--- tags: - networking - l1 - flashcard-deck - vlans --- [Portal](../../../../library/portal/index.md) | **Level:** [L1: Foundations](../../../../library/portal/levels.md) | **Topics:** [VLANs](../../../../library/portal/topics.md) | **Domain:** Networking id category difficulty tags question answer source_path vlans/a1c2e3f4b5d6 vlans easy vlans, networking, concepts What is a VLAN and what problem does it solve? A VLAN (Virtual LAN) segments a physical switch into separate Layer 2 broadcast domains. It isolates traffic so hosts in different VLANs cannot communicate at Layer 2, improving security, performance, and organization.\n\nRemember: "VLAN = Virtual LAN." It segments a physical switch into multiple broadcast domains. VLAN 1 is the default (avoid for security). training/library/topics/vlans/primer.md vlans/b2d3f4a5c6e7 vlans easy vlans, 802.1q, tagging What does an 802.1Q tag contain and how large is it? An 802.1Q tag is 4 bytes inserted into the Ethernet frame header. It contains a TPID (0x8100), a 12-bit VLAN ID (range 1-4094), a 3-bit Priority Code Point (PCP), and a 1-bit DEI field.\n\nRemember: "Trunk port carries multiple VLANs (tagged). Access port carries one VLAN (untagged)."\n\nGotcha: Misconfigured trunk ports are a top cause of inter-VLAN connectivity issues. training/library/topics/vlans/primer.md vlans/c3e4a5b6d7f8 vlans easy vlans, access, trunk What is the difference between an access port and a trunk port? An access port carries traffic for one VLAN and sends/receives untagged frames (end devices are VLAN-unaware). A trunk port carries multiple VLANs simultaneously using 802.1Q tags and connects switches, routers, or VLAN-aware hosts.\n\nRemember: "802.1Q tag = 4-byte header inserted into the Ethernet frame." It contains the VLAN ID (12 bits = up to 4094 VLANs). training/library/topics/vlans/primer.md vlans/d4f5b6c7e8a9 vlans medium vlans, native, security What is the native VLAN and why is a mismatch dangerous? The native VLAN is the VLAN assigned to untagged traffic on a trunk port (default: VLAN 1). If the native VLAN differs on each end of a trunk, untagged frames cross VLAN boundaries unintentionally, causing connectivity issues and enabling VLAN hopping attacks. training/library/topics/vlans/primer.md vlans/e5a6c7d8f9b0 vlans medium vlans, linux, commands How do you create a VLAN interface on Linux using iproute2? Run `ip link add link eth0 name eth0.100 type vlan id 100`, then assign an IP with `ip addr add 10.100.0.5/24 dev eth0.100` and bring it up with `ip link set eth0.100 up`. The 8021q kernel module must be loaded. training/library/topics/vlans/primer.md vlans/f6b7d8e9a0c1 vlans medium vlans, routing, inter-vlan How does inter-VLAN routing work and what are the two common approaches? Since VLANs isolate Layer 2 domains, a Layer 3 device is needed to route between them. Router-on-a-stick uses a single router with sub-interfaces per VLAN on a trunk link. Layer 3 switches use SVIs (Switched Virtual Interfaces) to route at line rate in hardware. training/library/topics/vlans/primer.md vlans/a7c8e9f0b1d2 vlans medium vlans, troubleshooting A host on VLAN 100 can reach other hosts on the same switch but not hosts on VLAN 100 on a different switch. What is the most likely cause? The trunk link between the switches does not have VLAN 100 in its allowed VLAN list. Verify with `show interface trunk` and add the VLAN with `switchport trunk allowed vlan add 100`.\n\nRemember: "Inter-VLAN routing requires a Layer 3 device." Either a router (router-on-a-stick) or a Layer 3 switch with SVIs. training/library/topics/vlans/primer.md vlans/c9e0a1b2d3f4 vlans hard vlans, linux, troubleshooting A Linux VLAN interface (eth0.100) is up and has an IP assigned, but no traffic passes. List four things to check. (1) Physical interface eth0 is up and linked. (2) The 8021q kernel module is loaded (`lsmod | grep 8021q`). (3) The switch port is in trunk mode and allows VLAN 100. (4) MTU is sufficient — the 4-byte VLAN tag can cause oversized frames to be dropped if the path MTU is tight. training/library/topics/vlans/primer.md vlans/d0f1b2c3e4a5 vlans hard vlans, kubernetes, containers How does Multus CNI enable VLAN access for Kubernetes pods? Multus allows attaching multiple network interfaces to a pod. A NetworkAttachmentDefinition can specify a macvlan or host-device interface on a VLAN sub-interface (e.g., eth0.200), giving the pod a second NIC on that VLAN while keeping the primary interface on the cluster overlay network. training/library/topics/vlans/primer.md vlans/e1a2c3d4f5b6 vlans hard vlans, security, design What is a VLAN hopping attack and how do you prevent it? VLAN hopping exploits native VLAN mismatches or DTP (Dynamic Trunking Protocol) to send traffic into VLANs the attacker should not access. Prevent it by: changing the native VLAN from default VLAN 1 to an unused VLAN, disabling DTP on access ports (`switchport nonegotiate`), explicitly setting ports to access mode, and tagging the native VLAN on trunks. training/library/topics/vlans/primer.md --- ## Wiki Navigation ### Related Content - [Case Study: Backup Job Failing — iSCSI Target Unreachable, VLAN Misconfigured](../../../../library/case-studies/cross-domain/backup-job-iscsi-vlan/README.md) (Case Study, L2) — VLANs - [Case Study: DHCP Relay Broken](../../../../library/case-studies/networking/dhcp-relay-broken/README.md) (Case Study, L1) — VLANs - [Case Study: Multicast Not Crossing Router](../../../../library/case-studies/networking/multicast-not-crossing-router/README.md) (Case Study, L2) — VLANs - [Case Study: Network Loop Broadcast Storm](../../../../library/case-studies/networking/network-loop-broadcast-storm/README.md) (Case Study, L2) — VLANs - [Case Study: VLAN Trunk Mistag](../../../../library/case-studies/networking/vlan-trunk-mistag/README.md) (Case Study, L1) — VLANs - [Cisco Fundamentals for DevOps](../../../../library/topics/cisco-fundamentals-for-devops/index.md) (Topic Pack, L1) — VLANs - [Networking Deep Dive](../../../../library/topics/networking/index.md) (Topic Pack, L1) — VLANs - [Scenario: VLAN Trunk Mismatch](../../../../library/scenarios/networking/vlan-trunk-mismatch.md) (Scenario, L2) — VLANs - [Skillcheck: Networking Fundamentals](../../../../library/skillchecks/networking.fundamentals.md) (Assessment, L1) — VLANs - [VLANs](../../../../library/topics/vlans/index.md) (Topic Pack, L1) — VLANs