ZyXEL Communications USG 2000 User Manual

 Chapter 13 Interfaces

ZyWALL USG 2000 User’s Guide

Each VLAN is a separate network with separate IP addresses, subnet masks, and 
gateways. Each VLAN also has a unique identification number (ID). The ID is a 12-
bit value that is stored in the MAC header. The VLANs are connected to switches, 
and the switches are connected to the router. (If one switch has enough 
connections for the entire network, the network does not need switches A and B.)

• Traffic inside each VLAN is layer-2 communication (data link layer, MAC 

addresses). It is handled by the switches. As a result, the new switch is required 

to handle traffic inside VLAN 2. Traffic is only broadcast inside each VLAN, not 

each physical network.

• Traffic between VLANs (or between a VLAN and another type of network) is 

layer-3 communication (network layer, IP addresses). It is handled by the 

router.

This approach provides a few advantages.

• Increased performance - In VLAN 2, the extra switch should route traffic inside 

the sales department faster than the router does. In addition, broadcasts are 

limited to smaller, more logical groups of users.

• Higher security - If each computer has a separate physical connection to the 

switch, then broadcast traffic in each VLAN is never sent to computers in 

another VLAN.

• Better manageability - You can align network policies more appropriately for 

users. For example, you can create different content filtering rules for each 

VLAN (each department in the example above), and you can set different 

bandwidth limits for each VLAN. These rules are also independent of the 

physical network, so you can change the physical network without changing 

policies.

In this example, the new switch handles the following types of traffic:

• Inside  VLAN  2.
• Between the router and VLAN 1.
• Between the router and VLAN 2.
• Between the router and VLAN 3.

In the ZyWALL, each VLAN is called a VLAN interface. As a router, the ZyWALL 
routes traffic between VLAN interfaces, but it does not route traffic within a VLAN 
interface. All traffic for each VLAN interface can go through only one Ethernet 
interface, though each Ethernet interface can have one or more VLAN interfaces.

Note: Each VLAN interface is created on top of only one Ethernet interface.

Otherwise, VLAN interfaces are similar to other interfaces in many ways. They 
have an IP address, subnet mask, and gateway used to make routing decisions.