1 1 00:00:00,660 --> 00:00:02,970 The next major concept that we need to cover 2 2 00:00:02,970 --> 00:00:05,830 is that of a virtual local area network, 3 3 00:00:05,830 --> 00:00:07,840 also known as a VLAN. 4 4 00:00:07,840 --> 00:00:10,758 Now, we talked about switch ports all being 5 5 00:00:10,758 --> 00:00:11,780 on a single broadcast domain. 6 6 00:00:11,780 --> 00:00:14,830 And to break them up, we have to use a layer three switch 7 7 00:00:14,830 --> 00:00:16,690 or a router to do that. 8 8 00:00:16,690 --> 00:00:19,280 Well, VLANs allow you to break out certain ports 9 9 00:00:19,280 --> 00:00:21,400 to be used for different broadcast domains, 10 10 00:00:21,400 --> 00:00:24,150 just like you would if you had a virtual router. 11 11 00:00:24,150 --> 00:00:26,820 Now, before VLANs, we had to use additional routers 12 12 00:00:26,820 --> 00:00:28,790 and cables and switches to separate out 13 13 00:00:28,790 --> 00:00:30,730 our different departments and our different functions 14 14 00:00:30,730 --> 00:00:34,310 and our different subnets, but with the advent of a VLAN 15 15 00:00:34,310 --> 00:00:35,670 with layer three switching, 16 16 00:00:35,670 --> 00:00:37,810 you can have this inside of layer three switching 17 17 00:00:37,810 --> 00:00:39,730 or even some layer two switches. 18 18 00:00:39,730 --> 00:00:42,150 This allows you to have a different logical network 19 19 00:00:42,150 --> 00:00:44,470 that share the same physical hardware. 20 20 00:00:44,470 --> 00:00:46,670 This is going to provide you with a lot of additional security 21 21 00:00:46,670 --> 00:00:49,450 and efficiency that you don't get with using everything 22 22 00:00:49,450 --> 00:00:53,070 in a single broadcast domain on a standard layer two switch. 23 23 00:00:53,070 --> 00:00:55,790 Now, back before we had VLANs, you had diagrams 24 24 00:00:55,790 --> 00:00:57,040 that look like this. 25 25 00:00:57,040 --> 00:00:58,700 Let's say I had the IT department 26 26 00:00:58,700 --> 00:01:00,250 and the human resource department, 27 27 00:01:00,250 --> 00:01:02,520 and I wanted to keep them separate for security. 28 28 00:01:02,520 --> 00:01:03,620 Well, if I wanted to do that, 29 29 00:01:03,620 --> 00:01:05,620 I had to plug them into different switches, 30 30 00:01:05,620 --> 00:01:07,070 and then have different routers 31 31 00:01:07,070 --> 00:01:10,150 and be able to route the traffic between those two networks. 32 32 00:01:10,150 --> 00:01:13,310 Now, if I had the IT and the HR on floors one and two, 33 33 00:01:13,310 --> 00:01:15,430 I might have to have switch one and switch three 34 34 00:01:15,430 --> 00:01:18,020 on the second floor and switch two and switch four 35 35 00:01:18,020 --> 00:01:19,260 on the bottom floor. 36 36 00:01:19,260 --> 00:01:21,560 And so, now I have double the equipment 37 37 00:01:21,560 --> 00:01:23,830 to maintain this logical separation. 38 38 00:01:23,830 --> 00:01:26,350 And in this case, I also had physical separation too, 39 39 00:01:26,350 --> 00:01:27,890 because I had four different switches 40 40 00:01:27,890 --> 00:01:30,640 for those two floors and those two departments. 41 41 00:01:30,640 --> 00:01:33,420 Now, with virtual local area networks, or VLANs, 42 42 00:01:33,420 --> 00:01:36,610 I can consolidate all of that into just two switches, 43 43 00:01:36,610 --> 00:01:39,350 one for the first floor and one for the second floor. 44 44 00:01:39,350 --> 00:01:42,120 And then, I can logically separate out the traffic 45 45 00:01:42,120 --> 00:01:44,390 into each of those virtual networks. 46 46 00:01:44,390 --> 00:01:47,240 Notice that the IT department is cabled into the switch 47 47 00:01:47,240 --> 00:01:50,180 and logically, it trunks down from switch one 48 48 00:01:50,180 --> 00:01:53,110 into switch two and then down into our router 49 49 00:01:53,110 --> 00:01:55,280 and it keeps everything logically separate 50 50 00:01:55,280 --> 00:01:57,260 as shown by this color scheme. 51 51 00:01:57,260 --> 00:01:59,120 Now, either with these different switch ports 52 52 00:01:59,120 --> 00:02:00,430 and they're in different LANs, 53 53 00:02:00,430 --> 00:02:02,840 they're also going to be in the same physical hardware though, 54 54 00:02:02,840 --> 00:02:05,390 and they're writing the exact same cable. 55 55 00:02:05,390 --> 00:02:07,360 That's how you can see this purple and blue cable 56 56 00:02:07,360 --> 00:02:09,780 going from a switch to down to the router, 57 57 00:02:09,780 --> 00:02:11,580 it's actually only one cable, 58 58 00:02:11,580 --> 00:02:14,370 but logically in this diagram, they are going to be 59 59 00:02:14,370 --> 00:02:16,970 two separate logical cables, right? 60 60 00:02:16,970 --> 00:02:19,260 But in real life, it is really one cable. 61 61 00:02:19,260 --> 00:02:21,480 This is the idea of doing VLAN trunking. 62 62 00:02:21,480 --> 00:02:24,960 And to do this, we use this protocol called VLAN trunking 63 63 00:02:24,960 --> 00:02:27,370 known as 802.1Q. 64 64 00:02:27,370 --> 00:02:29,150 So, I want you to write that down in your note sheet, 65 65 00:02:29,150 --> 00:02:32,400 802.1Q is for VLAN trunking. 66 66 00:02:32,400 --> 00:02:34,605 Now, this is what happens when you merge 67 67 00:02:34,605 --> 00:02:38,010 all that data onto a single cable, we call it a trunk. 68 68 00:02:38,010 --> 00:02:39,800 Now, since we have multiple VLANs, 69 69 00:02:39,800 --> 00:02:41,550 and they're all going over the same cable, 70 70 00:02:41,550 --> 00:02:43,820 we have to have a way to identify them. 71 71 00:02:43,820 --> 00:02:46,840 This again is reducing the amount of physical infrastructure 72 72 00:02:46,840 --> 00:02:49,000 cables and switches and routers that we need, 73 73 00:02:49,000 --> 00:02:52,320 while still giving us the logical separation that we desire. 74 74 00:02:52,320 --> 00:02:55,180 With VLAN trunking using 802.1Q, 75 75 00:02:55,180 --> 00:02:57,120 this is something you need to be able to recognize 76 76 00:02:57,120 --> 00:02:59,080 for test day and you want to make sure 77 77 00:02:59,080 --> 00:03:00,170 that you have it written down 78 78 00:03:00,170 --> 00:03:02,240 because it's a really important concept. 79 79 00:03:02,240 --> 00:03:04,570 Now, the way we identify the different VLANs 80 80 00:03:04,570 --> 00:03:08,130 that are going over this trunk is by using an electronic tag 81 81 00:03:08,130 --> 00:03:12,220 that is four bytes long and it's called a 4-byte identifier. 82 82 00:03:12,220 --> 00:03:14,310 Now, there are two pieces to that. 83 83 00:03:14,310 --> 00:03:17,120 We have the TPI and the TCI. 84 84 00:03:17,120 --> 00:03:19,860 The TPI is the tag protocol identifier, 85 85 00:03:19,860 --> 00:03:22,930 and the TCI is the tag control identifier. 86 86 00:03:22,930 --> 00:03:25,610 When you have one VLAN and it's left untagged, 87 87 00:03:25,610 --> 00:03:27,920 that becomes your native VLAN, 88 88 00:03:27,920 --> 00:03:31,000 also referred to as VLAN zero. 89 89 00:03:31,000 --> 00:03:33,120 Now, you can see the packets here on the screen 90 90 00:03:33,120 --> 00:03:34,870 and again, you don't have to memorize 91 91 00:03:34,870 --> 00:03:36,660 the way these packets are laid out. 92 92 00:03:36,660 --> 00:03:40,320 This is just a graphical depiction to show you what 802.1Q 93 93 00:03:40,320 --> 00:03:42,550 actually looks like in the real world. 94 94 00:03:42,550 --> 00:03:44,300 What you really need to know about VLANs 95 95 00:03:44,300 --> 00:03:46,040 is that they are great for security, 96 96 00:03:46,040 --> 00:03:47,730 and if you're using VLAN trunking, 97 97 00:03:47,730 --> 00:03:50,823 your 802.1Q is your standard for VLANs.