VLANs

VLANs (Virtual Local Area Networks) are logical subdivisions of a physical network that segment and isolate network traffic at the data link layer (Layer 2). They allow multiple distinct broadcast domains to coexist on the same physical infrastructure, enabling better network organization, security, performance, and traffic management without requiring separate physical switches for each network segment.

Concept and Purpose of VLANs

A VLAN groups a set of devices as if they were on the same physical LAN, even if they are spread across different switches or locations. By tagging Ethernet frames with VLAN identifiers, switches can segregate traffic so that devices on different VLANs do not directly communicate unless routed through a Layer 3 device (such as a router or Layer 3 switch).

The primary purposes of VLANs include:

• Traffic Isolation: Separating traffic reduces unnecessary broadcast traffic and improves security by limiting access to sensitive resources.
• Improved Performance: By reducing broadcast domains, VLANs minimize broadcast storms and unnecessary packet processing.
• Simplified Network Management: VLANs allow grouping devices by function, department, or project regardless of physical location.
• Enhanced Security: VLANs can be used to isolate sensitive systems or users, enforcing access controls at the network level.
• Flexibility and Scalability: Network administrators can add, move, or change VLAN membership through software configuration without rewiring.

VLAN Identification and Tagging

Each VLAN is identified by a unique VLAN ID, an integer between 1 and 4094 following the IEEE 802.1Q standard. VLAN ID 0 and 4095 are reserved, and VLAN 1 is the default VLAN on most switches.

To distinguish traffic belonging to different VLANs across shared physical links (trunk ports), Ethernet frames are tagged with a VLAN header. The 802.1Q tag inserts a 4-byte field into the Ethernet frame between the source MAC address and the EtherType fields, containing:

• Tag Protocol Identifier (TPID): A fixed value of 0x8100 identifying the frame as VLAN-tagged.
• Tag Control Information (TCI): Consisting of:
  • Priority Code Point (PCP): 3 bits for QoS priority.
  • Drop Eligible Indicator (DEI): 1 bit indicating frame drop precedence.
  • VLAN Identifier (VID): 12 bits specifying the VLAN ID.

When a frame arrives on a trunk port, the switch reads the VLAN tag to forward the frame only to ports in the same VLAN.

Types of Ports in VLAN Configuration

• Access Ports: Carry traffic for a single VLAN and connect end devices like PCs and printers. Frames on access ports are untagged; the switch adds the VLAN tag internally.
• Trunk Ports: Carry traffic for multiple VLANs between switches or to routers. Frames are tagged with VLAN IDs except for native VLAN frames, which remain untagged.
• Hybrid Ports: Support both tagged and untagged frames and can be configured for more complex scenarios (common in some vendors' implementations).

VLAN Configuration in Alpine Linux

Alpine Linux uses standard Linux networking tools and utilities to configure VLANs, such as the ip command from the iproute2 package and configuration files under /etc/network/ or /etc/network/interfaces.

To create a VLAN interface, the typical command is:

ip link add link <physical-interface> name <vlan-interface> type vlan id <vlan-id>
ip link set dev <vlan-interface> up

For example, to create VLAN 10 on interface eth0:

ip link add link eth0 name eth0.10 type vlan id 10
ip link set dev eth0.10 up

This creates a virtual interface eth0.10 that carries traffic tagged with VLAN ID 10.

Network configuration files can be adjusted to bring up VLAN interfaces automatically during boot by defining the VLAN interfaces and associating them with physical interfaces.

VLAN Forwarding and Routing

VLANs isolate Layer 2 traffic, but communication between VLANs (inter-VLAN routing) requires Layer 3 devices. This is typically done by a router or a Layer 3 switch that supports VLAN interfaces (also called switched virtual interfaces, SVIs).

Each VLAN is assigned an IP subnet, and the router provides routing between these subnets. Without inter-VLAN routing, devices on different VLANs cannot communicate.

Best Practices and Considerations

• Avoid Using VLAN 1 for User Traffic: VLAN 1 is often the default VLAN and used for management; segregating user traffic avoids security risks.
• Native VLAN Configuration: Trunk ports have a native VLAN for untagged frames; it's best practice to set it to an unused VLAN to prevent VLAN hopping attacks.
• VLAN Trunking Protocols: Some vendors use proprietary protocols (e.g., Cisco VTP) for VLAN management; Alpine Linux relies on standard 802.1Q tagging.
• Security Measures: Use VLAN Access Control Lists (VACLs) and private VLANs for enhanced traffic control.
• Documentation: Maintain clear VLAN diagrams and documentation to avoid configuration errors.

Summary of VLAN Concepts

By implementing VLANs, networks can achieve logical separation of devices, optimized traffic flow, enhanced security, and simplified management, all while using a shared physical infrastructure. VLANs are fundamental in modern enterprise networking, data centers, and cloud environments, enabling versatile and scalable network architectures.