Changing the roles of routers and switches in VLANs

Changing the roles of routers and switches in VLAN (Virtual LAN) is undoubtedly a good news for network administrators. Because we can easily segment the network by using a virtual LAN, isolate broadcast domains, and improve network performance. At the same time, we can isolate the departments of various hosts to improve their security. Most importantly, implementing these needs is very cheap. Www.2cto.com a virtual LAN can be divided based on the functions, project composition, or department composition of the Network Working Group, without considering the specific geographical location. Simply put, the R & D department on the fourth and fifth floors of an office building can be in the same virtual LAN. It can be seen that the network can be segmented very cheaply to improve the security performance of the network and reduce the occurrence of conflicts. A virtual LAN can divide a user and a terminal device into a logical segment, and then group these logical segments into an exchange network through a virtual LAN switch. Each port of the vswitch can be connected to an independent LAN. The ports allocated to the same virtual LAN share the broadcast domain. Ports of different virtual LAN do not share the broadcast domain. In this way, you can use a virtual network to isolate broadcast domains, thereby improving network performance cheaply, avoiding some common DDOS attacks, and improving network security. Therefore, the appearance of Virtual LAN has changed the way our network administrators work. At the same time, the role of routers and switches has also changed. After understanding these changes, the network administrator helps us design and manage the virtual LAN. Now let's take a look at the specific changes? 1. The transformation of vro roles in Virtual LAN in traditional LAN, vrouters generally only provide firewalls, route processing and allocation, broadcast management, and so on. However, the responsibilities of routers in Virtual LAN have significantly changed with the tasks undertaken by traditional LAN, or the meaning has been derived. The main difference is that the routers in the virtual LAN must also provide information forwarding functions between Working Groups. Vrouters provide two main functions in the virtual LAN. One is to provide users in the virtual LAN with the ability to access shared resources, and the other is to help communication between virtual LAN. We all know that the main function of a virtual LAN is to divide the LAN of an enterprise into several independent ones, which is the same as that of a different LAN. Without the help of routers, these working groups cannot communicate with each other. That is to say, the sales department and the finance department cannot communicate with each other if they are located between two different virtual LAN networks without the help of routers. Www.2cto.com In addition, the router also provides users with virtual LAN access to some shared resources, such as the server path. Most of the current application software is in server/client or server/browser mode. The access traffic to servers is extremely high. For most enterprises, server access efficiency is the bottleneck of enterprise network applications. Therefore, if the server access performance can be improved, the overall network execution efficiency can be improved. The effective method is to isolate the server and reduce the broadcast, thus improving the network operation efficiency of the server. Now, if we divide servers and other working groups into two virtual LAN networks, it will undoubtedly reduce broadcast conflicts and improve network performance. However, the problem is that if the server is in a different virtual LAN from the Working Group, employees of the company cannot access the server normally. Therefore, we also need help from routers to provide access paths to these servers. In practice, our network administrator can economically connect a router to a virtual LAN through one or more Express Trunk Lines. With the help of a vro, the virtual LAN not only provides the logical segmentation function, but also greatly improves the network performance and security. Or, the combination of a virtual LAN and a router is a process in which both parties learn from each other. A company network that uses virtual LAN and routers can improve the information throughput between routers and switches. As we all know, a packet over Ethernet will be sent to all hosts in the LAN. This will undoubtedly increase the working pressure of routers and switch ports in the LAN. With the virtual LAN, data packets are forwarded within a minimum range, so that useless data packets do not occupy the valuable port bandwidth of the vro and vswitch. This increases the information throughput of routers and switches from the other hand. In addition, with the help of routers, the communication and control capabilities of all physical ports in the virtual LAN can be enhanced. 2. Switch role transformation in a virtual LAN switch is one of the core network devices in the virtual LAN. As a terminal device, the switch enters the virtual LAN. It is the entry for information transmission in the virtual LAN, it plays a vital role in Virtual LAN. It is no exaggeration to say that there is no vswitch or virtual LAN. Traditional vswitches generally do not support network segmentation. That is to say, all ports on a vswitch are in the same LAN. However, with the advent of the virtual LAN technology, the network ports on a vswitch can also belong to different network segments. In other words, you can use vswitches and the virtual LAN technology to segment networks. If vswitches support the virtual LAN technology, they can determine whether to filter the data packet or forward the data packet based on the preset rules of our network administrator. If it is forwarding, it will forward data to other switches or routers in the network. For example, the most common methods for a vswitch to filter data include swap filtering and swap table marking. Both methods analyze the data packets through the vswitch, and combine the pre-defined virtual LAN rules, and then decide whether to forward or filter. Most importantly, these tasks can be centrally managed and easily applied to the enterprise LAN. The vswitch that uses the token filtering method checks all the token information passing through the vswitch. In addition, each vswitch has a filter table. In this way, the switch can flexibly control data forwarding and provide a high-level management control. For example, the enterprise LAN can be divided into different segments based on the IP addresses, MAC addresses, and network layer protocols of end users. When a data packet is forwarded on this vswitch, The vswitch combines the information about the data shard and determines the related operations by referring to the internal filter table. However, this processing mechanism is a relatively early processing method. Because the switch needs to perform similar inspection, judgment, and processing on all data shards through it, if this mode is used, its Virtual LAN is not very efficient. Therefore, in the early days, even if a company adopted a virtual LAN, it would not feel any improvement in LAN performance. Www.2cto.com currently many VLAN switches use the routing label method. A unique identifier is added to the header of each shard when the primary route is forwarded. When a virtual LAN switch forwards the token, such as broadcasting it to other switches, routers, or other interrupt devices, it will check the token. This identifier is cleared when the hacker leaves the trunk line, or when the data hacker leaves the VPC switch. That is to say, other devices do not need to check this identifier. Because the second layer of the network protocol checks the ingress, its useful resources are relatively small, and the impact on network performance is also very limited. In addition, this method also provides good flexibility and can be well implemented during subsequent network upgrades. Therefore, in a large enterprise network, I still set up a virtual LAN switch using the routing filter method. Now this technology has been adopted by IEEE organizations. It can be seen that the appearance of the virtual LAN expands the application scope of the switch, allowing the switch to transfer data from the traditional to the current smart segmentation of the LAN. This is an improvement in the quality of a vswitch, greatly improving the price/performance ratio of the vswitch. Finally, I would like to remind you that although the management of Virtual LAN is flexible, its flexibility is also closely related to the design of virtual LAN and the equipment used. To improve the flexibility and scalability of the virtual LAN, we need to adopt Dynamic Virtual LAN when designing a virtual LAN; when using a port-centered virtual LAN or Static Virtual LAN, you must be careful. Relatively speaking, the flexibility and scalability of Dynamic Virtual LAN are higher than those of the latter two, but their security is worse than that of the other two methods. On the contrary, a port-centered virtual LAN or a Static Virtual LAN is slightly less flexible and scalable. However, it is more secure. Therefore, when designing a virtual LAN, enterprises still need to obtain a balance point here. According to the author's suggestion, it is best to adopt Dynamic Virtual LAN for scalable enterprises. According to my many years of work experience, for some growing enterprises, it is often necessary to adjust the organizational structure. Therefore, such growth enterprises have high requirements on the flexibility of network applications.