Note: Many topics at this site are reduced versions of the text in "The Encyclopedia of Networking and Telecommunications." Search results will not be as extensive as a search of the book's CD-ROM.

Most enterprises have moved toward the switched network paradigm, in which computers are connected to dedicated ports on Ethernet switches, Gigabit Ethernet switches, ATM switches, or other types of switches. Switching devices support network designs in which the entire network is one big flat network as opposed to many subnetworks interconnected by routers. In a flat network, all workstations are in the same broadcast domain. Any computer can directly communicate with any other computer. This has advantages and disadvantages that will be discussed here.

A flat network easily interconnects all systems into a single broadcast domain, but a single broadcast domain has drawbacks related to security, network traffic problems, and a loss of local management. Some administrators prefer traditional subnetwork designs, which can be introduced into flat switched network designs with VLANs. The IEEE 802.1Q VLAN standard was rolled out to provide important VLAN techniques required to build large switched networks. The IEEE standard is discussed later.

A basic VLAN is pictured in Figure V-1. All the computers are connected to the same network. Two logical subnets in the form of VLANs overlay the physical network. In older physical LAN models, all the computers in Sales were connected to the same physical network within the same physical area. In the VLAN model, a computer at any location on the physical network can participate in a VLANs. For example, users in different buildings on the same campus can be part of the same VLAN group, broadcasting messages to one another and sharing the same group servers, printers, and other resources.

Keep in mind that the underlying physical network for VLANs is a flat switched network. VLANs overlay this topology. Routers are still needed to forward packets between VLANs, as shown on the left in Figure V-2. They provide a way for each VLAN to maintain its autonomy and broadcast nature while forwarding packets between VLANs when necessary. Routing allows administrators to put security policies in place as well, such as packet-filtering techniques, as discussed under "Firewall." An optimally designed network will have VLANs configured to reduce as much inter-VLAN routing as possible.

While routing adds the advantages of subnetworking back into the flat switched network topology, routing packets is slower than switching them (unless layer 3 routing is used, which reduces the need for VLANs, as discussed later). Even though a network may be subdivided into VLANs, the underlying network is still capable of switching packets to any computer at high speed. So the "route first, then switch" (or "cut-through" routing) technique is applied to boost performance. A router is initially used to establish a route between two systems in different VLANs and to provide security aspects of verifying that the two systems can set up a connection. Once the route is established and security is checked, packets are switched using the layer 2 switching fabric. This basically avoids moving all but the first few packets through the slow router once it has done its job. In some environments, a route server calculates routes, but all packets are switched. See "IP over ATM."

Figure V-3 illustrates how VLANs are configured. The bottom of the illustration shows the structure of the physical LAN. Backbone switches and local area switches provide VLAN configuration functions.

The network administrator includes a computer (or user) in a VLAN based on a switch port address, a computer hardware address (the MAC, or Medium Access Control address of a network interface card), an IP address, or some other method. In Figure V-3, when computer B transmits, it sends a message that is broadcast to all the computers in the Marketing VLAN, which includes computers E, G, H, and J. If computer B needs to send a message to a user in the Research VLAN, the message must be routed. This is handled by a routing function in the backbone switch or by a separate router.

VLANs are essential in organizations in which users move from one group to another, or the structure of the organization is such that members of the same workgroup are located in different physical locations. VLANs let scattered group members share common resources, such as storage devices, and be part of the same broadcast domain. In other words, traffic generated by users in a group should stay confined to their group. If users are highly mobile and move from one office to another as part of their job, the network administrator can use VLAN techniques to keep the user within a broadcast group no matter where they plug into the network.

With the advent of routing switches, as described under "Multilayer Switching," VLAN usage has fallen off. Routing switches perform routing in hardware, which removes the performance problem of traditional software-based routers. These switches are said to route at wire speed. Thus, high-performance, inexpensive, well-understood routing via routing switches has supplanted VLANs. Still, many of these routing switches support VLAN technologies, so VLANs can be configured if necessary.

VLANs have always been difficult to configure, while routed subneting is well understood. In addition, the network design supported by VLANs is not as practical in enterprise networks where traffic heads straight for enterprise data centers and the Internet, rather than servers and other devices within "local" groups.