Private VLANs (PVLAN)

VLAN provides network isolation and layer 2. Typical VLAN would have a single subnet and all the devices within the VLAN can communicate with each other. But what if you want to put multiple devices within a subnet and do not wish to communicate with each other ? The answer would be the use of Private VLANs (PVLANs).

How it works

PVLANs are actually a set of VLANs. There is a Primary VLAN and one or more Secondary VLANs. 

Primary VLAN – Same as a typical VLAN and the networks are promiscuous, as they will always communicate with each other

Secondary VLAN – These networks are associated with the Primary VLAN and they keep seperated with each other

In Secondary VLANs, there are two types of Networks 

  • Community VLAN – In a community VLAN, the devices will communicate with each other. But the Inter community VLAN does not take place. [ex: Community A and Community B VLANs will have no communication]
  • Isolated VLAN – In an Isolated VLAN, the devices will not communicate with each other. They also have no Inter commuication with Community VLANs.

All the devices can connect to the Primary VLAN. So this allows the devices to share Internet connectivity. Basically, this will act as the default gateway. 

Ports in the Primary VLAN are known as the Promiscuous Ports (P-Ports). Layer 3 switches are placed here and can have SVI (Switch Virtual Interface) configured in the Primary VLAN.

Ports in the Secondary VLANs are known as the Host Ports , as the name suggests these ports are being used to connect the end points (devices).

The below Diagram provides a good explanation

Continue reading “Private VLANs (PVLAN)”

Graphical representation and the configuration

[Kevin Wallace Training, LLC]

What is VxLAN

VxLAN stands for Virtual Extensible LAN. We used VLAN to extened the address space. But with VLAN, we have a hard limit of 4000 usable VLANs. This is an issue with service providers. They may have to maintain several VLANs per customer, which exhausts the address space quickly. To work around this VLAN ID’s can be reused on different switches, or technologies like Q-in-Q can be used.

VxLAN does not have this limitation. It uses a 24-bit header, which gives us about 16 million VNI’s to use. A VNI is the identifier for the LAN segment, similar to a VLAN ID. With an address space this large, an ID can be assigned to a customer, and it can remain unique across the entire network.

VxLAN separates the VNI from the physical network. This means no trunking across the infrastructure is needed. This is done by making each VNI a virtual overlay network. The core network, or underlay, runs at layer-3. VNI’s are layer-2 and run across the layer-3 network. To make this possible, VxLAN switches encapsulate layer-2 frames in layer-3 packets.

There are several advantages to this. As already mentioned, the core network does not have any layer-2 links. This means no trunking and no spanning-tree. Also, VNI’s can be stretched from one end of the network to another. This greatly simplifies mobility and allows hosts to have layer-2 adjacency.

Continue reading “What is VxLAN”

Spine/Leaf Topology

The Spine/Leaf Topology is commonly used in the IP underlay network. It’s quite different to the traditional hierarchy. Keep in mind that this is an architecture, and is not specific to VxLAN. Other technologies like FabricPath may also use spine/leaf.

This architecture uses two layers- the Spine layer and the Leaf layer.

The Leaf layer is where hosts and other devices connect. The leaf layer handles all the VxLAN functions, like creating the virtual networks, and mapping VLANs to VNIs.

The Spine layer is used for transport. The only thing that connects to spine switches is leaf switches. All links to the spine switches are routed links. This creates many ECMP paths, which can be managed by a routing protocol. The spine switches just pass traffic and are unaware that VxLAN even exists.