In a switched environment, a station will see only traffic destined for it. The switch filters traffic in the network allowing the workstation to have full, dedicated bandwidth for sending or receiving traffic. Unlike a shared-hub system where only one station can transmit at a time, the switched network allows many concurrent transmissions within a broadcast domain. The switched network does this without directly affecting other stations inside or outside of the broadcast domain. Station pairs A/B, C/D, and E/F can all communicate without affecting the other station pairs.

Each VLAN must have a unique Layer 3 network address assigned. This enables routers to switch packets between VLANs.

VLANs can exist either as end-to-end networks or they can exist inside of geographic boundaries.

An end-to-end VLAN network comprises the following characteristics:

• Users are grouped into VLANs independent of physical location, but dependent on group or job function.
• All users in a VLAN should have the same 80/20 traffic flow patterns.
• As a user moves around the campus, VLAN membership for that user should not change.
• Each VLAN has a common set of security requirements for all members.

Starting at the access layer, switch ports are provisioned for each user. Each color represents a subnet. Because people have moved around over time, each switch eventually becomes a member of all VLANs. Frame tagging is used to carry multiple VLAN information between the access layer wiring closets and the distribution layer switches.

ISL is a Cisco proprietary protocol that maintains VLAN information as traffic flows between switches and routers. IEEE 802.1Q is an open-standard (IEEE) VLAN tagging mechanism in switching installations. Catalyst 2950 switches do not support ISL trunking.

Workgroup servers operate in a client/server model. For this reason, attempts have been made to keep users in the same VLAN as their server to maximize the performance of Layer 2 switching and keep traffic localized.

In Figure , a core layer router is being used to route between subnets. The network is engineered, based on traffic flow patterns, to have 80 percent of the traffic contained within a VLAN. The remaining 20 percent crosses the router to the enterprise servers and to the Internet and WAN.