Switching Technologies and Virtual LANs
Switching Technologies and Virtual LANs
Learn how Ethernet switches make forwarding decisions, how VLANs divide a physical switch into logical networks, and how STP, trunks, inter-VLAN routing, and switch security keep a modern LAN efficient and resilient.
The Role of Switching in a LAN
A Layer 2 switch connects devices within an Ethernet local area network and forwards frames by examining their destination MAC addresses. Unlike a hub, which repeats every signal out every port, a switch builds a record of where devices are located and sends most frames only through the port that leads to the destination.
This selective forwarding improves bandwidth use and gives every switch port its own collision domain. However, all ports remain in the same broadcast domain unless VLANs or a Layer 3 boundary are introduced.
Forward
Send a frame through the port associated with its destination MAC address.
Filter
Keep a frame from being transmitted through ports where the destination cannot exist.
Flood
Replicate certain frames through all eligible ports except the port on which they arrived.
How a Switch Builds Its MAC Address Table
A switch learns from the source MAC address of every frame it receives. It records the address, the ingress port, and usually the VLAN. This information is held in the MAC address table, also called a Content Addressable Memory (CAM) table.
A frame enters a switch port. The switch reads both the source and destination MAC addresses.
The switch associates the source address with the ingress port and VLAN. Existing entries are refreshed.
The switch looks up the destination address and selects a forwarding action.
Dynamically learned entries eventually age out if no matching source traffic is observed.
| VLAN | MAC address | Port | Type |
|---|---|---|---|
| 10 | 00:1A:2B:3C:4D:01 | Gi0/1 | Dynamic |
| 10 | 00:1A:2B:3C:4D:02 | Gi0/4 | Dynamic |
| 20 | 00:1A:2B:3C:4D:03 | Gi0/7 | Dynamic |
Known Unicast, Unknown Unicast, and Broadcast
| Traffic | Switch action | Reason |
|---|---|---|
| Known unicast | Forward through one matching port | The destination MAC address exists in the table. |
| Unknown unicast | Flood within the VLAN | The destination MAC address has not yet been learned. |
| Broadcast | Flood within the VLAN | The destination is FF:FF:FF:FF:FF:FF and is intended for every host in the broadcast domain. |
| Multicast | Flood or selectively forward | Behaviour depends on multicast features such as IGMP snooping. |
ARP demonstrates the relationship between broadcasts and unicasts. An IPv4 host first broadcasts an ARP request asking which device owns a destination IP address. The owner normally responds with a unicast ARP reply containing its MAC address.
The switch learns where hosts are located and restricts known-unicast traffic to the required path.
Mini MAC-Learning Simulator
Select a frame. Watch the switch learn the source and decide what to do with the destination.
Access Ports, Trunks, and IEEE 802.1Q
An access port normally carries traffic for one VLAN and connects an endpoint such as a workstation, printer, or IP camera. A trunk port carries traffic for multiple VLANs, commonly between switches, a switch and a router, or a switch and a virtualization host.
IEEE 802.1Q inserts a four-byte tag into an Ethernet frame. The tag includes a 12-bit VLAN identifier, allowing VLAN IDs from 0 through 4095; in ordinary configurations, IDs 1–4094 are usable, with 0 and 4095 reserved.
Tagged traffic
Frames carry an 802.1Q VLAN tag so the receiving device can associate them with the correct VLAN.
Native VLAN
Frames belonging to the native VLAN are untagged by default. Native VLAN mismatches can create connectivity and security problems.
Why Redundant Links Can Create Broadcast Storms
Redundant paths improve availability, but Ethernet frames do not contain a Layer 2 equivalent of the IP Time to Live field. If parallel paths form a loop, broadcast and unknown-unicast frames can circulate repeatedly. The results include a broadcast storm, duplicate frames, high link utilization, and an unstable MAC address table known as MAC flapping.
Frames circulate
Flooded frames repeatedly cross the same links.
MAC table instability
The same source appears to arrive through different ports.
LAN disruption
Bandwidth and switch resources become overwhelmed.
Creating a Loop-Free Logical Topology
Spanning Tree Protocol (STP), standardized as IEEE 802.1D, prevents Layer 2 loops by placing selected redundant ports into a non-forwarding state. The physical links remain connected and can be activated if the preferred path fails. Rapid Spanning Tree Protocol (RSTP), IEEE 802.1w, achieves the same purpose with faster convergence.
How the spanning tree is selected
Switches exchange Bridge Protocol Data Units (BPDUs).
The switch with the lowest Bridge ID becomes the root bridge. The ID is influenced by bridge priority and MAC address.
Each non-root switch chooses one root port, representing its best path toward the root bridge.
Each network segment selects a designated port. Alternate redundant paths are prevented from forwarding.
| STP concept | Meaning |
|---|---|
| Root bridge | The reference switch at the centre of the spanning-tree calculation. |
| Root port | The best path from a non-root switch toward the root bridge. |
| Designated port | The forwarding port selected for a LAN segment. |
| Blocked / alternate port | A redundant path held out of forwarding to prevent a loop. |
| Convergence | The period in which switches recalculate and agree on a stable topology. |
Logical Segmentation on Shared Switches
A Virtual LAN (VLAN) creates a logical Layer 2 broadcast domain independent of the physical switch layout. Ports assigned to different VLANs behave as though they were attached to different switches, even when they share the same hardware.
Why organizations use VLANs
Security separation
Place user groups, servers, guests, voice devices, or management interfaces into distinct broadcast domains.
Broadcast control
Limit the scope of broadcasts instead of exposing every switched device to every broadcast.
Flexible organization
Group users by role or policy rather than by their location in a building.
Policy enforcement
Apply routing, access control, quality of service, and monitoring at the boundary between VLANs.
Static VLAN assignment maps a switch port to a VLAN through manual configuration. Dynamic VLAN assignment uses information such as device identity, authentication, or policy to determine the VLAN automatically. Static assignment is simpler and common; dynamic assignment is more flexible but depends on additional control systems.
Communicating Across VLAN Boundaries
Devices in the same VLAN can exchange frames through Layer 2 switching. Devices in different VLANs require a Layer 3 device because each VLAN normally maps to a different IP subnet. The Layer 3 interface for a VLAN becomes the hosts' default gateway.
Separate router interfaces
Each VLAN connects to a different physical router interface. Clear but inefficient at scale.
Router-on-a-stick
One router interface uses tagged subinterfaces over an 802.1Q trunk.
Layer 3 switch
Switch Virtual Interfaces (SVIs) perform routing at high speed inside a multilayer switch.
| VLAN | Example subnet | Default gateway / SVI |
|---|---|---|
| 10 — Sales | 192.168.10.0/24 | 192.168.10.1 |
| 20 — HR | 192.168.20.0/24 | 192.168.20.1 |
| 30 — Voice | 192.168.30.0/24 | 192.168.30.1 |
Operational, Security, and Availability Features
| Feature | Purpose | Key detail |
|---|---|---|
| Port security | Restricts which MAC addresses may use a port. | May use static, dynamically learned, or sticky MAC addresses and can shut, restrict, or protect on violation. |
| Flood guard / storm control | Limits excessive broadcast, multicast, or unknown-unicast traffic. | Helps keep abnormal flooding from consuming the LAN. |
| Port channel | Combines several physical links into one logical link. | Provides added bandwidth and redundancy; protocols include LACP (802.1AX, formerly 802.3ad). |
| PoE | Delivers electrical power over Ethernet cabling. | Powers devices such as wireless APs, VoIP phones, and cameras. |
| PoE budget | Defines total power that a switch can supply. | A switch may have enough ports but insufficient wattage to power every attached device at maximum demand. |
| Management VLAN | Separates switch-management traffic from ordinary user traffic. | Should be protected by access controls and secure management protocols. |
Common Power over Ethernet standards
| Standard | Common name | Maximum power from source | Typical use |
|---|---|---|---|
| IEEE 802.3af | PoE | 15.4 W | Phones, basic cameras |
| IEEE 802.3at | PoE+ | 30 W | Wireless APs, advanced cameras |
| IEEE 802.3bt Type 3 | PoE++ | 60 W | Multiradio APs, displays |
| IEEE 802.3bt Type 4 | Higher-power PoE | 90 W | High-power endpoints |
A Structured Switching and VLAN Checklist
- Verify the physical layer: power, cable, transceiver, port LEDs, negotiated speed, and duplex.
- Check port state: confirm the interface is enabled and not err-disabled or blocked unexpectedly.
- Confirm VLAN membership: validate the access VLAN and ensure the VLAN exists on every required switch.
- Inspect trunks: verify trunk mode, allowed VLANs, tagging, and native VLAN consistency.
- Review the MAC table: determine whether source addresses are learned on the expected interfaces and VLANs.
- Check STP: identify the root bridge and ensure port roles match the intended topology.
- Validate Layer 3: confirm IP subnet, default gateway, SVI state, routing, and access-control rules.
- Look for security actions: review port-security violations, storm-control counters, and authentication results.
Practice Tasks for a Switch Simulator
Task A — Observe learning
- Clear the MAC table.
- Generate traffic between two hosts.
- Inspect learned source addresses.
- Wait or clear entries to observe aging.
Task B — Build VLANs
- Create VLANs 10 and 20.
- Assign access ports.
- Test within each VLAN.
- Confirm that cross-VLAN traffic fails without routing.
Task C — Configure a trunk
- Connect two switches.
- Set the link to 802.1Q trunking.
- Allow the required VLANs.
- Test same-VLAN connectivity across switches.
Task D — Examine STP
- Add a redundant link.
- Identify the root bridge.
- Find the blocked or alternate port.
- Fail the active path and observe convergence.