Switching and VLANs: bridges, 802.1Q, STP
You build virtual switches with Linux bridges and Open vSwitch, split the network with VLANs, prevent loops with STP and read the MAC table.
Level 201 · 18 lessons · 15 practice labs
Lessons
How a switch works
- Switch, hub and router: the difference
- MAC learning and the forwarding table
- Broadcast domains and collision domains
- Building a Linux bridge: ip link and bridge
- Short task: join three machines on one bridge
VLANs
- The 802.1Q tag and VLAN ID
- Access and trunk ports
- A VLAN-aware Linux bridge
- The native VLAN and untagged traffic
- Routing between VLANs
- Short task: separate three departments with VLANs
Loops and Open vSwitch
- Switching loops and broadcast storms
- STP: the root bridge and blocked ports
- Fast convergence with RSTP
- Introduction to Open vSwitch: ovs-vsctl
- VLANs and port mirroring in Open vSwitch
- Short task: find the link causing a loop and fix it with STP
Wrap-up
- Capstone: switching and VLAN design for a multi-floor office
Practice labs
- The bridge is up, the server dropped off: Show that the server which dropped off the network after its interface joined a bridge still has its address on the old interface, move the address to the bridge and confirm connectivity and the FDB.
- One machine left alone on the bridge: Find why a machine attached to the bridge cannot reach the others (port state, wrong master), fix it and confirm with the FDB table.
- A MAC address keeps jumping ports: Find why a MAC address keeps changing port in the FDB (a double connection, a cloned VM), remove the cause and show the table settling.
- The printer in the wrong VLAN: Find the port putting the accounting printer in the wrong VLAN, move it to the right access VLAN and prove it by reaching the printer from an accounting client.
- Upstairs guests have no internet: Find the guest VLAN missing from the trunk between floors, allow it and show the tagged frames with tcpdump.
- Untagged traffic lands in the wrong VLAN: Detect the silent leak caused by a native VLAN mismatch between two bridges, prove which VLAN the traffic bleeds into and fix it so every VLAN is carried tagged.
- Departments cannot reach each other: Set up VLAN sub-interfaces on one Linux router to route between two department VLANs, and show it with ping both ways.
- One VLAN has the wrong gateway: Find why only one VLAN cannot get out in an inter-VLAN routing setup (wrong gateway address, missing sub-interface), fix it and test from every VLAN.
- Guest VLAN to the internet only: Route between student, teacher and guest VLANs at Selvi Schools, apply a policy letting guests only go outside, and fill in the permission matrix with tests.
- The root bridge is the wrong device: Fix a small under-desk bridge being elected root by changing priorities, and show the new root and the blocked ports.
- Broadcast storm: the network froze: Show with counters the storm caused by a double link between two bridges with STP off, break the loop by enabling STP and measure traffic returning to normal.
- Thirty seconds of silence on a link change: Measure the long outage when traffic moves to the backup link, shorten it with RSTP and edge-port settings, and compare before-and-after measurements.
- Two VLANs on Open vSwitch: Build two access VLANs on Open vSwitch, attach four clients to the right VLANs and show only same-VLAN clients can talk.
- Copy the traffic and watch it: Mirror a server port’s traffic to an Open vSwitch mirror port, and show the server’s conversations with tcpdump on the monitoring host.
- Three faults in an inherited Open vSwitch setup: In an Open vSwitch setup inherited from Brightfield Labs, find the incomplete trunk VLAN list, the wrongly tagged port and the mirror setting causing a loop, fix them and document a connectivity test per department.
About this course
You build virtual switches with Linux bridges and Open vSwitch, split the network with VLANs, prevent loops with STP and read the MAC table.
What you will learn
- How a switch works
- VLANs
- Loops and Open vSwitch
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.