ZyXEL Communications ZyWall USG 50-H Series User Manual page 198

Chapter 8 Interface
Figure 155 Example: After VLAN
Each VLAN is a separate network with separate IP addresses, subnet masks, and gateways.
Each VLAN also has a unique identification number (ID). The ID is a 12-bit value that is
stored in the MAC header. The VLANs are connected to switches, and the switches are
connected to the router. (If one switch has enough connections for the entire network, the
network does not need switches A and B.)
• Traffic inside each VLAN is layer-2 communication (data link layer, MAC addresses). It
is handled by the switches. As a result, the new switch is required to handle traffic inside
VLAN 2. Traffic is only broadcast inside each VLAN, not each physical network.
• Traffic between VLANs (or between a VLAN and another type of network) is layer-3
communication (network layer, IP addresses). It is handled by the router.
This approach provides a few advantages.
• Increased performance - In VLAN 2, the extra switch should route traffic inside the sales
department faster than the router does. In addition, broadcasts are limited to smaller, more
logical groups of users.
• Higher security - If each computer has a separate physical connection to the switch, then
broadcast traffic in each VLAN is never sent to computers in another VLAN.
• Better manageability - You can align network policies more appropriately for users. For
example, you can create different security rules for each VLAN (each department in the
example above), and you can set different bandwidth limits for each VLAN. These rules
are also independent of the physical network, so you can change the physical network
without changing policies.
In this example, the new switch handles the following types of traffic:
• Inside VLAN 2.
• Between the router and VLAN 1.
• Between the router and VLAN 2.
• Between the router and VLAN 3.
VLAN Interfaces Overview
In the ZyWALL, each VLAN is called a VLAN interface. As a router, the ZyWALL routes
traffic between VLAN interfaces, but it does not route traffic within a VLAN interface. All
traffic for each VLAN interface can go through only one Ethernet interface, though each
Ethernet interface can have one or more VLAN interfaces.
198
A
B
ZyWALL USG 50-H User's Guide