D-Link UNIFIED WIRED & WIRELESS ACCESS SYSTEM..., Configuration Manual

Page: 33 / 192

33
3
Virtual LANs
Adding Virtual LAN (VLAN) support to a Layer 2 switch offers some of the benefits of both
bridging and routing. Like a bridge, a VLAN switch forwards traffic based on the Layer 2
header, which is fast. Like a router, it partitions the network into logical segments, which
provides better administration, security and management of multicast traffic.
A VLAN is a set of end stations and the switch ports that connect them. You can have many
reasons for the logical division, for example, department or project membership. The only
physical requirement is that the end station, and the port to which it is connected, both belong
to the same VLAN.
Each VLAN in a network has an associated VLAN ID, which appears in the IEEE 802.1Q tag
in the Layer 2 header of packets transmitted on a VLAN. An end station may omit the tag, or
the VLAN portion of the tag, in which case the first switch port to receive the packet may
either reject it or insert a tag using its default VLAN ID. A given port may handle traffic for
more than one VLAN, but it can only support one default VLAN ID.
Two features let you define packet filters that the switch uses as the matching criteria to
determine if a particular packet belongs to a particular VLAN.
• The IP-subnet Based VLAN feature lets you map IP addresses to VLANs by specifying a
source IP address, network mask, and the desired VLAN ID.
• The MAC-based VLAN feature let packets originating from end stations become part of a
VLAN according to source MAC address. To configure the feature, you specify a source
MAC address and a VLAN ID.
The Private Edge VLAN feature lets you set protection between ports located on the switch.
This means that a protected port cannot forward traffic to another protected port on the same
switch.
The feature does not provide protection between ports located on different switches.
The Voice VLAN feature lets you enable switch ports to carry traffic with defined settings so
that voice and data traffic are separated when coming onto the port.