Name: The Foundation of Iron — Week 18 — Switching and VLANs
Author: Amine RAITI

RATIO

THE FOUNDATION OF IRON · COURSE MATERIAL · WEEK 18

◆◆◆

SWITCHING
AND VLANs
Week 18 of 26 · Block 6 — Foundational Networking
10h theory · 25h practice

◆

◆ WEEKLY LEARNING OBJECTIVES

1. Understand how a switch works (MAC table, forwarding, flooding)
2. Design and configure network segmentation using VLANs
3. Configure trunking between switches (trunk mode, 802.1Q protocol)
4. Test and validate segmentation in a simulator
5. Understand why VLAN segmentation is a direct prerequisite for the DHCP covered next

◆◆◆

⚠ WARNING — SHELF LIFE OF VERSIONS REFERENCED HERE

This material references Cisco Packet Tracer and GNS3 as simulators. Other simulators may be substituted. Switch configuration syntax varies by vendor and software version — the instructor adapts commands to the environment actually available.

◆

Amine RAITI · Infrastructure Architect & SRE
Public document · CC BY-NC-SA 4.0 · AI Powered by Amine
Opération Dindon

RATIO

COURSE OUTLINE · 10H

THEORY GUIDING THREAD

◆

18.1 · How a switch works3h

— CAM table (Content Addressable Memory): how the switch learns and stores MAC addresses associated with each port
— Forwarding: sending a frame only to the destination port (saving bandwidth)
— Flooding: sending to all ports when the destination is unknown or broadcast
— Difference between a hub (repeats to all ports) and a switch (forwards intelligently) — link with OSI layer 2 from Week 17

18.2 · VLANs — concept and purpose3h

— A VLAN creates independent logical segments on a single physical switch — traffic isolation without extra cabling
— Typical use cases: separating management, technical and guest traffic on the same physical infrastructure
— Access ports (one VLAN) vs trunk ports (multiple 802.1Q-tagged VLANs)

18.3 · Trunking and the 802.1Q protocol2h

— Trunk link: a port carrying multiple VLANs between two switches or between a switch and a router
— 802.1Q tag: a field added to the Ethernet frame to identify the VLAN
— Native VLAN: untagged VLAN on a trunk (must be configured consistently on both sides)

18.4 · VLANs as a prerequisite for DHCP and inter-VLAN routing2h

— Without mastered VLAN segmentation, it is impossible to correctly understand inter-VLAN DHCP relay configuration (Week 20)
— The router (Week 19) will enable communication between VLANs — conceptual introduction to prepare for next week

RATIO

EXERCISE 1 · VLAN CONFIGURATION IN A SIMULATOR · 12H

Equipment: network simulator (Cisco Packet Tracer or GNS3), provided topology to load (2 switches, 6 machines split into 3 functional groups).

(2h) Exploring the provided topology, identifying machines by functional group, verifying all machines are currently in the same broadcast domain (cross-ping test).

(3h) Creating 3 VLANs on both switches (VLAN 10 = management, VLAN 20 = technical, VLAN 30 = guests), configuring ports in access mode for each machine.

(2h) Configuring the trunk link between the two switches to carry all 3 VLANs.

(3h) Segmentation testing: verify that machines in the same VLAN can communicate, and that machines in different VLANs cannot reach each other directly.

(2h) Documenting the final topology: VLAN table (ID, name, associated ports) and annotated network diagram.

SOLUTION — EXERCISE 1

Expected segmentation result: machines in VLAN 10 can ping each other, but a ping from a VLAN 10 machine to a VLAN 20 machine must fail — VLAN segmentation correctly isolates groups at layer 2.

Common mistake: trunk port not correctly configured between the two switches (forgetting to allow the VLANs on the trunk) — results in a machine being able to reach machines in the same VLAN on the same switch, but not those in the same VLAN on the remote switch.

RATIO

EXERCISE 2 · VLAN SEGMENTATION ON THE HYPERVISOR · 13H

Equipment: the Proxmox VE hypervisor from previous weeks, already-created Linux VMs.

(3h) Configuring VLANs on the hypervisor's network bridges (Proxmox VE supports 802.1Q tagging on its Linux bridges), creating 2 separate bridges simulating 2 VLANs.

(3h) Assigning the existing VMs to the corresponding bridges: 2 VMs on "VLAN 10", 2 VMs on "VLAN 20".

(3h) Connectivity testing: verify that VMs on the same bridge can reach each other, and that VMs on different bridges cannot (virtual network isolation).

(2h) Observing the security benefit of hypervisor segmentation: a compromised VM in one VLAN cannot directly reach VMs in another VLAN — link with the hardening covered in Week 15.

(2h) Writing a final virtual network diagram documenting the VLANs and the VMs attached to each.

SOLUTION — EXERCISE 2

Key teaching point: VLAN segmentation on the hypervisor reproduces exactly the same principles as physical segmentation on a real switch — VMs "see" their network the same way a physical machine sees its VLAN. This is the concrete demonstration that virtualising network resources (Week 13) follows exactly the same rules as the physical network.

◆ SUMMARY SHEET — WEEK 18 SELF-ASSESSMENT

1. I can explain how a switch works (MAC table, forwarding, flooding).

2. I can explain the purpose of a VLAN.

3. I can configure VLANs on a switch in a simulator.

4. I can configure a port in access mode and a port in trunk mode.

5. I can explain the role of the 802.1Q tag.

6. I can test and validate VLAN segmentation.

7. I can configure VLAN bridges on a Proxmox VE hypervisor.

8. I can explain why VLAN segmentation is a prerequisite for multi-VLAN DHCP.