A VLAN is a group
of end stations in a switched network that is logically segmented by function,
project team, or application, without the limitation to the physical locations
of the users. VLANs have the same attributes as physical LANs, but you can
group end stations even if they are not physically located on the same LAN
Any port can belong
to a VLAN; all unicast, broadcast, and multicast packets are forwarded and
flooded only to end stations in that VLAN. Each VLAN is considered a logical
network. If a packet destination address does not belong to the VLAN, it must
be forwarded through a router.
The following figure
shows VLANs as logical networks. In this diagram, the stations in the
engineering department are assigned to one VLAN, the stations in the marketing
department are assigned to another VLAN, and the stations in the accounting
department are assigned to yet another VLAN.
Figure 1. VLANs as
Logically Defined Networks
VLANs are usually
associated with IP subnetworks. For example, all the end stations in a
particular IP subnet belong to the same VLAN. To communicate between VLANs, you
must route the traffic.
By default, a newly
created VLAN is operational. To disable the VLAN use the
shutdown command. Additionally, you can configure
VLANs to be in the active state (passing traffic), or the suspended state (in
which the VLANs are not passing packets). By default, the VLANs are in the
active state and pass traffic.
The VLAN Trunking
Protocol (VTP) mode is OFF. VTP BPDUs are dropped on all interfaces of the
switch. This process has the effect of partitioning VTP domains if other
switches have VTP turned on.
VLAN can also be configured as a switched virtual interface (SVI). In this
case, the switch ports in the VLAN are represented by a virtual interface to a
routing or bridging system. The SVI can be configured for routing, in which
case it supports Layer 3 protocols for processing packets from all switch ports
associated with the VLAN, or for in-band management of the switch.