An easy to understand description of VLANs for Cisco, HP, VMWare, or Microsoft

VLANs can be confusing for virtualization administrators, because it takes a really solid understanding of networking to then be abstracted into a virtual environment, which can then be configured multiple ways.
Let's make sure we're on the same page with VLANs first

Let's think about a physical environment that is segmented without any VLANS

 

If we think about networks from a chronological perspective, we start with just the green local area network at the top. All your local clients were in a local broadcast domain with a single network ID. And the living was easy.

Then LANs continued to grow and grow, which caused too many broadcasts, traffic congestion, and security vulnerabilities... all because all the devices were playing in the same "sandbox."

 

So to divide the LAN we ran a dedicated cable from a newly dedicated interface on the router, installed a separate switch, and routed between the LANs, as seen in the diagram above.

 

Question: Why would anyone ever want anything better than that solution?

#1 - Money: High speed Ethernet interfaces on routers are a costly proposition, only superseded by purchasing entirely new routers to handle the traffic from each network. Additionally, every subnet needs a dedicated switch. What if a 48 port switch is serving a network of only 10 hosts? 37 wasted ports.

#2 - Management: To reassign a host to a different subnet means moving their patch cable to a physically different switch. This is a manual, physical process that requires going into the racks and mucking about - always an additional risk, easy to make mistakes

The good news is that soon one of the first network virtualization technologies came into being. Instead of having to buy additional switches and router interfaces, we can use virtual LANs (VLANs)

- VLANs allow us to virtualize networks using two key components:

1) Switch ports are virtualized so that instead of one switch you can have the effect of having two or three or more switches from a single physical switch, and then you can spread these multiple virtual switches across multiple physical switches!

2) Router interfaces are also virtualized, using sub-interfaces on physical routers or virtual VLAN interfaces on multilayer switches. Each virtualized router interface will be configured to "plug in" to the virtual switch. This means that one uplink could support a connection to 20 different subnets!

So how do you go about virtualization? It's all about playing a game of tag. Each switch's access port (a port going to an end station such as a server, desktop, phone, or router) will be tagged with a particular VLAN number, determined arbitrarily by the administrator.  (Side note, many administrators make their lives easier by creating a loose association between VLANs and subnet IDs. For example, the 192.168.5.0 subnet could be assigned VLAN 5 for simplicity.)

So each VLAN is identified by a number and the default VLAN is VLAN 1. All ports are assigned to VLAN 1 by default, meaning that the switch functions like an unmanaged switch, all ports will forward, filter, and flood with all other ports. Since this is the case, by default, VLAN tagging (inserting the tag ID into the frame) is skipped by default for VLAN 1. This skipping can only be done for one VLAN ID number, and is known as the "native VLAN". 

But now we choose to subdivide the switch by adding VLAN 2.  Generally on a switch you will have the opportunity to provide a VLAN name, which makes it a more sensical device (ie: HR_192.168.5.0 for the Human Resources subnet using 192.168.5.0)

Now that we two different VLANs an administrator needs to assign access ports to that VLAN.

This effectively turns a switch from this:

(Switch with all ports still on VLAN 1)

into this:




Remember, the devices connected to the switch know nothing about VLANs. But now the switch has virtualized two networks instead of one, which means that traffic must be ROUTED from one VLAN into the other, not just switch. 

In order to allow multiple switches and routers to participate in these VLANs we must modify the standard Ethernet frame and insert a VLAN tag number so that all devices can respect the defined VLAN boundaries. Tagging is done between devices over what are known as trunk ports. Trunk ports are used when connecting switches to each other or when connecting switches with multiple vlans to a router. Trunk ports are not assigned a VLAN number because their job is to carry ALL VLAN traffic upstream to a router and to take the returning packets and forward them to the correct access ports. VLAN ID numbers are stripped from the frames before they enter an access port.

That allows for this:

With this configuration you can see that we have the equivalent of 4 switches instead of two, with two switches in each broadcast domain. The great thing about the configuration above is that a device in VLAN 1 can switch to another device in VLAN 1 (or a VLAN 2 device to another VLAN 2 device) at high speeds. However, if a device wants to connect to another device across VLANs (VLAN 1 PC to a VLAN 2 Server, for example) then they had better know the know the IP address of the sub-interface (virtual interface) of their L3 routing service! In other words, they must route as if they were physically connected to different physical interfaces of the router.

But the real beauty of all this is that any device could be moved to a different subnet by reconfiguring the VLAN ID of an access port to a different number. As long as all the switches have the same VLAN ID numbers (and the router has VLAN associated sub-interfaces.

A little more about the native VLAN. The default VLAN is VLAN 1 (what all ports start off as). The default VLAN is also the native VLAN (untagged "assumed" VLAN number) by default. This was useful when connecting unmanaged and managed switches and in carrying management traffic back in the day. However, for security reasons, it is usually a best practice to change the native vlan to a different, unused VLAN ID number (such as 999). This ensures that are no assumptions, and therefore no annoying security holes. Now VLAN1 frames will be tagged as VLAN 1 just like all the other VLANs

When VLAN 2 is added, the VLAN tag is added to frames that are a part of VLAN 2. We now have two VLANs, and at least one of them must be tagged to be identified. 

Now, let’s add VLAN 3.  In this setup, two VLANs would need to be tagged, one would not because it was the original lan (VLAN)  The VLAN that is not tagged is known as the native VLAN.

There are a lot of questions of when and why to use the native VLAN or if you should use the native VLAN at all.  As always in IT, the answer is, it depends on what you are doing. VLAN 1 does not have to be your management VLAN.  It does not have to be the native or untagged VLAN. You can do whatever you need for your environment.  Typically, I do not use the native VLAN for security reasons, and I choose to tag everything. 

Remember that all of this is true whether you are dealing with a physical switch or a hypervisor driven virtual switch on Microsoft Hyper-V or VMWare ESXi. Trunk ports between switches, defined VLANs omnipresent, Access ports with VLAN ID numbers on individual access ports.

Keep it clean, keep it safe.

Get Trunk!!!

Remember - you can't carry traffic for multiple VLANs unless you...

Smiles,

Majorbacon's 6 steps guide to easy IPv4 Subnetting

Subnetting is a process that you just have to practice. Here's what I do so that I can quickly work through subnetting test questions (or real life situations... there's a reason these are on tests you know)

THE PROCESS:

1. Read the question.  Know what network ID you are starting with and what your GOAL is: Do you need to obtain a certain number of subnets out of your original network or do you need to ensure a certain number of hosts are available in each subnet?
2. Write your binary table on your paper.  If you can multiply by two, you can do this
   
3.  Use one of two magic formulas to determine the number of bits that will be used in the new subnet mask
• 2ⁿ  >= your desired number of subnets, where n is the number of new ones in the new subnet mask.  The rest of the subnet mask will be composed of binary zeros.
• 2^h-2 >= your desired number of hosts, where h is the number of zeros left in the new subnet mask.  The rest of the subnet mask will be composed of binary ones.


4. Based on this, write out your new subnet mask (in binary, counting ones or zeros as necessary).
5. In order to figure out the number of hosts you have in each subnet, use 2^h-2, where h is the number of zeros in your subnet mask. 
6. In order to figure out the total number of subnets you have, use 2ⁿ, where n is the number of new ones (not total ones) in your subnet mask.
7. In order to determine your subnet IDs we need to find the block value. Start with your original network ID for the first subnet, but remember it has a new subnet mask. Your next subnet will be one block value away.  How much is your block value?  It’s determined by the “least significant bit”, the last one in the subnet mask.  Look up the column value for this bit in the table because this bit will be the increment from one network to the next, in that same octet!  
• Or Skip the table and use this trick: 256 minus the last positive octet will also yield the block value of the networks

WORK THE EXAMPLE:

1.    You have a Class C network, 202.5.4.0 that you want to subnet into 6 subnets.
2.    We write down the all-important table:

3.    2ⁿ  >= your Goal, therefore 2³ = 8 >= 6 desired subnets.

4.    A Class C subnet mask is 255.255.255.0, so if we add 3 ones, it will be 255.255.255.11100000 or 255.255.255.224 - that's 27 binary ones in the subnet mask, so our CIDR notation will be /27. (If you remember that a class C address starts as a CIDR /24 then you could just do /24+3 bits = /27)

5.    We have five zeros in the subnet mask, so 2⁵-2=30 hosts per subnet, and we have added 3 ones to the subnet mask, so 2³=8 new subnets

6.    Our increment is based on the least significant bit in the subnet mask, which in binary was 255.255.255.11100000.  If we examine the last octet compared to our table we see that the last one is in the thirty-two column.  (Also, 256-224=32)

That was 6 steps - so we should be done! Let's review:

• So, our network started as 202.5.4.0/24 (the /24 being CIDR notation for a 24-bit 255.255.255.0 subnet mask). 
• Now we have a new subnet mask 255.255.255.224, CIDR notation /27
• Our first subnet ID is the same as the original network ID but with a new subnet mask: 205.5.4.0/27
• We determined our block value is by 32 in the fourth octet
• Therefore our second subnet would be: 202.5.4.32/27, 
• Third: 202.5.4.64/27
• Fourth: 202.5.4.92/27
• Fifth: 202.5.4.128/27
• Sixth: 202.5.4.160/27
• Seventh: 202.5.4.192/27
• and finally Eighth: 202.5.4.224/27
• So there are the 8 subnets that each have 30 hosts per subnet, as expected!

Please note that if you count all of those subnets up, you have 8 of them.  The amount we predicted back in step 3. Great job!

More subnetting examples and practice to come:
Keep practicing - here are some random subnetting question generators:
http://david.clauss.us/Subneting/
http://www.subnettingquestions.com/

Have fun!

Majorbacon's Quick Important Shortcuts for the Cisco CLI

I wanted to share four things that speed up my use of the Cisco CLI.

The first three tricks are associated with register context. In order to perform command you have to enter the correct context first. Global, Global Configuration, Specific Configuration (like VLAN, Router, Interface, Line, etc.) Sometimes being in the wrong context slows you down, and these tricks help speed you back up again.

1) Get Global

If you are in a sub-interface level command, you can enter a different sub-interface without returning to the parent interface.

For example:

(config)# interface fa 0/0
(config-if)# ip address 192.168.1.1 255.255.255.0
(config-if)# interface fa 0/1
(config-if)# ip address 192.168.2.1 255.255.255.0

 - notice that there was no exit command between the second and third steps.

Another way to avoid the exit in a sub-interface mode is to type a global configuration command without exiting first - really that's what you did a moment ago - you called for a global config command to enter a sub-interface without leaving the interface first. But you can enter any global config command you want!

For example:

(config)# interface fa 0/0
(config-if)# ip address 192.168.1.1 255.255.255.0
(config-if)# hostname Router1
(config)#

 - Notice that the router rip command, a global configuration was issued without leaving the sub-interface context, and then I was left at the global level. Be aware that tab-completion and ? help will not work across contexts.

2) Do the "Do"

If you are in any configuration mode and wish to issue a command from the enable mode, such as all the show and debug commands, you can do so with the "Do" command. You remain in your config mode, but get the results from the enable mode.

(config)# interface fa 0/0
(config-if)# ip address 192.168.1.1 255.255.255.0
(config-if)# no shutdown
(config-if)# do show ip int briefInterface  IP-Address    OK?  Method    Status       Protocol
S0          unassigned   YES  unset     admin down    down
Fa0/0      192.168.1.1   YES  unset     up             up
(config-if)#

-notice that with the do command I was able to verify what I had done at the interface level, saving myself from typing the exit command, the configure terminal command, and the interface fa 0/0 command!

3) Sanity Check!

Translating "undegub"... domain server (255.255.255.255)

One of the more annoying behaviors on a Cisco device is when you completely fat-finger it and then the entire device pauses for a good minute as though to punish you for your error with a strange 255.255.255.255 message.

This also can happen when you are in the wrong context and it doesn't recognize your command there.

This is because by default, when you enter an unrecognized command the router believes that this must be a host name of a device you want to telnet to! Assuming you haven't defined a DNS server in the configuration the router will issue a broadcast for the command to be translated into an IP address. Waiting for broadcasts to fail takes several seconds for the router. (Waiting for broadcasts to fail has been the bane of administrators since the dawn of time).

The fixes: 

1. Skip attempting look-ups altogether (you'll have to use the local hosts table if you want name resolution)
   (config)# no ip domain-lookup
2. Or point to a valid dns server but disable dynamic lookup
   (config)# ip name-server 8.8.8.8
   (config)# line vty 0 15
   (config-line)# transport preferred none

 

4) Where do I "begin"?

When you show a long list, such as a mac-address-table or configuration file, it is often inconvenient to try and  find the particular place where an item is located that you want to verify. Fortunately, you can pipe your show command into a begin statement that will actually find what you are looking for and start your results there!

For example:

Router1# show running-config | begin line
Building configuration...
line con 0
  transport input none
line aux 0
line vty 0 15
!
no scheduler allocate
end

So - I hope these tools will help you use Cisco's CLI with greater speed and agility, so you can spend less time scanning and more time doing!

 

Know your Ports!

Like many of you, I have used the windows utility of NETSTAT -a to reveal to me what port connections I have made when I (or the operating system) are connected to an outside resource. 

Note that you can see the local and remote systems and their local and remote port numbers (If instead of port numbers you see "isakmp" or "http", Windows looked up a nice label for the well-known-port reference from c:\windows\system32\drivers\etc\services file.

 

To complement this, let me suggest that you check out the Windows Resource Monitor available in Windows 7 and later. Open from Start or Task Manager.

Once inside, take a look at the networking tab:

 

As you can see, this utility will tell you the process ID (and goes ahead and looks up the process name) that goes with any assigned Port.

 Whether you are running Windows Server or Client software, it can be very nice to see exactly where your system is going when it thinks you're not paying attention - Think malware, viruses, gamers, etc.

 Remember, a port number is just a network convention used to find the right application on a system that is expected to speak a certain language. There is nothing that prevents an ftp client from making a request on port 25 rather than on port 21, but the problem is that the SMTP server service bound to Port 25 is expecting SMTP formatted email communications, not FTP file transfer requests!

 

The OSI 7 Layer Model

I might know what you are thinking. Because its probably what I'm thinking. The OSI 7 layer model? Really? I know, I know. This is a subject on which there is absolutely NO END of publication. Its the model that wouldn't die!

Nevertheless, I feel compelled to try my best to expand on this subject, because after having presented it many times, I often have students tell me that this time they get it. So maybe there's something in this presentation on the subject that will do the same for you.

So we will begin at the beginning.

Before considering the official 7 layer burrito, consider the following: In order for two computers to be able to "talk" to one another, they will need to have some things in common.

1. They need common "air" to communicate through (the wire),
2. something plugged into that wire that can know when and how to "speak" and "listen" (the network card).
3. They must speak and hear the same "language" (protocols).
4. Finally, they need to have "something relevant" to say to one another (network applications and services).

The OSI 7 layer model is simply a slightly more detailed diagram of the basic model that we have just worked out.

So let's look at the layers of the OSI model.

Layer 7: The Application Layer. This is the top layer, the most complicated, and what begins the initial process of communication. Layer 7 represents the language that is shared by two networking applications. Examples of protocols that are at the Application layer include HTTP, HTTPS, FTP, SMTP, Kerberos, DNS, and many more. Note that the application layer doesn't quite represent an application itself. For example, you have many web browsers (Opera, Internet Explorer, Firefox) and web servers (IIS, Apache...) that all share the common application protocol of HTTP and HTTPs. So when a web browser makes a request of a a web server using the common language of HTTP requests and responses can be made for web based data. Application protocols are often associated with specific port numbers (Port 80 for HTTP, port 53 for DNS, etc). Port numbers are simply conventions for values that are associated with a particular particular process. For Example IIS or Apache could be listening on port 80, but not both. Only one process can be bound to port 80.

Layer 6: The Presentation Layer.  Sometimes (which means not always), an application needs to alter the information that it is going to send over the internet into a format that is more appropriate for network travel. Two common changes to presentation are Compression (think of all the internet compressed file types, such as .jpg, .mp3, .wmv, etc) and Encryption (like Secure Sockets Layer, SSL for HTTPS). The application makes a call for this additional processing before sending the data, and the data must be converted back to its original format before it can be processed by the application.

Layer 5: The Session Layer. Many applications expect there to be a persistent connection between the two programs that are running over the network. This means that a network application usually doesn't begin with a request for data, but instead requests a session with the other application. Once the two programs have "sniffed tails" (figured out the rules for their session) data can actually be sent. My client port for http expects that that server's http port will remain open unless send a "goodbye" signal.

Layer 4: The Transport Layer. The application performs a handoff to the operating system, and depending on the application, will specify a certain preinstalled transport protocol to be responsible for delivery of the data. The two most likely handoffs are to Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). TCP provides "guaranteed" delivery, in which the block of data is broken down into segments, and each segment is verified received by the recipient or it is sent again. (Like ordering something online, if you only got half of the content shipped to you, you'll request that the company attempt to send the rest again).  UDP, on the other hand, is a "best effort" delivery protocol. UDP will simply send the data to the destination, and any validation of receipt is up to the application layer protocol.

Layer 3: The Network Layer. The network layer is responsible for logical addressing and routing. Logical addressing is like your street address. It describes where you live, and will change if you move.  A snail mail address is not really a description of you as a person, but is needed for you to receive those important credit card offers from the banks. The Internet Protocol (IP) is the star of this layer, and your computer owns an IP address so that IP routers can deliver the data to you from remote networks. Once the data gets to the local network its time to move to the next layer...

Layer 2: The DataLink Layer. The DataLink layer is all about physical addressing and local physical delivery. Different network adapters have differing methodologies to determine when they may "speak" on the network and how to "listen". Ethernet Network Cards uses an access method called CSMA/CD unless you have a full duplexed switch. Wireless network cards use CSMA/CA to do the same thing.  How do they know that data on the wire is meant for them?  Every Ethernet network card is stamped with a MAC address which represents that NIC as a unique entity on the local network. Your MAC address is like your Social Security Number. It keeps you unique for the purposes of HR at your business, but it can't be used to tell them where you are. But if someone shouted out "would the person with SSN 234-52-2342 please stand up? I found your wallet with your SSN card inside!" You would get the message. But it only works if the person shouts out that message in the room your in. It wouldn't do that person any good to ask the post office to deliver your wallet based upon the known SSN value. In the same way, MAC addresses are used to communicate with the right node on the network, but never between networks. So... Network Cards are Layer 2 Devices.  Bridges and Switches forward local packets to the correct switchport based upon building a table of all known MAC addresses and the port that holds them, and are therefore layer 2 devices as well. ATM, Frame Relay, and MPLS are all layer 2 protocols, but these are used to between two nodes that are on a local Wide Area Connection Link, rather than a local link.

Layer 1: The Physical Layer. This is the dumb-as-dirt media that carries the signal from point A to point B. Cat 5 UTP cable, copper coax cable, fiber-optic cable, rj-45 connectors, MJ connectors, 2.4 Ghz bandwidth, clocking signal rates, modems, repeaters, and hubs are all layer 1 components. Note that Switches, Bridges, and Network cards all do have a physical aspect to them (you can bang them on a desk, right?), but the highest layer that they reach is layer 2. A router is physical as well, but the highest layer it reaches is layer 3.

Top down, bottoms up?

Communication is triggered from the top down, sent over the network and read from the bottom up.

Failure of any lower layer preempts the success of any higher layer.

The application/service is associated with layers 5-7
The OS protocol stack is associated with layers 3-4
The drivers and hardware are associated with layers 1-2

Even a stopped watch tells the right time twice a day, so if your network goes down, don't panic!