Chapter 10 Interfaces
ZyWALL USG Series User’s Guide
354
Figure 264 Example: Before VLAN
In this example, there are two physical networks and three departments A, B, and C. The physical
networks are connected to hubs, and the hubs are connected to the router.
Alternatively, you can divide the physical networks into three VLANs.
Figure 265 Example: After VLAN
Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways. Each VLAN
also has a unique identification number (ID). The ID is a 12-bit value that is stored in the MAC header. The
VLANs are connected to switches, and the switches are connected to the router. (If one switch has
enough connections for the entire network, the network does not need switches A and B.)
• Traffic inside each VLAN is layer-2 communication (data link layer, MAC addresses). It is handled by
the switches. As a result, the new switch is required to handle traffic inside VLAN 2. Traffic is only
broadcast inside each VLAN, not each physical network.
• Traffic between VLANs (or between a VLAN and another type of network) is layer-3 communication
(network layer, IP addresses). It is handled by the router.
This approach provides a few advantages.
• Increased performance - In VLAN 2, the extra switch should route traffic inside the sales department
faster than the router does. In addition, broadcasts are limited to smaller, more logical groups of users.
• Higher security - If each computer has a separate physical connection to the switch, then broadcast
traffic in each VLAN is never sent to computers in another VLAN.
• Better manageability - You can align network policies more appropriately for users. For example, you
can create different content filtering rules for each VLAN (each department in the example above),
and you can set different bandwidth limits for each VLAN. These rules are also independent of the
physical network, so you can change the physical network without changing policies.
In this example, the new switch handles the following types of traffic:
• Inside VLAN 2.
To Next Page
Loading...
