Start

Welcome to

VLAN Configuration and Networking Lab


vlan.go38.net

辛文義 (Eric Hsin) / eric.hsin@gmail.com

Taiwan need VLAN right now?

About me


Course Objectives

Explore network segmentation and communication using VLANs.

Gain hands-on experience with MikroTik RouterOS devices.

What Will You Conquer Today?

1

VLAN Concepts

Understand VLANs and IEEE 802.1Q tagging.

2

Configuration

Configure VLANs on MikroTik routers and switches.

3

Trunk and Access Ports

Set up trunk ports for multiple VLANs.
Set up access ports for client devices.

4

Inter-VLAN Routing

Enable secure communication between VLANs.

5

Build Small Office Network

Design and implement a small office network using VLANs to ensure secure and efficient communication between departments.

Why Do We Need VLANs?

"VLANs enhance network security, performance, manageability, and scalability – essential for modern business and campus networks."

Security

Network Segmentation, Isolate traffic to protect sensitive information.

Efficiency

Reduce congestion and improve performance.

Control

Precise control over access and resources.

Scalability

VLANs make it easy to add or change devices without disrupting the network.

What is a VLAN?

Definition

Logically segment physical network into multiple, isolated networks.

Purpose

Improve security, optimize performance, manage network resources efficiently.

Function

Network within a network for private department communication.

VLAN Tagging

IEEE 802.1Q

Industry standard for VLAN tagging.

Packet Tagging

Each data packet tagged with VLAN ID.

Tagged Traffic

Includes VLAN information.

Untagged Traffic

Default traffic with no VLAN information.

Types of VLAN Ports

Trunk Port

A port that carries multiple VLANs, typically between switches or to a router.

Access Port

A port that carries traffic for only one VLAN, typically connected to end-user devices.

Hybrid Port

Acts as both access and trunk port.

Inter-VLAN Routing

Definition

Enables communication between different VLANs.

How it Works

Router or Layer 3 switch routes traffic between VLANs.

Benefits

Maintains security while allowing controlled communication.

Happy Halloween

Let's play!


https://kahoot.it


VLAN Lab Practice

Scenario

GO38.net is a growing company, HR and IT shared the same network. HR needed data privacy, while IT often tested tools, creating heavy traffic. One day, Mark from IT tested a monitoring tool and accidentally accessed HR’s data, raising privacy concerns. Tensions grew between the departments.

As the company expanded, network overload became an issue. IT’s updates slowed down HR’s work, frustrating both teams. Management saw a need for change to improve security and performance.

HR Department

Sensitive data exposed to other departments.

IT Department

Devices interfere with HR's communications.

Solution

Implement VLANs to segment network by department.

Pair Debugging：Do the lab in pairs

Prepare your device and cable

Each participant in your group will be equipped with a RouterBOARD – at least 2 wireless (dualband) and 5 Ethernet interfaces, a laptop computer, Ethernet cable(s).

Second ROS device from your partner
(required for the step 2 )

Two UTP cables

Step 1: Configure Router VLAN Interfaces

1

Connect to the Router

Connect to the Router using WinBox.

2

Create VLAN Interfaces

Create VLAN interfaces on the trunk port (e.g., ether2):

  • VLAN 10 (HR)
  • VLAN 20 (IT)
3

Assign IP Addresses

Assign IP addresses to the VLAN interfaces:

VLAN 10: 172.16.10.254/24

VLAN 20: 172.16.20.254/24

4

Set Up DHCP Servers

Set up DHCP servers for each VLAN:

  • VLAN 10: DHCP for HR
  • VLAN 20: DHCP for IT
5

*Test Your Configuration

Test your configuration:

Connect a computer to Port 2.

Set the computer’s VLAN ID on its network interface to match the VLAN ID.

[Tip] Enable RoMON on the router to help with future management.


The next step requires two devices, so I encourage you to do the lab in pairs.

Step 2: Configure VLANs on the Switch

1

Bridge Mode Setup

Reset the second router (if no switch is available) and set it to Bridge Mode.

2

WinBox Connection

Connect to the switch using WinBox.

3

VLAN Filtering Check

Check the first bridge (bridgeLocal) and make sure VLAN filtering is disabled.

4

VLAN Creation

Create two VLANs under Bridge -VLANs:
(1) Bridge= bridgeLocal, VLAN IDs=10,Tagged=ether1,Untagged=ether2 and ether3
(2) Bridge= bridgeLocal, VLAN IDs=20,Tagged=ether1,Untagged=ether4 and ether5

5

VLAN ID Assignment

Assign the Port VLAN ID (PVID) for each port under Bridge->Ports:
(1) ether2 VLAN, set PVID=10
(2) ether3 VLAN, set PVID=10
(3) ether4 VLAN, set PVID=20
(4) ether5 VLAN, set PVID=20

6

Enable VLAN Filtering

Go back to Bridge and enable VLAN filtering.

Step 3: Check the Inter-VLAN Routing

1

Understanding Inter-VLAN Routing

Inter-VLAN routing allows communication between different VLANs. To achieve this, you'll configure routing rules on a router that connects the VLANs. This ensures that traffic can flow between devices in different VLANs.

2

Add Routing Rules

Go to IP -> Routes on the router.

3

Establish Routing Connection

Add a route to allow traffic between VLAN 10 and VLAN 20.

4

Firewall Configuration

Ensure there are no firewall rules blocking inter-VLAN traffic.

Step 4: Test VLAN Communication

1

Connect Devices

Connect devices to the following ports:

  • Port 2 (VLAN 10)
  • Port 4 (VLAN 20)
2

Test Intra-VLAN Communication

Test communication with the following commands:

  • From VLAN 10: ping 172.16.10.254
  • From VLAN 20: ping 172.16.20.254
3

Test Inter-VLAN Communication

Test inter-VLAN communication:

  • From a device in VLAN 10, ping a device in VLAN 20 and verify connectivity.

Step 5: Troubleshoot Common Issues

Check VLAN IDs and IP Settings

Check that VLAN IDs and IP settings match on the router and switch.

Verify Trunk Port Configuration

Confirm that the trunk port is set up correctly for tagged VLAN traffic.

Review Firewall Rules

Ensure firewall rules allow inter-VLAN communication.

Bonus Task: Expand Your Office Network

Add more Switches

Try adding more Switches to your network to create a more complex and efficient infrastructure.

Create new VLANs

Create new VLANs to support different departments and test their connectivity.

Test connectivity

Verify that devices in different VLANs can communicate correctly.

Summary

Configured VLANs

You configured VLANs on both a router and a switch.

Created Trunk and Access Ports

You created trunk and access ports to manage network traffic effectively.

Enabled Inter-VLAN Routing

You enabled inter-VLAN routing and tested communication between different VLANs.

Troubleshooted Common VLAN Issues

You learned to troubleshoot common VLAN issues and address connectivity problems.

Network Security

You understand how to segment networks to enhance security.

Reflection

How can you apply VLANs in your future projects?

What was the most challenging part of this lab?

Learning by Doing!

1

Apply

Use VLANs in real-world projects and networks.

2

Start Small

Set up VLANs on home network or school lab.

3

Divide and Conquer

Select a suitable troubleshooting approach.

4

Explore More

Discover advanced features in MikroTik RouterOS.

Any final questions?

Looking forward to seeing your future VLAN projects!


You Raise Me Up, Thank You!

A special thanks to MikroTik for giving me this incredible opportunity.

Eric Hsin in Riga, Latvia , from Taiwan , eric@gmail.com

Made with