Virtual Local Area Networks in Windows

Written by Maxim Klimanov

The use of virtual local area networks (VLAN) is commonly associated with managed switches and router subinterfaces. However, it is not exactly so. A direct transmission of tagged frames to servers can be a good solution in some particular situations. It must be mentioned that this article is only a brief description of how to make it work and it is up to the reader to decide what situation will need such a realization or when the use of trunk is possible.

To proceed, we need two devices: a managed switch with 802.1q support and a network card with drivers supporting the same trunk protocol. It is important to mention that switches using only ISL will not fit here because of the drivers that support only 802.1p/802.1q encapsulation. We will configure the server based on the Microsoft Windows operating system.

The current Marvell NIC drivers support VLANs and link aggregation. To show how simple the solution can be, we use a PC (hereafter called the test server) with Windows XP x64 Professional SP2 Eng operating system on which we have installed the latest NIC drivers (available on the vendor’s website) and the control utility (Network Control Utility for Aggregation and VLANs in x86 & x64 XP, Server 2003, Vista, Server 2008) for Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller.

From the additional tabs that appeared in the option panel we select VLAN tab. In the Existing VLANs list we need to add new VLAN IDs which we are going to use. We add two virtual LANs (2 and 3).

<!--[if !vml]--><!--[endif]-->

As a result, two new virtual network adapters (one per VLAN) will be added to the original physical controller and will become available in “Network Connections”. On the main (physical) NIC only Marvell VLAN Protocol will be enabled.

<!--[if !vml]--><!--[endif]-->

Then, in the adapter option panel of other connections we go to the Advanced tab to check that each NIC is assigned to the associated VLAN ID.

<!--[if !vml]--><!--[endif]-->

Now we need to configure network parameters and assign IP addresses to the virtual network adapters. This could be done manually or via DHCP (at this step the trunk is not up yet so DHCP leasing is not available). We decided to configure the IP parameters manually.

Such model can be used for building a server with a direct access from several VLANs via only OSI Layer-2 devices. Another application of the model can be a server configuration that enables network and port address translation (NAT/PAT). Let us configure a test bench, which will allow a notebook (laptop) to connect to the internet through a desktop computer by using ICS (Internet Connection Sharing). ICS configuration in Windows XP is described here. The test server is configured in the same way.

Now we need to configure the switch our devices are connected to. In our case it was Cisco Catalyst WS-C2960G-24TC-L, its IOS version is presented below. Some inessential parts are omitted.

After the switch is loaded, we erase its configuration and use the initial config. Firstly, we choose Transparent as a VTP mode, though for large corporate networks this part of configuration may differ substantially.

Then we create virtual LANs in the switch configuration and add its physical interfaces to these VLANs. We use Gi0/20 port for internet connections; whereas Gi0/19 faces the local network. The description of Cisco switch configuration is out of scope of this article.

Gi0/1 port is connected to the routing server through the trunk. Results of configuration are listed below.

Other L2 devices can be configured in the same way. An example of switch configuration for Linksys RVS4000 is shown below.

<!--[if !vml]--><!--[endif]-->

Let’s go back to our test bench (WS-C2960G-24TC-L) and check its bridge table to make sure that both devices on trunk endpoints properly identify dot1q-encupsulation received from each other. We see that the MAC address 001b.fce1.e2ff is visible in the both VLANs.

Now we make network settings for ASUS Eee PC 900 notebook (see the listing below) and connect it to Gi0/19 switch port by the patch-cord.

The only thing left is to check that the internet can be accessed from the server as well as from the test laptop through the routing server. Part of the network hops the data pass through is deliberately hidden; the reader shouldn’t be confused by this fact.

We see that the internet is accessed from the server. Now we trace the route to the same internet address from the notebook.

The route tracing shows the desirable result: the packets sent from the laptop to the internet reach the test server in the first hop. The diagram below shows how the traffic passes through the test bench. Such configuration enables to install on this soft router a billing solution, or network statistics software, or antiviral software, or any other software.

<!--[if !vml]--><!--[endif]-->

It is important to mention that in such model the trunk is going to be loaded with twice more traffic as each packet is transmitted from the switch to the routing server first and then sent back to the switch over the same physical link.

The model we demonstrate allows connecting the server via trunk. Due to this cheaper routers hardware and a fewer number of switch ports are needed for such server connection.