
Network Configuration
A number of methods can be used to mitigate problems and threats associated with large broadcast domains,
including broadcast filtering and physically separating large broadcast domains into smaller domains. The problem
with these solutions is that the are typically implemented at the Network Layer (Layer 3), and require Layer 3
devices (such as routers and firewalls) to implement them. These Layer 3 devices require separate subnets, and
themselves emit a significant amount of broadcast traffic.
What we really want is a way of abstracting the idea of a LAN so that large broadcast domains can be separated
into smaller domains
without requiring any network rewiring or physical movement of systems
. We’d also like the
ability to extend broadcast domains across Layer 3 devices to physically remote systems.
With a VLAN, the broadcast domain for a particular system is determined by the
software settings on the Layer 2
switch port to which the system is connected
.
So, for example, in a traditional LAN, all the systems connected to Switch A would be part of Broadcast Domain A.
If the switch is a VLAN-capable switch, then it is possible to configure several ports on the switch for VLAN A,
several others to VLAN B, others to VLAN C, and so on.
This allows you to both:
l reduce the number of devices in local broadcast domains
l extend broadcast domains across devices separated by more than one switch
The predominant VLAN standard is 802.1q. This standard adds a VLAN tag to the information in the Ethernet
packet. Since they operate at the switching level, VLANs are Layer 2 technologies -- though they are often
confused with Layer 3 subnetting, because in many configurations there is one VLAN configured per subnet. This
is usually done for the practical purpose of allowing the systems on a VLAN to be managed as a group by other
network management devices/software that work by IP address ranges, for example, rather than VLAN tags.
Configuring VLANs
The following table shows you how to perform VLAN tasks using the CLI and the GUI:
It should be noted that on switch less Equalizers (the E250GX hardware and the Equalizer OnDemand virtual
platform), only one port can be assigned to a VLAN. On Equalizers with a front-panel switch (E350GX, E450GX,
E650GX), multiple ports can be assigned to a VLAN.
Note - The VID values must be between 1 and 4094.
CLI and GUI VLAN Commands
Task Command / Procedure
Add a VLAN
CLI
eqcli > vlan name vid VLAN_ID [parameters]
GUI
1. Right-click VLANs in the left frame.
2. Select Add VLAN from the popup command menu.
3. Enter a VLAN Name and VID (VLAN ID).
4. Click Commit.
Remove a VLAN CLI
eqcli > no vlan name
100
Copyright © 2013 Coyote Point Systems. A subsidiary of Fortinet, Inc.
Comentarios a estos manuales