> Source: [sk39632](https://support.checkpoint.com/results/sk/sk39632) # sk39632 - What are VLANs and how are they used in IPSO | Property | Value | |----------|-------| | Solution ID | sk39632 | | Date Created | 2009-04-14 | | Last Modified | 2023-03-16 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Solution **VLAN: Virtual Local Area Network and IEEE 802.1Q** Virtual LAN (VLAN) is a group of devices on one or more LANs that are configured so that they can communicate, as if they were attached to the same physical subnet, when in fact they are located on a number of different LAN segments. Because VLANs are based on logical instead of physical connections, it is very flexible for user/host management, bandwidth allocation and resource optimization. There are the following types of Virtual LANs: 1. **Port-Based VLAN:** each physical switch port is configured with an access list specifying membership in a set of VLANs.
1. **MAC-based VLAN:** a switch is configured with an access list mapping individual MAC addresses to VLAN membership.
1. **Protocol-based VLAN:** a switch is configured with a list mapping layer 3 protocol types to VLAN membership - thereby filtering IP traffic from nearby end-stations using a particular protocol such as IPX.
1. **ATM VLAN:** using LAN Emulation (LANE) protocol to map Ethernet packets into ATM cells and deliver them to their destination by converting an Ethernet MAC address into an ATM address. Nokia IPSO supports Virtual LAN (VLAN) interfaces on all supported Ethernet interfaces. VLAN interfaces let you configure subnets with a secure private link to a Check Point Security Gateway with the existing topology. VLAN enables the multiplexing of Ethernet traffic into channels on a single cable or "trunk". {#SPAN18516674} VLAN capabilities are available on all supported ethernet interfaces. IPSO provides the ability to receive and generate VLAN tagged packets. As a result: * Gigabit Ethernet interfaces can be used to reduce the cabling / interfaces required to offer each subnet a secure private link to a CheckPoint Security Gateway.
* A Nokia Security appliance can be used in some applications where a switch was previously used, to enhance the security of the topology, while maintaining the current VLAN-based layout.

The Nokia implementation of VLAN supports adding a logical interface with a VLAN ID to a physical interface. In a VLAN packet, the OSI Layer 2 header, also called the MAC header, contains four more bytes than the typical Ethernet header for a total of 18 bytes. When traffic arrives at the physical interface, the system examines it for the VLAN Layer 2 header and accepts and forwards the traffic, if a VLAN logical interface is configured for the corresponding VLAN ID. If the traffic that arrives at the physical interface does not have a VLAN header, it is directed to the channel 0, or untagged, interface. If traffic is received for a VLAN that is not configured on the Nokia platform, it is also sent to the channel 0 interface. Outgoing traffic from a VLAN interface is tagged with the VLAN header. The Nokia appliance can receive and generate fully conformant IEEE 802.1Q tags. The IEEE802.1Q standard defines the technology for virtual bridged networks. The Nokia implementation is completely interoperable as a router, **not**as a switch. IPSO supports a maximum of 1015 VLAN interfaces. However, if you do not explicitly configure the system to support this number (in the Maximum Number of VLANs Allowed text box), the default maximum is 950 VLAN interfaces. This is a system limit and not limited to specific interface. The range for VLAN ID is 2 to 4094. The values 0 and 4095 are reserved by the IEEE standard. VLAN ID 1 is reserved by convention. There is no default. A VLAN is created and configured via Nokia Voyager. To configure VLAN, you need to specify a VLAN ID to be added to a physical interface. When you specify the VLAN ID, a new logical interface is created for that VLAN ID. VLAN interface; IPSO Assigns the logical interface name eth-sXpYcZ, where: * X is the slot
* Y is the physical port number
* Z is the channel number

There is no relation between the channel number and the VLAN ID. The channel number increases as each VLAN logical interface is created. If a logical interface is deleted, it is available to be re-used. **VLAN ID numbers 0, 1 and 4095 are reserved and are not permitted by IPSO.** In a VLAN the traffic is routed in the following order:
1. After the VLAN interface is created and configured, traffic arriving on the physical interface is examined for the Layer 2 VLAN header.{#SPAN18516674}
1. If the traffic has the Layer 2 VLAN header type, and there is a VLAN logical interface provisioned to accept the VLAN ID in the header, the traffic is accepted for processing.{#SPAN18516674}
1. If the traffic has a non-VLAN header, it is directed to the channel 0 logical interface and routed according to the configuration of the channel 0 interface, which is also known as the untagged logical interface within Nokia Voyager and Check Point security Gateway.
1. Traffic for any VLAN ID can be accepted on any physical port, as long as a logical interface for that VLAN ID has been provisioned to accept it.{#SPAN18516674}
1. If the arriving VLAN packet has multicast of broadcast bits set, the routing portion of IPSO performs the multicast or broadcast functions.
1. After IPSO routes and CheckPoint Security Gateway approves the packet for egress, the layer 2 code is invoked before transmit to generate the VLAN tagged Layer 2 header.


--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content