Advanced Switching and Virtual LANs

Introduction and Context

Ethernet switching is the foundation of most contemporary enterprise, campus, data-centre, and cloud networks. Although Ethernet began as a shared medium, modern switched Ethernet provides dedicated point-to-point links, high aggregate capacity, segmentation, redundancy, and programmable forwarding. These capabilities are essential in data-science environments, where distributed storage, accelerated computing, container platforms, and large-scale data pipelines generate substantial east–west traffic between servers.

This chapter examines switching beyond basic frame forwarding. It develops a systematic understanding of virtual LANs (VLANs), trunking, loop prevention, link aggregation, overlays, tunnelling, and scalable Layer 2 design. The central design problem is to obtain the operational flexibility of Layer 2 connectivity without allowing broadcast domains, failure domains, or control-plane complexity to grow uncontrollably.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain Ethernet switch learning, forwarding, flooding, filtering, and ageing.
2. Design VLAN and trunking arrangements using IEEE 802.1Q concepts.
3. Analyse spanning-tree mechanisms and select appropriate redundancy designs.
4. Explain link aggregation and calculate effective capacity and availability.
5. Distinguish traditional Layer 2 extension from overlay technologies such as VXLAN.
6. Evaluate tunnelling, scalable Layer 2 architectures, and their operational risks.
7. Diagnose common switching failures and recommend secure, resilient designs.

1. Ethernet Switching as a Learning System

A switch is a multiport bridge that makes forwarding decisions primarily from destination MAC addresses. Its forwarding database (FDB), often called a MAC-address table, records associations between learned source MAC addresses and switch ports.

When a frame arrives, the switch generally performs the following operations:

1. It validates the frame and identifies the ingress port and VLAN context.
2. It learns the source MAC address on that port.
3. It searches the FDB for the destination MAC address within the relevant VLAN.
4. If the destination is known and reachable through another port, it forwards the frame selectively.
5. If the destination is unknown, or if the frame is broadcast or an applicable multicast frame, it floods the frame within the VLAN, excluding the ingress port.
6. If the destination is associated with the ingress port, it filters the frame rather than transmitting it again.

The VLAN context is critical: the same MAC address can theoretically appear in different VLANs without representing the same Layer 2 identity. Therefore an FDB entry is conceptually indexed by both VLAN and MAC address.

Learning and ageing

Learning is based on the source address because the source is known to have arrived through the observed port. Entries are temporary. If a device moves, new source frames update the entry; if no traffic is observed for a configured ageing interval, the entry is removed. Ageing limits stale information but creates a short period in which a destination may be flooded.

A switching loop is especially dangerous because Ethernet frames traditionally have no hop-count field. A broadcast or unknown-unicast frame can circulate indefinitely, consuming bandwidth and switch resources. Spanning Tree Protocol (STP) exists primarily to prevent such active Layer 2 loops.

Forwarding performance

Switches commonly use hardware tables and application-specific integrated circuits (ASICs), allowing forwarding at or near line rate. However, performance depends on table capacity, packet size, lookup architecture, buffering, and the distinction between unicast forwarding and exceptional processing. Control-plane traffic, malformed frames, table misses, and security events may be handled differently from ordinary hardware-switched traffic.

2. VLANs and Broadcast-Domain Design

A VLAN is a logically distinct Layer 2 broadcast domain implemented across one or more physical switches. VLANs allow an organisation to separate traffic without requiring a separate physical switching infrastructure for every group.

Typical VLANs include:

• user-access VLANs;
• server VLANs;
• voice VLANs;
• management VLANs;
• guest or quarantine VLANs;
• storage or specialised application VLANs.

A VLAN is not, by itself, a security boundary equivalent to a firewall. Devices in the same VLAN share a broadcast domain and can communicate at Layer 2 subject to switch controls. Communication between VLANs requires Layer 3 routing, where access-control policies can be applied.

Access and trunk ports

An access port normally carries traffic for one VLAN. Frames arriving from an attached end device are associated with the configured access VLAN, and transmitted frames are usually untagged.

A trunk port carries traffic for multiple VLANs between switches, between a switch and a router, or between a switch and a virtualisation host. IEEE 802.1Q inserts a VLAN tag into an Ethernet frame. The tag identifies the VLAN and includes priority and congestion-related fields.

The 802.1Q tag contains, among other fields:

• a Tag Protocol Identifier (TPID), commonly indicating an 802.1Q tag;
• Priority Code Point (PCP), used for Layer 2 quality-of-service marking;
• Drop Eligible Indicator (DEI);
• a 12-bit VLAN Identifier (VID).

The 12-bit VID field permits 4096 numerical values, but some values are reserved and ordinary deployments do not treat all 4096 values as usable customer VLANs. Exact usable ranges and reserved values depend on the relevant standard and platform implementation.

The native VLAN concept permits one VLAN on a trunk to be transmitted without an 802.1Q tag. Native VLAN mismatches can cause traffic leakage, confusing troubleshooting, and security exposure. A robust design explicitly defines the native VLAN, avoids using it for ordinary user traffic where possible, and validates configuration at both ends.

Inter-VLAN routing

Hosts in different VLANs require a Layer 3 gateway. Common models are:

• a router with separate physical interfaces;
• router-on-a-stick, where one router interface uses multiple tagged subinterfaces;
• a multilayer switch with switched virtual interfaces (SVIs);
• a distributed virtual router in a data-centre fabric.

The default gateway for a host should normally be located close to the access layer to reduce unnecessary Layer 2 extension. Routing at the distribution or leaf layer also enables policy enforcement, path selection, and failure isolation.

3. Trunking and VLAN Control

Trunking simplifies connectivity but increases the consequences of configuration errors. The allowed VLAN list on every trunk should be deliberately restricted. Carrying every VLAN everywhere increases broadcast exposure, enlarges the spanning-tree topology, and complicates incident response.

Dynamic trunk negotiation protocols may be useful in controlled environments but create avoidable risk on untrusted or user-facing ports. Best practice is to configure access ports explicitly as access ports and configure trusted inter-switch links explicitly as trunks. Disable unused negotiation features when they are not required.

A VLAN database must be consistent enough for end-to-end intent. The existence of a VLAN on a switch does not automatically mean that it should be permitted on every trunk. Operational documentation should specify:

• VLAN purpose and owner;
• address space and gateway;
• permitted access ports;
• permitted trunks;
• spanning-tree root expectations;
• security policy;
• monitoring and logging requirements.

4. Spanning Tree and Redundant Layer 2 Networks

The spanning-tree model

Spanning Tree Protocol converts a physical topology that may contain loops into a logical tree. The protocol elects a root bridge and determines a preferred loop-free path from each switch to that root. Redundant links remain available as alternatives but are placed in a non-forwarding state until needed.

The root bridge is selected using the lowest Bridge ID. The Bridge ID combines a configurable priority and a bridge MAC address; when priorities are equal, the lower MAC address wins. Therefore root placement should be engineered by configuring priority rather than relying on MAC-address tie-breaking.

For each non-root switch, STP selects a root port: the port with the lowest path cost toward the root. On each network segment, one designated port forwards traffic toward the segment. Other redundant ports are blocked or placed in a non-forwarding role.

A simplified path-selection relationship is:

where C_path is the total path cost, c_i is the cost assigned to link i, and the summation covers all links on the candidate path. The actual cost values are standard- and speed-dependent; they must be taken from the applicable protocol and vendor implementation rather than invented from bandwidth alone.

STP variants

Classic 802.1D STP can converge slowly after topology changes. Rapid Spanning Tree Protocol (RSTP), standardised in IEEE 802.1w and incorporated into later bridging standards, uses improved port roles and proposal/agreement mechanisms to reduce convergence time.

Multiple Spanning Tree Protocol (MSTP) maps VLANs to a smaller number of spanning-tree instances. This can reduce control-plane scale compared with maintaining one independent tree per VLAN. However, MST regions require consistent configuration, including region name, revision information, and VLAN-to-instance mapping. A mismatch can create an unintended boundary and unexpected topology.

Per-VLAN variants allow different VLANs to use different roots and paths. They can improve load distribution, but they increase configuration and troubleshooting complexity.

Protection features

Edge ports connected to end devices should use an edge or PortFast-like configuration so that hosts do not wait through unnecessary transition states. Edge settings should not be applied indiscriminately to switch-to-switch links.

Important protection mechanisms include:

• BPDU Guard: disables or restricts an edge port if bridge protocol data units are received unexpectedly.
• BPDU Filter: suppresses or ignores BPDUs in carefully controlled circumstances; misuse can conceal loops.
• Root Guard: prevents a designated port from accepting superior root information.
• Loop Guard: helps prevent a unidirectional failure from causing an incorrectly forwarding port.
• Storm control: limits broadcast, multicast, or unknown-unicast rates.

These mechanisms complement, but do not replace, sound topology design.

Failure and convergence

STP convergence is influenced by protocol version, failure detection, physical-layer signals, bidirectional forwarding detection, timers, topology size, and implementation. A design should define acceptable recovery objectives rather than assuming that redundancy automatically means fast recovery. Excessive Layer 2 diameter and many blocked links indicate that the architecture may need redesign rather than more tuning.

5. Link Aggregation

Link aggregation combines multiple physical links into one logical bundle. IEEE 802.1AX Link Aggregation Control Protocol (LACP) supports negotiation, member-state checking, and failure detection. The bundle provides higher aggregate capacity and can improve availability.

A crucial limitation is that aggregation does not normally split one ordinary flow arbitrarily across all members. A hashing algorithm selects a member using fields such as source and destination MAC addresses, IP addresses, and transport ports. Consequently, aggregate throughput can approach the sum of active members across many flows, while one large flow may be limited to the capacity of one member.

For n equal links of capacity R each, the ideal aggregate capacity is:

This is an upper bound, assuming all members are active, traffic is sufficiently distributed by the hashing function, and protocol overhead and contention are ignored. If only k members are operational, the ideal capacity becomes:

For independent identical links with individual availability A and a bundle that remains operational when at least one of n links works, the idealised bundle availability is:

This formula assumes statistical independence, identical link availability, and no common failure such as a shared line card, power supply, transceiver cage, or upstream device. Real availability is often lower because common-cause failures violate independence.

LACP does not make incompatible configurations safe. Member links should match in speed, duplex, VLAN/trunk policy, MTU, and other relevant parameters. A bundle should be terminated on devices that support multi-chassis aggregation when device-level redundancy is required; otherwise all members may depend on one physical switch.

6. Overlay Networks and Tunnelling

Traditional VLANs use a 12-bit identifier and extend Layer 2 domains through physical trunks. This model is simple and efficient at modest scale, but it becomes difficult when a data centre requires many tenants, frequent workload mobility, or a large number of isolated logical networks.

VXLAN

Virtual Extensible LAN (VXLAN) encapsulates an inner Ethernet frame inside UDP/IP. It uses a 24-bit VXLAN Network Identifier (VNI), permitting far more logical segments than ordinary VLAN numbering. VXLAN tunnel endpoints (VTEPs) perform encapsulation and decapsulation. In a leaf–spine fabric, VTEPs are commonly located in leaf switches or hypervisors.

An abstract packet structure is:

Outer Ethernet | Outer IP | UDP | VXLAN header | Inner Ethernet | Payload

The underlay provides IP reachability between VTEPs. The overlay provides logical Layer 2 or Layer 3 connectivity independent of the physical path. This separation permits the underlay to remain a routed fabric while tenant or application segmentation is implemented above it.

Control plane and data plane

Flood-and-learn overlays replicate unknown traffic and learn remote endpoint locations from data-plane observation. EVPN, commonly carried over MP-BGP, supplies a control plane for advertising MAC and IP reachability. It can reduce unnecessary flooding, support multihoming, and improve convergence and policy visibility.

The overlay does not eliminate the need for design discipline. Operators must understand underlay MTU, VTEP reachability, route-target policy, endpoint mobility, multicast or ingress-replication behaviour, and failure-domain boundaries.

MTU calculation

Encapsulation adds overhead. If an inner frame has size L and the encapsulation adds H bytes, the outer frame size is:

The underlay MTU must be at least L_outer for the intended packet size, unless fragmentation or another adaptation mechanism is deliberately supported. The values of H depend on the exact encapsulation, addressing, Ethernet framing, and optional headers. A practical design validates the largest permitted frame end to end rather than assuming that a nominal “jumbo” setting is sufficient.

Tunnelling can also be used for secure connectivity. IPsec provides confidentiality, integrity, authentication, and anti-replay services when correctly configured, whereas a generic tunnel may provide reachability without encryption. Security claims must therefore be tied to the actual tunnel protocol and cryptographic configuration.

7. Scalable Layer 2 Design

A scalable network limits the size of each failure and broadcast domain. The following principles are generally effective:

1. Keep VLANs local to the smallest area that requires them.
2. Prefer Layer 3 routing between distribution blocks, racks, or leaves.
3. Use Layer 2 extension only where application or operational requirements justify it.
4. Establish deterministic STP roots and document expected paths.
5. Restrict trunk VLANs and remove unused VLANs.
6. Use link aggregation for capacity and physical resilience, while recognising flow-hash limits.
7. Separate management, user, storage, and control traffic according to risk and performance needs.
8. Provide independent power, line cards, supervisors, and paths where availability objectives require it.
9. Instrument the design with MAC-move alerts, STP events, interface errors, queue drops, broadcast rates, and overlay endpoint state.
10. Test failure scenarios, including link loss, switch loss, mispatched trunks, MTU mismatch, and control-plane unavailability.

Layer 2 versus Layer 3 boundaries

Layer 2 is useful for adjacency, mobility, clustering, and some storage protocols. Layer 3 is useful for scale, containment, equal-cost multipath, policy, and predictable failure domains. The choice should be based on application requirements rather than habit.

Extending a VLAN across a campus or data centre may simplify virtual-machine mobility, but it also extends broadcast traffic, STP influence, troubleshooting scope, and the impact of a loop. In many modern designs, workload mobility is addressed through distributed routing, application redesign, orchestration, or overlays rather than by extending every VLAN physically.

8. Worked Example: Capacity, Availability, and MTU

Consider a four-member LACP bundle with each link operating at 10 Gbit/s. Under ideal conditions, the aggregate capacity is:

This does not imply that one TCP flow will obtain 40 Gbit/s; the flow may be assigned to one member by the hashing function.

Suppose each link has availability A = 0.999 and failures are assumed independent. The idealised bundle availability is:

This result is mathematically correct under the stated assumptions but should not be interpreted as a real-world guarantee. Shared power, optics, software, a common switch, or a maintenance event may dominate actual availability.

Now suppose an overlay adds 50 bytes of headers to a 1500-byte inner packet. The required outer packet size is:

An underlay supporting only a 1500-byte maximum transmission unit cannot carry that packet without fragmentation, reduction of the inner payload, or another adaptation. The operational remedy is to validate and configure an adequate end-to-end MTU, not merely to increase the MTU on one interface.

9. Applied Case: Illustrative Data-Science Research Campus

Background

A research campus operates GPU clusters, data-lake servers, student laboratories, and administrative systems. Its original network extended many VLANs across a large Layer 2 core. Virtual machines were mobile, but broadcast traffic increased, STP changes were frequent, and a misconfigured laboratory switch once caused a campus-wide outage.

Problem

The organisation needed higher east–west capacity and workload mobility while reducing the blast radius of loops and broadcast storms. It also required separate control, storage, management, research, and guest traffic.

Analysis

The existing design had three weaknesses. First, VLANs were larger than the applications required. Second, the STP topology depended on manually maintained priorities and included numerous blocked links. Third, the core was expected to provide both Layer 2 extension and most routing, creating a large failure domain.

Traffic measurements showed that many flows were between servers in the same rack or adjacent racks, while only a subset required mobility across the entire campus. This indicated that universal Layer 2 extension was unnecessary.

Approach and solution

The campus adopted a routed leaf–spine underlay for data-centre resources. Server-facing leaf switches used LACP to provide resilient connectivity. VLANs were kept local where possible, and selected tenant segments were extended through VXLAN. EVPN distributed endpoint reachability, while distributed gateways provided inter-subnet routing close to workloads.

Access-layer ports were explicitly configured, unused ports were disabled, and BPDU Guard was enabled on genuine edge ports. STP remained within deliberately bounded domains for legacy segments rather than spanning the entire fabric. Management access used a separate VRF and role-based administrative controls. The underlay MTU was validated through automated tests.

Outcome

The new design reduced the number of switches participating in any single Layer 2 domain, improved path utilisation through routed equal-cost paths, and limited the effect of access-layer loops. Workload mobility remained available for the applications that required it, but it was no longer treated as a justification for extending all VLANs everywhere.

Learning points

The principal lesson is architectural: redundancy and mobility should be provided at the narrowest layer that satisfies the requirement. LACP solves a link-level problem; STP solves a Layer 2 loop problem; routing solves scale and containment problems; overlays solve selected logical-topology problems. No single mechanism substitutes for the others.

10. Security, Governance, and Operational Risks

Switching designs have significant security implications. VLAN hopping may arise from incorrect trunk negotiation, native VLAN mismatches, or poorly controlled tagging. DHCP snooping, dynamic ARP inspection, IP Source Guard, port security, storm control, and 802.1X can reduce risks, but each requires compatible design and monitoring.

Management interfaces should not be exposed through ordinary user VLANs. Administrative access should use authenticated protocols, central logging, least privilege, and preferably a separate management plane or VRF. Configuration changes should be reviewed, recorded, and reversible.

Network telemetry can contain sensitive information, including endpoint identities, research-system relationships, and user activity patterns. Retention, access control, and regulatory obligations should therefore apply to switch logs, flow records, packet captures, and management databases. Automation should be subject to validation and staged deployment; an incorrect template can propagate a VLAN or trunk error across hundreds of devices.

11. Contemporary Developments

Modern data-centre fabrics increasingly use routed underlays, EVPN control planes, programmable telemetry, and intent-based automation. Merchant-silicon switches provide high-speed forwarding, while software agents manage configuration, compliance, and event correlation. Segment routing and programmable data planes may further integrate traffic engineering with service policy, although their operational complexity remains substantial.

Artificial intelligence can assist with anomaly detection, capacity forecasting, configuration validation, and root-cause analysis. It should not be treated as an unquestionable authority. Training data may be incomplete, rare failure modes may be underrepresented, and an automated remediation system can amplify a mistaken inference. Human approval, audit trails, bounded actions, and rollback mechanisms remain essential.

Best-Practice Checklist

• Define VLANs by business or technical function, not by convenience alone.
• Make access and trunk roles explicit.
• Restrict allowed VLANs on trunks.
• Engineer STP root placement and verify it continuously.
• Apply edge protection only to genuine edge ports.
• Use LACP with consistent member configurations.
• Design for common-cause failures, not only independent link failures.
• Validate underlay MTU for every encapsulation path.
• Prefer routing boundaries that limit broadcast and failure domains.
• Monitor MAC movement, STP changes, interface errors, queue drops, and control-plane health.
• Automate testing and configuration compliance with staged deployment and rollback.

Chapter Summary

Ethernet switches learn source MAC addresses and use VLAN-scoped forwarding databases to selectively forward, flood, or filter frames. VLANs create logical broadcast domains, while 802.1Q trunks transport multiple VLANs between devices. Inter-VLAN communication requires Layer 3 routing and should be designed as a deliberate policy boundary.

STP and its successors prevent physical Layer 2 loops by constructing a logical tree, but extensive Layer 2 domains increase convergence time and failure impact. LACP combines physical links into logical bundles, improving aggregate capacity and resilience, although individual flows are usually constrained by hashing. Overlays such as VXLAN separate a routed underlay from logical tenant networks, while EVPN can provide a scalable control plane for endpoint reachability.

Scalable designs limit VLAN scope, use routing between major blocks, apply overlays selectively, validate MTU and redundancy assumptions, and protect edge and management interfaces. Effective engineering requires understanding not only the protocol mechanisms but also their failure modes, operational dependencies, security implications, and governance requirements.

Key Terms

VLAN: A logical Layer 2 broadcast domain.

802.1Q: IEEE standard for VLAN tagging on Ethernet frames.

Access port: A port normally associated with one VLAN and untagged end-device traffic.

Trunk port: A port carrying multiple VLANs, usually with tags.

Native VLAN: The VLAN transmitted untagged on a trunk.

Forwarding database: A table mapping VLAN-scoped MAC addresses to switch ports.

Flooding: Transmission to multiple ports when a destination is unknown or inherently broadcast/multicast.

STP: A protocol that prevents active Layer 2 loops.

RSTP: A faster-converging spanning-tree protocol.

MSTP: A protocol that maps VLANs to multiple spanning-tree instances.

Root bridge: The switch selected as the reference point for a spanning-tree topology.

LACP: A protocol for negotiating and monitoring link aggregation.

Link aggregation: Combining physical links into one logical bundle.

VXLAN: An IP/UDP-based overlay that carries Ethernet frames using a 24-bit VNI.

VTEP: A device that encapsulates and decapsulates VXLAN traffic.

EVPN: A control-plane technology, commonly using BGP, for advertising Ethernet VPN reachability.

Underlay: The physical or routed network carrying overlay traffic.

Overlay: A logical network built over an underlay.

Broadcast domain: The set of devices receiving a Layer 2 broadcast.

Common-cause failure: A failure that affects multiple apparently redundant components simultaneously.

Review Questions

Short Answer Questions

1. What information does an Ethernet switch learn from the source address of an arriving frame?
2. Why is a VLAN not automatically equivalent to a firewall security zone?
3. What is the purpose of a trunk port?
4. Why can one large flow fail to use the full capacity of an LACP bundle?
5. What problem does VXLAN address in large data-centre networks?

Long Answer Questions

1. Explain the complete learning and forwarding process for a frame entering a VLAN-aware Ethernet switch.
2. Compare classic STP, RSTP, and MSTP, including their scaling and convergence considerations.
3. Discuss the design trade-offs between extending Layer 2 and routing between distribution blocks.
4. Explain the roles of the VXLAN underlay, VTEP, VNI, and EVPN control plane.
5. Develop a secure and resilient VLAN and trunking policy for a university campus.

Analytical / Application Questions

1. A four-link bundle contains 25 Gbit/s links, but traffic consists mainly of one elephant flow. Analyse the expected aggregate and per-flow performance and recommend a mitigation.
2. A VXLAN deployment adds 50 bytes of encapsulation to 1500-byte inner packets over a 1500-byte underlay. Identify the failure mechanism and propose two technically valid remedies.
3. A campus has frequent STP topology changes caused by laboratory switches and wants to retain redundancy. Design a revised architecture and justify where Layer 2, Layer 3, edge protection, and monitoring should be applied.

Multiple Choice Questions with Answers

Question 1

Which action allows a switch to build a forwarding-database entry?

A. Learning the source MAC address on the ingress port

B. Learning the destination IP address from the payload

C. Using only the switch management address

D. Disabling VLAN membership checks

Correct Answer: A. Learning the source MAC address on the ingress port

Question 2

What is the principal purpose of an IEEE 802.1Q trunk?

A. To encrypt Ethernet frames

B. To carry multiple VLANs over one link

C. To replace all Layer 3 routing

D. To prevent every physical link failure

Correct Answer: B. To carry multiple VLANs over one link

Question 3

Which device function is required for communication between different VLANs?

A. Layer 3 routing

B. MAC ageing only

C. Storm control only

D. A second native VLAN

Correct Answer: A. Layer 3 routing

Question 4

What does STP primarily prevent?

A. IP address duplication

B. Layer 2 forwarding loops

C. Wireless interference

D. Transport-layer congestion

Correct Answer: B. Layer 2 forwarding loops

Question 5

A bundle has three operational links, each rated at 10 Gbit/s. What is its ideal aggregate capacity?

A. 3 Gbit/s

B. 10 Gbit/s

C. 20 Gbit/s

D. 30 Gbit/s

Correct Answer: D. 30 Gbit/s

Question 6

Why may one large flow use only one member of a link aggregation bundle?

A. The flow is selected by a hashing algorithm

B. LACP encrypts the flow

C. STP permanently blocks all members

D. VLAN tags remove the physical links

Correct Answer: A. The flow is selected by a hashing algorithm

Question 7

What is the main scaling advantage of VXLAN over ordinary VLAN numbering?

A. It eliminates the need for IP addresses

B. It provides a much larger logical segment identifier space

C. It guarantees encryption

D. It removes all MTU requirements

Correct Answer: B. It provides a much larger logical segment identifier space

Question 8

What is the role of a VTEP?

A. To assign user passwords

B. To encapsulate and decapsulate overlay traffic

C. To select the STP root using DNS

D. To replace every switch ASIC

Correct Answer: B. To encapsulate and decapsulate overlay traffic

Question 9

A 1500-byte inner packet gains 50 bytes of tunnel overhead. What outer packet size is required?

A. 1450 bytes

B. 1500 bytes

C. 1550 bytes

D. 1600 bytes

Correct Answer: C. 1550 bytes

Question 10

Which practice most directly limits the blast radius of a Layer 2 loop?

A. Extending every VLAN across the entire campus

B. Using routing boundaries and keeping VLANs local

C. Allowing all VLANs on every trunk

D. Disabling all monitoring

Correct Answer: B. Using routing boundaries and keeping VLANs local