Well, as we turn our attention into the world of layer two, we're going to
start with the
conversation just around VLANs and SVIs.
And this is eventually going to lead to ether channels and spanning tree.
But it's going to be a journey that starts with some CCNA level concepts.
But then as we would expect with an exam like this, we're going to dive deeper
into those
same topics.
And so let's go ahead and make sure we have some of the fundamentals, but then
continue
to dig deeper with every topic that we explore. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to dig deeper with every topic that we explore.
So we're going to start with the concept of VLANs.
And when we're talking about first learning about VLANs, these VLANs are things
that we
configure on switches.
We know that they divide a switch up.
So for example, back in the early days, we'd had hubs and all of these hosts
would communicate.
And if I'm trying to talk to this host over here, well, then everybody would
hear that
because it's a hub.
It's layer one.
And then we came up with the concept of the switch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we came up with the concept of the switch.
And the switch allows me to just send communications through this device
towards another device
like this.
And it would only be heard by the destination.
These other devices wouldn't hear it outside of the possibility that I'm
sending a broadcast.
And so if I'm sending broadcast traffic of which there's a lot in a layer two
domain,
now all of a sudden we have the same problem as a hub and everybody's receiving
this traffic
whether they wanted or not. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whether they wanted or not.
And so we connect enough devices together and these broadcasts become a problem
because
all of this is known as a broadcast domain.
A broadcast domain is the entire networking region that's going to propagate
these broadcasts.
So if I'm sending a broadcast in, who all is receiving it?
Well, it's everyone in the broadcast domain and by default, that's everyone in
the entire
layer two network.
And so this is where VLANs come into play. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is where VLANs come into play.
The idea of VLANs was that we could carve this switch up into two different
broadcast
domains and call them two different VLANs.
So maybe VLAN 10 on the left, VLAN 20 on the right.
And so now if we have a bunch of hosts connecting into these VLANs, if I send a
broadcast on
a VLAN 10 interface, that broadcast will get propagated out to the other VLAN
10 hosts
and ports, but it won't get sent out to anybody in VLAN 20. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and ports, but it won't get sent out to anybody in VLAN 20.
And the reason for this is because a VLAN really is a broadcast domain.
Sometimes when we're first learning about VLANs and we see that we map a subnet
to a
VLAN, we might equate the two and say, oh, a VLAN is just a one-to-one mapping
with a
subnet, it's the layer two equivalent.
But I don't like that description.
I prefer to think of it like this, because this is the very accurate way of
describing
what exactly VLAN is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
what exactly VLAN is.
It's a broadcast domain that is virtually created, hence the V and VLAN.
It's not tied to anything physical.
So I can have a great many VLANs here.
I could have a hundred VLANs if I so desired, as long as I have enough ports to
support it,
I suppose, throughout the network.
And that's going to create a bunch of individual broadcast domains, which makes
for a much cleaner
network.
Now, I mentioned subnets, and that's another conversation here, because when we
talk about WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
talk about
things from a layer three perspective, and I want to, let's say, map a subnet
onto the
network, usually I'm going to place a subnet onto a VLAN.
And we like this to be a one-to-one mapping.
So a subnet to VLAN should be one-to-one in an ideal world.
However, that's not technically required.
We could have many subnets tied to just a single VLAN.
And we'll see this when we configure secondary interfaces later on on the SVIs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll see this when we configure secondary interfaces later on on the SVIs.
But just be aware that a VLAN truly, again, is just a broadcast domain.
I could put as many subnets on there as I want.
But even though the hosts are going to largely communicate to hosts in their
own subnet,
all of the broadcasts that get sent out from one subnet would be received by
all the other
subnets on that VLAN, which is why we prefer to keep it one-to-one.
But in some situations in the real world, we have no choice but to deploy
multiple subnets WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
multiple subnets
to a single VLAN.
Now, VLANs also come with identifiers, with numbers.
So we have this concept of VLAN IDs.
And this is rooted in the fact that a VLAN ID is a 12-bit identifier.
And it exists inside of the Ethernet header.
And specifically, not part of the standard Ethernet header, but as part of the
802.1q
header that gets inserted into the Ethernet header. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
header that gets inserted into the Ethernet header.
And so this is where we can talk about trunk links and such.
And we will get to that.
But the idea here is that within this header, we have an identifier that is 12
bits.
And if we do our math there, 2 to the 12th power, that's 4096, which means our
total
range of VLANs would be 0 through 4096.
Although in a real world, or from a real world perspective, I suppose, that
translates
really to 1 to 4094. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
really to 1 to 4094.
And the reason for that is because 0 and 4095, these are reserved.
We're not allowed to use them.
It was declared as such way back when, and that rule still applies today.
So our full range of VLANs is 1 to 4096.
Now what's kind of curious about this is that we have to actually break this
range down
into different regions if we want to call it that.
And this is primarily a Cisco thing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is primarily a Cisco thing.
And just because Cisco's been around for such a long time, they had a situation
, really
let's just say that they had to adapt to evolving situations and evolving
technologies
over time.
So specifically, when Cisco first supported VLANs, they supported VLANs from 1
to 1,005.
And this is known as the standard range of VLANs.
This is a Cisco term that they use to describe these first range of VLANs that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is a Cisco term that they use to describe these first range of VLANs that
they supported.
And if we do commands like show VLAN and such, we might find that we're going
to see that
these VLANs are separated out from the rest for that reason.
Furthermore, a few of these VLANs have been reserved, specifically 1,002 to 1,
005 were
originally reserved for FDDI and token ring, which are...
This is very legacy technologies at this point, but because of this, these VLAN WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is very legacy technologies at this point, but because of this, these VLAN
s are actually
configured by default on our Cisco iOSXE devices.
So if I get onto a Cisco device and before I do any configuration, I do a show
VLAN,
I'm going to see that VLAN 1 and 1,002 to 1,005 are already configured.
And the reason for that is, again, historical.
It's this legacy concept that Cisco's been around for so long that they WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's this legacy concept that Cisco's been around for so long that they
originally only
supported 1,005 and they had set some aside to support some legacy technologies
, or least
technologies that are now legacy.
Well fortunately, eventually we were allowed to use all of the VLANs in the
full range.
And so this 1006 through 4094, this is known as the extended range of VLANs.
So does it matter to us which VLANs are in the extended range versus the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So does it matter to us which VLANs are in the extended range versus the
standard range?
Not really, but at the same time, there are some nuances to this conversation.
Specifically, when we start talking about VTP, the VLAN trunking protocol,
which is a protocol
that carries VLANs between switches, if we talk about version 1 or version 2,
this only
supports the standard range.
If we want to support the extended range of VLANs, then we're going to have to
go to
VTP version 3, which is the most modern version in the version we should all be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VTP version 3, which is the most modern version in the version we should all be
using.
But at the same time, it's worth noting that those are the kinds of things that
we're going
to encounter if we're trying to use the extended range.
That said, in a modern network, we should have no concerns about using the
extended range
of VLANs.
All of those VLAN IDs are there for us to use, and we can even reclaim 1002 to
1005 if we
so desire.
But again, just understand when we're looking at Cisco configuration why things WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But again, just understand when we're looking at Cisco configuration why things
get broken
down the way they do.
Now as a final note, and we always like to talk about security where we can and
where
it makes sense to do so.
We do need to be aware of the concept of the default VLAN.
Oftentimes we talk about the native VLAN on a trunk, but this is talking about
something
else.
The default VLAN is the VLAN gets automatically assigned to all of our
interfaces.
So when I first spin up a Cisco switch, all of the interfaces are going to be
placed into
the default VLAN, which is 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the default VLAN, which is 1.
So I'm placing all of these ports into VLAN 1 by default.
And the reason why this is a security conversation is because all of the threat
actors know that
VLAN 1 is an ID that's in use in a lot of organizations.
So what do we try to do?
We try to avoid using VLAN 1, even if it's just as simple as changing the
identifier
to VLAN 2 on all the interfaces, then so be it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to VLAN 2 on all the interfaces, then so be it.
But generally speaking, we want to avoid using VLAN 1 in our networks because
that is the
VLAN that every port belongs to when the switch is first turned on.