2

I am a networking newbie so please go easy on me. I am studying VLANs and for a fictional project, I want to use tag-based VLANs. In the project, there are three layer 3 switches with multiple wireless access points connected to them. I want to use one VLAN ID with tagging for students on the network and another for faculty at a fictional campus.

In my project I decided to give faculty the VLAN ID of 2, and students the ID of 3. I was wondering how the faculty's and students' workstations know what VLAN it would be on. After a search I found that in the NIC settings, one can enter which VLAN ID to connect to.

So my question would be is what is to prevent a student from putting down the VLAN ID of 2 down to access resources that should only be accessible by faculty? I read about VLAN hopping, but I am not sure how it relates to this scenario. Is there a better way to assign the workstations (laptops primarily) VLAN IDs?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 14, 2017 at 19:10

3 Answers 3

Reset to default
2

The assignment of VLAN is done by the network, not by the endpoint. On a wired LAN (switch) this is configured per port, the default is usually VLAN 1. On a wireless LAN (AP), this is configured per SSID (per WiFi network it is said).

The AP plugs into the switch via a trunk port that carries all VLANs. This link is called a trunk link. The frames are said to be tagged to a particular VLAN. So, the AP may broadcast more than one VLAN. Maybe teacher VLAN has a password and student vlan does.

Improve this answer
0
2

You misunderstand VLAN tags. Ethernet frames can be tagged on trunks. This lets the switches on each end of the trunk link separate the frames on the trunk into the correct VLANs.

Access connections (where end-devices connect) don't tag frames, and most end-devices don't understand VLAN tags. You can configure access ports to be in a VLAN, but the frames through those ports are not tagged. The frames only get tagged if they must traverse a trunk, and the tags are removed if the frames leave through an access port. Your end-devices should be unaware that they are even on a VLAN.

A student should not have access to change the switch configuration to change the VLAN of his access port, so his PC will only be in the VLAN for which the access port is configured.

Edit:

Based on your comment about using Wi-Fi, The Wi-Fi clients only know about the SSID to which they connect. Each SSID represents a different network. A WAP is a translating bridge (it translates between ethernet and Wi-Fi). When Wi-Fi frames come into the WAP, and they need to be sent to the wired network, the WAP can be connected to the wired network with a trunk, and each SSID can be assigned to a different VLAN. The reverse happens when frames from the wired network, with VLAN tags, reach the WAP.

Improve this answer
3
  • Thanks for the reply, Ron. I am still a little confused. The students and faculty are sometimes sharing the same access point. If tag-based VLANs in the way I described would not work, what is the best way to configure the switches (which would be trunked) so that faculty and students can share the same access point(s) while still getting different privileges? I have a feeling I am making this out to be more complicated than it is, but it is my first serious networking class.
    – Ryesky
    Jul 6, 2016 at 20:09
  • The different types of users attach to different SSIDs, even on the same WAP. Each SSID is a different network, and that gets translated to VLANs on a trunk from the WAP to the switch where the WAP is connected.
    – Ron Maupin ♦
    Jul 6, 2016 at 20:11
  • @Ryesky, I updated my answer. Don't confuse ethernet and Wi-Fi frames. Those are two completely separate layer-1/2 protocols.
    – Ron Maupin ♦
    Jul 6, 2016 at 21:32
2

Elderly equipment was limited (device port or trunk port, never the twain shall meet.)

More recent (by which I do not mean new) equipment is less limited, and can have ports that have both untagged and tagged traffic (from different VLANs) on them. I have 3com (so you know they are not new) switches from both of these flavors, and the older ones are on the shelf.

Under the "modern" scheme ports have several settings that govern how they behave - incoming untagged traffic can be assigned to a VLAN, while incoming tagged traffic is left on the VLAN it's on; or incoming untagged traffic can be discarded (which is more similar to an older trunk port setup.) Traffic tagged with a VLAN that's not assigned to the port is dropped in any case. Outgoing traffic from one VLAN can be untagged as it exits the port - any others need to be tagged, or all can be tagged (similar to an older trunk port).

While it is uncommon for most end-users to use (or understand) the functionality, "end-user" computers can in fact handle VLAN tagging, and it's folly to assume they cannot (don't expose something to end users in the belief they can't touch it.) I have a 2006 MacBook laptop that's been happily connected to VLAN1 (untagged) and VLAN4 (Tagged) for several months now, since I wanted it to be accessible from both networks. It's easy enough to find the same ability in Windows (I just haven't really used it there.)

Most "enterprise" WiFi will (or can) assign a SSID to a VLAN. Fancier/newer implementations will (or can) assign a VLAN when a user signs into the RADIUS server (so two users on the same SSID could be assigned to different VLANs depending on their sign-in credentials.) Whether or not you make use of dynamic VLANs, using a RADIUS server (WPA2 enterprise) makes it much harder for "students" to get access to the "faculty" network, and also lets you know which faculty to have a little chat with if they do, since each user has a unique password, rather than "anyone who knows TheSecret123FacultyPa55w0rd can get on the faculty network."

In a normal install, you assign wired end-use ports to one VLAN and untag them (the old-fashioned approach.) APs get ports tagged with the VLANs that the SSIDs are assigned to, or that are the various dynamic VLANs users will be assigned to. Trunks between switches are tagged.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.