VLAN

VLAN

1. Function Overview

VLAN (Virtual LAN) is technology that allows a LAN to be constructed virtually, without regard to the physical structure of connections.
This product lets you use VLANs to divide the LAN into multiple broadcast domains.
The VLANs that are supported by this product are shown below.

VLAN types Summary

Port-based VLAN

Groups that can communicate are configured for each LAN/SFP port.

Tagged VLAN

Groups that can communicate are identified, based on the fixed-length tag information appended to the Ethernet frame.
Multiple and different VLANs can be made to communicate by means of one LAN/SFP port.

Private VLAN

Groups that can communicate within the same VLAN can be divided up. It consists of the following three types of VLANs:
- Primary VLAN
- Isolated VLAN
- Community VLAN

Multiple VLAN

Each LAN/SFP port can be divided into multiple groups that can communicate.
Refer to this information for multiple VLANs.

Voice VLAN

This allows audio and data to be handled separately on an access port.

2. Definition of Terms Used

Broadcast domain

This is a range in which broadcast frames can be delivered in a network, such as an Ethernet.
Devices that are connected by relaying a data link layer (MAC layer), such as switching hubs, can belong to the same broadcast domain.
A broadcast domain generally refers to the network in an Ethernet.

3. Function Details

3.1. Defining a VLAN ID

On product, a maximum of 255 VLANs can be defined, with VLAN IDs ranging from 2–4094. (ID #1 is used as the default VLAN ID.)
VLAN IDs are defined using the vlan command, after the vlan database command is used to enter VLAN mode.
For details, refer to the Command Reference.

3.2. VLAN settings for the LAN/SFP ports

The following settings must be configured after defining the VLANs to use, in order to make use of VLAN on this product.

  • Set LAN/SFP port mode settings

  • Set associated VLAN for LAN/SFP ports

  1. The LAN/SFP ports on this product are set to one of the following modes.

    • Access port
      This is a port that handles untagged frames. It can be associated with one VLAN.

    • Trunk port
      This is a port that handles both tagged and untagged frames.
      It can be associated with multiple VLANs, and is mainly used to connect switches to one another.
      This product only supports IEEE 802.1Q. (Cisco ISL is not supported.)

  2. Use the switchport mode command to set the LAN/SFP port mode.
    When setting the trunk port, use the input filter (“ingress-filter”) to control whether frames not belonging to the specified VLAN ID will be handled.

    • Input filter enabled: Only frames set to the specified VLAN ID will be handled.

    • Input filter disabled: Frames with any VLAN ID will be handled.

  3. Use the show interface switchport command to check the LAN/SFP port setting mode.

  4. Use the switchport access vlan command to set which VLANs belong to the access port.

  5. Use the switchport trunk allowed vlan command to set which VLANs belong to the trunk port.
    As the trunk port can be associated with multiple VLANs, use the “all”, “none”, “except”, “add” and “remove” settings as shown below.

    • add
      Adds the specified VLAN ID.
      VLAN IDs that can be added are limited by the IDs that are defined by the VLAN mode.

    • remove
      Deletes the specified VLAN ID.

    • all
      Adds all VLAN IDs specified by the VLAN mode.
      The VLAN IDs added by the VLAN mode can also be added after this command is executed.

    • none
      The trunk port will not be associated with any VLAN.

    • except
      Adds all other VLAN IDs except for the ones specified.
      The VLAN IDs added by the VLAN mode can also be added after this command is executed.

  6. A VLAN that uses untagged frames (native VLAN) can be specified for the trunk port.

  7. Tagged audio frames can be transferred by specifying a voice VLAN for an access port.

  8. Use the show vlan command to check which VLANs belong to a LAN/SFP port.

3.3. VLAN access control

This product provides an VLAN access map function, to control access to the VLAN.
The VLAN access map can be associated with a standard/extended IP access control list and a MAC address control list as VLAN ID filtering parameters.
The VLAN access map is operated using the commands shown below.

  • Create VLAN access map: vlan access-map command

  • Set VLAN access map parameters: match access-list command

  • Assign VLAN access map: vlan filter command

  • Show VLAN access map: show vlan access-map command

3.4. Default VLAN

The default VLAN is VLAN #1 (vlan1), which exists in this switch by default.
As the default VLAN is a special VLAN, it always exists and cannot be deleted.
The following operations can be used to automatically delete the relevant port from the default VLAN.

  • Setting the VLAN for an access port

  • Setting any VLAN other than the default as the native VLAN for the trunk port

  • Setting the native VLAN for the trunk port to “none”

3.5. Native VLAN

A native VLAN is a VLAN that associates untagged frames received by the LAN/SFP port that was set as a trunk port.
Defining an LAN/SFP port as a trunk port will set the default VLAN (VLAN #1) as the native VLAN.
Use the switchport trunk native vlan command when specifying a certain VLAN as the native VLAN.
If you do not want to handle untagged frames on the LAN/SFP port, you can set the native VLAN to none. (Specify “none” with the “switchport trunk native vlan” command.)

3.6. Private VLAN

This product can configure a private VLAN for further dividing up groups that can communicate within the same subnet.
The operating specifications are shown below.

  1. A private VLAN contains the following three VLAN types.

    • Primary VLAN
      This is the parent VLAN of the secondary VLAN.
      Only one primary VLAN can be set per private VLAN.

    • Isolated VLAN
      This is a kind of secondary VLAN, which only sends traffic to a primary VLAN.
      Only one primary VLAN can be set per private VLAN.

    • Community VLAN
      This is a kind of secondary VLAN, which only sends traffic to VLANs in the same community and to a primary VLAN.
      Multiple community VLANs can be set for each private VLAN.

  2. A primary VLAN may contain multiple promiscuous ports.
    Access ports, trunk ports, or static/LACP logical interfaces are the ports that can be used as promiscuous ports.

  3. Only access ports can be used as host ports for a secondary VLAN (isolated VLAN, community VLAN).

  4. A secondary VLAN (isolated VLAN, community VLAN) can be associated with one primary VLAN.
    Use the switchport private-vlan mapping command to create the association.

    • An isolated VLAN can be associated with multiple promiscuous ports contained within a private VLAN.

    • A community VLAN can be associated with multiple promiscuous ports contained within a private VLAN.

3.7. Voice VLAN

Voice VLAN is a function that can prevent audio from being adversely affected even when IP phone voice traffic is mixed with PC data traffic.

image

Some IP phones have two ports: a port for connection to the network switch and a port for connection to the PC.
By connecting the network switch to the IP phone, and the IP phone to the PC, it is possible to use one port of the network switch to handle the IP phone audio traffic and the PC’s data traffic.
Using the voice VLAN function in this type of configuration allows the audio data and the PC data to be separated so that noise is less likely to occur on the IP phone, or to handle the audio data with a higher priority.

Voice VLAN settings are made by the switchport voice vlan command.
Set one of the following to be handled as voice traffic.

  • Frames with the 802.1p tag

  • Priority tag frames (802.1p tags with a VLAN ID of 0 and only the CoS value specified)

  • Untagged frames

When tagged frames are handled as voice traffic, untagged frames are handled as data traffic.

By using LLDP, this product can automatically apply settings to a connected IP telephone.
The conditions for making automatic settings are as follows.

  • LLDP-MED TLV transmission is enabled on the port for which voice VLAN is enabled.

  • The connected IP phone supports settings via LLDP-MED.

If the above conditions are satisfied, and when an IP phone is connected to the corresponding port, voice VLAN information (tagged/untagged, VLAN ID, the CoS value to be used, DSCP value) are notified according to the Network Policy TLV of LLDP-MED when an IP phone is connected to the corresponding port.
The IP phone will transmit voice data according to the information that was provided to it from this unit.

The CoS value specified for the IP phone is set by the switchport voice cos command, and the DSCP value is set by the switchport voice dscp command.
In order to give priority to handling voice traffic, QoS settings (enable QoS, set trust mode) according to the IP phone settings are also required.

The limitations of voice VLAN are as follows.

  • It can be used only on a physical interface port that is assigned as an access port.
    It cannot be used on a link aggregation logical interface or on a VLAN logical interface.

  • The voice VLAN function and the port authentication function cannot be used together.

4. Related Commands

4.1. List of related commands

  • Related commands are indicated below.

    Operations Operating commands

    Enter VLAN mode

    vlan database

    Define VLAN interface, or change a predefined VLAN

    vlan

    Define a private VLAN

    private-vlan

    Set the secondary VLAN for a private VLAN

    private-vlan association

    Create VLAN access map

    vlan access-map

    Set VLAN access map parameters

    match

    Assign VLAN access map to VLAN

    vlan filter

    Set access port (untagged port)

    switchport mode access

    Set associated VLAN of an access port (untagged port)

    switchport access vlan

    Set trunk port (tagged port)

    switchport mode trunk

    Set associated VLAN for trunk port (tagged port)

    switchport trunk allowed vlan

    Set native VLAN for trunk port (tagged port)

    switchport trunk native vlan

    Set ports for private VLAN (promiscuous port, host port)

    switchport mode private-vlan

    Configure VLAN for private VLAN port and host port

    switchport private-vlan host-association

    Configure VLAN for private VLAN port and promiscuous port

    switchport private-vlan mapping

    Configure voice VLAN

    switchport voice vlan

    Set CoS value for voice VLAN

    switchport voice cos

    Set DSCP value for voice VLAN

    switchport voice dscp

    Show VLAN information

    show vlan

    Show private VLAN information

    show vlan private-vlan

    Show VLAN access map

    show vlan access-map

    Show VLAN access map filter

    show vlan filter

5. Examples of Command Execution

5.1. Port-based VLAN settings

In this example, a port-based VLAN is configured for this product in order to allow communication between hosts A–B and hosts C–D.

image

The LAN port settings for this product are as follows.

  • LAN ports #1 and #2: Set as access port, and associated with VLAN #1000

  • LAN ports #3 and #4: Set as access port, and associated with VLAN #2000

■ Setting Procedure

  1. Switch to VLAN mode using the vlan database command, and define two VLANs using the vlan command.

    Yamaha(config)# vlan database (1)
    Yamaha(config-vlan)# vlan 1000 (2)
    Yamaha(config-vlan)# vlan 2000 (3)
    Yamaha(config-if)# exit
    1 Switch to VLAN mode
    2 Create VLAN #1000
    3 Create VLAN #2000
  2. Set LAN ports #1–2 as access ports, and associate them with VLAN #1000.

    Yamaha(config)# interface port1.1-2 (1)
    Yamaha(config-if)# switchport mode access (2)
    Yamaha(config-if)# switchport access vlan 1000 (3)
    Yamaha(config-if)# exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Define a VLAN ID
  3. Set LAN ports #3–4 as access ports, and associate them with VLAN #2000.

    Yamaha(config)# interface port1.3-4
    Yamaha(config-if)# switchport mode access
    Yamaha(config-if)# switchport access vlan 2000
    Yamaha(config-if)# exit
  4. Confirm the VLAN settings.

    Yamaha#show vlan brief
    (u)-Untagged, (t)-Tagged
    VLAN ID  Name            State   Member ports
    ======= ================ ======= ===============================
    1       default          ACTIVE  port1.5(u) port1.6(u)
                                     port1.7(u) port1.8(u)
    1000    VLAN1000         ACTIVE  port1.1(u) port1.2(u)
    2000    VLAN2000         ACTIVE  port1.3(u) port1.4(u)

5.2. Tagged VLAN settings

In this example, a tagged VLAN is configured between #A and #B of this product, in order to communicate between hosts A–B and hosts C–D.

image

The LAN port settings for #A and #B of this product are as follows.

  • LAN port #1: Set as access port, and associated with VLAN #1000

  • LAN port #2: Set as access port, and associated with VLAN #2000

  • LAN port #3: Set as trunk port, and associated with LAN #1000 and VLAN #2000

  1. [Switch #A/#B] Define VLAN.

    Yamaha(config)#vlan database (1)
    Yamaha(config-vlan)#vlan 1000 (2)
    Yamaha(config-vlan)#vlan 2000 (3)
    1 Switch to vlan mode
    2 Define VLAN #1000
    3 Define VLAN #2000
  2. [Switch #A/#B] Set LAN port #1 as the access port, and associate it with VLAN #1000.

    Yamaha(config)#interface port1.1 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport access vlan 1000 (3)
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Associate it with VLAN #1000
  3. [Switch #A/#B] Set LAN port #2 as the access port, and associate it with VLAN #2000.

    Yamaha(config)#interface port1.2 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport access vlan 2000 (3)
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Associate it with VLAN #2000
  4. [Switch #A/#B] Set LAN port #3 as a trunk port, and associate it with VLAN #1000/#2000.

    Yamaha(config)#interface port1.3 (1)
    Yamaha(config-if)#switchport mode trunk (2)
    Yamaha(config-if)#switchport trunk allowed vlan add 1000 (3)
    Yamaha(config-if)#switchport trunk allowed vlan add 2000 (4)
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the port as trunk port
    3 Add VLAN #1000
    4 Add VLAN #2000
  5. Confirm the VLAN settings.

    Yamaha#show vlan brief
    (u)-Untagged, (t)-Tagged
    
    VLAN ID  Name                            State   Member ports
    ======= ================================ ======= ======================
    1       default                          ACTIVE  port1.3(u)
    1000    VLAN1000                         ACTIVE  port1.1(u) port1.3(t)
    2000    VLAN2000                         ACTIVE  port1.2(u) port1.3(t)

5.3. Private VLAN settings

This example makes private VLAN settings for this product, to achieve the following.

Hosts connected to ports 1–7 will connect to the Internet and other external lines, through the line to which port 8 is connected
Communications between hosts connected to ports 1–4 are blocked (isolated VLAN: VLAN #21)
Communications between hosts connected to ports 5–7 are permitted (community VLAN: VLAN #22)
Communications between hosts connected to ports 1–4 and ports 5–7 are blocked

image

  1. Define the VLAN ID to be used for the private VLAN.

    Yamaha(config)# vlan database (1)
    Yamaha(config-vlan)# vlan 2 (2)
    Yamaha(config-vlan)# vlan 21
    Yamaha(config-vlan)# vlan 22
    Yamaha(config-vlan)# private-vlan 2 primary (3)
    Yamaha(config-vlan)# private-vlan 21 isolated (4)
    Yamaha(config-vlan)# private-vlan 22 community (5)
    Yamaha(config-vlan)# private-vlan 2 association add 21 (6)
    Yamaha(config-vlan)# private-vlan 2 association add 22
    Yamaha(config-vlan)# exit
    1 Switch to VLAN mode
    2 Create VLAN
    3 Configure primary VLAN
    4 Configure isolated VLAN
    5 Configure community VLAN
    6 Associate the ports with primary VLAN
  2. Configure the isolated VLAN (VLAN #21) for LAN ports 1–4.

    Yamaha(config)#interface port1.1-4 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport access vlan 21 (3)
    Yamaha(config-if)#switchport mode private-vlan host (4)
    Yamaha(config-if)#switchport private-vlan host-association 2 add 21
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Associate the ports with VLAN #21
    4 Set the ports as private VLAN host port
  3. Configure the community VLAN (VLAN #22) for LAN ports 5–7.

    Yamaha(config)#interface port1.5-7 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport access vlan 22 (3)
    Yamaha(config-if)#switchport mode private-vlan host (4)
    Yamaha(config-if)#switchport private-vlan host-association 2 add 22
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Associate the ports with VLAN #22
    4 Set the ports as private VLAN host port
  4. Configure the primary VLAN (VLAN #2) for LAN port 8. (Promiscuous port)

    Yamaha(config)#interface port1.8 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport access vlan 2 (3)
    Yamaha(config-if)#switchport mode private-vlan promiscuous (4)
    Yamaha(config-if)#switchport private-vlan mapping 2 add 21
    Yamaha(config-if)#switchport private-vlan mapping 2 add 22
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Associate the ports with VLAN #2
    4 Set the ports as private VLAN promiscuous port
  5. Confirm the VLAN settings.

    Yamaha#show vlan brief
    (u)-Untagged, (t)-Tagged
    
    VLAN ID  Name                            State   Member ports
    ======= ================================ ======= ======================
    1       default                          ACTIVE
    2       VLAN0002                         ACTIVE  port1.8(u)
    21      VLAN0021                         ACTIVE  port1.1(u) port1.2(u)
                                                     port1.3(u) port1.4(u)
    22      VLAN0022                         ACTIVE  port1.5(u) port1.6(u)
                                                     port1.7(u)
    
    Yamaha#show vlan private-vlan
     PRIMARY        SECONDARY          TYPE          INTERFACES
     -------        ---------       ----------      ----------
           2              21          isolated       port1.1 port1.2
                                                     port1.3 port1.4
           2              22         community       port1.5 port1.6
                                                     port1.7

5.4. Voice VLAN settings

Make voice VLAN settings for this product, and implement the following.

Connect an IP phone to port 1. Connect a PC to the other LAN port of the IP phone.
Using LLDP-MED, make the following settings from this product for the IP phone.

  • As voice traffic for the IP phone, transmit and receive 802.1q tagged frames of VLAN #2.

  • Untagged frames are transmitted and received as PC data traffic.

  • Use a CoS value of 6 when transmitting and receiving voice traffic.

  1. Define the VLAN ID used by the voice VLAN.

    Yamaha(config)# vlan database (1)
    Yamaha(config-vlan)# vlan 2 (2)
    Yamaha(config-vlan)# exit
    1 Switch to VLAN mode
    2 Create VLAN
  2. Set voice VLAN for LAN port #1.

    Yamaha(config)#interface port1.1 (1)
    Yamaha(config-if)#switchport mode access (2)
    Yamaha(config-if)#switchport voice vlan 2 (3)
    Yamaha(config-if)#switchport voice cos 6 (4)
    Yamaha(config-if)#exit
    1 Switch to interface mode
    2 Set the ports as access port
    3 Configure voice traffic as tagged frames for VLAN #2
    4 Set the CoS value for voice traffic to 6
  3. Set QoS for LAN port #1.

    Yamaha(config)#qos enable (1)
    Yamaha(config)#interface port1.1 (2)
    Yamaha(config-if)#qos trust cos (3)
    Yamaha(config-if)#exit
    1 Enable QoS
    2 Switch to interface mode
    3 Set trust mode to CoS
  4. Set LLDP-MED transmission and reception for LAN port #1.

    Yamaha(config)#interface port1.1 (1)
    Yamaha(config-if)#lldp-agent (2)
    Yamaha(lldp-agent)#tlv-select med (3)
    Yamaha(lldp-agent)#set lldp enable txrx (4)
    Yamaha(lldp-agent)#exit
    Yamaha(config-if)#exit
    Yamaha(config)#lldp run (5)
    Yamaha(config)#exit
    1 Switch to interface mode
    2 Create LLDP agent, mode transition
    3 Set LLDP-MED TLV
    4 Set LLDP transmission/reception mode
    5 Enable LLDP function

6. Points of Caution

A host port that is associated with a private VLAN cannot be aggregated as a link aggregation logical interface; this limitation is specific to host ports.