1

I was reading information about vlanand how to manage it on GNU/Linux.

Whenever I needed to add a second network to the same physical NIC I would do

ifconfig eth0:test 192.168.66.1

and with it I would be able to access the 192.168.66.0/24 as well.

Now after reading about managing vlans, I see that I could have done

vconfig add eth0 700
ifconfig eth0.700 192.168.66.1

I understand that 802.1q also tags ethernet frames, but from a user perspective, is there any difference at all? When should I use ip aliasing and when 802.1q?

1 Answer 1

5

Yes, there are many differences between alias and vlan:

VLANs are isolated

When you're using IP alias, you're just propaging new IP on same network. It can be from same subnet or from different one. But anyone who can join to your LAN can access both subnets just adding new IP to their PC. You cannot manage it and secure it. Also anyone can listen to your traffic.

When you're using VLANs, you're creating virtual LANs. Those LANs are strictly separated, node from one VLAN cannot see communication in different VLANs. You can manage MAC filtering on VLAN level, so user cannot join another VLAN just with changing their IP. Also you can propagate VLAN only to some ports, so you can have server VLAN only in server room and IT office without needing of separated cables.

VLANs are just LANs - it can be limited

You can make QoS on your VLANs, different routing rules, firewalls etc. Each VLAN is separated from each other so you can handle it like real LAN.

You need switches and routers which support it

VLAN tag is another header in Ethernet frame, you have to have switches and routers which can reflect it. If you will use switches without support of 802.1q, your separation will not work because those switches will mix it together and send all packets to all.

You can go deeper - q-in-q

You can tagg already tagged frames, so you can have VLAN in VLAN. It is usefull when you want to connect and secure two locality with different ISP. VLAN is normal connection in point of view of PC, so it can looks like those two networks are one big network. This setup needs cooperation with ISP, but works really well.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .