VLAN and switching — how a network is divided logically
Why you divide a physical network into multiple logical ones, and how traffic is marked
A switch forwards data based on MAC addresses and binds all connected devices together in one common broadcast domain — messages sent to everyone reach everyone. The more devices that share the same switch infrastructure, the more broadcast traffic flows around and the harder it becomes to separate departments or systems for security reasons. The solution is to logically divide the network with VLAN without having to run separate physical cables to each department.
§What is a VLAN?
A VLAN (Virtual Local Area Network) is a logical separate network that runs on the same physical switch infrastructure. The IEEE 802.1Q standard describes how a switch marks (tags) each data frame with a VLAN-id so traffic from different VLANs can be sent through the same physical cable without mixing. Devices in the same VLAN behave as if they were on their own physical network even though they are physically connected to the same switch as devices in other VLANs.
§Access and trunk ports
- 01An access port belongs to exactly one VLAN and is used to connect ordinary equipment like a computer or printer — the device itself doesn't know VLANs exist
- 02A trunk port can carry traffic from multiple VLANs simultaneously because each frame is 802.1Q-tagged with its VLAN-id
- 03Trunk ports are typically used between switches or to a router/firewall that must reach multiple VLANs
- 04A 'native VLAN' on a trunk port is the one VLAN sent untagged — often used for control traffic but should be chosen consciously for security reasons.
| VLAN ID | Name | Purpose |
|---|---|---|
| 10 | Office | Common workstations |
| 20 | Server | Internal servers and databases |
| 30 | Guest | Internet access without access to internal resources |
| 40 | Steering | Administration of switches and access points |
§Inter-VLAN routing
Because VLANs are separate broadcast domains, devices in two different VLANs cannot talk to each other directly — the traffic must be routed, just like between two physically separate networks. In practice this is solved either by a router with one connection that handles multiple tagged VLANs (often called 'router-on-a-stick'), or by a layer 3 switch that can itself route between VLANs internally. Here it is the router or layer 3 switch that can simultaneously set up access rules between the VLANs — for example that the guest VLAN cannot reach the server VLAN at all.
“A VLAN plan drawn on paper before touching the switch saves hours of troubleshooting afterward.”
— Rule of thumb from network design.