How And When To Use Virtual LANs (VLANs)

By Chris Bryant

From your Network+ exam studies, you know that switches forward broadcasts, and that sounds great, but that's not always a good thing. A switch can have anywhere from 12 ports to 80 or more, and by default all hosts connected to that switch are going to be in the same broadcast domain. Let's say we have an 80- port switch. If one host connected to that switch sends a broadcast, by default, all of the other 79 hosts are going to receive the broadcast. That will unnecessarily take up our network's available bandwidth.

It gets worse. For some network services and protocols, a broadcast received by a host results in that receiving host transmitting a broadcast of its own. Then when all the hosts receive that broadcast, they all end up transmitting even more broadcasts. Pretty soon, all these broadcasts have snowballed into a broadcast storm, which can take up most of a network's bandwidth and make normal network operations almost impossible.

Most likely, only a few hosts on each switch really need to communicate with each other. Let's take a eight-port switch for example, where three of the hosts are in the Security department, another three in the Accounting department, and the other two in the Publishing department.

If any of these PCs sends a broadcast, every other host attached to that switch is going to receive it, and may well generate a broadcast of its own in response. That's what we want to guard against, and we can do so through the creation of Virtual LANs, or VLANs.

Physically, these hosts all reside on the same Local Area Network, but we can configure the switch to place them in different logical (virtual) LANs. When a switch is configured with VLANs, the switch will forward a broadcast only to those hosts in the same VLAN as the host that originated it. By creating three VLANs on this switch, we now have three smaller broadcast domains, which helps to limit the scope of a broadcast.

After placing the Security hosts in their own VLAN, and then doing the same for the Accounting and Publishing hosts, broadcasts are now limited to being forwarded throughout their own VLAN. If a host in the Security department sends a broadcast, only other hosts in that same VLAN will receive it.

Now, here's another one of those good news / bad news scenarios we've discussed. (Better get used to those - in networking, almost everything we do has a good side and a bad side!)

Good news: Broadcasts will not be forwarded (propagated), between VLANs. A broadcast sent by one host in a VLAN will be forwarded only to other hosts in that same VLAN.

Bad news: No other traffic is going to be able to go from one VLAN to another, either. By default, there will be no inter-VLAN traffic on the switch. For traffic to go between VLANs, a Layer Three device must be involved, and that L3 device will most likely be a router.

Notice I said "most likely".