الدرس 41 · التبديل على نطاق واسع

Routing between VLANs

لم يُترجم بعد؛ يُعرض باللغة الإنجليزية

VLANs keep groups of devices apart on one switch, so a PC in VLAN 10 cannot reach a printer in VLAN 20 on its own. Follow one print job as it is tagged up a trunk to a router on a stick, routed, checked by an ACL and sent back down tagged for the other VLAN; then see how a layer 3 switch does the same job inside itself.

9 دقيقة10 خطوات5 أسئلةBeginner

شكل 41 · تفاعلي

جارٍ تحميل الرسم…

أو ← →

اختبر نفسك

5 أسئلة سريعة

اختر إجابة لتعرف السبب. تُحفَظ نتيجتك مع تقدّمك.

01A PC in VLAN 10 and a printer in VLAN 20 are plugged into the same switch. Why can't the PC's frames reach the printer directly?

Each VLAN is its own LAN and its own subnet. Getting from one to the other means going through a router (or a layer 3 switch) acting as each VLAN's gateway.

02On the trunk between the switch and the router on a stick, how does the router know which VLAN a frame belongs to?

The tag (TPID 0x8100 plus a 12-bit VLAN ID) tells the router which subinterface the frame arrived on. Access ports to the PC and printer carry no tag.

03The packet leaves the router for the printer. What has changed compared with the frame the PC sent?

Routing builds a new frame: from the router's MAC to the printer's MAC, tagged for VLAN 20. The IP addresses travel unchanged; TTL drops by one at the router.

04What is an SVI on a layer 3 switch?

With one SVI per VLAN (here 192.168.10.1 and 192.168.20.1) the switch routes in its own hardware at line rate, so no trip up a trunk to an outside router is needed.

05Why is the router (or layer 3 switch) a good place for an ACL between VLANs?

VLANs isolate by default; the routing point is the one doorway between them. Rules there can permit some traffic (printing on TCP 9100) and deny the rest.

المصطلحات الأساسية

المسرد

VLAN: Virtual LAN: a group of switch ports that act as their own separate LAN, with their own subnet, even though they share one switch.
Access port: A switch port in a single VLAN. Frames on it carry no VLAN tag, so the device plugged in does not need to know VLANs exist.
Trunk: A link that carries frames for several VLANs, each marked with an 802.1Q tag saying which VLAN it belongs to.
802.1Q tag: Four bytes added after the source MAC address: 0x8100, then a priority and a 12-bit VLAN ID (1 to 4094).
Router on a stick: A router joined to a switch by one trunk port, with one subinterface per VLAN, each acting as that VLAN's default gateway.
Subinterface: A virtual slice of one physical router port, tied to one VLAN tag and given its own IP address.
SVI: Switch virtual interface: a layer 3 switch's routed interface for one VLAN, holding that VLAN's gateway address.
ACL: Access control list: an ordered list of permit and deny rules a router or layer 3 switch checks for each packet; first match wins.

تفاصيل إضافية

الملاحظات والمصادر

Addresses are examples: 192.168.10.0/24 and 192.168.20.0/24 are private ranges (RFC 1918); MAC addresses are documentation values (RFC 7042, 00:00:5e:00:53:xx).
The PC already knows the gateway’s MAC and the router already knows the printer’s from earlier ARP exchanges, so ARP is not shown.
Both subinterfaces use the router port’s single MAC address, as most routers do. A VLAN ID can be 1 to 4094; 0 and 4095 are reserved (IEEE 802.1Q).
A trunk can carry one VLAN untagged, the native VLAN (often VLAN 1). VLANs 10 and 20 are not native here, so their frames are tagged.

اختبار يتاح بعد الخطوة الأخيرة.