A Survey of Virtual LAN Usage in Campus Networks
Total Page：16
File Type：pdf, Size：1020Kb
YU LAYOUT 6/20/11 4:24 PM Page 98 TOPICS IN NETWORK AND SERVICE MANAGEMENT A Survey of Virtual LAN Usage in Campus Networks Minlan Yu and Jennifer Rexford, Princeton University Xin Sun and Sanjay Rao, Purdue University Nick Feamster, Georgia Institute of Technology ABSTRACT router configuration data, we have obtained deeper insights into how the administrators use VLANs are widely used in today’s enterprise VLANs to achieve a variety of design goals, and networks to improve Ethernet scalability and the difficulties they encounter in the process. We support network policies. However, manuals and show that VLANs are not well-suited for many textbooks offer very little information about how of the tasks that they support today, and argue VLANs are actually used in practice. Through that future enterprise network architectures discussions with network administrators and anal- should decouple policy specification from scala- ysis of configuration data, we describe how three bility concerns with layer-2 protocols, topology, university campuses and one academic depart- and addressing. ment use VLANs to achieve a variety of goals. After a brief survey of VLAN technology, we We argue that VLANs are ill-suited to some of describe how the four networks use VLANs to these goals (e.g., VLANs are often used to real- support resource isolation, access control, decen- ize access control policies, but constrain the types tralized management, and host mobility. Howev- of policies that can be expressed). Furthermore, er, VLANs were not designed with these goals in the use of VLANs leads to significant complexity mind — network administrators use VLANs for in the configuration of network devices. the lack of a better alternative. We argue that VLANs are too crude a mechanism for specify- INTRODUCTION ing policies, due to scalability constraints (on the number and size of VLANs) and the coarse- Enterprise networks, which connect the comput- grained ways of assigning traffic to different ers within a college campus or corporate loca- VLANs. Further, VLAN configuration is far too tion, differ markedly from backbone networks. complicated, due to the tight coupling with span- These networks have distinctive topologies, pro- ning-tree construction, failure recovery, host tocols, policies, and configuration practices. Yet, address assignment, and IP routing, as discussed. the unique challenges in enterprise networks are We conclude the article. not well understood outside of the operator community. One prominent example is virtual LANs (VLANs) — a widely- used technology VIRTUAL LOCAL AREA NETWORKS that is barely discussed in networking textbooks. VLANs were initially intended to allow net- An enterprise network consists of islands of Eth- work administrators to connect a group of hosts ernet switches connected both to each other and in the same broadcast domain, independent of to the rest of the Internet by IP routers, as shown their physical location. However, today’s enter- in Fig. 1. We describe how administrators group prise administrators use VLANs for a variety of related hosts into VLANs, and how the switches other purposes, most notably for better scalabili- and routers forward traffic between hosts. ty and flexible specification of policies. However, enterprise administrators have seen many prob- CONVENTIONAL LOCAL AREA NETWORKS lems of VLANs because VLANs are used for other functions they were not designed for. In a traditional local area network (LAN), hosts Understandably, VLANs are at best an incom- are connected by a network of hubs and switch- plete solution for some of these problems. As a es. The switches cooperate to construct a span- result, managing VLANs is one of the most chal- ning tree for delivering traffic. Each switch lenging tasks they face. forwards Ethernet frames based on its destina- In this article, we study four networks — tion MAC address. If the switch contains no for- three university campuses and one academic warding-table entry for the frame’s destination department — to better understand how VLANs MAC address, the switch floods each frame over are used in practice. Through discussions with the entire spanning tree. A switch learns how to network administrators, and targeted analysis of reach a MAC address by remembering the 98 0163-6804/11/$25.00 © 2011 IEEE IEEE Communications Magazine • July 2011 YU LAYOUT 6/20/11 4:24 PM Page 99 incoming link for frames sent by that MAC address and creating a mapping between the H3 MAC address and that port. H4 To connect to the rest of the enterprise net- Ethernet island work (and the rest of the Internet), the island of R2 VLAN2 S5 VLAN1 Ethernet switches connects to IP routers that forward traffic to and from remote hosts. Each S2 R1 host interface in the LAN has an IP address S4 S6 from a common IP prefix (or set of prefixes). S1 IP router R3 Traffic sent to an IP address in the same subnet backbone S3 stays within the LAN; the sending host uses the VLAN1 Address Resolution Protocol (ARP) to deter- R5 VLAN2 H1 R4 mine the MAC address associated with the desti- Ethernet nation IP address. For traffic destined to remote H2 island Ethernet IP addresses, the host forwards the packets to island the gateway router, which forwards packets fur- ther toward their destinations. Figure 1. Enterprise network with Ethernet islands interconnected by IP routers. COMMUNICATION WITHIN A VLAN Administrators use VLANs to construct network segments that behave logically like a convention- port, which is connected to a host; or a trunk al LAN but are independent of the physical port, which is connected to another switch. An locations of the hosts; for example, hosts H1 and access port typically transports traffic for a single H3 in Fig. 1 both belong to VLAN1. As in a VLAN; the VLAN associated with a port may conventional physical LAN, the switches in a be either statically configured or dynamically VLAN construct a spanning tree, and use flood- assigned when the host connects, based on the ing and learning to forward traffic between host’s MAC address (e.g., using VLAN Manage- hosts. For example, the switches S3, S4, and S5 ment Policy Server VMPS [1]). In either case, form a spanning tree for VLAN2. the access port can tag incoming frames with the Communication between hosts in the same 12-bit VLAN identifier and removes the tag VLAN stays within the VLAN, with the switches from outgoing frames, obviating the need for the forwarding Ethernet frames along the spanning hosts to support VLANs. tree to the destination MAC address. For exam- In contrast, a trunk port may carry traffic for ple, hosts H2 and H4 communicate over the 2 multiple VLANs; for example, switch S4’s port spanning tree in VLAN2 based on their MAC connecting to S5 must forward traffic for both addresses. Similarly, hosts H1 and H3 communi- VLAN1 and VLAN2 (and participate in each cate over the spanning tree in VLAN1, where VLAN’s spanning tree protocol), but the trunk some of the IP routers (e.g., R1, R2, and R2) port to S3 does not. The administrators either may also act as switches in the spanning tree; manually configure each trunk port with a list of alternatively, a tunnel between R1 and R2 could VLAN identifiers, or run a protocol like VLAN participate in VLAN1 so the links in the IP back- Trunking Protocol (VTP) [2] or Multiple VLAN bone do not need to participate in the VLANs. Registration Protocol (MVRP) [3] to automati- cally determine which VLANs a trunk link should COMMUNICATION BBETWEEN VLANS handle. Configuring a VLAN also requires con- Each host has an IP address from an IP prefix figuring the gateway router to announce the asso- (or prefixes) associated with its VLAN; IP ciated IP prefixes into the routing protocol; each routers forward packets based on these prefixes, host interface must be assigned an IP address over paths computed in the routing protocol from the prefix associated with its VLAN. (e.g., Open Shortest Path First [OSPF] or Rout- ing Information Protocol [RIP]). Hence, traffic between hosts in different VLANs must traverse VLAN USAGE IN an intermediate IP router. For example, traffic AMPUS ETWORKS between hosts H3 and H4 would traverse router C N R2, even though the two hosts connect to the same Our campus network administrators use VLANs switch. For example, when sending traffic to H4, to achieve four main policy objectives — limiting host H3 forwards the packets to its gateway the scope of broadcast traffic, simplifying access router R2, since the destination IP address control policies, supporting decentralized net- belongs to a different prefix. R2 would then look work management, and enabling seamless host up the destination IP address to forward the mobility for wireless users. The four networks packet to H4 in VLAN2. If H4 sends an IP pack- include two large universities (campuses 1 and 2) et to H1, then H4’s router R3 forwards the pack- and a department network (campus 3) within et based on the IP routing protocol toward the another university-wide network (campus 4). All router announcing H1’s IP prefix, and that router four networks primarily run IPv4, with relatively would then forward the packet over the span- limited experimental deployment of IPv6. ning tree for VLAN1. SCOPING BROADCAST TRAFFIC CONFIGURING VLAN PORTS VLANs enable administrators to limit the scope Supporting VLANs requires a way to associate of broadcast traffic and network-wide flooding, switch ports with one or more VLANs. Adminis- to reduce network overhead and enhance both trators configure each port as either an access privacy and security. IEEE Communications Magazine • July 2011 99 YU LAYOUT 6/20/11 4:24 PM Page 100 Limiting the Broadcast/Flooding Overhead — are allowed to communicate freely.