During my CCNA preparation, I learned it's better to have a router when making VLAN. I also read it's fault to consider VLAN without router, I don't really get it. Any diagram to make it clearer? Or perhaps we, in a subtle way, points to switch layer 3? It's a bit vague.
It's not that it's 'better' to have a router, it's that you can't pass traffic between two VLANs without a routing process. That routing process can be provided by a router or by the routing process on a multi-layer switch.
Not sure to follow, when you move out, you take your workstation, you go to your new desk, (let's say 500 meters away), you plug the ethernet into the switch, and you can start immediately. What was the matter before? What administrators had to reconfigure? How painful it was?
The network drops, of course, connect back to a switch. If the configuration of the switchport - specifically the "switchport access vlan XXX" - is the same on the old switchport and the new switchport then the two ports connect the laptop in exactly the same way on the same network/ip subnet. If the old switchport and the new switchport have different vlans configured then the laptop has moved to a different network/ip subnet.
Both subnets will probably have DHCP and DNS and so it is entirely possible that even moving VLANs the laptop will function identically from the user's perspective. But there may be different security or other policies applied to the different networks that the user may or may not be aware of.
I hope that helps answer your direct questions.
---------------------------
Here is how I explain VLANs to folks:
If you think about a port on a router, that starts a new IP subnet which also starts a new broadcast domain. A switch that is connected to that router port would have it's ports in that same broadcast domain and any device connected to those switchports would get IP addresses on that IP subnet. They can, therefore, find each other using ARP and sending traffic direct to each other using each others' MAC addresses.
Each port on the router gets to start a new subnet/broadcast-domain in this same way. Picture a simple hub and spoke with the router in the middle, connected to switches, and then PCs off of the switches. In order for traffic to get from one ip subnet (on one switch) to get to another device on another ip subnet (on a different switch) it would have to pass through the router.
So here's the thing: What if I only have one switch but I need ports on the switch to connect the Executive staff (which has particular security and policy concerns) and also the IT staff (which has different security and policy concerns). I need the two groups to be on different IP subnets so that I can implement security policy on the router level between the two subnets. BUT...again I only have one switch.
What I can do is implement VLANs. The thing to understand is that an IP subnet and a broadcast domain are the same in scope as far as what endpoints belong to the group....AND....that is the same group as a VLAN. The three things (ip subnet, broadcast domain, VLAN) describe the same set of endpoints as a group. All ports in a VLAN are in the same IP subnet and therefore also the same broadcast domain.
VLANs allow a single physical switch to pretend it is multiple physical switches.
So what I can do is configure the switch to declare one group of ports to be in VLAN 10 (which puts them in their own broadcast domain and also their own IP subnet), and another group of ports to be in VLAN 20 (which puts them into their own broadcast domain and also their own IP subnet).
Devices on VLAN 10 can send traffic to other devices on VLAN 10 just like before. They are on the same broadcast domain and so can ARP for a MAC address and send traffic direct. Ditto with devices on VLAN 20. BUT...if a device on VLAN 10 wants to send traffic to a device on VLAN 20 that traffic has to pass through a router because, remember, that because the devices are in two different VLANs this means that the devices are on two different IP subnets.
In our scenario, we'd need to have a port on the switch that is in VLAN 10 have a cable to the correct port on the router for that subnet. And that same switch would have to have a port on the switch that is in VLAN 20 have a cable to a different port on the router for THAT subnet. (No, we really don't do this but from a 'picture it in your head' standpoint just go with it for now.)
So picture that same hub-and-spoke from before, but this time picture it where downstream of two router ports you have a single switch rather than two, but that switch is divided in half where half the ports are in one VLAN and the other half of the ports are in the other VLAN.
VLANs allow a single physical switch to pretend it is multiple physical switches.
There is more, like trunks and router-on-a-stick, and access VLANs with supplementary VLANs, and yet more after that. But as an introduction to what a VLAN is and how to think about them, I hope this helps.
Please let me know if you have questions or if any of this doesn't make sense.
Maren
