WEBVTT

1
00:00.000 --> 00:04.840
Well, as we turn our attention into the world of layer two, we're going to

2
00:04.840 --> 00:05.600
start with the

3
00:05.600 --> 00:08.920
conversation just around VLANs and SVIs.

4
00:08.920 --> 00:12.720
And this is eventually going to lead to ether channels and spanning tree.

5
00:12.720 --> 00:17.500
But it's going to be a journey that starts with some CCNA level concepts.

6
00:17.500 --> 00:21.720
But then as we would expect with an exam like this, we're going to dive deeper

7
00:21.720 --> 00:22.080
into those

8
00:22.080 --> 00:23.440
same topics.

9
00:23.440 --> 00:26.370
And so let's go ahead and make sure we have some of the fundamentals, but then

10
00:26.370 --> 00:26.840
continue

11
00:26.840 --> 00:30.440
to dig deeper with every topic that we explore.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.840 --> 00:30.440
to dig deeper with every topic that we explore.

12
00:30.440 --> 00:33.720
So we're going to start with the concept of VLANs.

13
00:33.720 --> 00:37.940
And when we're talking about first learning about VLANs, these VLANs are things

14
00:37.940 --> 00:39.280
that we

15
00:39.280 --> 00:40.960
configure on switches.

16
00:40.960 --> 00:43.400
We know that they divide a switch up.

17
00:43.400 --> 00:48.600
So for example, back in the early days, we'd had hubs and all of these hosts

18
00:48.600 --> 00:49.960
would communicate.

19
00:49.960 --> 00:53.940
And if I'm trying to talk to this host over here, well, then everybody would

20
00:53.940 --> 00:54.560
hear that

21
00:54.560 --> 00:55.760
because it's a hub.

22
00:55.760 --> 00:57.000
It's layer one.

23
00:57.000 --> 01:00.000
And then we came up with the concept of the switch.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.000 --> 01:00.000
And then we came up with the concept of the switch.

24
01:00.000 --> 01:05.100
And the switch allows me to just send communications through this device

25
01:05.100 --> 01:06.880
towards another device

26
01:06.880 --> 01:07.880
like this.

27
01:07.880 --> 01:11.360
And it would only be heard by the destination.

28
01:11.360 --> 01:17.000
These other devices wouldn't hear it outside of the possibility that I'm

29
01:17.000 --> 01:18.960
sending a broadcast.

30
01:18.960 --> 01:22.960
And so if I'm sending broadcast traffic of which there's a lot in a layer two

31
01:22.960 --> 01:23.600
domain,

32
01:23.600 --> 01:27.390
now all of a sudden we have the same problem as a hub and everybody's receiving

33
01:27.390 --> 01:28.120
this traffic

34
01:28.120 --> 01:30.200
whether they wanted or not.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:28.120 --> 01:30.200
whether they wanted or not.

35
01:30.200 --> 01:35.520
And so we connect enough devices together and these broadcasts become a problem

36
01:35.520 --> 01:35.920
because

37
01:35.920 --> 01:41.480
all of this is known as a broadcast domain.

38
01:41.480 --> 01:47.260
A broadcast domain is the entire networking region that's going to propagate

39
01:47.260 --> 01:48.680
these broadcasts.

40
01:48.680 --> 01:52.120
So if I'm sending a broadcast in, who all is receiving it?

41
01:52.120 --> 01:55.900
Well, it's everyone in the broadcast domain and by default, that's everyone in

42
01:55.900 --> 01:56.480
the entire

43
01:56.480 --> 01:58.040
layer two network.

44
01:58.040 --> 02:00.560
And so this is where VLANs come into play.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:58.040 --> 02:00.560
And so this is where VLANs come into play.

45
02:00.560 --> 02:05.450
The idea of VLANs was that we could carve this switch up into two different

46
02:05.450 --> 02:06.280
broadcast

47
02:06.280 --> 02:08.800
domains and call them two different VLANs.

48
02:08.800 --> 02:13.200
So maybe VLAN 10 on the left, VLAN 20 on the right.

49
02:13.200 --> 02:19.910
And so now if we have a bunch of hosts connecting into these VLANs, if I send a

50
02:19.910 --> 02:21.240
broadcast on

51
02:21.240 --> 02:27.870
a VLAN 10 interface, that broadcast will get propagated out to the other VLAN

52
02:27.870 --> 02:29.000
10 hosts

53
02:29.000 --> 02:34.600
and ports, but it won't get sent out to anybody in VLAN 20.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:29.000 --> 02:34.600
and ports, but it won't get sent out to anybody in VLAN 20.

54
02:34.600 --> 02:41.520
And the reason for this is because a VLAN really is a broadcast domain.

55
02:41.520 --> 02:44.850
Sometimes when we're first learning about VLANs and we see that we map a subnet

56
02:44.850 --> 02:45.200
to a

57
02:45.200 --> 02:48.910
VLAN, we might equate the two and say, oh, a VLAN is just a one-to-one mapping

58
02:48.910 --> 02:49.320
with a

59
02:49.320 --> 02:52.000
subnet, it's the layer two equivalent.

60
02:52.000 --> 02:53.720
But I don't like that description.

61
02:53.720 --> 02:57.530
I prefer to think of it like this, because this is the very accurate way of

62
02:57.530 --> 02:58.280
describing

63
02:58.280 --> 03:00.360
what exactly VLAN is.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:58.280 --> 03:00.360
what exactly VLAN is.

64
03:00.360 --> 03:06.440
It's a broadcast domain that is virtually created, hence the V and VLAN.

65
03:06.440 --> 03:09.240
It's not tied to anything physical.

66
03:09.240 --> 03:11.960
So I can have a great many VLANs here.

67
03:11.960 --> 03:16.000
I could have a hundred VLANs if I so desired, as long as I have enough ports to

68
03:16.000 --> 03:16.720
support it,

69
03:16.720 --> 03:19.640
I suppose, throughout the network.

70
03:19.640 --> 03:23.900
And that's going to create a bunch of individual broadcast domains, which makes

71
03:23.900 --> 03:24.880
for a much cleaner

72
03:24.880 --> 03:25.880
network.

73
03:25.880 --> 03:29.540
Now, I mentioned subnets, and that's another conversation here, because when we

74
03:29.540 --> 03:30.240
talk about
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
03:29.540 --> 03:30.240
talk about

75
03:30.240 --> 03:34.580
things from a layer three perspective, and I want to, let's say, map a subnet

76
03:34.580 --> 03:35.120
onto the

77
03:35.120 --> 03:38.960
network, usually I'm going to place a subnet onto a VLAN.

78
03:38.960 --> 03:42.240
And we like this to be a one-to-one mapping.

79
03:42.240 --> 03:48.520
So a subnet to VLAN should be one-to-one in an ideal world.

80
03:48.520 --> 03:51.400
However, that's not technically required.

81
03:51.400 --> 03:57.000
We could have many subnets tied to just a single VLAN.

82
03:57.000 --> 04:02.120
And we'll see this when we configure secondary interfaces later on on the SVIs.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
03:57.000 --> 04:02.120
And we'll see this when we configure secondary interfaces later on on the SVIs.

83
04:02.120 --> 04:07.240
But just be aware that a VLAN truly, again, is just a broadcast domain.

84
04:07.240 --> 04:09.920
I could put as many subnets on there as I want.

85
04:09.920 --> 04:14.190
But even though the hosts are going to largely communicate to hosts in their

86
04:14.190 --> 04:15.040
own subnet,

87
04:15.040 --> 04:18.810
all of the broadcasts that get sent out from one subnet would be received by

88
04:18.810 --> 04:19.600
all the other

89
04:19.600 --> 04:24.960
subnets on that VLAN, which is why we prefer to keep it one-to-one.

90
04:24.960 --> 04:28.840
But in some situations in the real world, we have no choice but to deploy

91
04:28.840 --> 04:30.220
multiple subnets
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
04:28.840 --> 04:30.220
multiple subnets

92
04:30.220 --> 04:32.040
to a single VLAN.

93
04:32.040 --> 04:37.880
Now, VLANs also come with identifiers, with numbers.

94
04:37.880 --> 04:40.680
So we have this concept of VLAN IDs.

95
04:40.680 --> 04:47.840
And this is rooted in the fact that a VLAN ID is a 12-bit identifier.

96
04:47.840 --> 04:52.000
And it exists inside of the Ethernet header.

97
04:52.000 --> 04:57.460
And specifically, not part of the standard Ethernet header, but as part of the

98
04:57.460 --> 04:59.280
802.1q

99
04:59.280 --> 05:03.320
header that gets inserted into the Ethernet header.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
04:59.280 --> 05:03.320
header that gets inserted into the Ethernet header.

100
05:03.320 --> 05:06.040
And so this is where we can talk about trunk links and such.

101
05:06.040 --> 05:07.480
And we will get to that.

102
05:07.480 --> 05:13.030
But the idea here is that within this header, we have an identifier that is 12

103
05:13.030 --> 05:13.680
bits.

104
05:13.680 --> 05:18.940
And if we do our math there, 2 to the 12th power, that's 4096, which means our

105
05:18.940 --> 05:19.300
total

106
05:19.300 --> 05:25.120
range of VLANs would be 0 through 4096.

107
05:25.120 --> 05:29.230
Although in a real world, or from a real world perspective, I suppose, that

108
05:29.230 --> 05:29.800
translates

109
05:29.800 --> 05:32.440
really to 1 to 4094.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
05:29.800 --> 05:32.440
really to 1 to 4094.

110
05:32.440 --> 05:37.480
And the reason for that is because 0 and 4095, these are reserved.

111
05:37.480 --> 05:39.680
We're not allowed to use them.

112
05:39.680 --> 05:44.600
It was declared as such way back when, and that rule still applies today.

113
05:44.600 --> 05:49.040
So our full range of VLANs is 1 to 4096.

114
05:49.040 --> 05:54.400
Now what's kind of curious about this is that we have to actually break this

115
05:54.400 --> 05:55.160
range down

116
05:55.160 --> 05:58.480
into different regions if we want to call it that.

117
05:58.480 --> 06:00.360
And this is primarily a Cisco thing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
05:58.480 --> 06:00.360
And this is primarily a Cisco thing.

118
06:00.360 --> 06:05.420
And just because Cisco's been around for such a long time, they had a situation

119
06:05.420 --> 06:06.280
, really

120
06:06.280 --> 06:10.360
let's just say that they had to adapt to evolving situations and evolving

121
06:10.360 --> 06:11.240
technologies

122
06:11.240 --> 06:12.480
over time.

123
06:12.480 --> 06:20.440
So specifically, when Cisco first supported VLANs, they supported VLANs from 1

124
06:20.440 --> 06:22.360
to 1,005.

125
06:22.360 --> 06:29.200
And this is known as the standard range of VLANs.

126
06:29.200 --> 06:33.790
This is a Cisco term that they use to describe these first range of VLANs that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
06:29.200 --> 06:33.790
This is a Cisco term that they use to describe these first range of VLANs that

127
06:33.790 --> 06:35.080
they supported.

128
06:35.080 --> 06:39.140
And if we do commands like show VLAN and such, we might find that we're going

129
06:39.140 --> 06:39.840
to see that

130
06:39.840 --> 06:44.000
these VLANs are separated out from the rest for that reason.

131
06:44.000 --> 06:50.640
Furthermore, a few of these VLANs have been reserved, specifically 1,002 to 1,

132
06:50.640 --> 06:51.840
005 were

133
06:51.840 --> 06:57.800
originally reserved for FDDI and token ring, which are...

134
06:57.800 --> 07:05.050
This is very legacy technologies at this point, but because of this, these VLAN
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
06:57.800 --> 07:05.050
This is very legacy technologies at this point, but because of this, these VLAN

135
07:05.050 --> 07:05.960
s are actually

136
07:05.960 --> 07:11.280
configured by default on our Cisco iOSXE devices.

137
07:11.280 --> 07:15.890
So if I get onto a Cisco device and before I do any configuration, I do a show

138
07:15.890 --> 07:16.320
VLAN,

139
07:16.320 --> 07:23.120
I'm going to see that VLAN 1 and 1,002 to 1,005 are already configured.

140
07:23.120 --> 07:26.400
And the reason for that is, again, historical.

141
07:26.400 --> 07:30.220
It's this legacy concept that Cisco's been around for so long that they
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
07:26.400 --> 07:30.220
It's this legacy concept that Cisco's been around for so long that they

142
07:30.220 --> 07:31.160
originally only

143
07:31.160 --> 07:36.270
supported 1,005 and they had set some aside to support some legacy technologies

144
07:36.270 --> 07:36.800
, or least

145
07:36.800 --> 07:40.640
technologies that are now legacy.

146
07:40.640 --> 07:44.770
Well fortunately, eventually we were allowed to use all of the VLANs in the

147
07:44.770 --> 07:45.760
full range.

148
07:45.760 --> 07:57.480
And so this 1006 through 4094, this is known as the extended range of VLANs.

149
07:57.480 --> 08:01.900
So does it matter to us which VLANs are in the extended range versus the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:57.480 --> 08:01.900
So does it matter to us which VLANs are in the extended range versus the

150
08:01.900 --> 08:03.240
standard range?

151
08:03.240 --> 08:08.520
Not really, but at the same time, there are some nuances to this conversation.

152
08:08.520 --> 08:14.360
Specifically, when we start talking about VTP, the VLAN trunking protocol,

153
08:14.360 --> 08:15.480
which is a protocol

154
08:15.480 --> 08:20.430
that carries VLANs between switches, if we talk about version 1 or version 2,

155
08:20.430 --> 08:21.240
this only

156
08:21.240 --> 08:24.440
supports the standard range.

157
08:24.440 --> 08:28.960
If we want to support the extended range of VLANs, then we're going to have to

158
08:28.960 --> 08:29.240
go to

159
08:29.240 --> 08:34.510
VTP version 3, which is the most modern version in the version we should all be
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
08:29.240 --> 08:34.510
VTP version 3, which is the most modern version in the version we should all be

160
08:34.510 --> 08:35.040
using.

161
08:35.040 --> 08:38.380
But at the same time, it's worth noting that those are the kinds of things that

162
08:38.380 --> 08:38.980
we're going

163
08:38.980 --> 08:42.360
to encounter if we're trying to use the extended range.

164
08:42.360 --> 08:47.200
That said, in a modern network, we should have no concerns about using the

165
08:47.200 --> 08:48.160
extended range

166
08:48.160 --> 08:49.160
of VLANs.

167
08:49.160 --> 08:54.550
All of those VLAN IDs are there for us to use, and we can even reclaim 1002 to

168
08:54.550 --> 08:55.800
1005 if we

169
08:55.800 --> 08:57.120
so desire.

170
08:57.120 --> 09:01.440
But again, just understand when we're looking at Cisco configuration why things
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
08:57.120 --> 09:01.440
But again, just understand when we're looking at Cisco configuration why things

171
09:01.440 --> 09:02.080
get broken

172
09:02.080 --> 09:04.360
down the way they do.

173
09:04.360 --> 09:08.670
Now as a final note, and we always like to talk about security where we can and

174
09:08.670 --> 09:09.160
where

175
09:09.160 --> 09:10.640
it makes sense to do so.

176
09:10.640 --> 09:15.560
We do need to be aware of the concept of the default VLAN.

177
09:15.560 --> 09:18.480
Oftentimes we talk about the native VLAN on a trunk, but this is talking about

178
09:18.480 --> 09:19.000
something

179
09:19.000 --> 09:20.000
else.

180
09:20.000 --> 09:23.740
The default VLAN is the VLAN gets automatically assigned to all of our

181
09:23.740 --> 09:24.680
interfaces.

182
09:24.680 --> 09:28.710
So when I first spin up a Cisco switch, all of the interfaces are going to be

183
09:28.710 --> 09:29.480
placed into

184
09:29.480 --> 09:33.600
the default VLAN, which is 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
09:29.480 --> 09:33.600
the default VLAN, which is 1.

185
09:33.600 --> 09:37.400
So I'm placing all of these ports into VLAN 1 by default.

186
09:37.400 --> 09:43.000
And the reason why this is a security conversation is because all of the threat

187
09:43.000 --> 09:44.360
actors know that

188
09:44.360 --> 09:49.320
VLAN 1 is an ID that's in use in a lot of organizations.

189
09:49.320 --> 09:50.320
So what do we try to do?

190
09:50.320 --> 09:55.920
We try to avoid using VLAN 1, even if it's just as simple as changing the

191
09:55.920 --> 09:56.960
identifier

192
09:56.960 --> 10:00.360
to VLAN 2 on all the interfaces, then so be it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
09:56.960 --> 10:00.360
to VLAN 2 on all the interfaces, then so be it.

193
10:00.360 --> 10:05.050
But generally speaking, we want to avoid using VLAN 1 in our networks because

194
10:05.050 --> 10:05.680
that is the

195
10:05.680 --> 10:10.800
VLAN that every port belongs to when the switch is first turned on.