VLAN segmentation is also the most widely used and most effective approach. Currently, the vast majority of switches supporting the VLAN protocol offer this VLAN configuration method.
This method of VLAN segmentation is based on the switching ports of an Ethernet switch. It divides the physical ports on the VLAN switch and the PVC ports inside the VLAN switch into several groups, with each group forming a virtual network, equivalent to an independent VLAN switch.
1. When different departments need to communicate with each other, routing can be handled through a router, combined with MAC address-based port filtering. On the switch, routing switch, or router port closest to a particular site along the access path, a set of permissible MAC addresses can be configured. This prevents illegal intruders from internally stealing IP addresses and gaining access from other accessible points.
2. From the segmentation method itself, we can see that its advantage is the simplicity of defining VLAN members鈥攜ou simply assign all ports to the corresponding VLAN group. It is suitable for networks of any size. Its disadvantage is that if a user leaves their original port and moves to a new port on a different switch, redefinition is required.
3. VLAN segmentation based on MAC addresses involves segmenting according to each host’s MAC address, meaning each host with a MAC address is configured to belong to a specific group. The mechanism it implements is that each network card corresponds to a unique MAC address, and the VLAN switch tracks addresses belonging to the VLAN MAC. This type of VLAN allows network users to move from one physical location to another while automatically retaining their VLAN membership identity.
4. From this segmentation mechanism, it is clear that the biggest advantage of this VLAN segmentation method is that when a user’s physical location changes鈥攆or example, moving from one switch to another鈥攖he VLAN does not need reconfiguration because it is user-based rather than switch-port-based. The disadvantage is that during initialization, all users must be configured. If there are hundreds or even thousands of users, the configuration is very laborious, so this segmentation method is typically suitable for small LANs. Additionally, this method also leads to reduced switch execution efficiency.
5. Because many VLAN group members may exist on every switch port, storing the MAC addresses of many users makes queries quite difficult. Furthermore, for users with laptops, their network cards may be changed frequently, meaning the VLAN must be reconfigured often. VLAN segmentation by network layer protocol鈥攆orming a VLAN based on network layer protocols鈥攁llows the broadcast domain to span multiple VLAN switches. This is very attractive to network administrators who wish to organize users based on specific applications and services.
Moreover, users can move freely within the network while their VLAN membership identity remains unchanged.
6. The advantage of this method is that if a user’s physical location changes, the VLAN they belong to does not need reconfiguration, and VLANs can be segmented according to protocol type, which is important to network administrators. Also, this method does not require additional frame tags to identify VLANs, thus reducing network traffic. The disadvantage is low efficiency, because checking the network layer address of each data packet consumes processing time. General switch chips can automatically inspect the Ethernet frame headers of data packets on the network, but enabling a chip to inspect IP frame headers requires higher technology and is also more time-consuming. Of course, this depends on each vendor’s implementation method.
7. IP multicast is actually also a definition of VLAN, where an IP multicast group is considered a VLAN. This segmentation method extends VLANs to the wide area network, thus offering greater flexibility and making it easy to extend through routers. It is mainly suitable for LAN users not in the same geographical area to form a VLAN, but it is not suitable for local area networks, primarily due to low efficiency.
8. Policy-based VLANs can implement multiple assignment methods, including VLAN switch ports, MAC addresses, IP addresses, network layer protocols, etc. Network administrators can decide which type of VLAN to choose based on their own management model and the needs of their organization.
9. VLAN segmentation