Vlan - D-Link DFL-1660 User Manual

3.4.3. VLAN

physical interface to a logical interface in the confguration, the logical interface is mapped to the
physical interface. However, this mapping must be done before the configuration is activated.
For a complete list of all CLI options see the CLI Reference Guide.
3.4.3. VLAN
Overview
Virtual LAN (VLAN) support in NetDefendOS allows the definition of one or more Virtual LAN
interfaces which are associated with a particular physical interface. These are then considered to be
logical interfaces by NetDefendOS and can be treated like any other interfaces in NetDefendOS rule
sets and routing tables.
VLANs are useful in several different scenarios. A typical application is to allow one Ethernet
interface to appear as many separate interfaces. This means that the number of physical Ethernet
interfaces on a NetDefend Firewall need not limit how many totally separated external networks can
be connected.
Another typical usage of VLANs is to group together clients in an organisation so that the traffic
belonging to different groups is kept completely separate in different VLANs. Traffic can then only
flow between the different VLANs under the control of NetDefendOS and is filtered using the
security policies described by the NetDefendOS rule sets.
As explained in more detail below, VLAN configuration with NetDefendOS involves a combination
of VLAN trunks from the NetDefend Firewall to switches and these switches are configured with
port based VLANs on their interfaces. Any physical firewall interface can, at the same time, carry
both non-VLAN traffic as well VLAN trunk traffic for one or multiple VLANs.
VLAN Processing
NetDefendOS follows the IEEE 802.1Q specification. The specifies how VLAN functions by
adding a Virtual LAN Identifier (VLAN ID) to Ethernet frame headers which are part of a VLAN's
traffic.
The VLAN ID is a number between 0 and 4095 which is used to identify the specific Virtual LAN
to which each frame belongs. With this mechanism, Ethernet frames can belong to different Virtual
LANs but can still share the same physical Ethernet link.
The following principles underlie the NetDefendOS processing of VLAN tagged Ethernet frames at
a physical interface:
• Ethernet frames received on a physical interface by NetDefendOS, are examined for a VLAN
ID. If a VLAN ID is found and a matching VLAN interface has been defined for that interface,
NetDefendOS will use the VLAN interface as the logical source interface for further rule set
processing.
• If there is no VLAN ID attached to an Ethernet frame received on an interface then the source of
the frame is considered to be the physical interface and not a VLAN.
• If VLAN tagged traffic is received on a physical interface and there is no VLAN defined for that
interface in the NetDefendOS configuration with a corresponding VLAN ID then that traffic is
dropped by NetDefendOS and an unknown_vlanid log message is generated.
• The VLAN ID must be unique for a single NetDefendOS physical interface but the same VLAN
ID can be used on more than one physical interface. In other words, the same VLAN can span
many physical interfaces.
• A physical interface does not need to be dedicated to VLANs and can carry a mixture of VLAN
and non-VLAN traffic.
117
Chapter 3. Fundamentals