VLAN (Virtual LAN), translated into Chinese is "virtual local area network". A LAN can be a network of a few home computers or an enterprise network of hundreds of computers. The LAN referred to by VLAN refers to a network divided by a router—that is, a broadcast domain.

Why use VLAN? Because it is logically divided rather than physically divided, each workstation in the same VLAN is not limited to the same physical range, that is, these workstations can be in different physical LAN segments (it is recommended that one VLAN corresponds to one IP subnet). Network. It is wrong to use the same IP subnet for different VLANs or for one VLAN to correspond to multiple IP subnets). According to the characteristics of VLAN, the broadcast and unicast traffic in a VLAN will not be forwarded to other VLANs, which helps to control traffic, reduce equipment investment, simplify network management, and improve network security.

VLAN division method:

1. Port-based VLAN

This is the most commonly used VLAN division method, and it is the most widely used and most effective. At present, most VLAN protocol switches provide this VLAN configuration method. This method of dividing VLANs is based on the switch port of the Ethernet switch. It divides the physical port on the VLAN switch and the PVC (permanent virtual circuit) port inside the VLAN switch into several groups, and each group forms a virtual network, which is equivalent to an independent VLAN switch.

2. Divide VLAN based on MAC address

This method of dividing VLANs is based on the MAC address of each host, that is, configure which group he belongs to for each host with a MAC address. The mechanism it implements is that each network card corresponds to a unique MAC address, and the VLAN switch tracks Address belonging to the VLAN MAC This approach to VLAN allows network users to automatically retain their membership in the VLAN when they move from one physical location to another.

3. Divide VLANs based on network layer protocols

VLAN is divided according to the network layer protocol, and can be divided into VLAN networks such as IP, IPX, DECnet, AppleTalk, Banyan, etc. This VLAN composed of network layer protocols can make the broadcast domain span multiple VLAN switches. It is very attractive for network administrators who use services to organize users. Moreover, users can move freely within the network, but their VLAN membership remains unchanged.

4. Divide VLANs according to IP multicast

In fact, IP multicast is also a definition of VLAN, that is, an IP multicast group is considered to be a VLAN. This method of division expands VLAN to the wide area network, so this method has greater flexibility and is also easy to pass through routers. Expanding is mainly suitable for LAN users who are not in the same geographical area to form a VLAN, but it is not suitable for LAN, mainly because the efficiency is not high.

5. Divide VLANs according to policies

VLAN based on policies can implement multiple allocation methods, including VLAN switch port, MAC address, IP address, network layer protocol, etc. Network managers can decide which type of VLAN to choose according to their own management mode and the needs of the unit.

6. Divide VLAN according to user definition and non-user authorization

To divide VLANs based on user definition and non-user authorization means that in order to adapt to a special VLAN network, VLANs are defined and designed according to the special requirements of specific network users, and non-VLAN group users can access VLANs, but user passwords are required. You can join a VLAN only after you have been authenticated by VLAN management.