| 2.5 |  | Securing Switches and LAN Access |
| 2.5.4 |  | VLANs |

| A virtual LAN (VLAN) is a switched network that is logically segmented on an organizational basis by functions, project teams, or applications rather than on a physical or geographical basis . For example, all workstations and servers used by a particular workgroup team can be connected to the same VLAN, regardless of their physical connections to the network or the fact that they might be intermingled with other teams. Reconfiguration of the network can be done through software rather than by physically unplugging and moving devices or wires.

VLANs are created to provide the segmentation services traditionally provided by routers in LAN configurations. VLANs address scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, address summarization, and traffic flow management. None of the switches within the defined group will bridge any frames, not even broadcast frames, between two VLANs. Several key issues must be considered when designing and building switched-LAN internetworks.

The two common approaches to assigning VLAN membership are as follows:

- Static VLANs - This method is also referred to as port-based membership. Assigning ports to a VLAN create static VLAN assignments. As a device enters the network, the device automatically assumes the VLAN of the port. If the user changes ports and needs access to the same VLAN, the network administrator must manually make a port-to-VLAN assignment for the new connection.
- Dynamic VLANs - Dynamic VLANs are created through the use of software packages such as CiscoWorks 2000 VLAN Management Protocol Server (VMPS) and CSACS. Dynamic VLANs currently allow for membership based on the MAC address of the device. As a device enters the network, the device queries a database for VLAN membership.