VLANs
One physical switch, many broadcast domains. 802.1Q tags and trunk ports.
Level: intermediate
What is it?
A Virtual LAN (VLAN) partitions a switched Ethernet infrastructure into separate logical layer-2 broadcast domains. IEEE 802.1Q tagging carries VLAN identity across trunk links; access ports commonly connect endpoints to a single configured VLAN.
Why does it matter?
VLANs organize networks by function or trust boundary without requiring one physical switch per network. Inter-VLAN communication still needs a layer-3 routing function and should be governed by routing and firewall policy.
Mental model
VLANs separate layer-2 neighborhoods on shared physical infrastructure. An endpoint sends ordinary Ethernet frames on an access port; a trunk carries frames tagged to distinguish multiple VLANs across the link.
How it works
- An access port normally assigns untagged endpoint traffic to one configured VLAN.
- A trunk carries traffic for multiple VLANs and uses 802.1Q tags, subject to allowed-VLAN configuration.
- Broadcast and unknown-unicast flooding normally remains within a VLAN.
- Devices in different VLANs do not communicate at layer 2 just because they share a switch chassis.
- VLAN separation is not complete security by itself; routing ACLs, firewall rules, and management-plane controls matter.
Steps
- Put two endpoint ports in VLAN 10 and VLAN 20.
- Each host can exchange frames with peers in its own VLAN when addressing is valid.
- An inter-VLAN packet needs a router or layer-3 switch interface.
- Apply and verify routing/firewall rules before allowing cross-VLAN access.
Real-world usage
- Segmenting guest, staff, server, or IoT traffic.
- Troubleshooting a port connected to the wrong VLAN.
- Understanding access ports, trunks, native VLAN behavior, and inter-VLAN routing.
Common mistakes
- Believing a VLAN tag alone encrypts traffic.
- Allowing a trunk to carry unintended VLANs.
- Assuming VLANs automatically restrict traffic once a router permits it.
Interview questions
What does a VLAN change?
It defines a logical layer-2 broadcast domain on a shared switched infrastructure.
How do two VLANs communicate?
Traffic typically requires a layer-3 routing function, and policy must permit the desired communication.