Operation Manual - Link Layer Protocol
H3C SecPath F1800-A Firewall
Chapter 1 VLAN Configuration
4-3
VLANs cannot directly communicate with one another, that is, the users in one VLAN
cannot directly access those in other VLANs. They need help of such layer 3 devices
as routers and Layer 3 switches to fulfill the access.
3)
It provides the virtual workgroup.
VLAN can be used to group users to different workgroups. When the workgroups
change, the users need not change their physical locations. In the application, users
of the same workgroup usually cooperate with each other at the same place, and
there are few cases that users are in different places.
On a switch, the common ports can only belong to one VLAN, that is, they can only
identify and send packets of the VLAN they belong to. However, when the VLAN is
across switches, it is necessary that the ports (links) among the switches can identify
and send packets of several VLANs at the same time. The same problem exists
among the switches and routers that support VLAN.
The link of this type is called Trunk, which has two meanings:
z
One is "trunking".
Namely, transparently transmit the VLAN packets to the interconnected switches or
routers so as to extend the VLAN.
z
The other is "super trunk".
Namely, several VLANs run on such a link.
The common protocol used to implement Trunk is IEEE 802.1Q (dot1q) is a standard
protocol of IEEE. It identifies the VLAN through adding a 4-byte VLAN tag to the end
of the source address field in the original Ethernet packet.
VLANs cannot directly interconnect with each other. So routers supporting VLAN
must be used to connect each VLAN to implement the interconnection among VLANs.
Usually, this is a kind of layer 3 (IP layer) interconnection.
1.1.3 VLAN Aggregation
In the application of broadband network, a large number of VLAN users need to be
connected to the router (firewall). A typical way for connecting residential users of
metropolitan area network (MAN) to broadband via Ethernet is: Connect the users
through Ethernet switch and isolate, mark and manage users through VLAN.
A problem exists in such networking model: Each VLAN occupies a separate address
segment and the upstream gateway is various. Thus, many IP addresses are wasted.
In addition, it’s not convenient for the network management and extension because
various users need to be allocated various gateways if Dynamic Host Configuration
Protocol (DHCP) is not adopted.
VLAN aggregation is brought forward to solve the above networking problem.
Through VLAN aggregation, a sub-interface can be configured a VLAN, but several
