.
  3. Limiting MAC address counts. Most switches can handle a limited number of MAC addresses before they start to have problems with the amount varying by device. Splitting the network into VLANs and only taking a subset of those VLANs to each switch can avoid having to have every switch know every MAC address.
  4. Toplogy, trees get inefficient as networks get larger and more robust. Splitting into VLANs and using an appropriate variant of spanning tree protocol can allow different trees to be used for each VLAN better utilising links. On the flip-side though having multiple VLANs can force local traffic to take circuitous routes via a router.
  5. Identification, each VLAN can have a seperate DHCP server which hands out distinct IPs that can be distinguished in higher level routing/firewalling.
  6. Handling overlapping IP addresses. In an ideal world you wouldn't have these but if you must then VLANs give you a way to isolate them.
0

Logical segmentation of networks is defined as Vlan . Vlan itself is broadcast domain . Traffic can be isolated with the help of vlans

VLAN is a custom network which is created from one or more LANs. It ensures group of devices available in multiple networks to be combined into one logical network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.