Best Practices for VLAN Design

§One to three VLANs per access module and limit those VLANs to a couple of access switches and the distribution switches.

§Avoid using VLAN 1 as the "blackhole" for all unused ports. Use a dedicated VLAN separate from VLAN 1 to assign all the unused ports.

§Separate the voice VLANs, data VLANs, the management VLAN, the native VLAN, blackhole VLANs, and the default VLAN (VLAN 1).

§Avoid VTP when using local VLANs; use manually allowed VLANs on trunks.

§For trunk ports, turn off Dynamic Trunking Protocol (DTP) and configure trunking. Use IEEE 802.1Q rather than ISL because it has better support for QoS and is a standard protocol.

§Manually configure access ports that are not specifically intended for a trunk link.

§Prevent all data traffic from VLAN 1; only permit control protocols to run on VLAN 1 (DTP, VTP, STP BPDUs, PAgP, LACP, CDP, etc.).

§Avoid using Telnet because of security risks; enable SSH support on management VLANs.

Local VLANs CCNP SWITCH Exam Faisalabad

•The Campus Enterprise Architecture is based on the local VLAN model wherein users of geographically common switches are grouped into a single VLAN, regardless of the organizational function of the users.

•Local VLANs are generally confined to a wiring closet, as shown in the figure, and VLANs are local to one access switch which trunks to the distribution switch.

•If users move from one location to another in the campus, their connection changes to the new VLAN at the new physical location.

•In the local VLAN model, Layer 2 switching is implemented at the access level and routing is implemented at the distribution and core level, as shown in the figure, to enable users to maintain access to the resources they need.

§Create local VLANs with physical boundaries in mind rather than job functions of the users. 

§Local VLANs exist between the access and distribution layers.

§Traffic from a local VLAN is routed at the distribution and core levels. 

§Switches are configured in VTP transparent mode.

§Spanning tree is used only to prevent inadvertent loops in the wiring closet.

§One to three VLANs per access layer switch recommended.