Operation Manual – User Access
H3C SecPath Series Security Products
Chapter 4 VLAN Configuration
4-2
VLAN A
VLAN B
VLAN A
VLAN B
VLAN A
VLAN B
LAN Switch
LAN Switch
SecPath
Figure 4-1
Example of VLAN
The buildup of VLAN is not restricted by physical locations, that is to say, one VLAN can
spread within one switch or across switches, or even across routers.
VLAN can be classified in several ways, such as the classifications based on the port,
on MAC address, on protocol type, on IP address mapping, on multicast, and on the
policy. At present, the generally accepted classification method is based on the port. In
this manual, the VLANs are all based on the port except otherwise noted.
The advantages of using VLAN are:
z
It can restrict broadcast packets (broadcast storm), save the bandwidth and thus
improve the processing ability of the network. The Broadcast Domain is restricted
in one VLAN and the switch would not directly send frames from one VLAN to
another except that it is a layer-3 switch.
z
It can enhance the security of LAN. VLANs cannot directly communicate with one
another, that is, the users in one VLAN cannot directly access those in other
VLANs. They need help of such layer 3 devices as routers or Layer 3 switches to
fulfill the access.
z
It provides virtual workgroups. VLAN can be used to group different users to
different workgroups. When the workgroups change, the users need not change
their physical locations. In the practical application, users of the same workgroup
usually cooperate with each other at the same place, and rarely at different places.
On a switch, the common ports can only belong to one VLAN, that is, they can only
identify and send packets of the VLAN they belong to. However when the VLAN is
across switches, it is necessary that the ports (links) among the switches can
concurrently identify and send packets of several VLANs. The same problem exists
among the switches and routers that support VLAN. The link of this type is called Trunk,
which has two meanings: one meaning is "relay", i.e., transparently transmitting the
