All right, so now we are going to have a discussion on configuring and verifying VLANs to get us ready for the certification exam.
The thing about the certification exam is it doesn't actually say we have to know anything about VLANs.
And I'm just going to double check that in case it's been updated within the last couple of minutes.
But I don't think it has.
But if we go under our infrastructure, no, it just says trunking protocols, Ether channels, spanning tree protocol.
But, folks, here's the deal.
You are going to be tested on VLANs because VLANs are all part of Layer 2.
It doesn't make sense to have trunks if you don't have VLANs.
So I'm assuming that they omitted VLANs and they're just assuming you're going to know about VLANs because you're talking about 802.1Q trunking protocols.
All right.
And in reality, 802.1Q trunking protocols is really just 802.1Q trunking protocol.
It's all said and done.
But with that said, we need to know VLANs.
We need to know 802.1Q.
And so we'll start off with a VLAN discussion, and then we'll have a trunking discussion after this to put it all together.
So how many of you have VLANs?
And if you have a VLAN, type in the number of VLANs that you have.
So if you have a VLAN, type in the number of VLANs that you have in your environment.
Lots.
It's a good answer.
I like that answer.
Hundreds.
Sixty.
Eight hundred.
A thousand.
Too many.
Many.
Yes.
All right.
So let me try to put this in a way that makes it really to understand why we have VLANs.
So if we had a router like this, and off of that router we put a switch.
Let's say it's a 48-port switch.
Then we would have many users connected to this one switch.
Let's say, for example, we have some people from HR.
Let's say, for example, we have some people from sales.
Let's say, for example, we have some people from support.
Let's say, for example, we have people from IT.
Let's say, for example, we have guests.
What's the problem with that, folks?
What's the problem with that?
Okay.
So first of all, that's a security problem.
That is absolutely a security problem.
Why is it a security problem?
Because everyone on the switch right now is in the same subnet.
They're in the same VLAN.
They're in the same broadcast domain.
Do we ever really want traffic from different departments, folks,
intermingling with each other in the exact same subnet size, VLAN size, broadcast domain?
Not in modern-day networks.
Why?
Because of security.
If anybody in HR or anybody in finance sent out a, let's say, a broadcast frame,
everybody would get a copy of that.
So we absolutely don't want that from a security perspective.
So what is the other option we have?
The other option we would have would be to set up our environment, so 1, 2, 3, 4, 5, 6.
So 1, 2, 3, 4, 5, 6.
Put a switch.
All right.
We'll say this is the rest of the network.
All right.
Put a little cloud there.
And now we have all of our HR people here.
We have all of our guests here.
We have all of our finance people here.
We have all of our IT people connected here.
We have all our support people here.
We have all of our sales people here.
Now is this way better from a security standpoint than this?
Yes or no?
Absolutely.
Yes, it is.
Because what do we have the ability to do here?
Specify our security boundaries.
Security boundaries.
Okay?
And as a result of that, better security, number one.
We can control the flow of traffic a lot better.
Problem with this, it's very wasteful.
It's very expensive.
When you think about the fact that in finance, you might only have one.
Let me ask you this.
How many people in your finance department, folks?
How many people in your finance department?
Most of you are going to give me a low number.
Some of you may give me a high number.
It really depends on what your organization is.
Yeah, so what do you say?
Let's go with four people, let's say, for fun today.
Okay.
Conrad, you got about 100.
All right.
More in your case.
All right.
How many HR people?
Again, really depends.
Okay.
But let's say 10 HR people.
Sales, let's say sales has 30.
Support has nine.
IT has, oh, like we always have just one person, right, in IT.
Feels like that, doesn't it?
But how many ports on all these switches?
Right?
48.
How much money do we spend on all these switches?
A lot of money.
Now, you could say, well, we'll just buy a switch with, like, 12 ports or 24.
It doesn't matter.
The fact of the matter is you've got all these switches.
You've got all these ports.
You've got all these switches.
You've got all these ports.
So, VLANs allow me to do this exact same thing but over here.
What if instead we said you are in your own VLAN?
Let's call it VLAN 10.
You are in your own VLAN.
We'll call it VLAN 20.
You are in your own VLAN.
VLAN 30.
You are in your own VLAN.
VLAN 40.
VLAN 50.
VLAN 60.
Can each of these VLANs talk directly to each other folks through this switch?
No, right?
We would have to do what?
We would have to do routing and typically when we route,
we also have our security boundaries and policies in place.
Now, we would allow all the traffic across this trunk link.
So, that would be a trunk link.
But if somebody in finance needed to talk to somebody in sales,
the traffic would have to flow from here to the router,
get routed back in down to sales.
But the thing is is that that would be traffic that has to go that way.
But if sales just sent out a broadcast, would any other environment get it?
Would any other VLAN get it?
Would it?
No, they would.
Only the devices in sales would get that.
So, now we have the isolation we need.
We have the security we need.
We have the segmentation we need.
We have the isolation we need.
I already used the word isolation.
I'm running out of words to use here.
But the point of the matter is is that now it's not going to cost us as much.
We still get away with the same situation.
But now we've carved it up.
So, we get better network performance as well because we're taking maybe large
broadcast domains, making them smaller.
We're getting better security because traffic within a VLAN stays in a VLAN.
Just think about the rule of Vegas.
What happens in Vegas stays in Vegas.
Well, what happens in a VLAN stays in a VLAN unless you route it.
So, what happens in Vegas stays in Vegas unless you route it.
Same idea.
So, that's what VLANs are going to give us the ability to do.
So, now I get to maximize my budget.
I get to, you know, ensure I'm not wasting money.
And I get to ensure that we have the security that we need.
So, I could really just fill every single port on a switch, have different people
in different VLANs, but still have the isolation and security I need.
So, what is a VLAN?
A VLAN is a virtual LAN, folks, a virtual local area network.
A VLAN, therefore, is a subnet.
And we know a subnet is a broadcast domain.
So, therefore, a VLAN is a broadcast domain.
So, from a fundamental standpoint, each VLAN is its own subnet.
Each VLAN is its own subnet.
That's the fundamental rule of VLANs.
Now, there's an exception to that rule.
How many of you have ever worked with private VLANs?
Okay, private VLANs is a way that we can take a single VLAN or, sorry, a single subnet
and break that subnet up into multiple VLANs.
We could do that with a private VLAN.
I've got a fly flying around in here.
It's really starting to bug me.
It's almost hit me twice.
I don't know if you saw it on camera, but it came close twice.
Going to have to get it at the next break.
All right.
So, when it comes to our discussion here, we're not going to worry about private VLANs
where you could have a multitude of different VLANs, different ISODs, different things like that, okay?
But in the grand scheme of things, with a certification exam where private VLANs is not on the certification exam,
if they ever ask you anything about a VLAN, it's a one-to-one relationship here.
One VLAN equals one subnet.
Therefore, every VLAN is its own broadcast domain.
Every VLAN is its own subnet.
Keep that in mind.
So, let's do a little bit of review here when it comes to our switches.
What does a switch do first, folks, when it receives a frame?
Does anybody remember this from their CCNA days?
What does a switch do first when it receives a frame?
What does it have to do?
Anybody remember?
Okay.
It has to learn.
No, it has to learn.
Yeah.
That's right.
It has to learn the source MAC address of the frame, populate the MAC address table with the what?
The MAC address, the port the frame arrived in on, and the VLAN ID of the port.
So, right now, you can see in our environment, let's just focus on this device here.
This is PC1 in our topology right now, and you'll see that off of gig 101, we have this MAC address, and it was this VLAN.
Why is it that VLAN?
Because that's what our default configuration is on our switch.
This switch right now is a default configuration.
So, every port is part of VLAN 1 by default.
So, right now, we have a device with that MAC address of gig 101, and it is part of VLAN number 1.
So, that would be this PC right here.
So, we learn that information, how?
By listening to frame.
A frame comes in on the port, and what do we do?
We look at a source MAC of the frame, and then we put an entry in.
So, that was the source MAC in the frame.
That's the interface the frame came in on, and that is the VLAN the interface belongs to.
Okay?
So, now, what part of the frame does a switch use to make a forwarding decision?
Excellent, Conrad.
Yeah, destination MAC address.
Destination MAC address.
Okay.
So, the next question is, when will the switch forward a frame out a specific port?
When will a switch forward a frame out a very specific port?
When the destination MAC address is in the MAC address table.
Yep.
Absolutely, Conrad.
Yep.
When the destination MAC address is in the MAC address table, it is in the MAC address table.
When the destination MAC address is in the MAC address table, and the destination is in the same VLAN,
those two values must both be met.
So, think about this scenario here.
Let's say PC1 wants to talk to PC2.
So, PC1's MAC out GIG101.
PC2's MAC's in the table out GIG102.
So, the frame arrives in with a source MAC of this and a destination MAC address of this.
The switch then looks at the destination MAC address and says, oh, I can reach that MAC address out this very specific port.
So, I will forward it out GIG102.
If and only if both of these devices are in the same VLAN, VLAN1, VLAN1, yes, okay, I can forward it.
If not, then I don't forward it because it would be a security violation at that point in time.
So, what happens when the destination MAC address is not in the same VLAN?
So, let's say PC2 was in a different VLAN.
Let's say, folks, that this instead said VLAN10.
Let's say it said VLAN10.
So, PC1's in VLAN1.
PC2's in VLAN10.
What's going to happen in that case?
What's going to happen?
The frame's going to get dropped.
The frame's going to get dropped because the switch sees that it does not meet the requirements of frame forwarding.
It's breaking the rule.
So, if PC1 has the ability to send the frame to a MAC address in a different subnet VLAN broadcast domain,
the switch is going to stop that from happening.
Now, you might be saying, wait a second.
Then how would you talk to somebody in a different VLAN?
That's different.
Totally different than what we just talked about.
So, let's say this is VLAN1 and this is VLAN10.
Okay, you have your default gateway up here for VLAN1 and you have your default gateway for VLAN10.
So, the source MAC in this case would be PC1, but the destination MAC would be who?
The destination MAC would be your default gateway.
See?
VLAN1.
Right?
You forward it to your default gateway.
Then it gets routed and then it gets sent back in.
But then what's the source MAC here?
Source MAC is now this device.
And the destination MAC is now this device.
The MAC address changes every time we have to route.
It's part of our CCNA discussion.
MAC address changes every time we have to route.
So, PC1 should never be able to create a frame with a destination MAC address of somebody in another subnet.
And why is that?
Because how do you figure out the MAC addresses of somebody in another subnet?
To figure out the MAC addresses, you use ARP.
Remember ARP?
Address Resolution Protocol?
The favorite protocol of SEALs?
ARP, ARP, ARP, ARP, ARP, ARP.
So, this protocol only works inside a subnet VLAN broadcast domain.
So, when I send out an ARP message saying, hey, if you're so-and-so, give me your MAC address,
only those devices in my subnet VLAN broadcast domain will actually get that message.
Nobody else would because it's a broadcast message.
So, PC1 should never learn PC2's MAC address.
So, the only way PC1 could create a frame that said source PC1 destination, so source MAC, destination MAC,
say this is VLAN1 and let's say this is VLAN10,
the only way I would figure out the destination MAC of PC2 is if they were able to get that information
in some way, shape, or form sniffing it out or actually going to that physical PC and figuring it out
by typing in IP config all as an example in a Windows box, but they figured it out somehow
and then they used software to create fake frames.
That's the only way they could do that.
But because the switch won't allow it to happen, when I do execute it, it's not going to be allowed out anyway
because the switch is going to be like, you can't do that because that destination MAC address
is not in the same VLAN that you are in.
That's why it would have to get dropped because it violates the rules of switching.
Now, when will the frame get flooded?
Okay, the frame gets flooded any time the destination is FFFFFF, all Fs, that's when a frame gets flooded.
A broadcast frame or what?
When the destination is not in the MAC address table.
So if the destination is not in the MAC address table, our switches are going to flood at all ports
except the port they came in on.
If it's a broadcast frame like an ART message or a DHCP discover message,
flood it at all ports except the port it came in on.
But we have to remember now, it only gets flooded out the ports that are in the same VLAN.
So if I have a broadcast frame, it's only going to get flooded out the same ports that are in the same VLAN
as the device who created it.
And then if the destination is not in the MAC address table,
then I'm only going to flood out those ports that are right in the same VLAN as the source.
That's it.
So all things that can come up on your certification exam in a multiple choice question,
just to test you on do you truly understand how VLANs work and how switching works.
So make sure you're familiar with all of that.
All right.
So what we're going to do today is we're going to build a little network.
We'll say this is 10.0.0.0.24.
We're going to make this VLAN 10.
Let's make it for sales.
We're going to do VLAN 20 here.
It's going to be 10.0.2.0.24.
And this is going to be for, let's say, HR today.
And then we're going to have 10.0.1.0.24.
This is going to be VLAN 50.
And this is going to be for, ooh, I don't know, let's say finance for fun.
And then we're also going to talk about voice VLANs today.
So let's do VLAN 200.
And we're going to do 10.0.3.0.24.
You know, you might be saying,
that's very poor VLAN IP addressing that you've done here, Raymond.
That's okay.
It's all right.
Because in the grand scheme of things, it doesn't matter.
That's why I'm doing it this way,
just to show you that the numbers and the VLANs are what you decide to do.
And if you are the type of person who says VLAN 10 is going to be 10.0.10.0.24,
and VLAN 20 is going to be 10.0.20.0.24,
and VLAN 50 is going to be 10.0.50.0.24.
Great. That's perfect.
That's fine.
You can do it that way if you want to.
But it's not always going to be that way.
And it doesn't have to be that way.
So the moral of the story is that when it comes to VLANs
and it comes to IP addressing,
this is something that you have to figure out on paper,
and it's something that you're going to have to document,
and it's something that you're going to have to configure and implement.
And let's just be very clear here that these access layer switches
don't understand the IP addressing at all.
It's not going to matter to them.
It doesn't matter at all.
Because what are they?
Layer 2 switches.
Layer 2 switches that move frames.
They have no idea what subnets are.
They don't.
So the IP addressing is for whose sake?
My sake.
My end user's sake.
My default gateway's sake.
My router's sakes.
But not my layer 2 switches.
All right, so let's start looking at things here.
Let's go to ASW1 right now.
We're going to type in our first command, show VLAN brief.
All right, so when it comes to show VLAN brief, what do we see?
We see that every single port on this device right now is part of VLAN number 1.
Every single one of them.
And what do we call VLAN number 1?
We call it our default Ethernet VLAN.
So it only says default there, but it's our default Ethernet VLAN.
VLAN number 1.
All ports are part of it.
Notice it's active.
Be mindful that you cannot disable this VLAN.
You cannot shut it down.
You cannot delete this VLAN no matter what.
So your default VLAN is VLAN 1, and it must be on and active at all times.
And why is that?
Because there's a lot of services behind the scenes that run on your device
that simply rely on VLAN 1 no matter what.
So, for example, when you think about Spanning Tree Protocol
or you think about CDP or LLDP or a multitude of other protocols like VTP,
they use VLAN 1.
Whether you're using it or not, they use VLAN 1.
Also, another thing I want to point out to you is that when you're manipulating
these VLANs, you're manipulating it for essentially end-user traffic.
So traffic that has generated somewhere in your environment
and is flowing through this actual switch, not to the actual switch,
meaning it's not destined to the switch.
So you're messing around with user VLANs here.
You're messing around with voice VLANs here.
So if it's traffic generated by a switch like Spanning Tree Protocol message
going to another switch, what I'm doing here doesn't affect that.
If it's a DTP message for trunking, what I'm doing here with my VLANs doesn't affect that.
We call that control traffic.
All right, that fly is right there on the ceiling.
Give me one second.
I can actually reach it.
Give me one second.
Got it.
All right.
Oops, wrong button.
Let's go back to this.
The fly, let's put it this way, has probably woken up from a long sleep over the winter.
As a result of that, he wasn't very fast or aware that I was even going after him.
So that's why he didn't get away.
Didn't have to pull out the fly swatter just yet.
All right, so let's exit out of here.
Do show VLAN brief.
You'll also see that we have a few more VLANs, VLAN 1000, 2000, 3000, 4005.
These are unsupported on this device, this platform, because these would have been VLANs for FDII
and Token Ring and FIDINET.
So FIDI stands for Fiber Distributed Data Interface, something like that.
It's so old, I can't remember the name of it, and Token Ring Net.
So these are unsupported on this switch because it's purely an Ethernet switch,
but there are switches out there that potentially support it.
As a result of that, the iOS, since it's usable on many different switches,
you would see that on your switch even if your switch couldn't support it,
like this particular switch here.
You won't be tested on those on the certification exam, but that's why they're there.
They're for old-school technologies that are really not around anymore
and therefore unsupported on most of our products and platforms.
How many total VLANs can we create on our device?
Let's type in VLAN?
And you'll see here that it says we can create VLANs 1 through 4094.
VLANs range from 0 to 4095 for a total of 4096 VLANs.
You can't use 0.
You can't use 4095.
1 is our default Ethernet VLAN, 1000, 2, 3, 4, and 5 are for FIDI and Token Ring.
But you can pretty much use anything else.
However, there are some other technologies on your device that might be getting in your way
from you being able to use them.
For example, if I create something like VLAN 10, that works no problem.
Do show VLAN brief.
And you'll see that VLAN 10 now exists.
But let's try and create something like VLAN 1009.
Looks like I was able to do that.
But let's exit out because it's when you exit out that it actually executes your commands.
In this case, it says I cannot do that.
It failed to create my VLANs, 1009.
And the reason why, as you'll see, is because of something called VLAN chunking protocol.
When Cisco created their iOS for their switches, as you see here,
we were dealing with a timeframe whereby there was not a possibility for 4096 VLANs.
That's right.
We had VLANs from 0 through 1005.
That's what we had.
That is what we had.
So this number that you see here used to be 1 through 1005.
And you can't do 2, 3, 4, and 5 because they're reserved.
Because back at that time, VLANs were not a standard.
And since VLANs were not a standard, vendors were doing it themselves,
and Cisco on their products did it themselves.
Right?
These are VLANs.
This is how we're implementing them.
You can do everything from 1 to 1005.
And as a result, they also created at the same time other technologies,
like VLAN chunking protocol, as an example.
And because of the mode of VLAN chunking protocol, totally different service,
because of VLAN chunking protocol mode,
it prevents me from creating anything higher than VLAN 1005.
I can create everything up to 1001, but I cannot go any higher than that,
all because of something else.
And why am I telling you this?
Because I always want us to remember going forward that everything you do on
your Cisco devices, every service and technology you use,
there's going to be some other service or technology that it either depends on
or works with or interferes with, like we see here.
Let's say you wanted to create VLAN 1009.
You can't, using the default configuration of your switch.
You would have to understand, how does VTP also affect me?
And these are some of the things that could show up on a certification exam
at this level,
understanding how other services can negatively affect another service.
So, for example, if we type in do show VTP status right now,
you'll see that I am in server mode and we're using version one.
So, because we're using server mode and we are using version one,
I am not allowed to create anything more than VLAN 1005.
However, if we change the mode to transparent,
I'll show you how to do that later in our VTP discussion,
and we leave it as version one, so transparent and version one,
then I can create VLAN 1009, no problem, anything higher than that.
So, if you're in transparent mode,
you'll be able to create VLANs up to those numbers there.
But if you're in server mode with version one, you can't.
The other option is to change it to version three.
So, if you change it to version three VTP, then server mode,
client mode, and transparent mode all support all the VLANs.
Just little things to keep in mind as we go through things,
because they could show up on the exam.
If all of a sudden you had a question that says you're trying to create VLAN 2000,
but you get the error message, failed to create VLAN 2000, why is that?
Well, I mean, it could be a lot of different reasons,
but if you look at the list and what the list says,
you're using VTP version one and mode server,
well, then that's probably the reason why.
I would be picking that 100% of the time on an exam question,
if that ever came up.
Just keep that in mind.
All right.
So, I'll show you how to mess around with VTP later on.
Back to our VLANs.
Do show VLAN brief.
So, folks, as we create VLANs, let's create some more VLANs here.
Let's create, for example, VLAN 20.
Let's create VLAN 30.
Let's create VLAN 200.
Do show VLAN brief.
You'll see they're all in here and they all have default names, VLAN 10,
VLAN 20, VLAN 30, VLAN 200.
You can name them if you want to.
So, if you go VLAN 10, you might want to name it sales data VLAN
or data traffic for that VLAN,
just to show you how the name would change in that particular case.
One thing I always want you to remember for the certification exam is that
what they put here might not be exactly what the VLAN is for.
Always remember that.
Because we're going to be doing VLAN 200 as our voice VLAN, correct?
So, what if they did something like this on the exam?
And you were looking at the output, and the output here said voice,
but the diagram said VLAN 200 is supposed to be voice.
What I want you to realize is that don't ever go by the name.
The name could be totally wrong.
Use the name to guide you,
and if the name given matches what's on the diagram, then you know it's fine.
If the name given doesn't match the diagram, don't trust the names.
Because you can name it anything you want, and it doesn't matter,
in the grand scheme of things.
It just messes you up as a human being.
That's all it does.
The odds of them doing that to you on the exam, though, is very slim,
but you never know.
They could totally do that to you,
and I'd hate for you to mess up on a question only because they named it
something that it was not, just to try and trick you,
which is dirty for them to do that.
But it has happened in the past.
I just can't confirm if it's going to happen to you this time.
So just keep that in mind.
All right, so we have our sales VLANs.
We have our HR VLAN.
We have our finance VLAN.
Oh, that's wrong.
It's supposed to be VLAN 50, right?
Nobody called me out on that.
All right, let's delete it.
Let me show you how to delete it, Dan.
No VLAN 30.
So VLAN 30 is gone.
VLAN 50 is now there.
All right, back to it.
There we go.
10, 20, 50, 200.
Perfect.
10, 20, 50, 200.
Looks good.
Okay, good.
So the next question I have for you folks is,
where is this information being saved?
Where is this information being saved?
Okay, VLAN database, excellent.
Where is the VLAN database stored?
Andrew says VLAN.dat, excellent.
That's the name of the file.
So where is the VLAN database called VLAN.dat stored?
Jeffrey says flash, good job.
Where is that VLAN database stored?
Jeffrey says flash, excellent.
Where is the VLAN database called VLAN.dat stored?
Jeffrey says flash, absolutely.
So let's type in do show flash.
And you'll see that I have the VLAN.dat filed listed right here.
So that is where everything is being stored by default for my VLANs.
It's not in the running config.
So if we type in do show run, we're going to see here that there is nothing in our running config related to VLANs except for this command right here.
Okay.
That was it.
But where is VLAN 10, 20, 50, 200?
It's not there.
It's in the flash.dat file.
So when I type in do show flash, it's not there.
So when I type in do show flash, no, sorry, do show VLAN, I am looking at what is stored right now in regards to these.
I am looking at what is stored in that VLAN.dat file.
And there's other stuff in that VLAN.dat file as well.
But usually when we type in brief, we're just getting a snapshot of the top stuff.
That's it.
Okay.
Now, if you change your VTP, and this is happening because of the VLAN.
Now, if you change your VTP, and this is happening because of our VTP mode.
That's right.
This is happening because of our VTP mode.
So if we type in do show VTP again, status, because our VTP mode is server, we store it in the VLAN.dat file.
If it was client mode, it would also be in the VLAN.dat file.
But if we change our VTP mode to transparent, we're going to see now by typing do show run that everything is where?
Now in the running config.
So think about it this way.
Think about it this way.
If it's stored in the VLAN.dat file in Flash, you don't have to save your VLANs when you create them because it's automatically saved for you.
However, you still have to remember that if the Flash file gets damaged or corrupt, well, your VLAN information is gone.
So you'll definitely want to store a copy of your VLAN.dat file somewhere else on a server as well as a backup.
Just like you'd store your startup config somewhere as a backup just in case the startup config gets corrupted on your device.
However, if you are in transparent mode of VTP, then what does that mean?
If you're in VTP mode transparent, any VLAN change you make is not automatically saved.
You're going to have to do a copy run start, copy run start, copy run start every time you make a VLAN change to save your changes.
Or else every change you make is not going to be saved.
So think about that from an exam standpoint.
If you're talking about configuring, verifying, or troubleshooting VLAN information, and they're showing you a little bit of VTP information,
they're showing you some running config information, or not even showing you running config information, they're just talking about VLANs.
If you look at VTP and it says transparent mode, well, you know you're going to have to do copy run stars in order to save your config of any VLAN adjustments.
But if it's VLAN.dat file, then you would not have to because those would be saved.
But it's only the stuff directly related to the VLANs.
So, for example, when we start moving our ports to the respective VLANs, that stuff's not stored in the VLAN database.
So if we scroll back up here, this stuff's not stored in the VLAN database, the ports.
This is part of your running config.
This is part of your startup config, not the VLAN.dat file.
The VLAN.dat file is anything related to the actual VLAN creation, the VLAN name itself, the state of the VLAN, the VLAN-specific stuff, but not the port stuff related to the actual VLAN.
I'm going to move that back to server mode.
And when you move it back to server mode, it'll go ahead and take everything out of the running config now and put it back into the VLAN.dat file.
So you'll see it's no longer in the running config.
So if I made any changes while in transparent mode, those would have been then brought into the VLAN.dat file for me to save them back to the VLAN.dat file.
So you can go back and forth if you want to from server to transparent, transparent back to server, and it just copies what's in there.
And then when you go back to server mode, it'll go back in.
More on VTP later, but you can just see already how understanding how one technology affects everything else is really important.
And that's true about Spanning Tree Protocol as well.
Most people don't realize the massive effect that Spanning Tree Protocol has on your Layer 2 environment.
And if you don't fully understand Spanning Tree Protocol, your environment may not be performing as optimally as you want.
That's why I said performing as optimally as you want.
So we'll talk about that when we get to our Spanning Tree discussion.
And how also doing certain things in trunking can affect Spanning Tree Protocol or doing certain things can affect this, that.
We'll make sure we cover all of that, that we can.
All right.
So now that we have our VLANs created, what do we want to do next?
We want to place our VLANs or place our ports and their respective VLANs based on our topology.
So right now if we type in do show VLAN brief, every single one of our ports are still in VLAN 1.
So these two ports, gigabit 1 and gigabit 2, have to be moved to VLAN 10.
So let's go ahead and do that right now.
So we're going to say interface, range, gigabit Ethernet, 1 slash 0 slash 1 and 2.
And then we'll say switch port, access, VLAN 10.
That's the command to move you from one VLAN to another VLAN.
If I type in do show run, pipe to section or pipe to not even pipe, show run interface, gigabit Ethernet, 1 slash 0 slash 1.
We'll see here I'm part of VLAN 10 now.
Type in do show VLAN brief.
We'll see that gigabit 1 and 2 are no longer listed here.
They're now listed down here as part of VLAN 10.
And if we type in the command do show interface gigabit Ethernet, 1 slash 0 slash 1, and we tack on the switch port keyword,
we're going to be able to see in this output that I am a member of VLAN 10, which is name sales.
Let's do the same thing for gigabit 1 slash 0 slash 3, but it's got to go in VLAN 20.
So interface gigabit 1 slash 0 slash 3, switch port, access, VLAN.
We said 20.
So do show run interface gigabit Ethernet, 1 slash 0 slash 3.
Do show run or do show interface gigabit Ethernet, so 0 slash 3, switch port.
And you'll see I'm part of VLAN 20, and the name is VLAN 0020.
Do show VLAN brief.
A question right now, what would happen if VLAN 10 got deleted, folks?
If VLAN 10 got deleted, what would happen to these two ports right here?
For example, would they get deleted, no longer exist, would they go back to VLAN 1?
What would happen if VLAN 10 got deleted?
So if we type in do show VLAN brief, we're going to see here that they're nowhere to be found.
And why is that?
Because they're still configured to be where?
Where?
They're still configured as part of VLAN 10.
That config didn't change.
Just because the VLAN's gone doesn't mean that the interface config has changed.
And if we look at the output of show interface gigabit 1 slash 0 slash 1, switch port,
notice it says we're still part of VLAN 10, but VLAN 10 is inactive, meaning it does not exist.
So if we add VLAN 10 back in, and then we look at our output again, you'll see that now it shows
that VLAN 10 is no longer inactive.
Type in do show VLAN brief, we'll see that the interfaces are now back with VLAN 10.
Let's talk about voice VLANs now on our Cisco IOS Catalyst switches.
So when we think about a phone, what do we need to be aware of when it comes to our phones?
Our Cisco phones are designed in a way so that way there we only have to consume one physical port on our switches.
So, for example, here's my switch.
My port, let's say, would connect to here.
This port then goes to the PC, and this wouldn't be a physical port, it would be a virtual port,
but it's connected to what?
The application-specific integrated circuits of the actual phone.
And so what does this allow us to do?
It allows us to only consume one port on the switch, and therefore traffic from the PC enters the phone,
gets forwarded out to the switch.
Traffic from the phone gets forwarded out to the switch.
And so we place our phones in their own VLANs.
Why?
That's right.
So we can implement quality of service.
So we can do traffic differentiation.
So traffic can be differentiated.
Because our voice traffic is very, very delicate.
Voice traffic requires what?
Jitter less than 30 milliseconds one way, delay less than 150 milliseconds one way, packet loss that is less than 1% one way.
And then we want to make sure that we can prioritize all of our traffic.
So if there is something called congestion, then we can move the voice traffic to the front of the line on our switches
and our routers and our firewalls, and that voice traffic can be processed first before other types of traffic.
So we do that by using quality of service and by marking our traffic.
Marking our traffic, for example, with a COS value of 5.
Now, there's other values that you'd find in your IP headers, DSCP values and different things like that.
But we're just talking about our frames right now.
So our frame would have a COS value of 5 inside of it.
So in our particular case, we are going to have voice VLAN 200 as an example.
So how do I now make sure that this port knows that we have a voice VLAN and a data VLAN, meaning VLAN for the PC, a data VLAN,
or we called it in our config, the access VLAN.
The access VLAN switch port, access VLAN 10.
And if we look at our output right here, what does it say?
It actually says access mode VLAN.
So on the exam, they might use the word access VLAN, or they might use data VLAN, or they might use the VLAN for the PC.
However they say it, they're referring to the traffic coming from the PC in that case.
Voice traffic will be specifically labeled as voice on the exam, voice traffic, voice VLAN.
So how does the switch port know the difference between voice traffic and our data traffic?
Different VLANs, different VLANs.
Absolutely.
So here is the config to add it.
I'm going to do it right now in our environment though.
So we know that VLAN 200 is going to be for voice.
So if we go to, for example, interface, range, gigabit ethernet, one size zero slash, one through three in our example right now,
because I'm going to put all of them in that voice VLAN.
We're going to type in switch port, voice VLAN, and then put the VLAN number of 200.
So my switch does not know that this is for voice, okay?
It doesn't.
Unless, until I do what?
Until I actually configure this command on an interface.
Now it knows like, oh, okay, that VLAN is for voice.
That's how it knows now.
Other than that, it had no idea what it was for.
Likewise, it had no idea what VLAN 10 was for until I configured what?
Switch port access VLAN 10.
Then it knows, oh, it's data traffic.
It's not voice traffic.
So let's go ahead and take a peek at our output now,
and you'll see that you have your access mode VLAN 10 and your voice VLAN of 200.
So we now type in do show VLAN brief.
You'll see that we have now gig 101 showing up here under VLAN 10
and 101 showing up as VLAN 200.
The only way you're going to see an interface listed twice in this output, folks,
is if the interface is part of a data VLAN, an access VLAN, and a voice VLAN.
That's it.
You cannot have one interface and two voice VLANs.
You cannot have one interface and two access data VLANs.
You cannot have that.
So that's why, for example, in the exam, don't necessarily always trust the labeling.
So what if they accidentally label this as voice and this as data?
How would you know for sure which one's which?
Look at the config.
That's how you are going to know.
For example, do show run interface gigabit ethernet 1 size 0 size 1 is one way to check.
You know that regardless of how this is labeled, right, it doesn't matter.
This is what tells the truth.
This would be for access traffic slash data traffic.
This would be for voice traffic regardless of what they had here as the name,
the description.
So if they named it voice and this is access VLAN,
they're trying to mess with your head on the exam.
Don't let them trick you that way.
This is the deciding factor as to what type of traffic it is for that VLAN on that port.
That's how it works.
So if we type now do show interface gigabit 1 size 0 size 1 switch port,
we'll see that we have another way to verify.
If it says VLAN 10 is access mode, you know no matter what this is labeled as,
it doesn't matter because this is telling the 100% truth based on this
configuration right here.
Likewise, this here is telling 100% truth based on the configuration right here
regardless of what this says right here.
Because that is just for you to describe it based on.
And the switch doesn't care about that right there.
Literally, the switch does not care about these names that you have right here.
It doesn't even reference them.
It doesn't even know what it means.
That's for you.
Likewise here, that's for you regardless of what it says.
So if that said voice here and that said data here,
you know that they just mislabeled it.
They mislabeled it.
That's all, okay?
Don't let that throw you off.
Okay, so if you did switch port access VLAN 200,
then what would happen is that in this scenario, this specific scenario,
then VLAN 10 would be replaced with VLAN 200.
So VLAN 200 would no longer be voice.
VLAN 200 would be here.
And then the switch would not necessarily recognize it as voice traffic.
That's all.
Would not necessarily recognize it as voice traffic unless you did other
configs on the switch to make it recognize it as voice traffic.
Now, if it was just a port all by itself
and you accidentally typed in access mode 200, again,
depending on how the rest of the switch is configured for quality of service
and different things like that and marking would ultimately determine
whether it's treated as voice traffic or not.
Because once the traffic arrives on the switch,
the switch has to make a decision.
If it's voice traffic, well, I'm going to treat it as voice traffic.
If it's data traffic, I'm going to treat it as data.
If the switch thinks it's data traffic, then what's going to happen?
It's going to treat it as data traffic.
Is it still going to work?
Possibly.
Possibly not.
It really depends on the rest of the network.
So what would happen?
Would the phone still work?
More than likely, yes, possibly, maybe.
There's no definitive perfect answer to that question
because it would rely on 100 other things being configured properly or not.
But the idea here is if it did work,
you probably wouldn't get the QoS that you expect to get,
and, therefore, the phone conversation might not be as clean
and clear as it should be.
Make sense?
There's too many variables in play here to answer that question perfectly.
Okay.
So far, so good.
Now, a lot of people ask, well, Raymond, how does that actually work now?
So let's talk about this.
We have our PC frame.
So a frame coming from this PC right here,
it's going to come to the phone, and the phone's just going to let it through.
The phone's not going to do anything to it.
Folks, is there any VLAN information in here at all?
Yes or no?
Is there any VLAN information in there at all?
Two here.
One second.
All right.
Is everybody back?
Looks like we had a small little blip in our stream.
Yeah, yeah.
Everybody back?
You good?
You should be back.
Yeah, I just noticed that.
We dropped 196 packets.
Talking about quality of service, and I dropped 196 packets.
Look at that.
Should be good now.
All right, perfect.
Excellent.
All right, so what I was asking here and just saying at this moment in time,
so we have the traffic that's coming from the PC,
and the traffic just arrives at the phone, gets sent right through the phone,
phone doesn't do anything with it, and then it arrives at the switch.
Is there anything in this frame from the PC, folks,
that tells the switch which VLAN it belongs to?
Yes or no?
This is the frame you would have learned about in your CCNA days.
We got our source and destination MAC addresses, our type link field,
our packet, and then our frame check sequence.
Is there anything there at all?
Nope, there's nothing.
Nothing.
So how does the switch know which VLAN the frame belongs to?
That you configured it.
When you configure this command, when you configure this command,
you are telling the switch if a frame arrives inbound on this interface
and there is no marking whatsoever, it belongs to VLAN 20.
Now, Conrad, you are not wrong.
You are not wrong.
Because I want you to think of it this way.
Right now, this is the default VLAN for that interface.
Think of it that way.
That is the default.
If we are not told otherwise, that is the VLAN on that interface.
There you go.
See, you weren't technically wrong, Conrad.
So, yes, Jeffrey, there's no tag here, right?
There's no tag.
It is untagged.
There is nothing about VLAN 20 that is untagged.
There's no tag.
It is untagged.
There is nothing about VLANs in it.
So as a result of that, you are in VLAN 20.
You are untagged.
Nothing.
Now, let's think about our phones.
Our phones, when they start up, when they boot up,
they contact the DHCP server.
The DHCP server gives them the IP address of, let's say, a TFTP server.
They reach out to the TFTP server.
They get their configuration file, and then they configure themselves.
One of the things they can configure themselves with is what?
The information that is necessary for tagging its traffic.
So the phone frame has a tag in it, an 802.1Q tag.
That's right, the same type of tag we use for trunk links.
So now, what does that mean?
Let's pull this out.
This says 802.1Q tagged.
This says this would be used for QoS.
This is our class of service field.
This would have a value of 5 in it, meaning voice.
There's the VLAN ID, 200, the phone would put in.
So does the switch know which VLAN this traffic belongs to now?
Sure.
The voice traffic belongs to VLAN 200.
So if you're tagged with 200, you're in my voice VLAN.
If you're not tagged, you're in my data VLAN, my access VLAN.
There you go.
That's how it works.
And so now when you configure your QoS values on your switch,
you'd be configuring that QoS to match the traffic that is coming from the phone's VLAN,
the phone's subnet, the phone's whatever you're using in your case.
But now the switch can do what it needs to do based on markings that we can trust the phone now.
It's part of QoS.
There you go.
So more on QoS in a different topic, different discussion.
This is not about QoS.
This is about simply understanding how we do our VLANs.
So at a minimum, you need to know this for the certification exam
because you never know when this is going to pop up in a question about access VLAN,
so data traffic, voice VLANs.
Those are the two most important commands you need to know about VLANs.
We're going to come back and talk about this command after,
but I'll give you a heads up on what it does.
It says, this port can never, ever, ever, ever, ever, ever, ever become a trunk.
That's what it means.
Therefore, I can be a member of a single access VLAN and a single voice VLAN.
Switch port mode access says you can be a member of a single access VLAN
and a single voice VLAN no more.
That's it.
That's all.
It prevents your port from ever accidentally becoming a trunk.
And we would never want that.
That goes down in our phones.
Now, some of you might be saying, okay, this is different than the way I do it
on my Cisco switches that I have.
And it's like, okay, my question to you is, are you using Cisco phones?
If you're not using Cisco phones, that's why.
Because there are phones out there that don't work with this type of config.
And as a result, you would actually be creating a trunk that goes down to the phone.
So, if you have actual trunks that you created that go down to your phones
and then down to the phones and PCs, okay,
it's because the phones don't support this type of config.
Or you're using a switch, a non-Cisco switch that, again,
doesn't support this type of config either.
So, that is a possibility.
But what is this course about?
Cisco products, Cisco configs, right?
That's what you're being tested on.
That's what you're expected to know.
So, there's your Cisco way of doing things with Cisco products.
That's what you're getting ready for.
All right.
So, we've already gone through this information.
We've seen Show VLAN Brief in our live environment.
We've already taken a look at this output here.
Beautiful.
So, that's it for our VLAN discussion, folks.
We have you covered for what you need to know for VLANs.
Oh, you know what?
I want to bring up one more thing.
I didn't word it as I wanted to, and I realized that after the fact.
But one final thing just to make sure we're 100% clear.
If I type in VLAN question mark.
So, I didn't explain exactly the range of values.
And I was, like, thinking about it after.
We need to know the name of the range of values.
So, for example, if you have 1 to 1,005, okay,
this is what Cisco calls the normal range VLANs.
And then you've got 1,006 to 4,095.
This would be your expanded, expanded, or extended VLANs.
So, back in the day when Cisco, when 802.1Q did not exist,
before VLANs were a standard, Cisco supported this many VLANs.
They had their own trunking protocol called ISL.
They were using VTP and different things like that.
That's where all that came into play.
But then once 802.1Q was invented,
then they had to expand to support all of that.
So, the reason why we have these two different names,
so if they talk about normal VLANs, that's what they mean.
If they're talking about expanded or extended,
they're talking about those ones.
They had to expand out their range because of what?
The invention of 802.1Q and VLANs,
and 802.1Q becoming a standard throughout the entire industry.
That's why they did that.
So, I just wanted to make sure you had those numbering schemes in place
that go along with our discussion.
I failed to mention that just in case, because on the exam,
if they use those words instead of actual numbers,
or they throw those words out there, I'd hate you to miss a question
just because you didn't know the word that goes along with it.
All right, there you go, folks.
Thank you.