Virtual Lan (Vlan); Vlan Infrastructure - D-Link DFL-1600 User Manual

56 Chapter 9. Interfaces
9.2

Virtual LAN (VLAN)

Virtual Networking is the ability of network appliances to manage the
logical network topologies on top of the actual physical connections,
allowing arbitrary segments within a network to be combined into a logical
group. Since the flexibility and the ease of network control provided by the
logical topologies, virtual networking has become one of the major areas in
the internetworking.
D-Link firewalls are fully compliant with IEEE 802.1Q specification for
Virtual LANs, featured by defining virtual interfaces upon the physical
Ethernet interface. Each virtual interface is interpreted as a logical
interface by the firewall, with the same security policies control and
configuration capabilities as regular interfaces.
9.2.1

VLAN Infrastructure

A Local Area Network (LAN) is a broadcast domain, that is, a section of
the network within whose boundaries any broadcast traffic is delivered to
all end-nodes. When the LAN environment grows bigger, the support of
broadcast or multicast applications that flood packets throughout the
network costs considerable waste of bandwidth, since packets are often
forwarded to nodes that do not require them.
Virtual LAN (VLAN) allows a single physical LAN to be partitioned into
several smaller logical LANs which are different broadcast domains. It
limits the size of the broadcast domain for each logical LAN, saves the
broadcast cost of the bandwidth to optimize the performance and resource
allocation, and also divides larger LANs into several independent security
zones to add security control points. Devices located in the same LAN can
communicate without the awareness of the devices in other virtual LANs.
This is ideal for separating industrial departments from physical topology
to different function segments.
A simple infrastructure of VLAN is shown in Figure 9.1. In this case, a
D-Link firewall is configured to have 2 VLAN interfaces. Now, although the
clients and servers are still sharing the same physical media, Client A can
only communicate with Server D and the firewall since they are configured
D-Link Firewalls User's Guide