MAC Addresses and VLANs

What it is

A MAC address identifies a network interface on a local link, and a VLAN splits one switch into several separate Layer 2 networks.

Switches use MAC addresses to deliver frames inside a network. VLANs decide which devices share a broadcast domain, even when they plug into the same switch.

Both matter to developers, because an application server and a device often have to sit in the right VLAN to reach each other.

How it works

Switches learn MAC addresses and forward frames, and VLAN tags keep traffic separate.

MAC addresses

A MAC address has 48 bits, written as 12 hexadecimal digits, for example 00:1A:2B:3C:4D:5E. It operates at Layer 2 of the OSI model.

• The first half is the OUI, which identifies the manufacturer.
• The second half is a number assigned by that manufacturer.
• It is also called the physical or hardware address, and it is normally fixed in the network card.
• The broadcast address is FF:FF:FF:FF:FF:FF, which reaches every device in the broadcast domain.

A MAC address is only used on the local network. A router rewrites the MAC addresses at every hop, while the IP addresses stay the same from end to end.

How a switch uses MAC addresses

A switch keeps a MAC address table, which maps each MAC address to a port.

1. A frame arrives on a port. The switch records the source MAC address against that port.
2. The switch looks up the destination MAC address.
3. If it is known, the switch sends the frame out of that one port.
4. If it is unknown, or a broadcast, the switch floods the frame out of all other ports in the VLAN.

Switch# show mac address-table
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    001a.2b3c.4d5e    DYNAMIC     Gi0/1
  10    001a.2b3c.4d5f    DYNAMIC     Gi0/2

The platform here is IOS XE, and the table shows the VLAN, address, type and port. ARP is the protocol that finds the MAC address for a known IP address.

What a VLAN is

A VLAN, or virtual LAN, is a logical Layer 2 network. Each VLAN is one broadcast domain, and devices in different VLANs cannot talk directly at Layer 2.

The benefits are:

• Smaller broadcast domains, which cut noise.
• Security. Departments or device types are kept apart.
• Flexibility. Devices can be grouped by role and not by their position in the building.
• Policy. Firewalls and routers can control traffic between VLANs.

VLAN IDs run from 1 to 4094. Traffic between VLANs must go through a router or a Layer 3 switch.

Access and trunk ports

The tag on a trunk follows the IEEE 802.1Q standard and holds the VLAN ID.

A basic configuration

Switch(config)# vlan 10
Switch(config-vlan)# name SERVERS
Switch(config-vlan)# exit
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# interface GigabitEthernet0/24
Switch(config-if)# switchport mode trunk

This IOS XE example creates VLAN 10 named SERVERS, puts port Gi0/1 in it as an access port, and makes Gi0/24 a trunk. Some switches also need switchport trunk encapsulation dot1q before the trunk command.

Switch# show vlan brief

The command lists each VLAN with its name and ports.

Why developers care

Container hosts and virtual machines are often attached to a trunk, with a different VLAN for each network. A server in the wrong VLAN cannot reach its gateway, so an API call to it fails with a timeout even though the service is running.