Coyote Point Systems E350GX, Руководство по установке и администрированию

Страница: 64 / 344

Chapter 4: Equalizer Network Configuration
64 Equalizer Installation and Administration Guide
VLAN Basics
Starting with Version 8.6, Equalizer models E350GX and above support tagged VLANs on both network interfaces.
This section provides a basic technical introduction to VLAN technology.
Many networking technologies use a technique called broadcasting to provide services on a Local Area Network
(LAN). Like traditional television or radio signals that are broadcast over the airwaves, broadcast network
transmissions are received by every node on the same LAN segment, or
broadcast domain . The Address Resolution
Protocol (ARP), the Dynamic Host Configuration Protocol (DHCP), and the Router Information Protocol (RIP) are
all examples of protocols that provide network services through broadcasting.
A LAN is a single broadcast domain composed of all the systems that are physically connected to the same switches,
hubs, and other devices that communicate at the Data Link Layer (Layer 2) of the OSI Networking Model. These
devices communicate using Layer 2 protocols, like Ethernet and ARP.
Virtual Local Area Network (VLAN) technology was developed to overcome these physical limitations of
traditional LAN technology. A VLAN is essentially a means of grouping systems at the Data Link Layer (Layer 2 of
the OSI networking model), using methods that are independent of the physical connection of the device to the
network.
By exchanging broadcast packets -- packets that are essentially sent to all systems connected to a Layer 2 switching
device -- switches can maintain a list of all MAC addresses connecteed to them and to the other switches to which
they are connected. A set of Layer 2 devices and the systems connected to them form a
broadcast domain --
meaning that all the systems can talk to one another using broadcast packets.
Conversely, broadcast packets are not forwarded beyond the boundaries of the broadcast domain. For example: if
two LANs are connected by a router (a Network Layer, or Layer 3, device), the broadcast traffic for one LAN is
never forwarded to the other LAN. The layout of a traditional LAN is therefore restricted to those systems that can
be wired together using Layer 2 devices -- a physically distant system that requires connectivity to the LAN would
require special routing and address translation (at Layer 3) in order to reach the LAN.
The dependence of LAN technology on physical connectivity at Layer 2 leads to two basic difficulties:
• broadcasts are received by all systems in the broadcast domain -- and if there is sufficient broadcast traffic,
it can significantly reduce the overall performance of the LAN, to the point where some services may
simply not be able to function properly due to latency or other factors introduced by a high level of
broadcast traffic
• if you want to include a system that is not physically connected to the LAN in the LAN’s broadcast domain,
you need to physically connect the system to the LAN
One problem with broadcasting is that lots of broadcast traffic on a LAN can slow network traffic down, as well as
slow individual systems down. If there is so much broadcast traffic on the LAN that other non-broadcast traffic is
significantly delayed (or never delivered), this is called a
broadcast storm . Broadcast storms typically arise when
network loops are created through faulty network configuration, but can also happen as the result of a malicious
attack. For example, a classic Denial of Service attack is to send an ICMP echo request (‘ping’) over the LAN that
specifies the source address of a system and a broadcast address for the destination. Every system receiving the ping
will respond to it -- flooding the system specified as the source of the ping with ICMP echo replies.
There are also other security concerns associated with broadcasting. Since all the systems in the broadcast domain
can see broadcast packets, the information in them is susceptible to discovery, intercept, and modification. This is of
particular concern in industrial Ethernet environments (where, for example, manufacturing processes are controlled
directly by computers) and in any environment (such as government and finance) where sensitive data is regularly
transmitted over the LAN.
For an overview of the VLAN configurations supported on Equalizer, see “Equalizer E350GX, E450GX, E650GX
Network Configuration” on page 32.