VLAN
VLAN
1. Function Overview
VLAN (Virtual LAN) is technology that allows a LAN to be constructed virtually, without regard to the physical structure of connections.
This product lets you use VLANs to divide the LAN into multiple broadcast domains.
The VLANs that are supported by this product are shown below.
VLAN types | Summary |
---|---|
Port-based VLAN |
Groups that can communicate are configured for each LAN/SFP port. |
Tagged VLAN |
Groups that can communicate are identified, based on the fixed-length tag information appended to the Ethernet frame. |
Private VLAN |
Groups that can communicate within the same VLAN can be divided up. It consists of the following three types of VLANs: |
Multiple VLAN |
Each LAN/SFP port can be divided into multiple groups that can communicate. |
Voice VLAN |
This allows audio and data to be handled separately on an access port. |
2. Definition of Terms Used
Broadcast domain
This is a range in which broadcast frames can be delivered in a network, such as an Ethernet.
Devices that are connected by relaying a data link layer (MAC layer), such as switching hubs, can belong to the same broadcast domain.
A broadcast domain generally refers to the network in an Ethernet.
3. Function Details
3.1. Defining a VLAN ID
On product, a maximum of 255 VLANs can be defined, with VLAN IDs ranging from 2–4094. (ID #1 is used as the default VLAN ID.)
VLAN IDs are defined using the vlan command, after the vlan database command is used to enter VLAN mode.
For details, refer to the Command Reference.
3.2. VLAN settings for the LAN/SFP ports
The following settings must be configured after defining the VLANs to use, in order to make use of VLAN on this product.
-
Set LAN/SFP port mode settings
-
Set associated VLAN for LAN/SFP ports
-
The LAN/SFP ports on this product are set to one of the following modes.
-
Access port
This is a port that handles untagged frames. It can be associated with one VLAN. -
Trunk port
This is a port that handles both tagged and untagged frames.
It can be associated with multiple VLANs, and is mainly used to connect switches to one another.
This product only supports IEEE 802.1Q. (Cisco ISL is not supported.)
-
-
Use the switchport mode command to set the LAN/SFP port mode.
When setting the trunk port, use the input filter (“ingress-filter”) to control whether frames not belonging to the specified VLAN ID will be handled.-
Input filter enabled: Only frames set to the specified VLAN ID will be handled.
-
Input filter disabled: Frames with any VLAN ID will be handled.
-
-
Use the show interface switchport command to check the LAN/SFP port setting mode.
-
Use the switchport access vlan command to set which VLANs belong to the access port.
-
Use the switchport trunk allowed vlan command to set which VLANs belong to the trunk port.
As the trunk port can be associated with multiple VLANs, use the “all”, “none”, “except”, “add” and “remove” settings as shown below.-
add
Adds the specified VLAN ID.
VLAN IDs that can be added are limited by the IDs that are defined by the VLAN mode. -
remove
Deletes the specified VLAN ID. -
all
Adds all VLAN IDs specified by the VLAN mode.
The VLAN IDs added by the VLAN mode can also be added after this command is executed. -
none
The trunk port will not be associated with any VLAN. -
except
Adds all other VLAN IDs except for the ones specified.
The VLAN IDs added by the VLAN mode can also be added after this command is executed.
-
-
A VLAN that uses untagged frames (native VLAN) can be specified for the trunk port.
-
Tagged audio frames can be transferred by specifying a voice VLAN for an access port.
-
Use the show vlan command to check which VLANs belong to a LAN/SFP port.
3.3. VLAN access control
This product provides an VLAN access map function, to control access to the VLAN.
The VLAN access map can be associated with a standard/extended IP access control list and a MAC address control list as VLAN ID filtering parameters.
The VLAN access map is operated using the commands shown below.
-
Create VLAN access map: vlan access-map command
-
Set VLAN access map parameters: match access-list command
-
Assign VLAN access map: vlan filter command
-
Show VLAN access map: show vlan access-map command
3.4. Default VLAN
The default VLAN is VLAN #1 (vlan1), which exists in this switch by default.
As the default VLAN is a special VLAN, it always exists and cannot be deleted.
The following operations can be used to automatically delete the relevant port from the default VLAN.
-
Setting the VLAN for an access port
-
Setting any VLAN other than the default as the native VLAN for the trunk port
-
Setting the native VLAN for the trunk port to “none”
3.5. Native VLAN
A native VLAN is a VLAN that associates untagged frames received by the LAN/SFP port that was set as a trunk port.
Defining an LAN/SFP port as a trunk port will set the default VLAN (VLAN #1) as the native VLAN.
Use the switchport trunk native vlan command when specifying a certain VLAN as the native VLAN.
If you do not want to handle untagged frames on the LAN/SFP port, you can set the native VLAN to none. (Specify “none” with the “switchport trunk native vlan” command.)
3.6. Private VLAN
This product can configure a private VLAN for further dividing up groups that can communicate within the same subnet.
The operating specifications are shown below.
-
A private VLAN contains the following three VLAN types.
-
Primary VLAN
This is the parent VLAN of the secondary VLAN.
Only one primary VLAN can be set per private VLAN. -
Isolated VLAN
This is a kind of secondary VLAN, which only sends traffic to a primary VLAN.
Only one primary VLAN can be set per private VLAN. -
Community VLAN
This is a kind of secondary VLAN, which only sends traffic to VLANs in the same community and to a primary VLAN.
Multiple community VLANs can be set for each private VLAN.
-
-
A primary VLAN may contain multiple promiscuous ports.
Access ports, trunk ports, or static/LACP logical interfaces are the ports that can be used as promiscuous ports. -
Only access ports can be used as host ports for a secondary VLAN (isolated VLAN, community VLAN).
-
A secondary VLAN (isolated VLAN, community VLAN) can be associated with one primary VLAN.
Use the switchport private-vlan mapping command to create the association.-
An isolated VLAN can be associated with multiple promiscuous ports contained within a private VLAN.
-
A community VLAN can be associated with multiple promiscuous ports contained within a private VLAN.
-
3.7. Voice VLAN
Voice VLAN is a function that can prevent audio from being adversely affected even when IP phone voice traffic is mixed with PC data traffic.
Some IP phones have two ports: a port for connection to the network switch and a port for connection to the PC.
By connecting the network switch to the IP phone, and the IP phone to the PC, it is possible to use one port of the network switch to handle the IP phone audio traffic and the PC’s data traffic.
Using the voice VLAN function in this type of configuration allows the audio data and the PC data to be separated so that noise is less likely to occur on the IP phone, or to handle the audio data with a higher priority.
Voice VLAN settings are made by the switchport voice vlan command.
Set one of the following to be handled as voice traffic.
-
Frames with the 802.1p tag
-
Priority tag frames (802.1p tags with a VLAN ID of 0 and only the CoS value specified)
-
Untagged frames
When tagged frames are handled as voice traffic, untagged frames are handled as data traffic.
By using LLDP, this product can automatically apply settings to a connected IP telephone.
The conditions for making automatic settings are as follows.
-
LLDP-MED TLV transmission is enabled on the port for which voice VLAN is enabled.
-
The connected IP phone supports settings via LLDP-MED.
If the above conditions are satisfied, and when an IP phone is connected to the corresponding port, voice VLAN information (tagged/untagged, VLAN ID, the CoS value to be used, DSCP value) are notified according to the Network Policy TLV of LLDP-MED when an IP phone is connected to the corresponding port.
The IP phone will transmit voice data according to the information that was provided to it from this unit.
The CoS value specified for the IP phone is set by the switchport voice cos command, and the DSCP value is set by the switchport voice dscp command.
In order to give priority to handling voice traffic, QoS settings (enable QoS, set trust mode) according to the IP phone settings are also required.
The limitations of voice VLAN are as follows.
-
It can be used only on a physical interface port that is assigned as an access port.
It cannot be used on a link aggregation logical interface or on a VLAN logical interface. -
The voice VLAN function and the port authentication function cannot be used together.
4. Related Commands
4.1. List of related commands
-
Related commands are indicated below.
Operations Operating commands Enter VLAN mode
vlan database
Define VLAN interface, or change a predefined VLAN
vlan
Define a private VLAN
private-vlan
Set the secondary VLAN for a private VLAN
private-vlan association
Create VLAN access map
vlan access-map
Set VLAN access map parameters
match
Assign VLAN access map to VLAN
vlan filter
Set access port (untagged port)
switchport mode access
Set associated VLAN of an access port (untagged port)
switchport access vlan
Set trunk port (tagged port)
switchport mode trunk
Set associated VLAN for trunk port (tagged port)
switchport trunk allowed vlan
Set native VLAN for trunk port (tagged port)
switchport trunk native vlan
Set ports for private VLAN (promiscuous port, host port)
switchport mode private-vlan
Configure VLAN for private VLAN port and host port
switchport private-vlan host-association
Configure VLAN for private VLAN port and promiscuous port
switchport private-vlan mapping
Configure voice VLAN
switchport voice vlan
Set CoS value for voice VLAN
switchport voice cos
Set DSCP value for voice VLAN
switchport voice dscp
Show VLAN information
show vlan
Show private VLAN information
show vlan private-vlan
Show VLAN access map
show vlan access-map
Show VLAN access map filter
show vlan filter
5. Examples of Command Execution
5.1. Port-based VLAN settings
In this example, a port-based VLAN is configured for this product in order to allow communication between hosts A–B and hosts C–D.
The LAN port settings for this product are as follows.
-
LAN ports #1 and #2: Set as access port, and associated with VLAN #1000
-
LAN ports #3 and #4: Set as access port, and associated with VLAN #2000
■ Setting Procedure
-
Switch to VLAN mode using the vlan database command, and define two VLANs using the vlan command.
Yamaha(config)# vlan database (1) Yamaha(config-vlan)# vlan 1000 (2) Yamaha(config-vlan)# vlan 2000 (3) Yamaha(config-if)# exit
1 Switch to VLAN mode 2 Create VLAN #1000 3 Create VLAN #2000 -
Set LAN ports #1–2 as access ports, and associate them with VLAN #1000.
Yamaha(config)# interface port1.1-2 (1) Yamaha(config-if)# switchport mode access (2) Yamaha(config-if)# switchport access vlan 1000 (3) Yamaha(config-if)# exit
1 Switch to interface mode 2 Set the ports as access port 3 Define a VLAN ID -
Set LAN ports #3–4 as access ports, and associate them with VLAN #2000.
Yamaha(config)# interface port1.3-4 Yamaha(config-if)# switchport mode access Yamaha(config-if)# switchport access vlan 2000 Yamaha(config-if)# exit
-
Confirm the VLAN settings.
Yamaha#show vlan brief (u)-Untagged, (t)-Tagged VLAN ID Name State Member ports ======= ================ ======= =============================== 1 default ACTIVE port1.5(u) port1.6(u) port1.7(u) port1.8(u) 1000 VLAN1000 ACTIVE port1.1(u) port1.2(u) 2000 VLAN2000 ACTIVE port1.3(u) port1.4(u)
5.2. Tagged VLAN settings
In this example, a tagged VLAN is configured between #A and #B of this product, in order to communicate between hosts A–B and hosts C–D.
The LAN port settings for #A and #B of this product are as follows.
-
LAN port #1: Set as access port, and associated with VLAN #1000
-
LAN port #2: Set as access port, and associated with VLAN #2000
-
LAN port #3: Set as trunk port, and associated with LAN #1000 and VLAN #2000
-
[Switch #A/#B] Define VLAN.
Yamaha(config)#vlan database (1) Yamaha(config-vlan)#vlan 1000 (2) Yamaha(config-vlan)#vlan 2000 (3)
1 Switch to vlan mode 2 Define VLAN #1000 3 Define VLAN #2000 -
[Switch #A/#B] Set LAN port #1 as the access port, and associate it with VLAN #1000.
Yamaha(config)#interface port1.1 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport access vlan 1000 (3) Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Associate it with VLAN #1000 -
[Switch #A/#B] Set LAN port #2 as the access port, and associate it with VLAN #2000.
Yamaha(config)#interface port1.2 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport access vlan 2000 (3) Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Associate it with VLAN #2000 -
[Switch #A/#B] Set LAN port #3 as a trunk port, and associate it with VLAN #1000/#2000.
Yamaha(config)#interface port1.3 (1) Yamaha(config-if)#switchport mode trunk (2) Yamaha(config-if)#switchport trunk allowed vlan add 1000 (3) Yamaha(config-if)#switchport trunk allowed vlan add 2000 (4) Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the port as trunk port 3 Add VLAN #1000 4 Add VLAN #2000 -
Confirm the VLAN settings.
Yamaha#show vlan brief (u)-Untagged, (t)-Tagged VLAN ID Name State Member ports ======= ================================ ======= ====================== 1 default ACTIVE port1.3(u) 1000 VLAN1000 ACTIVE port1.1(u) port1.3(t) 2000 VLAN2000 ACTIVE port1.2(u) port1.3(t)
5.3. Private VLAN settings
This example makes private VLAN settings for this product, to achieve the following.
Hosts connected to ports 1–7 will connect to the Internet and other external lines, through the line to which port 8 is connected
Communications between hosts connected to ports 1–4 are blocked (isolated VLAN: VLAN #21)
Communications between hosts connected to ports 5–7 are permitted (community VLAN: VLAN #22)
Communications between hosts connected to ports 1–4 and ports 5–7 are blocked
-
Define the VLAN ID to be used for the private VLAN.
Yamaha(config)# vlan database (1) Yamaha(config-vlan)# vlan 2 (2) Yamaha(config-vlan)# vlan 21 Yamaha(config-vlan)# vlan 22 Yamaha(config-vlan)# private-vlan 2 primary (3) Yamaha(config-vlan)# private-vlan 21 isolated (4) Yamaha(config-vlan)# private-vlan 22 community (5) Yamaha(config-vlan)# private-vlan 2 association add 21 (6) Yamaha(config-vlan)# private-vlan 2 association add 22 Yamaha(config-vlan)# exit
1 Switch to VLAN mode 2 Create VLAN 3 Configure primary VLAN 4 Configure isolated VLAN 5 Configure community VLAN 6 Associate the ports with primary VLAN -
Configure the isolated VLAN (VLAN #21) for LAN ports 1–4.
Yamaha(config)#interface port1.1-4 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport access vlan 21 (3) Yamaha(config-if)#switchport mode private-vlan host (4) Yamaha(config-if)#switchport private-vlan host-association 2 add 21 Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Associate the ports with VLAN #21 4 Set the ports as private VLAN host port -
Configure the community VLAN (VLAN #22) for LAN ports 5–7.
Yamaha(config)#interface port1.5-7 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport access vlan 22 (3) Yamaha(config-if)#switchport mode private-vlan host (4) Yamaha(config-if)#switchport private-vlan host-association 2 add 22 Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Associate the ports with VLAN #22 4 Set the ports as private VLAN host port -
Configure the primary VLAN (VLAN #2) for LAN port 8. (Promiscuous port)
Yamaha(config)#interface port1.8 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport access vlan 2 (3) Yamaha(config-if)#switchport mode private-vlan promiscuous (4) Yamaha(config-if)#switchport private-vlan mapping 2 add 21 Yamaha(config-if)#switchport private-vlan mapping 2 add 22 Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Associate the ports with VLAN #2 4 Set the ports as private VLAN promiscuous port -
Confirm the VLAN settings.
Yamaha#show vlan brief (u)-Untagged, (t)-Tagged VLAN ID Name State Member ports ======= ================================ ======= ====================== 1 default ACTIVE 2 VLAN0002 ACTIVE port1.8(u) 21 VLAN0021 ACTIVE port1.1(u) port1.2(u) port1.3(u) port1.4(u) 22 VLAN0022 ACTIVE port1.5(u) port1.6(u) port1.7(u) Yamaha#show vlan private-vlan PRIMARY SECONDARY TYPE INTERFACES ------- --------- ---------- ---------- 2 21 isolated port1.1 port1.2 port1.3 port1.4 2 22 community port1.5 port1.6 port1.7
5.4. Voice VLAN settings
Make voice VLAN settings for this product, and implement the following.
Connect an IP phone to port 1. Connect a PC to the other LAN port of the IP phone.
Using LLDP-MED, make the following settings from this product for the IP phone.
-
As voice traffic for the IP phone, transmit and receive 802.1q tagged frames of VLAN #2.
-
Untagged frames are transmitted and received as PC data traffic.
-
Use a CoS value of 6 when transmitting and receiving voice traffic.
-
Define the VLAN ID used by the voice VLAN.
Yamaha(config)# vlan database (1) Yamaha(config-vlan)# vlan 2 (2) Yamaha(config-vlan)# exit
1 Switch to VLAN mode 2 Create VLAN -
Set voice VLAN for LAN port #1.
Yamaha(config)#interface port1.1 (1) Yamaha(config-if)#switchport mode access (2) Yamaha(config-if)#switchport voice vlan 2 (3) Yamaha(config-if)#switchport voice cos 6 (4) Yamaha(config-if)#exit
1 Switch to interface mode 2 Set the ports as access port 3 Configure voice traffic as tagged frames for VLAN #2 4 Set the CoS value for voice traffic to 6 -
Set QoS for LAN port #1.
Yamaha(config)#qos enable (1) Yamaha(config)#interface port1.1 (2) Yamaha(config-if)#qos trust cos (3) Yamaha(config-if)#exit
1 Enable QoS 2 Switch to interface mode 3 Set trust mode to CoS -
Set LLDP-MED transmission and reception for LAN port #1.
Yamaha(config)#interface port1.1 (1) Yamaha(config-if)#lldp-agent (2) Yamaha(lldp-agent)#tlv-select med (3) Yamaha(lldp-agent)#set lldp enable txrx (4) Yamaha(lldp-agent)#exit Yamaha(config-if)#exit Yamaha(config)#lldp run (5) Yamaha(config)#exit
1 Switch to interface mode 2 Create LLDP agent, mode transition 3 Set LLDP-MED TLV 4 Set LLDP transmission/reception mode 5 Enable LLDP function
6. Points of Caution
A host port that is associated with a private VLAN cannot be aggregated as a link aggregation logical interface; this limitation is specific to host ports.