Basic understanding of VLANs and how they work.
Defines the physical port of a piece of equipment.
Defines the default VLAN for traffic leaving a specified interface. Also referred to as Native Network, Parent VLAN. Untagged traffic will be tagged with this ID leaving the port.
Defines a virtual port of a piece of equipment; Commonly swapped with VLAN or VID.
Defines a parent virtual port of a piece of equipment; Commonly swapped with PVLAN or PVID.
Defines a virtual port of a piece of equipment; must be associated with a PIF. Commonly used interchangeably with VLAN, VIF.
A virtual network, creating logical separations within a switch. This allows for multiple broadcast domains on the switch.
L2 (layer 2).
Independent Broadcast Domain.
Configured with 802.1Q.
1is generally used as a management VLAN with no VLAN tags.
Integer number between
0-4095identifying a specific VLAN.
Concept used to denote ALL VLANS and untagged traffic. Typically used in defining trunks. If ALL is not used, then untagged traffic must be explicitly allowed.
Network packet that has already been tagged with the 802.1Q header, identifying that packet as being on a specific VLAN.
Network packet that does not have the 802.1Q header. This is standard network traffic. Also commonly referred to as the Native VLAN.
- Management VLAN
VLAN used for general management and adminstration; not typically for everyday data traffic. In common practice, the management VLAN is usually Untagged traffic to allow for unconfigured devices the ability to be connected to when added to the network. Some devices (like Ubiquiti) treat the Management VLAN, Untagged traffic, and Native VLAN as VLANID 1.
- Native VLAN
Synonym for Untagged. Standard network traffic to allow for unconfigured devices the ability to be connected to when added to the network. Some devices (like Ubiquiti) treat the Management VLAN, Untagged traffic, and Native VLAN as VLANID 1.
Used for upstream or downstream links between switches and routers. Accepts and forwards traffic on multiple VLANS, usually including Untagged traffic.
Basic VLAN Switch Concepts
VLANs allow you to ‘breakup’ a switch to effectively act as multiple switches by isolating the broadcast domain of traffic.
In this example, port 1 will see all traffic from all VLANS. ports 2 and 3 will only see traffic on VLAN 2, 4-6 sees only VLAN 3, 7-8 sees only VLAN4:
The equivalent physical configuration looks something like:
Basic VLAN Port Concepts
Conceptualize VLANS as a way to filter traffic from either side of a port. It may also help to think of VLANs as ‘cables’ between switching devices.
PIF will be used for all cases of PIF, PVIF, PVID, Native Network and Parent VLAN.
Management VLAN is defined as Untagged network (e.g. PIF 1, VLAN 1).
VLANS are NOT SUBNETS. A VLAN may transmit multiple subnets of traffic as long as those packets are tagged appropriately and are physically enforced at the hardware/server level. Subnets are defined farther up in the networking stack, typically in software. Generally you’ll see one subnet per VLAN.
Standard device on a port
Devices which do not support VLANs will send data Untagged onto the network. This untagged traffic will be tagged with the PIF ID exiting the port.
Untagged traffic from a device will be untagged exiting the port if ALL networks are allowed:
Untagged traffic from a device will be tagged with the PIF VLAN if it is explicitly defined:
Tagged and Untagged traffic will be filtered at the port based on PIF and VIF:
Untagged traffic will be allow through the port to the device if ALL networks are allowed:
Traffic must be tagged with the PIF VLAN for it to reach the device:
Tagged and Untagged traffic will be filtered at the port based on PIF and VIF.
Unifi APs transmit both tagged and untagged data at the same time.
Tagged: AP data. If configured, AP data is explicitly tagged with a VLAN before leaving the device.
Untagged: AP Management Interface. By default the management interface is exposed with untagged traffic (Management VLAN,
VLAN 1); to make adoption easier. In newer versions you can configure the management VLAN to a custom VLAN.
LANnetwork defined in Networks on the Unifi controller describes the properties of the Management VLAN. This is the network that Untagged traffic will be sent on.
Fundamental concepts about VLANS need to be clarified before proceeding. VLANS allow the separation of networks on the phyiscal switch level (L2/L3); which can be thought of as applying switch-level filters to prevent specific traffic from ever hitting network ports.
Important things to note:
Untagged traffic is traffic without any VLAN tags. Within VLAN aware devices this is tagged as
VLAN1. ALL also includes this traffic.
Ports will have a default or PVIF. This is the default VLAN traffic will be tagged with, if no tags are present. If you connect a bunch of computers to a switch, and plug that switch into this port, they will all behave as though they are on the default or PVIF network.
Ports will typically have an additional set of VLANS that are allowed. Traffic using these VLANS needs to be pre-tagged with VLAN IDs to be allowed through. Untagged traffic will be tagged with the default VLAN.
Trunks aggregate traffic together, used to push traffic upstream to another device. Trunk configurations should be the same set of VLANS on both ends in most cases. Trunks connecting directly to the router should generally contain all VLANS, while Trunks downstream should only specify VLANS that are actually used or needed on those devices. It my be helpful to look at the leaf nodes first and work your way back to prevent VLANS inadvertently being dropped on the way to the router.
Set a spare port on switches for Management VLAN access so you can locally manage devices if something goes wrong.
You need to understand your current network and layout a plan for how the traffic should work on VLANS. Generally VLANs segregate traffic based on type; e.g. wifi, iot, servers, desktops, etc.