In this video, you and I get to discuss
private VLANs, the big picture of how they work.
So I think one of the best ways of doing that for you
and I is, let's take a moment on the chalkboard,
and let's take a look at how traditional VLANs operate,
and then we'll introduce a few new components
with private VLANs that give us the benefits
of micro-segmentation, of controlling
within a VLAN which ports are allowed to forward frames
back and forth to other parts.
All right.
So let's begin with a little history with traditional VLANs.
So imagine this is VLAN 100, so we create VLAN 100. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So imagine this is VLAN 100, so we create VLAN 100.
It has no ports assigned to it by default, and then we go out
and we assign ports.
So we use a range command or something similar,
and we take these ports and we assign them as access ports
in VLAN 100.
Then as we connect devices to those ports,
those devices at layer 2 are now part of the same VLAN.
Now, behind that, we're going to have a network IP addressing
scheme, which is layer 3, and it's
going to associated with that VLAN.
So maybe we're using 10.100.0.0/24, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So maybe we're using 10.100.0.0/24,
and we can hand out IP addresses via DHTP or manually configure
it.
So the end result would be VLAN 100, these four devices,
all in that IP address space based on their configuration.
And as a result of being in the same VLAN,
the switch is going to allow frames
to be sent between any of these ports in the same VLAN.
So if this guy sends a broadcast,
it'll be seen by everybody else, and they
can have direct communication.
The switch with traditional VLANs
is going to do nothing to stop traffic between PC 1 and PC 4. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to do nothing to stop traffic between PC 1 and PC 4.
If there's a broadcast, that broadcast
gets sent and propagated, and the IP protocol stack
operates as normal.
So let's compare and contrast that
to what private VLANs can bring to the table,
and we'll also provide an insight to how
they do their magic.
So with private VLANs, we are going to still have a VLAN,
and in private VLANs, they call it the big VLAN.
They call that the primary.
So this could still be VLAN 100, the number,
and we would identify it as a primary VLAN, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we would identify it as a primary VLAN,
but instead of just putting all the ports into that one
primary VLAN, we could create logical subdivisions
of this VLAN.
And to do that, we are going to create secondary VLANs.
Anyway, that's cool.
Keith, what are they secondary to?
Their secondary to the primary VLANs.
Whenever you hear the term secondary VLANs, just think,
oh, this is like a subsection or us
a partition of the primary VLAN 100, a subsection.
So perhaps we create a little subsection, a secondary VLAN,
and for numbering sake, let's go ahead and call this VLAN 200. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and for numbering sake, let's go ahead and call this VLAN 200.
And when we create it, we'll specify it's a secondary VLAN
and that it's associated with the primary VLAN of 100.
Now, in addition, when we create this little subsection,
this 200, which is going to be a subsection of the primary VLAN,
we are also going to specify the type.
Now, it is a secondary VLAN.
In fact, we have one primary, and then
everything that goes inside the blue box
is going to be a secondary VLAN.
But there's two different types.
We have a type called community, and when
you think of the word community, think of,
hey, community, like people working together, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
hey, community, like people working together,
and that's exactly what it means.
If we create a secondary VLAN, in this case, number 200,
and we specify as a type community, that
means any ports that we associate with VLAN 200
as part of the bigger private VLAN,
they can all communicate with each other,
like a happy little community.
However, if we created another secondary VLAN--
let's go ahead and use 300 here--
and we specify that this is also a type community
and then we have a few ports that we put into VLAN 300, all WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then we have a few ports that we put into VLAN 300, all
those ports, the switch would allow traffic and frames
to be forwarded between any of those ports
in the same community.
But what the switch is not going to do,
it's not going to allow traffic from ports in VLAN 200
to go to VLAN 300 because they are in different communities.
And while we're talking about these secondary VLANs,
these two types would be community secondary VLANs,
but there is one other type, and let me go ahead and draw
that in this color right here.
And let's call this VLAN 400.
It's still a secondary VLAN, but we can
specify it's a type isolated. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specify it's a type isolated.
And if we assign some ports to that VLAN 400, which
we identified as a secondary VLAN and the type isolated,
and if the secondary VLAN is a type isolated,
that means that every port that we have associated
with VLAN 400, this isolated secondary VLAN, each port
is pretty much isolated.
That means the switch will not forward
frames between this port right here
and any other port that are associated
with the isolated secondary VLAN.
And it also will not forward any frames WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it also will not forward any frames
between these ports and the isolated VLAN
and any of the other community VLANs
that may exist on the switch.
Now, the other point I want to add here
is that because we are using private VLANs,
we will still have this entire blue box,
the entire private VLAN architecture, if you will,
the primary VLAN and all these secondary VLANs,
they would all be using the same layer 3 address space.
So this whole blue box will be 10.100.0.0/24,
even though you can have a device like at .70 here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
even though you can have a device like at .70 here
and a device at .80 here.
Same subnet, but the switch would not
allow the traffic to be forwarded
at layer 2 between two ports that
are in different secondary community VLANs.
Now, one of the challenges is that those devices probably
are going to want to, at some point,
communicate off their local network to some other device
like a router, and how do you allow some devices that
are part of VLAN 200, which is a community VLAN
and VLAN 300, which is the community VLAN, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and VLAN 300, which is the community VLAN,
and VLAN 400, which is the isolated VLAN,
how do you allow that traffic to get off the network, meaning
go to their default gateway?
And the answer to that is in the primary VLAN,
we are going to have one or more promiscuous ports,
and that's what I'd like to talk about with you in detail
in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.