VLANs Explained

A VLAN (Virtual Local Area Network) allows you to logically divide a single physical network switch into multiple distinct, isolated virtual networks.

Instead of buying separate physical switches for different teams or device types, you use software configurations to group ports into virtual segments.

Why Use VLANs?

• Enhanced Security: Keep sensitive departments (like Finance or HR) isolated from general traffic or Guest Wi-Fi. Devices on different VLANs cannot talk to each other without a router or Layer 3 switch explicitly allowing it.
• Broadcast Containment: Physical switches regularly send broadcast traffic to every port. VLANs limit these broadcast domains, preventing network congestion.
• Cost Efficiency & Flexibility: Group devices by function or security policy rather than physical location—all on the same hardware.

How VLANs Work

VLANs rely on the IEEE 802.1Q standard, which adds a 4-byte "tag" containing a VLAN ID (a number between 1 and 4094) to Ethernet frames moving across the network.

Key Port Types

• Access Ports: Connect to end-user devices (PCs, printers, IP phones). These ports belong to a single VLAN and strip the tag before sending data to the end device.
• Trunk Ports: Connect switch-to-switch or switch-to-router. They carry traffic for multiple VLANs over a single cable by preserving the 802.1Q tags.

Common Setup Example

Imagine a small company using a single 24-port switch:

Even though everything is plugged into the exact same box, guests on VLAN 20 cannot discover or access corporate servers on VLAN 10 or security cameras on VLAN 30.