Rockwell-automation Ethernet Design Considerations Reference Manual Manual de usuario descargar pdf (Pagina 42)

42 Rockwell Automation Publication ENET-RM002C-EN-P - May 2013

Chapter 3 Ethernet Infrastructure Features

Virtual LANs and

Segmentation

A virtual LAN (VLAN) is a switched network segmented on a functional

application or organizational basis rather than a physical or geographical basis.

Switches filter destination MAC addresses and forward VLAN frames to ports

that serve the VLAN only to which the traffic belongs. A VLAN consists of

several end systems. These systems are either hosts or network equipment, such as

switches and routers, that are members of a single logical broadcast domain. A

VLAN does not have physical proximity constraints for the broadcast domain.

With VLANs, you can configure a switch to share two isolated networks without

the traffic from one network burdening the other. IP multicast traffic from

VLAN 1 does not reach VLAN 2. A VLAN blocks broadcast traffic and adds a

measure of security between networks.

A VLAN also gives you the ability to control access and security to a group of

devices independent of their physical location.

Segmentation is the process of outlining which endpoints need to be in the same

LAN. Segmentation is a key consideration for a cell or area network.

Segmentation is important to help manage the real-time communication

properties of the network, and yet support the requirements as defined by the

network traffic flows. Security is also an important consideration in making

segmentation decisions.

Table 6 - VLAN Features

Feature Description

Broadcast control Just as switches isolate collision domains for attached hosts and forward appropriate traffic out a particular port, VLANs

refine this concept and provide complete isolation between VLANs. A VLAN is a bridging domain, and all broadcast and

multicast traffic is contained within it.

Security High-security users can be grouped into a VLAN, possibly on the same physical segment, and no users outside of that

VLAN can communicate with them. VLANs can also assist in securing plant-floor systems by limiting access of production

floor personnel, such as a vendor or contractor, to certain functional areas of the production floor.

Performance The logical grouping of devices prevents traffic on one VLAN from burdening other network resources. Performance

within the VLAN is also improved because the VLAN acts as a dedicated LAN.

Network management You can logically move a device from one VLAN to another by configuring a port into a VLAN. The device does not have to

be physically disconnected from one network and reconnected to another, which can result in expensive,

time-consuming recabling.

Switch

Controller 1

I/O

Controller 2

I/O

VLAN 1 VLAN 2

1 2 ... 37 38 39 40 41 42 43 44 45 46 47 ... 105 106

Sin comentarios

Rockwell-automation Ethernet Design Considerations Reference Manual Manual de usuario Pagina 42