shed through VLAN hopping, especially where trunks inter- connect switches. Don't rely on VLANs as your sole means of security, especially in high-risk environments. Connecting VLANs Figure 4-1 shows a switch with multiple VLANs. The VLANs have been numbered 10, 20, 30, and 40. In general, VLANs can be named or numbered; Cisco's implementation uses numbers to identify VLANs by default. The default VLAN is numbered 1. If you plug a number of devices into a switch without assigning its ports to specific VLANs, all the devices will reside in VLAN 1. Frames cannot leave the VLANs from which they originate. This means that in the example configuration, Jack can communicate with Jill, and Bill can communicate with Ted, but Bill and Ted cannot communicate with Jack or Jill in any way. For a packet on a Layer-2 switch to cross from one VLAN to another, an outside router must be attached to each of the VLANs to be routed. Figure 4-2 shows an external router connecting VLAN 20 with VLAN 40. Assuming a proper configuration on the Port 8 Port 9 Port 10 Port 11 Port 12 Port 13 Port 14 Port 15 VLAN 20 VLAN 30 VLAN 40 VLAN 10 VLAN 10 VLAN 20 Port 0 Port 1 Port 2 Port 3 Port 4 Port 5 Port 6 Port 7 Figure 4-1. VLANs on a switch Port 8 Port 9 Port 10 Port 11 Port 12 Port 13 Port 14 Port 15 VLAN 20 VLAN 30 VLAN 40 VLAN 10 VLAN 10 VLAN 20 Port 0 Port 1 Port 2 Port 3 Port 4 Port 5 Port 6 Port 7 Figure 4-2. External routing between VLANs router, Bill will now be able to communicate with Jill, but neither workstation will show any indication that they reside on the same physical switch. When expanding a network using VLANs, you face the same limitations. If you connect another switch to a port that is configured for VLAN 20, the new switch will be able to forward frames only to or from VLAN 20. If you wanted to connect two switches, each containing four VLANs, you would need four links between the switches: one for each VLAN. A solution to this problem is to deploy trunks between switches. Trunks are links that carry frames for more th