Every time i try reading about the configuration of a device and adding it to the network, i always face a problem. The problem is basically am not able to understand Vlan's, and how for example some companies use it: to move Voice over IP through Vlan (for ex)100, What comes to my head is, what is connected that Vlan (physically)? is it only phones that carry voice over ip traffic or other devices? And 1 more example is some companies use a single Vlan as a whole to move trunk traffic or management traffic. Am not able to understand how is that done, and i ask questions to my self again and again like what is connected to it (the vlan)? how can they only move trunk traffic ? (and my knowledge tells that a trunk port is a port (not a vlan) that carries tagged traffic between 2 switches (supposing that 2 switches are there only ones in a the network).
Think of each VLAN as a single switch (or switch group).
VLANs work by logically partitioning a single physical infrastructure. Each port is logically connected to one of the VLANs = one of the imaginary switches. Only devices connected to the same VLAN or imaginary switch can talk to each other directly.
Devices in different VLANs require a router to forward their traffic - the router is your point of control where you can permit or deny the communication.
Instead of running a separate cable for each VLAN between two switches, you use a VLAN trunk port: on the wire, each frame is tagged with its VLAN ID. The VLAN ID tells the other switch where the frame belongs. (One of the VLANs - the "native" one - can remain untagged but both switches need to agree on that).
Edit: there are several goals when separating traffic into VLANs:
- reduce size of broadcast domains
- reduce node count in a segment/broadcast domain
- separate traffic for security reasons - nodes in one VLAN cannot simply communicate with nodes in another VLAN, they require a router
- separate traffic for prioritization reasons (QoS)
- utilize redundant links in per-VLAN spanning tree scheme (MSTP or RPVST)
Before VLANs, we used to do it like this:
- Use separate sets of switches for each area (servers, desktops, whatever)
- Keep those LANs completely distinct (different IP address ranges and no wires in between)
- Bundle several ethernet cables with cable ties, and plug all the LANs into separate interfaces of the router, which routes between the different LANs and distant networks
Now it's been virtualised
- Switches can be partitioned so that given sockets are on particular VLANs
- A bundle of cables is now a trunk, and the label on the cable has been replaced by a 'tag' on each ethernet frame
All the varieties of use you might imagine are possible:
- (Some) switches are able to add the tag to a frame depending on the incoming ethernet address
- (Some) switches use other information (such as Cisco discovery protocol) to decide a particular (ethernet) host is a phone, and put its frames onto a VLAN nominated for voice
- There is complexity in deciding what to do if some frames arrive without a tag on an interface which expects them (they go in a default VLAN)
- (Some) switches allow very complex rules for traffic on given ports and methods for assigning those permissions.