What is a VLAN, and how to build one

[00:00:03]This is Sally. Her business has been growing. She used to run everything from her laptop at home, but now she has an actual office, desks, employees, a small team.

[00:00:13]Like most small businesses, she set up her network pretty simply.

[00:00:17]Everyone plugs their computer into a switch. The switch connects to the router, and the router connects the office to the internet.

[00:00:25]And for a while, everything works fine.

[00:00:27]But now that her company is growing, Sally has started noticing a problem.

[00:00:32]In fact, she has two teams.

[00:00:34]Her sales team works with customer information, contact details, pricing proposals, and client contracts.

[00:00:42]Her engineering team works with completely different things, source code, product prototypes, and technical documentation.

[00:00:49]Right now, every computer in her office is on the same network, which means anything on any computer can in principle reach anything on any other computer.

[00:00:58]If a salesperson's laptop gets infected with malware, that malware can reach the engineering team's files.

[00:01:04]If an engineer accidentally misconfigures a share, the sales team can see internal technical documents.

[00:01:10]Sally wants to separate the two teams.

[00:01:13]Not physically, because they still share the same office space and the same network equipment, but logically.

[00:01:19]She wants each team to only see its own traffic.

[00:01:22]The technology that allows her to do this is called a VLAN.

[00:01:26]Now you might be wondering, what exactly is a VLAN?

[00:01:30]VLAN stands for virtual local area network. And the name actually tells us a lot, so let's break it down.

[00:01:37]A LAN, or local area network, is what happens when computers are connected together on the same network. They can see each other, talk to each other, share resources.

[00:01:47]Virtual means the LAN isn't defined by physical wiring. It's defined by configuration.

[00:01:52]You can have multiple logical LANs sharing the same physical equipment, and each computer only sees the LAN it's been assigned to.

[00:01:59]Here is Sally's company's network. Sally knows her business, but networking isn't her area of expertise. So, she hired Chuck, a network guru who knows exactly how to fix this kind of problem.

[00:02:11]Chuck arrives that morning, grabs a couple of cups of coffee, sits down at the console, and gets to work.

[00:02:17]Let's look over his shoulder and see how he builds Sally's VLAN setup.

[00:02:21]First, Chuck takes a look at Sally's physical network.

[00:02:24]She has one Cisco switch, the same type of switch you would find in a small business office.

[00:02:29]Connected to that switch are three computers.

[00:02:32]On the left, there is PC 1, a sales team laptop.

[00:02:36]In the middle, a second PC, an engineering laptop, and on the right, a third PC, another sales team laptop.

[00:02:43]All three computers are plugged into the same physical switch.

[00:02:47]Right now, they are all on the same network.

[00:02:50]Chuck launches the PC to inspect their IP addresses.

[00:02:54]The first sales PC has the IP address 192.168.1.10, the engineering PC has 192.168.1.20, and second sales PC has 192.168.1.30.

[00:03:10]This is Chuck's starting point. One switch, three computers, and no VLAN configured yet.

[00:03:16]Let's confirm they can all reach each other, starting with PC 1.

[00:03:20]Can it ping the engineering PC?

[00:03:22]Yes, it can.

[00:03:24]Can it ping the other sales PC?

[00:03:27]Yes, it can.

[00:03:28]And the same is true in the other direction. PC 2 and PC 3 can also reach the other computers on the network.

[00:03:35]As you can see, everyone can communicate with everyone else.

[00:03:39]That's the normal behavior of a basic switch with no VLAN configuration.

[00:03:43]But now, watch what happens when Chuck adds VLANs.

[00:03:47]To configure the VLANs, Chuck opens the switch's command line interface.

[00:03:51]This is a text-based interface that allows to configure and manage the switch through typed commands.

[00:03:57]The first thing he does is enter privileged mode.

[00:04:01]This is done with the enable command.

[00:04:03]This command gives Chuck access to the switch's administrative commands.

[00:04:07]In normal user mode, he can only view basic information. To make changes, he needs elevated privileges.

[00:04:14]Next, he enters configuration mode.

[00:04:16]The command for this is configure terminal. This tells the switch that he wants to start changing the configuration.

[00:04:23]Now, Chuck can create the VLANs. First, he creates VLAN 10 by simply typing VLAN 10.

[00:04:31]The number 10 is simply the VLAN ID.

[00:04:34]VLAN IDs are just labels that the switch uses to identify different virtual networks.

[00:04:40]There is nothing special about the number 10. Chuck could have chosen another valid VLAN number.

[00:04:46]Network engineers often use numbers like 10, 20, or 30 because they are easy to remember.

[00:04:52]Notice that the command prompt has changed from config to config VLAN.

[00:04:56]That's because Chuck is now configuring VLAN 10 specifically. Any commands he enters now will apply to this VLAN until he exits back to global configuration mode.

[00:05:05]Next, he gives this VLAN a name, namely sales.

[00:05:09]The name command tells the switch to assign a name to the VLAN. In this case, VLAN 10 is named sales.

[00:05:16]The name does not affect how the VLAN works. It is just a description that makes the configuration easier for humans to understand. Now, he exits VLAN configuration mode using the exit command.

[00:05:27]Now, Chuck creates the second VLAN.

[00:05:30]The command VLAN 20 creates a new VLAN with ID 20. Again, the number is just an identifier.

[00:05:36]Then, he names it engineering and exits the VLAN 20 configuration.

[00:05:41]Now, the switch knows that two separate VLANs exist. VLAN 10 for sales and VLAN 20 for engineering.

[00:05:48]But, there is one important thing to know. Creating VLANs does not automatically move any computers into them.

[00:05:54]Right now, every switch port is still assigned to the default VLAN, which is VLAN 1 on Cisco switches.

[00:06:01]So, even though VLAN 10 and VLAN 20 now exist, none of the computers are using them yet.

[00:06:06]The next step is to assign each switch port to the correct VLAN.

[00:06:10]So, now Chuck needs to tell the switch which ports belong to which VLAN.

[00:06:14]He starts with the port where sales laptop is connected.

[00:06:18]The interface command tells the switch which physical port Chuck wants to configure. In this case, it's Ethernet 0/1, the port connected to sales PC 1.

[00:06:28]Notice that the command prompt changes from config to config if. That's because Chuck is now configuring a specific interface.

[00:06:36]Next, he enters switchport mode access.

[00:06:40]The switchport mode access command tells the switch that this port is an access port.

[00:06:45]Access ports connect end devices like laptops, desktops, printers, or servers, and they carry traffic for only one VLAN.

[00:06:53]Now, Chuck assigns this port to the sales VLAN with the command switchport access VLAN 10.

[00:07:00]This places port Ethernet 0/1 into VLAN 10.

[00:07:04]That means any device plugged into this port automatically becomes part of the sales network.

[00:07:09]And that's it for the first sales laptop.

[00:07:12]Next, Chuck configures the engineering laptop. The commands are the same.

[00:07:17]Port Ethernet 0/2 is connected to the engineering PC, so Chuck assigns it to VLAN 20, the engineering VLAN.

[00:07:24]Finally, he configures the second sales laptop.

[00:07:27]Since sales PC 2 also belongs to the sales team, port Ethernet 0/3 is assigned to VLAN 10.

[00:07:34]That's it. The configuration is complete. Sales laptop 1 and sales laptop 2 are now members of VLAN 10, and engineering PC is a member of VLAN 20.

[00:07:44]Notice that nothing has changed physically. The same three computers are still connected to the same switch using the same network cables.

[00:07:52]The only thing that changed is the switch's configuration. Let's see what happens now when the computers try to communicate.

[00:07:59]First, laptop one tries to reach the other sales laptop.

[00:08:03]Both are in the sales team. Both are in VLAN 10.

[00:08:07]That works fine. They can talk to each other.

[00:08:10]Now laptop one tries to reach the engineering PC. So sales laptop trying to reach engineering PC.

[00:08:16]Nothing. Zero replies.

[00:08:19]Let's test the connection in the other direction.

[00:08:22]Can the engineering PC reach the sales laptops?

[00:08:26]No response from sales laptop one.

[00:08:28]What about sales laptop two?

[00:08:31]Also, no reply. [music] The separation works both ways.

[00:08:36]Remember that these three computers are still connected to the same physical switch.

[00:08:40]The cables have not changed. The switch has not changed. The only difference is that they are now in different VLANs.

[00:08:47]Sales laptop one and sales laptop two are both in VLAN 10.

[00:08:51]The engineering PC is in VLAN 20.

[00:08:54]The switch is treating them as two completely separate networks. Almost like there are two different switches sitting inside the same physical device.

[00:09:02]And that is the power of a VLAN.

[00:09:04]So what actually happened inside the switch?

[00:09:07]Let's take a closer look at what the switch is actually doing.

[00:09:10]When laptop one sends a packet to the engineering PC, the frame arrives at the switch on port Ethernet 0/1.

[00:09:18]The switch checks its configuration and sees this port belongs to VLAN 10.

[00:09:23]Next, it looks for the destination device.

[00:09:26]The engineering PC is connected to port Ethernet 0/2.

[00:09:30]But that port belongs to VLAN 20.

[00:09:33]At this point, the switch stops.

[00:09:35]It does not forward the traffic because VLAN 10 and VLAN 20 are separate layer two networks.

[00:09:42]From the switches perspective, these are two completely separate switches that just happen to exist inside the same physical device.

[00:09:50]That's the idea behind VLANs.

[00:09:52]A VLAN allows one physical switch to act like multiple independent switches.

[00:09:58]A hospital can use VLANs to keep patient monitoring equipment separate from staff computers.

[00:10:03]A university can use VLANs to separate student Wi-Fi from administrative systems.

[00:10:07]A retail company can use VLANs to keep payment terminals isolated from public guest Wi-Fi.

[00:10:13]In every case, the idea is the same.

[00:10:15]Just because devices share the same physical equipment doesn't mean they should share the same network.

[00:10:20]VLANs allow one physical switch to become multiple logical networks, giving different groups their own separate space while still using the same hardware.

[00:10:28]And that's exactly what Chuck did for Sally.

[00:10:31]Sally had one flat network where every device was on the same logical network.

[00:10:36]Now she has two separate networks running on the same physical switch.

[00:10:40]The sales team has its own VLAN and the engineering team has its own VLAN. Same office, same cables, same hardware, but now each team has its own isolated network space.

[00:10:53]You've been on VLANs your whole life.

[00:10:55]Now you know what they are.

[00:10:57]That's it for today. Thanks for watching.

[00:11:00]If you found this helpful, hit the like button, subscribe, and turn on notifications so you don't miss the next episode.

[00:11:06]See you there. Bye-bye.