WEBVTT

1
00:00.000 --> 00:01.290 align:middle line:84%


2
00:01.290 --> 00:03.090 align:middle line:90%
In this video, you
and I get to discuss

3
00:03.090 --> 00:05.472 align:middle line:90%
private VLANs, the big
picture of how they work.

4
00:05.472 --> 00:07.680 align:middle line:90%
So I think one of the best
ways of doing that for you

5
00:07.680 --> 00:09.720 align:middle line:90%
and I is, let's take a
moment on the chalkboard,

6
00:09.720 --> 00:12.450 align:middle line:90%
and let's take a look at how
traditional VLANs operate,

7
00:12.450 --> 00:14.760 align:middle line:90%
and then we'll introduce
a few new components

8
00:14.760 --> 00:17.460 align:middle line:90%
with private VLANs that
give us the benefits

9
00:17.460 --> 00:19.800 align:middle line:90%
of micro-segmentation,
of controlling

10
00:19.800 --> 00:23.070 align:middle line:90%
within a VLAN which ports
are allowed to forward frames

11
00:23.070 --> 00:24.880 align:middle line:84%
back and forth to other parts.

12
00:24.880 --> 00:25.380 align:middle line:84%
All right.

13
00:25.380 --> 00:29.550 align:middle line:90%
So let's begin with a little
history with traditional VLANs.

14
00:29.550 --> 00:33.505 align:middle line:90%
So imagine this is VLAN
100, so we create VLAN 100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.550 --> 00:33.505 align:middle line:90%
So imagine this is VLAN
100, so we create VLAN 100.

15
00:33.505 --> 00:37.230 align:middle line:90%
It has no ports assigned to it
by default, and then we go out

16
00:37.230 --> 00:38.580 align:middle line:84%
and we assign ports.

17
00:38.580 --> 00:41.130 align:middle line:90%
So we use a range command
or something similar,

18
00:41.130 --> 00:44.340 align:middle line:90%
and we take these ports and
we assign them as access ports

19
00:44.340 --> 00:45.810 align:middle line:84%
in VLAN 100.

20
00:45.810 --> 00:48.480 align:middle line:90%
Then as we connect
devices to those ports,

21
00:48.480 --> 00:51.130 align:middle line:90%
those devices at layer 2 are
now part of the same VLAN.

22
00:51.130 --> 00:53.940 align:middle line:90%
Now, behind that, we're going
to have a network IP addressing

23
00:53.940 --> 00:55.860 align:middle line:90%
scheme, which is
layer 3, and it's

24
00:55.860 --> 00:57.550 align:middle line:90%
going to associated
with that VLAN.

25
00:57.550 --> 01:03.270 align:middle line:90%
So maybe we're
using 10.100.0.0/24,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:57.550 --> 01:03.270 align:middle line:90%
So maybe we're
using 10.100.0.0/24,

26
01:03.270 --> 01:06.540 align:middle line:90%
and we can hand out IP addresses
via DHTP or manually configure

27
01:06.540 --> 01:07.270 align:middle line:84%
it.

28
01:07.270 --> 01:10.860 align:middle line:90%
So the end result would be
VLAN 100, these four devices,

29
01:10.860 --> 01:14.010 align:middle line:90%
all in that IP address space
based on their configuration.

30
01:14.010 --> 01:16.590 align:middle line:90%
And as a result of
being in the same VLAN,

31
01:16.590 --> 01:18.270 align:middle line:90%
the switch is going
to allow frames

32
01:18.270 --> 01:20.820 align:middle line:90%
to be sent between any of
these ports in the same VLAN.

33
01:20.820 --> 01:22.622 align:middle line:90%
So if this guy
sends a broadcast,

34
01:22.622 --> 01:24.330 align:middle line:90%
it'll be seen by
everybody else, and they

35
01:24.330 --> 01:25.580 align:middle line:84%
can have direct communication.

36
01:25.580 --> 01:27.690 align:middle line:90%
The switch with
traditional VLANs

37
01:27.690 --> 01:32.880 align:middle line:90%
is going to do nothing to stop
traffic between PC 1 and PC 4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:27.690 --> 01:32.880 align:middle line:90%
is going to do nothing to stop
traffic between PC 1 and PC 4.

38
01:32.880 --> 01:34.800 align:middle line:90%
If there's a broadcast,
that broadcast

39
01:34.800 --> 01:37.740 align:middle line:90%
gets sent and propagated,
and the IP protocol stack

40
01:37.740 --> 01:39.210 align:middle line:84%
operates as normal.

41
01:39.210 --> 01:41.010 align:middle line:90%
So let's compare
and contrast that

42
01:41.010 --> 01:43.650 align:middle line:90%
to what private VLANs
can bring to the table,

43
01:43.650 --> 01:45.390 align:middle line:90%
and we'll also provide
an insight to how

44
01:45.390 --> 01:46.810 align:middle line:84%
they do their magic.

45
01:46.810 --> 01:50.580 align:middle line:90%
So with private VLANs, we are
going to still have a VLAN,

46
01:50.580 --> 01:53.880 align:middle line:90%
and in private VLANs,
they call it the big VLAN.

47
01:53.880 --> 01:55.950 align:middle line:84%
They call that the primary.

48
01:55.950 --> 01:58.380 align:middle line:90%
So this could still be
VLAN 100, the number,

49
01:58.380 --> 02:01.020 align:middle line:90%
and we would identify
it as a primary VLAN,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:58.380 --> 02:01.020 align:middle line:90%
and we would identify
it as a primary VLAN,

50
02:01.020 --> 02:04.020 align:middle line:90%
but instead of just putting
all the ports into that one

51
02:04.020 --> 02:08.250 align:middle line:90%
primary VLAN, we could
create logical subdivisions

52
02:08.250 --> 02:09.419 align:middle line:84%
of this VLAN.

53
02:09.419 --> 02:12.880 align:middle line:90%
And to do that, we are going
to create secondary VLANs.

54
02:12.880 --> 02:13.750 align:middle line:84%
Anyway, that's cool.

55
02:13.750 --> 02:15.270 align:middle line:90%
Keith, what are
they secondary to?

56
02:15.270 --> 02:17.248 align:middle line:90%
Their secondary to
the primary VLANs.

57
02:17.248 --> 02:19.540 align:middle line:90%
Whenever you hear the term
secondary VLANs, just think,

58
02:19.540 --> 02:21.180 align:middle line:90%
oh, this is like
a subsection or us

59
02:21.180 --> 02:25.080 align:middle line:90%
a partition of the primary
VLAN 100, a subsection.

60
02:25.080 --> 02:29.370 align:middle line:90%
So perhaps we create a little
subsection, a secondary VLAN,

61
02:29.370 --> 02:33.090 align:middle line:90%
and for numbering sake, let's
go ahead and call this VLAN 200.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.370 --> 02:33.090 align:middle line:90%
and for numbering sake, let's
go ahead and call this VLAN 200.

62
02:33.090 --> 02:36.210 align:middle line:90%
And when we create it, we'll
specify it's a secondary VLAN

63
02:36.210 --> 02:39.760 align:middle line:90%
and that it's associated
with the primary VLAN of 100.

64
02:39.760 --> 02:42.120 align:middle line:90%
Now, in addition, when we
create this little subsection,

65
02:42.120 --> 02:45.200 align:middle line:90%
this 200, which is going to be a
subsection of the primary VLAN,

66
02:45.200 --> 02:47.500 align:middle line:90%
we are also going
to specify the type.

67
02:47.500 --> 02:49.380 align:middle line:84%
Now, it is a secondary VLAN.

68
02:49.380 --> 02:51.010 align:middle line:90%
In fact, we have one
primary, and then

69
02:51.010 --> 02:52.680 align:middle line:90%
everything that goes
inside the blue box

70
02:52.680 --> 02:54.630 align:middle line:84%
is going to be a secondary VLAN.

71
02:54.630 --> 02:56.050 align:middle line:84%
But there's two different types.

72
02:56.050 --> 02:58.010 align:middle line:90%
We have a type called
community, and when

73
02:58.010 --> 02:59.760 align:middle line:90%
you think of the word
community, think of,

74
02:59.760 --> 03:02.710 align:middle line:90%
hey, community, like
people working together,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.760 --> 03:02.710 align:middle line:90%
hey, community, like
people working together,

75
03:02.710 --> 03:04.230 align:middle line:90%
and that's exactly
what it means.

76
03:04.230 --> 03:07.050 align:middle line:90%
If we create a secondary VLAN,
in this case, number 200,

77
03:07.050 --> 03:09.150 align:middle line:90%
and we specify as a
type community, that

78
03:09.150 --> 03:12.360 align:middle line:90%
means any ports that we
associate with VLAN 200

79
03:12.360 --> 03:14.250 align:middle line:90%
as part of the
bigger private VLAN,

80
03:14.250 --> 03:16.200 align:middle line:90%
they can all communicate
with each other,

81
03:16.200 --> 03:18.010 align:middle line:84%
like a happy little community.

82
03:18.010 --> 03:20.640 align:middle line:90%
However, if we created
another secondary VLAN--

83
03:20.640 --> 03:22.950 align:middle line:90%
let's go ahead
and use 300 here--

84
03:22.950 --> 03:27.010 align:middle line:90%
and we specify that this
is also a type community

85
03:27.010 --> 03:31.320 align:middle line:90%
and then we have a few ports
that we put into VLAN 300, all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:27.010 --> 03:31.320 align:middle line:90%
and then we have a few ports
that we put into VLAN 300, all

86
03:31.320 --> 03:33.810 align:middle line:90%
those ports, the switch would
allow traffic and frames

87
03:33.810 --> 03:35.850 align:middle line:90%
to be forwarded between
any of those ports

88
03:35.850 --> 03:37.075 align:middle line:84%
in the same community.

89
03:37.075 --> 03:38.700 align:middle line:90%
But what the switch
is not going to do,

90
03:38.700 --> 03:42.810 align:middle line:90%
it's not going to allow
traffic from ports in VLAN 200

91
03:42.810 --> 03:47.303 align:middle line:90%
to go to VLAN 300 because they
are in different communities.

92
03:47.303 --> 03:49.470 align:middle line:90%
And while we're talking
about these secondary VLANs,

93
03:49.470 --> 03:52.260 align:middle line:90%
these two types would be
community secondary VLANs,

94
03:52.260 --> 03:54.930 align:middle line:90%
but there is one other type,
and let me go ahead and draw

95
03:54.930 --> 03:56.520 align:middle line:84%
that in this color right here.

96
03:56.520 --> 03:58.050 align:middle line:84%
And let's call this VLAN 400.

97
03:58.050 --> 03:59.700 align:middle line:90%
It's still a secondary
VLAN, but we can

98
03:59.700 --> 04:02.530 align:middle line:84%
specify it's a type isolated.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.700 --> 04:02.530 align:middle line:84%
specify it's a type isolated.

99
04:02.530 --> 04:05.790 align:middle line:90%
And if we assign some ports
to that VLAN 400, which

100
04:05.790 --> 04:09.850 align:middle line:90%
we identified as a secondary
VLAN and the type isolated,

101
04:09.850 --> 04:12.450 align:middle line:90%
and if the secondary
VLAN is a type isolated,

102
04:12.450 --> 04:15.420 align:middle line:90%
that means that every port
that we have associated

103
04:15.420 --> 04:19.890 align:middle line:90%
with VLAN 400, this isolated
secondary VLAN, each port

104
04:19.890 --> 04:21.660 align:middle line:84%
is pretty much isolated.

105
04:21.660 --> 04:23.310 align:middle line:90%
That means the switch
will not forward

106
04:23.310 --> 04:25.530 align:middle line:90%
frames between this
port right here

107
04:25.530 --> 04:27.180 align:middle line:90%
and any other port
that are associated

108
04:27.180 --> 04:29.070 align:middle line:90%
with the isolated
secondary VLAN.

109
04:29.070 --> 04:32.340 align:middle line:90%
And it also will not
forward any frames
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:29.070 --> 04:32.340 align:middle line:90%
And it also will not
forward any frames

110
04:32.340 --> 04:34.650 align:middle line:90%
between these ports
and the isolated VLAN

111
04:34.650 --> 04:36.750 align:middle line:90%
and any of the other
community VLANs

112
04:36.750 --> 04:38.695 align:middle line:84%
that may exist on the switch.

113
04:38.695 --> 04:40.320 align:middle line:90%
Now, the other point
I want to add here

114
04:40.320 --> 04:42.840 align:middle line:90%
is that because we are
using private VLANs,

115
04:42.840 --> 04:45.060 align:middle line:90%
we will still have
this entire blue box,

116
04:45.060 --> 04:48.160 align:middle line:90%
the entire private VLAN
architecture, if you will,

117
04:48.160 --> 04:51.090 align:middle line:90%
the primary VLAN and all
these secondary VLANs,

118
04:51.090 --> 04:53.560 align:middle line:90%
they would all be using the
same layer 3 address space.

119
04:53.560 --> 04:58.830 align:middle line:90%
So this whole blue box
will be 10.100.0.0/24,

120
04:58.830 --> 05:02.950 align:middle line:90%
even though you can have
a device like at .70 here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:58.830 --> 05:02.950 align:middle line:90%
even though you can have
a device like at .70 here

121
05:02.950 --> 05:05.080 align:middle line:84%
and a device at .80 here.

122
05:05.080 --> 05:07.600 align:middle line:90%
Same subnet, but
the switch would not

123
05:07.600 --> 05:09.220 align:middle line:90%
allow the traffic
to be forwarded

124
05:09.220 --> 05:11.560 align:middle line:90%
at layer 2 between
two ports that

125
05:11.560 --> 05:14.260 align:middle line:90%
are in different
secondary community VLANs.

126
05:14.260 --> 05:16.870 align:middle line:90%
Now, one of the challenges is
that those devices probably

127
05:16.870 --> 05:18.370 align:middle line:90%
are going to want
to, at some point,

128
05:18.370 --> 05:20.860 align:middle line:90%
communicate off their local
network to some other device

129
05:20.860 --> 05:24.430 align:middle line:90%
like a router, and how do
you allow some devices that

130
05:24.430 --> 05:27.850 align:middle line:90%
are part of VLAN 200,
which is a community VLAN

131
05:27.850 --> 05:30.250 align:middle line:90%
and VLAN 300, which
is the community VLAN,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
05:27.850 --> 05:30.250 align:middle line:90%
and VLAN 300, which
is the community VLAN,

132
05:30.250 --> 05:32.770 align:middle line:90%
and VLAN 400, which
is the isolated VLAN,

133
05:32.770 --> 05:36.220 align:middle line:90%
how do you allow that traffic
to get off the network, meaning

134
05:36.220 --> 05:37.540 align:middle line:84%
go to their default gateway?

135
05:37.540 --> 05:40.790 align:middle line:90%
And the answer to that
is in the primary VLAN,

136
05:40.790 --> 05:44.680 align:middle line:90%
we are going to have one
or more promiscuous ports,

137
05:44.680 --> 05:47.410 align:middle line:90%
and that's what I'd like to
talk about with you in detail

138
05:47.410 --> 05:48.315 align:middle line:84%
in the next video.

139
05:48.315 --> 05:49.940 align:middle line:90%
So I'll see you there
in just a moment.

140
05:49.940 --> 05:52.420 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

141
05:52.420 --> 05:55.740 align:middle line:90%
and I'd like to thank
you for viewing.