It is possible about VLAN "on the fingers"?

Question

HP

I 'm starting to transfer a normal flat network to a VLAN
. The goal is, for example, so that users do not share their folders. Yes, a lot of things, mainly in terms of security.
Is available:
1. Experimental HP 2610 switch, is able up to 256 vlan`ov.
2. a couple of PCs to experiment with
3. and a working grid
In perspective:
a. IP phones (which, accordingly, will have to be tied to a vlan allocated for telephony)
b. office next door with about the same mesh (now connected via VPN)
Honestly read a lot of manuals, both general on Vlan, and on ProCurve in particular. All sorts of manuals and impressions of those who implemented ...
But in my head - porridge.
Can you suggest the material or explain on the fingers?
1. Vlan happen trunk and are not present. What's the difference, why? Maybe there are some more?
2. The piece of iron hangs up a vlan label on packets, right? There's an ID and all that. Another piece of iron takes this ID and compares it with its own, right? Means, vlan`y on two pieces of iron should have identical IDs?
3. Sometimes I see that it is necessary to configure the PCs themselves additionally. What for? Like all pieces of iron should do.
Well, here's an example.
There are PC 1,2,3. 1 is admin. There is a file dump 4.
We take and make vlans with ports:
vlan1 - 1,2,3,4 - this is so that the admin can administer
vlan2 - 2.4 - this is computer 2 so that he can use the file dump
... but in this case the same 3 will see everything? It is also included in vlan1.
In general ... porridge.

Answer 1

1. Vlan happen trunk and are not present. What's the difference, why? Maybe there are some more?
The trunk wealan (more precisely, the trunk port) adds to each outgoing and reads from the incoming tag, which consists of 2 bytes, the maximum number of weeds there is 4096. By this tag, the equipment determines whether the packet belongs to one or another virtual network. The port can also be configured in such a way that packets belonging to a certain wealan "go out" to it, but they already go out WITHOUT a tag, and the switch simply knows that the packets of this port will belong to such and such a wealan. This is called "without a tag, but in a weelan". :)
Another situation - there is a link between the switches, and you need the same wealan to be visible on both switches - then we put a tag on the packets and send them there. The tags, again, will determine the ownership of the traffic, and it will be correctly divided. Of course, in this case, the ID of the same wean must be the same on both switches, otherwise the packets will simply be lost (without going into details). Well, in this way, any number of Wealans can be transmitted through one link, within 4096 and the capacity of the equipment.
That's right. If it is configured that "the port belongs to the 3rd wealan without a tag" - the PC will see this packet without tags and will not even suspect anything, without any crutches and dancing with a tambourine, but inside the switch it will be clearly allocated to the wealan. If it is necessary to send to a PC, for example, several velans on one network card (you never know, there are some restrictions), then you can send one velan without a tag (although not necessary), and the rest - in a tag. In this case, you need drivers for the network card that support weelans, and with their help virtual interfaces will be created, one for each tagged wealan. Their number is determined by your settings (wealan is added -> an interface appears).
In order for people located in different velans to see each other, it is necessary that in both velans one router interface hangs (in the simplest case, the same router) as a gateway, and the router will already forward traffic between velans and subnets. Well, then you can wind up security on the router, because. the only point of "transition" of traffic between Wealans will be this router. Without this router, PCs in different wilans will not see each other .

Answer 2

habrahabr.ru/post/138043

Answer 3

Reading networks for the little ones .

Answer 4

I recommend watching a video tutorial about Wealans, type in a course of a young fighter in YouTube (do not look at what is on the Cisco equipment, everything is looked at on general examples) choose a lesson on Wealans there it is very intelligible and very interesting to talk about Wealans, and not only about Wealans there are many lessons about the network in general.

Answer 5

xgu.ru/wiki/VLAN