Network switches use Layer 2 bridging protocols to discoverthe topology of their LAN and to forward traffic toward destinationson the LAN. This topic explains the following concepts regarding bridgingand VLANs:
Note:
For Ethernet, Fast Ethernet, Tri-Rate Ethernet copper,Gigabit Ethernet, 10-Gigabit Ethernet, and aggregated Ethernet interfacessupporting VPLS, the Junos OS supports a subset of the IEEE 802.1Qstandard for channelizing an Ethernet interface into multiple logicalinterfaces, allowing many hosts to be connected to the same GigabitEthernet switch, but preventing them from being in the same routingor bridging domain.
- Benefits of Using VLANs
- History of VLANs
- How Bridging of VLAN Traffic Works
- Packets Are Either Tagged or Untagged
- Switch Interface Modes—Access, Trunk, or Tagged Access
- Maximum VLANs and VLAN Members Per Switch
- A Default VLAN Is Configured on Most Switches
- Assigning Traffic to VLANs
- Forwarding VLAN Traffic
- VLANs Communicate with Integrated Routing and Bridging Interfacesor Routed VLAN Interfaces
- VPLS Ports
Benefits of Using VLANs
In addition to reducing traffic and thereby speeding up thenetwork, VLANs have the following advantages:
VLANs provide segmentation services traditionally providedby routers in LAN configurations, thereby reducing hardware equipmentcosts.
Packets coupled to a VLAN can be reliably identified andsorted into different domains. You can contain broadcasts within partsof the network, thereby freeing up network resources. For example,when a DHCP server is plugged into a switch and starts broadcastingits presence, you can prevent some hosts from accessing it by usingVLANs to split up the network.
For security issues, VLANs provide granular control ofthe network because each VLAN is identified by a single IP subnetwork.All packets passing in and out of a VLAN are consistently tagged withthe VLAN ID of that VLAN, thereby providing easy identification, becausea VLAN ID on a packet cannot be altered. (For a switch that runs JunosOS that does not support ELS, we recommend that you avoid using 1as a VLAN ID, because that ID is a default value.)
VLANs react quickly to host relocation—this is alsodue to the persistent VLAN tag on packets.
On an Ethernet LAN, all network nodes must be physicallyconnected to the same network. In VLANs, the physical location ofnodes is not important—you can group network devices in anyway that makes sense for your organization, such as by departmentor business function, types of network nodes, or physical location.
History of VLANs
Ethernet LANs were originally designed for small, simple networksthat primarily carried text. However, over time, the type of datacarried by LANs grew to include voice, graphics, and video. This morecomplex data, when combined with the ever-increasing speed of transmission,eventually became too much of a load for the original Ethernet LANdesign. Multiple packet collisions were significantly slowing downthe larger LANs.
The IEEE 802.1D-2004 standard helped evolve Ethernet LANs tocope with the higher data and transmission requirements by definingthe concept of transparent bridging (generallycalled simply bridging). Bridging divides a singlephysical LAN (now called a single broadcast domain) into two or more virtual LANs, or VLANs. Each VLAN is a collection of some of the LAN nodes grouped together to formindividual broadcast domains.
When VLANs are grouped logically by function or organization,a significant percentage of data traffic stays within the VLAN. Thisrelieves the load on the LAN because all traffic no longer has tobe forwarded to all nodes on the LAN. A VLAN first transmits packetswithin the VLAN, thereby reducing the number of packets transmittedon the entire LAN. Because packets whose origin and destination arein the same VLAN are forwarded only within the local VLAN, packetsthat are not destined for the local VLAN are the only ones forwardedto other broadcast domains. This way, bridging and VLANs limit theamount of traffic flowing across the entire LAN by reducing the possiblenumber of collisions and packet retransmissions within VLANs and onthe LAN as a whole.
How Bridging of VLAN Traffic Works
Because the objective of the IEEE 802.1D-2004 standard was toreduce traffic and therefore reduce potential transmission collisionsfor Ethernet, a system was implemented to reuse information. Insteadof having a switch go through a location process every time a frameis sent to a node, the transparent bridging protocol allows a switchto record the location of known nodes. When packets are sent to nodes,those destination node locations are stored in address-lookup tablescalled Ethernet switching tables. Before sendinga packet, a switch using bridging first consults the switching tablesto see if that node has already been located. If the location of anode is known, the frame is sent directly to that node.
Transparent bridging uses five mechanisms to create and maintainEthernet switching tables on the switch:
Learning
Forwarding
Flooding
Filtering
Aging
The key bridging mechanism used by LANs and VLANs is learning. When a switch is first connected to an EthernetLAN or VLAN, it has no information about other nodes on the network.As packets are sent, the switch learns the embedded MAC addressesof the sending nodes and stores them in the Ethernet switching table,along with two other pieces of information—the interface (orport) on which the traffic was received on the destination node andthe time the address was learned.
Learning allows switches to then do forwarding. By consulting the Ethernet switching table to see whether thetable already contains the frame’s destination MAC address,switches save time and resources when forwarding packets to the knownMAC addresses. If the Ethernet switching table does not contain anentry for an address, the switch uses flooding to learn that address.
Flooding finds a particular destinationMAC address without using the Ethernet switching table. When trafficoriginates on the switch and the Ethernet switching table does notyet contain the destination MAC address, the switch first floods thetraffic to all other interfaces within the VLAN. When the destinationnode receives the flooded traffic, it can send an acknowledgment packetback to the switch, allowing it to learn the MAC address of the nodeand add the address to its Ethernet switching table.
Filtering, the fourth bridging mechanism,is how broadcast traffic is limited to the local VLAN whenever possible.As the number of entries in the Ethernet switching table grows, theswitch pieces together an increasingly complete picture of the VLANand the larger LAN—it learns which nodes are in the local VLANand which are on other network segments. The switch uses this informationto filter traffic. Specifically, for traffic whose source and destinationMAC addresses are in the local VLAN, filtering prevents the switchfrom forwarding this traffic to other network segments.
To keep entries in the Ethernet switching table current, theswitch uses a fifth bridging mechanism, aging. Aging is the reason that the Ethernet switching table entries includetimestamps. Each time the switch detects traffic from a MAC address,it updates the timestamp. A timer on the switch periodically checksthe timestamp, and if it is older than a user-configured value, theswitch removes the node's MAC address from the Ethernet switchingtable. This aging process eventually flushes unavailable network nodesout of the Ethernet switching table.
Packets Are Either Tagged or Untagged
When an Ethernet LAN is divided into VLANs, each VLAN is identifiedby a unique 802.1Q ID. The number of available VLANs and VLAN IDsare listed below:
On a switch running ELS software, you can configure 4093VLANs using VLAN IDs 1 through 4094, while VLAN IDs 0 and 4095 arereserved by Junos OS and cannot be assigned.
On a switch running non-ELS software, you can configure4091 VLANs using VLAN IDs 1-4094.
Ethernet packets include a tag protocol identifier (TPID) EtherTypefield, which identifies the protocol being transported. When a devicewithin a VLAN generates a packet, this field includes a value of 0x8100,which indicates that the packet is a VLAN-tagged packet. The packetalso has a VLAN ID field that includes the unique 802.1Q ID, whichidentifies the VLAN to which the packet belongs.
Junos OS switches support the TPID value 0x9100 for Q-in-Q onswitches. In addition to the TPID EtherType value of 0x8100, EX Seriesswitches that do not support the Enhanced Layer 2 Software (ELS) configurationstyle also support values of 0x88a8 (Provider Bridging and ShortestPath Bridging) and 0x9100 (Q-inQ).
For a simple network that has only a single VLAN, all packetsinclude a default 802.1Q tag, which is the only VLAN membership thatdoes not mark the packet as tagged. These packets are untagged packets.
Note:
Q-in-Q tunnelling is not supported on NFX150 devices.
Switch Interface Modes—Access, Trunk, or Tagged Access
Ports, or interfaces, on a switch operate in one of three modes:
Access mode
Trunk mode
Tagged-access mode
- Access Mode
- Trunk Mode
- Trunk Mode and Native VLAN
- Tagged-Access Mode
Access Mode
An interface in access mode connects a switch to a single networkdevice, such as a desktop computer, an IP telephone, a printer, afile server, or a security camera. Access interfaces accept only untaggedpackets.
By default, when you boot a switch that runs Junos OS that doesnot support ELS and use the factory default configuration, or whenyou boot such a switch and do not explicitly configure a port mode,all interfaces on the switch are in access mode and accept only untaggedpackets from the VLAN named default. You can optionallyconfigure another VLAN and use that VLAN instead of default.
On a switch that supports ELS, the VLAN named default is not supported. Therefore, on such switches, you must explicitlyconfigure at least one VLAN, even if your network is simple and youwant only one broadcast domain to exist. After you assign an interfaceto a VLAN, the interface functions in access mode.
For switches that run either type of software, you can alsoconfigure a trunk port or interface to accept untagged packets froma user-configured VLAN. For details about this concept (native VLAN),see Trunk Mode and Native VLAN.
Trunk Mode
Trunk mode interfaces are generally used to connect switchesto one another. Traffic sent between switches can then consist ofpackets from multiple VLANs, with those packets multiplexed so thatthey can be sent over the same physical connection. Trunk interfacesusually accept only tagged packets and use the VLAN ID tag to determineboth the packets’ VLAN origin and VLAN destination.
On a switch that runs software that does not support ELS, anuntagged packet is not recognized on a trunk port unless you configureadditional settings on that port.
On a switch that runs Junos OS that supports ELS, a trunk portrecognizes untagged control packets for protocols such as the LinkAggregation Control Protocol (LACP) and the Link Layer Discovery Protocol(LLDP). However, the trunk port does not recognize untagged data packetsunless you configure additional settings on that port.
Note:
LACP is not supported on NFX150 devices.
In the rare case where you want untagged packets to be recognizedby a trunk port on switches that run either type of software, youmust configure the single VLAN on a trunk port as a nativeVLAN. For more information about native VLANs, see Trunk Mode and Native VLAN.
Trunk Mode and Native VLAN
On a switch that runs Junos OS that does not support ELS, atrunk port does not recognize packets that do not include VLAN tags,which are also known an untagged packets. On a switch that runs JunosOS that supports ELS, a trunk port recognizes untagged control packets,but it does not recognize untagged data packets. With native VLANconfigured, untagged packets that a trunk port normally does not recognizeare sent over the trunk interface. In a situation where packets passfrom a device, such as an IP phone or printer, to a switch in accessmode, and you want those packets sent from the switch over a trunkport, use native VLAN mode. Create a native VLAN by configuring aVLAN ID for it, and specify that the trunk port is a member of thenative VLAN.
The switch’s trunk port will then treat those packetsdifferently than the other tagged packets. For example, if a trunkport has three VLANs, 10, 20, and 30, assigned to it with VLAN 10being the native VLAN, packets on VLAN 10 that leave the trunk porton the other end have no 802.1Q header (tag).
There is another native VLAN option for switches that do notsupport ELS. You can have the switch add and remove tags for untaggedpackets. To do this, you first configure the single VLAN as a nativeVLAN on a port attached to a device on the edge. Then, assign a VLANID tag to the single native VLAN on the port connected to a device.Last, add the VLAN ID to the trunk port. Now, when the switch receivesthe untagged packet, it adds the ID you specified and sends and receivesthe tagged packets on the trunk port configured to accept that VLAN.
Tagged-Access Mode
Only switches that run Junos OS not using the ELS configurationstyle support tagged-access mode. Tagged-access mode accommodatescloud computing, specifically scenarios including virtual machinesor virtual computers. Because several virtual computers can be includedon one physical server, the packets generated by one server can containan aggregation of VLAN packets from different virtual machines onthat server. To accommodate this situation, tagged-access mode reflectspackets back to the physical server on the same downstream port whenthe destination address of the packet was learned on that downstreamport. Packets are also reflected back to the physical server on thedownstream port when the destination has not yet been learned. Therefore,the third interface mode, tagged access, has some characteristicsof access mode and some characteristics of trunk mode:
Like access mode, tagged-access mode connects the switchto an access layer device. Unlike access mode, tagged-access modeis capable of accepting VLAN tagged packets.
Like trunk mode, tagged-access mode accepts VLAN tagged packets from multiple VLANs. Unlike trunk port interfaces, which are connected at the core/distribution layer, tagged-access port interfaces connect devices at the access layer.
Like trunk mode, tagged-access mode also supports native VLAN.
Note:
Control packets are never reflected back on the downstream port.
Maximum VLANs and VLAN Members Per Switch
Starting in Junos OSRelease 17.3 on QFX10000 switches, the number of vmembers has increasedto 256k for integrated routing and bridging interfaces and aggregatedEthernet interfaces.
The number of VLANs supported per switch varies for each switch.Use the configuration-mode command set vlans vlan-name vlan-id ? to determine the maximum number of VLANs allowedon a switch. You cannot exceed this VLAN limit because you have toassign a specific ID number when you create a VLAN—you couldoverwrite one of the numbers, but you cannot exceed the limit.
You can, however, exceed the recommended VLAN member maximumfor a switch.
On a switch that runs Junos OS that does not support the ELSconfiguration style, the maximum number of VLAN members allowed onthe switch is eight times the maximum number of VLANs that the switchsupports (vmember limit = vlan max * 8). If the configuration of theswitch exceeds the recommended VLAN member maximum, a warning messageappears when you commit the configuration. If you commit the configurationdespite the warning, the commit succeeds, but there is a risk of theEthernet switching process (eswd) failing as a result of memory allocationfailure.
On most switches running Junos OS that supports ELS, the maximumnumber of VLAN members allowed on the switch is 24 times the maximum number of VLANs that the switch supports (vmember limit = vlan max* 24). If the configuration of the switch exceeds the recommendedVLAN member maximum, a warning message appears in the system log (syslog).
On an EX Series switch that runs Junos OS that supports ELS,the maximum number of VLAN members allowed on the switch is as follows:
EX4300—24 times the maximum number of VLANs thatthe switch supports (vmember limit = vlan max * 24)
EX3400—16 times the maximum number of VLANs thatthe switch supports (vmember limit = vlan max * 16)
EX2300—8 times the maximum number of VLANs thatthe switch supports (vmember limit = vlan max * 8)
A QFabric system supports up to 131,008 VLAN members (vmembers)on a single network node group, server node group, or redundant servernode group. The number of vmembers is calculated by multiplying themaximum number of VLANs by 32.
For example, to calculate how many interfaces are required tosupport 4,000 VLANs, divide the maximum number of vmembers (128,000)by the number of configured VLANs (4,000). In this case, 32 interfacesare required.
On network Node groups and server Node groups, you can configurelink aggregation groups (LAGs) across multiple interfaces. Each LAGand VLAN combination is considered a vmember.
Note:
LAG is not supported on NFX150 devices.
A Virtual Chassis Fabric supports up to 512,000 vmembers. Thenumber of vmembers is based on the number of VLANs, and the numberof interfaces configured in each VLAN.
A Default VLAN Is Configured on Most Switches
Some switches running Junos OS that do not support the ELS configurationstyle are preconfigured with a VLAN named default thatdoes not tag packets and operates only with untagged packets. On theseswitches, each interface already belongs to the VLAN named default and all traffic uses this VLAN until you configure more VLANs andassign traffic to those VLANs.
EX Series switches that run Junos OS with the ELS configurationstyle do not support a default VLAN. The following EX Series switchesrunning Junos OS not supporting the ELS configuration style are notpreconfigured to belong to default or any other VLAN:
Modular switches, such as the EX8200 switches and EX6200switches
Switches that are part of a Virtual Chassis
The reason that these switches are not preconfigured is thatthe physical configuration in both situations is flexible. There isno way of knowing which line cards have been inserted in either theEX8200 switch or EX6200 switch. There is also no way of knowing whichswitches are included in the Virtual Chassis. Switch interfaces inthese two cases must first be defined as Ethernet switching interfaces.After an interface is defined as an Ethernet switching interface,the default VLAN appears in the output from the ? help and other commands.
Note:
When a Juniper Networks EX4500 Ethernet Switch, EX4200 EthernetSwitch, EX3300 Ethernet Switch, QFX3500 or QFX3600 switch is interconnectedwith other switches in a Virtual Chassis configuration, each individualswitch that is included as a member of the configuration is identifiedwith a member ID. The member ID functions as an FPC slot number. Whenyou are configuring interfaces for a Virtual Chassis configuration,you specify the appropriate member ID (0 through 9) as the slot elementof the interface name. The default factory settings for a VirtualChassis configuration include FPC 0 as a member of the default VLANbecause FPC 0 is configured as part of the ethernet-switching family.In order to include FPC 1 through FPC 9 in the default VLAN, add theethernet-switching family to the configurations for those interfaces.
Note:
You cannot configure a default VLAN on NFX150 devices.
Assigning Traffic to VLANs
You can assign traffic on any switch to a particular VLAN byreferencing either the interface port of the traffic or the MAC addressesof devices sending traffic.
Note:
Two logical interfaces that are configured on the same physicalinterface cannot be mapped to the same VLAN.
- Assign VLAN Traffic According to the Interface Port Source
- Assign VLAN Traffic According to the Source MAC Address
Assign VLAN Traffic According to the Interface Port Source
This method is most commonly used to assign traffic to VLANs.In this case, you specify that all traffic received on a particularswitch interface is assigned to a specific VLAN. You configure thisVLAN assignment when you configure the switch, by using either theVLAN number (called a VLAN ID) or by using the VLAN name, which theswitch then translates into a numeric VLAN ID. This method is referredto simply as creating a VLAN because it is the most commonly usedmethod.
Assign VLAN Traffic According to the Source MAC Address
In this case, all traffic received from a specific MAC addressis forwarded to a specific egress interface (next hop) on the switch.MAC-based VLANs are either static (named MAC addresses configuredone at a time) or dynamic (configured using a RADIUS server).
To configure a static MAC-based VLAN on a switch that supportsELS, see Adding a Static MAC Address Entry to the EthernetSwitching Table.To configure a static MAC-based VLAN ona switch that does not support ELS, see Adding a Static MAC Address Entry to the EthernetSwitching Table.
For information about using 802.1X authentication to authenticateend devices and allow access to dynamic VLANs configured on a RADIUSserver, see Understanding Dynamic VLAN Assignment Using RADIUSAttributes. You can optionally implement this featureto offload the manual assignment of VLAN traffic to automated RADIUSserver databases.
Forwarding VLAN Traffic
To pass traffic within a VLAN, the switch uses Layer2forwarding protocols, including IEEE 802.1Q spanning-tree protocols.
To pass traffic between two VLANs, the switch uses standardLayer3 routing protocols, such as static routing, OSPF, andRIP. The same interfaces that support Layer 2 bridging protocols alsosupport Layer3 routing protocols, providing multilayer switching.
To pass traffic from a single device on an access port to aswitch and then pass those packets on a trunk port, use the nativemode configuration previously discussed under Trunk Mode.
VLANs Communicate with Integrated Routing and Bridging Interfacesor Routed VLAN Interfaces
Traditionally, switches sent traffic to hosts that were partof the same broadcast domain (VLAN) but routers were needed to routetraffic from one broadcast domain to another. Also, only routers performedother Layer 3 functions such as traffic engineering.
Switches that run Junos OS that supports the ELS configurationstyle perform inter-VLAN routing functions using an integrated routingand bridging (IRB) interface named irb, while switches that run JunosOS that does not support ELS perform these functions using a routedVLAN interface (RVI) named vlan. These interfaces detect both MACaddresses and IP addresses and route data to Layer 3 interfaces, therebyfrequently eliminating the need to have both a switch and a router.
VPLS Ports
You can configure VPLS ports in a virtual switch instead ofa dedicated routing instance of type vpls so that the logicalinterfaces of the Layer2 VLANs in the virtual switch can handleVPLS routing instance traffic. Packets received on a Layer2trunk interface are forwarded within a VLAN that has the same VLANidentifier.
