Ethernet Switching and VLANs

Ethernet switching is the process of forwarding Ethernet frames based on MAC addresses. Unlike a hub that repeats every frame out all ports, a switch learns which MAC addresses are reachable via each port and forwards frames only to the appropriate port. This reduces collision domains and increases network efficiency. The switch operates at Layer 2 (Data Link Layer) of the OSI model.

The MAC address table (also called CAM table – Content Addressable Memory) is the core data structure. It maps MAC addresses to switch port numbers. Default aging time is 300 seconds (5 minutes) on most Cisco switches. When a frame arrives, the switch:

The N10-009 exam tests three switching methods: - Store-and-forward: The switch receives the entire frame, checks the FCS (Frame Check Sequence) for errors, then forwards. This introduces latency but ensures error-free forwarding. Used in most modern enterprise switches. - Cut-through: The switch forwards the frame as soon as it reads the destination MAC address (after the first 6 bytes). Latency is minimal, but corrupted frames may be forwarded. Subtypes: fast-forward (immediately after dest MAC) and fragment-free (reads first 64 bytes to detect collisions). - Fragment-free: A compromise – reads the first 64 bytes (the minimum Ethernet frame size) to check for runts before forwarding.

A VLAN (IEEE 802.1Q) logically segments a switch into multiple isolated broadcast domains. By default, all ports belong to VLAN 1. VLANs allow you to group users by function (e.g., VLAN 10 for HR, VLAN 20 for Engineering) regardless of physical location. Traffic between VLANs requires a Layer 3 device (router or Layer 3 switch).

Trunking allows multiple VLANs to traverse a single link. The switch inserts a 4-byte tag into the Ethernet frame between the source MAC and EtherType fields. The tag includes: - TPID (Tag Protocol Identifier): 0x8100 (16 bits) - TCI (Tag Control Information): Priority (3 bits for CoS), Drop Eligible Indicator (1 bit), VLAN ID (12 bits – supports up to 4094 VLANs).

The native VLAN (default VLAN 1) is untagged on a trunk – the switch assumes frames without a tag belong to the native VLAN. Mismatched native VLANs can cause security issues.

VTP (Cisco proprietary) propagates VLAN information across a domain. Modes: - Server: Can create, modify, delete VLANs; advertises changes. - Client: Receives and applies changes; cannot modify locally. - Transparent: Forwards VTP advertisements but does not apply them; can manage VLANs locally.

VTP is rarely used in modern networks due to risk of accidental propagation (e.g., a switch with a higher revision number can overwrite VLAN databases). The exam expects you to know these modes.

DTP negotiates trunking between Cisco switches. Modes: - Dynamic desirable: Actively tries to form a trunk. - Dynamic auto: Waits for the other side to initiate. - Trunk: Forces trunking. - Access: Forces access mode (no trunking).

Security best practice: disable DTP on access ports with switchport nonegotiate.

STP (IEEE 802.1D) prevents loops in redundant topologies. Switches exchange BPDUs (Bridge Protocol Data Units) to elect a root bridge, determine root ports, designated ports, and block redundant paths. Port states: Blocking (20 sec), Listening (15 sec), Learning (15 sec), Forwarding. Timers: Hello (2 sec), Forward Delay (15 sec), Max Age (20 sec).

RSTP (802.1w) speeds convergence to seconds. The exam may ask about port roles: Root, Designated, Alternate, Backup.

Port security limits the number of MAC addresses allowed on a switch port. Default: 1 MAC. Violation modes: - Shutdown: Port goes err-disabled (default). - Restrict: Drops offending frames, increments counter. - Protect: Drops offending frames silently.

Sticky MAC learning: dynamically learned MACs are saved to the running config.

! Create VLAN
Switch(config)# vlan 10
Switch(config-vlan)# name HR

! Assign port to VLAN
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Configure trunk
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30

! Verify
Switch# show vlan brief
Switch# show interfaces trunk
Switch# show mac-address-table
Switch# show spanning-tree
Switch# show port-security interface fa0/1

Know the three switching methods and their trade-offs. Store-and-forward is the most reliable but slowest; cut-through is fastest but may forward errors. Fragment-free is a middle ground. The exam may ask which method is best for latency-sensitive applications (cut-through).

VTP revision numbers increase with each change. If a switch with a higher revision number connects to the domain, it can overwrite the VLAN database. This is a common exam scenario: 'Why did VLANs disappear after adding a new switch?' Answer: The new switch had a higher VTP revision number.

If two switches have different native VLANs on a trunk, control traffic (CDP, VTP, STP BPDUs) may be misdirected, and the trunk may not form. The command show interfaces trunk will show 'Native VLAN mismatch'.

Private VLANs (PVLANs) further isolate ports within a VLAN. Promiscuous ports can communicate with all; isolated ports can only talk to promiscuous ports; community ports can talk to each other and promiscuous ports. Exam may ask about isolated ports.

Ethernet switching and VLANs are the backbone of modern LANs. Understand the frame-forwarding logic, VLAN segmentation, trunking, and loop prevention. Practice configuration and verification commands. The N10-009 exam will test you on these concepts with scenario-based questions.

In a typical enterprise campus network, Ethernet switching and VLANs are deployed to segment departments, improve security, and reduce broadcast traffic. For example, a university may have separate VLANs for students, faculty, and administration. Each VLAN is assigned a unique IP subnet (e.g., 10.1.1.0/24 for students, 10.1.2.0/24 for faculty). Access switches are configured with port security to allow only one MAC address per port, preventing unauthorized devices from connecting. Trunk links between access switches and distribution switches carry multiple VLANs using 802.1Q tagging. The native VLAN is changed from the default VLAN 1 to an unused VLAN (e.g., VLAN 999) to prevent VLAN hopping attacks. STP is configured with Rapid Spanning Tree (RSTP) for fast convergence, and root bridges are manually elected by setting the priority lower (e.g., 4096) on the core switch.

A common issue in production is a native VLAN mismatch on a trunk. For example, if Switch A has native VLAN 99 and Switch B has native VLAN 1, the trunk may still come up, but control traffic (CDP, STP BPDUs) will be misdirected, potentially causing a loop or connectivity loss. The solution is to ensure consistent native VLAN configuration on both ends.

Another scenario is a VTP disaster: an engineer connects a new switch with a higher VTP revision number to the network, and within seconds, all VLANs are deleted from the domain. This is why best practice is to set VTP to transparent mode or disable it entirely. In cloud environments, virtual switches (e.g., VMware vSwitch or AWS VPC) implement similar VLAN concepts but with software-defined networking. For instance, a VMware vSwitch can be configured with VLAN tagging (VST mode) to isolate virtual machines. Misconfiguration can lead to VM-to-VM communication failures if port groups are not assigned correctly.

Performance considerations: The MAC address table size varies by switch model – enterprise switches may support 32,000 to 128,000 entries. Exceeding this limit can cause flooding of all unknown unicast traffic, degrading performance. Monitoring CAM table utilization is important. Also, STP convergence time can be an issue in large networks; using RSTP or MSTP (Multiple Spanning Tree) helps. For high availability, link aggregation (LACP) is used to bundle multiple physical links into one logical trunk, increasing bandwidth and providing redundancy.