Hone

Lessons · Network switches · VLANs for a cell

Designing VLANs for a production cell

The cell gets its own VLAN, with one controlled way in and out, so office traffic can never reach it and its own traffic never leaves.

Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.

What it is for

Control traffic has a deadline. A broadcast storm from a printer must not be able to arrive at a drive, and a VLAN is the only wall that guarantees it cannot.

How to think about it

One VLAN per cell, not one per device. The cell talks to itself constantly and to the outside rarely, and that is exactly the shape a VLAN fits.

Worked example

enable
The # prompt.
configure terminal
Into configuration mode.
vlan 60
The cell.
name CELL7
Named.
exit
Out.
vlan 99
And management, separate from both the cell and the office.
name MGMT
Named.
exit
Out.
interface gi0/4
The controller.
switchport mode access
Access.
switchport access vlan 60
In the cell.
spanning-tree portfast
One device on the end.
spanning-tree bpduguard enable
And if that turns out to be false, the port goes down rather than the line.
exit
Out.
interface gi0/1
The uplink.
switchport mode trunk
A trunk.
switchport trunk allowed vlan 60,99
Only the two VLANs that belong here cross it. The office VLAN cannot reach this switch at all.
end
Out.
show vlan brief
Two VLANs, the cell ports in one, and a trunk carrying only what was allowed.

Your turn

Let only VLANs 60 and 99 across the uplink.

switchport trunk  vlan 60,99

The trap

Leaving the trunk carrying everything because it works. It does work, right up until the day something on the office VLAN misbehaves and the cell is in its broadcast domain after all.

Practise VLANs for a cell on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.