A virtual local area network (VLAN) is a logical network created on shared network switches. Devices assigned to the same VLAN behave as if they were connected to their own separate switch, even when they share hardware and cabling with other groups. VLANs are a common way to keep guest Wi-Fi, office computers, phones, cameras, payment systems and servers apart without building separate physical networks. They are defined by the IEEE 802.1Q standard and supported by most managed business switches.
At a glance
- A VLAN splits one physical switched network into several separate logical networks.
- Each VLAN is its own broadcast domain; traffic only moves between VLANs through a router, Layer 3 switch or firewall.
- VLANs are a building block of network segmentation, but on their own they don’t decide what may cross between groups.
- Misconfiguration can undo the separation, so design, documentation and switch hardening matter.
- They work within a site or campus; extending them between sites needs suitable Layer 2 services or overlay technology.
What problem it solves
In a flat network every device can reach every other device, and broadcast traffic from each one reaches all the rest. As the network grows, that becomes slow, hard to manage and risky: a compromised guest laptop or security camera sits on the same network as finance systems and servers.
Before VLANs, separating groups meant separate switches and cabling for each one. VLANs let one set of switches carry several isolated networks. Guest Wi-Fi, voice phones, building systems and payment terminals can each get their own VLAN, with their own addressing and policies, on the same hardware. That reduces cost, makes moves and changes easier, and creates natural points where traffic between groups can be inspected and controlled.
How it works
Assigning devices. Each switch port, or each wireless network name on an access point, is assigned to a VLAN. Some networks assign VLANs dynamically based on who or what connects, using network access control (NAC).
Tagging. Between switches, traffic for many VLANs shares one link called a trunk. Each Ethernet frame on a trunk carries a small 802.1Q tag with its VLAN ID, so the next switch knows which VLAN it belongs to. Ports that connect end devices, called access ports, usually belong to a single VLAN and don’t need tags.
Routing between VLANs. Devices on different VLANs can’t talk directly. Traffic between them goes through a router, Layer 3 switch or firewall, which is where access control lists or firewall rules decide what may cross. Without those rules, VLANs separate traffic on paper but allow most of it in practice.
Supporting protocols. Each VLAN usually has its own IP subnet and address pool. Protocols such as Spanning Tree Protocol (STP) prevent loops in the switched network.
Limits. The standard allows up to 4,094 usable VLAN IDs. Data centers and clouds that need far more segments, or that stretch segments across sites, often use overlay technologies such as VXLAN.
Hardening. Weak configurations, such as leaving unused ports active or trunks open to end devices, can let traffic jump between VLANs. Standard switch hardening and regular configuration reviews reduce that risk.
When it matters for buyers
- When redesigning an office or campus network. VLAN design determines how guests, staff, phones, cameras and building systems are separated.
- When compliance requires separation. Payment card environments and systems handling health or other regulated data often need to be kept apart from the rest of the network; VLANs plus firewall rules are a common way to do it. Check what your auditor or the applicable standard expects.
- When adding IoT, cameras or building systems. These devices are often hard to patch and benefit from their own VLAN with tightly limited access.
- When buying managed network services. Ask who designs, documents and changes VLANs, and how changes are approved.
Our Wired and Wireless LAN Infrastructure guide covers switching and Wi-Fi design, including segmentation.
Questions to ask vendors
- How will you design and document our VLANs, subnets and the rules between them?
- Where will traffic between VLANs be routed and filtered: on a switch, a router or a firewall?
- How are guest, IoT and voice devices assigned to their VLANs, including on Wi-Fi?
- What switch hardening do you apply to prevent VLAN hopping and unauthorized trunks?
- How are VLAN changes requested, approved and recorded?
- If we need segments across sites, will you extend VLANs or route between sites, and why?
How it differs from network segmentation
A VLAN is a specific technique for splitting a switched network into separate logical networks. Network segmentation is the broader practice of dividing a network into zones and controlling what traffic crosses between them. VLANs are one of the most common building blocks of segmentation, but they are not segmentation by themselves: if traffic can route freely between VLANs, the network is divided on paper only. Microsegmentation takes the idea further, applying rules to individual workloads or devices.
Problems this helps with
- Guest Wi-Fi, cameras and office PCs all on the same flat network
- Keeping payment or medical devices apart from everything else
- A slow network caused by too much broadcast traffic
- Not knowing which devices can talk to which
