ZyXEL Communications ZYWALL USG 20 Manual page 265

• Traffic inside each VLAN is layer-2 communication (data link layer, MAC
addresses). It is handled by the switches. As a result, the new switch is required
to handle traffic inside VLAN 2. Traffic is only broadcast inside each VLAN, not
each physical network.
• Traffic between VLANs (or between a VLAN and another type of network) is
layer-3 communication (network layer, IP addresses). It is handled by the
router.
This approach provides a few advantages.
• Increased performance - In VLAN 2, the extra switch should route traffic inside
the sales department faster than the router does. In addition, broadcasts are
limited to smaller, more logical groups of users.
• Higher security - If each computer has a separate physical connection to the
switch, then broadcast traffic in each VLAN is never sent to computers in
another VLAN.
• Better manageability - You can align network policies more appropriately for
users. For example, you can create different content filtering rules for each
VLAN (each department in the example above), and you can set different
bandwidth limits for each VLAN. These rules are also independent of the
physical network, so you can change the physical network without changing
policies.
In this example, the new switch handles the following types of traffic:
• Inside VLAN 2.
• Between the router and VLAN 1.
• Between the router and VLAN 2.
• Between the router and VLAN 3.
VLAN Interfaces Overview
In the ZyWALL, each VLAN is called a VLAN interface. As a router, the ZyWALL
routes traffic between VLAN interfaces, but it does not route traffic within a VLAN
interface. All traffic for each VLAN interface can go through only one Ethernet
interface, though each Ethernet interface can have one or more VLAN interfaces.
Note: Each VLAN interface is created on top of only one Ethernet interface.
Otherwise, VLAN interfaces are similar to other interfaces in many ways. They
have an IP address, subnet mask, and gateway used to make routing decisions.
They restrict bandwidth and packet size. They can provide DHCP services, and
they can verify the gateway is available.
ZyWALL USG 20/20W User's Guide
Chapter 11 Interfaces
265