Unlike CNU's old ATM VLANs, which were based on IP addresses alone and thus vulnerable to attack, Gigabit Ethernet VLANs create IP-based workgroups based on physical connections. These workgroups are invisible to one another even though they run on the same physical network. VLAN tagging lets workgroups share peripherals and servers.

With CNU's four Alteon ACEswitch 180 Gigabit Ethernet switches, which handle all IP routing, Savage and other network-support technicians configure the switch ports to determine which workstations and workgroups can talk to which VLANs. If a student is assigned only to the student computer laboratory on VLAN #10, for instance, he or she can't stray from the confines of that lab network. Even if a rogue student somehow captured the Ethernet switch's IP address and password, he or she still couldn't reach the switch itself or a VLAN of which the student wasn't a member, such as a faculty VLAN, Savage says.

"You can't physically reach the switch without kicking down the door and breaking into it manually," he says.

Meanwhile, VLAN tagging lets CNU put high-end shared servers such as its e-mail server in multiple VLANs to avoid excess routing, and thereby improve performance.

VLANs have a catch: While they may be easy to configure, doing so requires some knowledge of just how users on the virtual networks work together. "You have to know who's in a logical workgroup and who's doing what," Savage says. "If you're setting up a VLAN and you don't know who is doing what kinds of work with whom, you can easily set it up incorrectly."

CNU enjoys yet another level of security with its new Alteon gigabit-speed switches--IP filtering transforms the switches into mini-firewalls that determine who can go where based on IP addresses. That's safer than ATM-based VLANs, according to Savage. "You can set up filtering rules to allow and disallow access," he says. "It's not a full-blown router, but it satisfies internal security needs," such as keeping student LANs separate from administrative ones.