What Is a VLAN? A Beginner's Guide to Network Segmentation
Learn how VLANs separate devices on one network, how access and trunk ports work, and what to check before deploying VLANs in a small business.
A VLAN, short for virtual local area network, lets you divide one physical network into separate logical networks. A small office can use the same managed switch for employee computers, guest Wi-Fi, and security cameras without placing all those devices in one shared broadcast domain.
That separation makes a network easier to organize and can support better security. It does not, by itself, replace a firewall or make devices impossible to reach from other VLANs.
What is a VLAN?
Imagine a building with three departments. Everyone shares the same hallways, but each department has its own rooms. A VLAN works similarly: devices can share switching hardware while belonging to distinct Layer 2 networks.
Without VLANs, devices connected to the same ordinary switch network typically share one broadcast domain. With VLANs, a managed switch can keep traffic for one group separate from another. Devices in different VLANs generally need a router or Layer 3 switch to communicate.
VLANs are commonly identified by numbers, such as VLAN 10 or VLAN 20. Those numbers are labels in the switch configuration, not IP addresses or security policies.
A practical small-office example
Consider an office with employee laptops, VoIP phones, and visitor Wi-Fi. You might create three VLANs:
| VLAN | Purpose | Example subnet |
|---|---|---|
| 10 | Office computers and printers | 192.168.10.0/24 |
| 20 | VoIP phones | 192.168.20.0/24 |
| 30 | Guest Wi-Fi | 192.168.30.0/24 |
The subnet assignments are examples, not requirements. A VLAN and an IP subnet are different concepts, although using one subnet per VLAN is the usual design for straightforward networks.
Each VLAN is its own Layer 2 broadcast domain. For example, a broadcast from an office computer in VLAN 10 stays in VLAN 10 instead of being forwarded into the voice or guest VLANs. This does not mean devices in separate VLANs can never communicate. A router, firewall, or Layer 3 switch can route traffic between them when its routing configuration and access-control policies permit it.
A sensible firewall policy could let employees access approved printers, give guests internet-only access, and allow phones to reach the approved phone system. VLANs separate the Layer 2 broadcast domains; routing and firewall rules control which traffic can pass between them.
How do VLANs work?
A managed switch tracks which ports belong to which VLAN. When it receives an Ethernet frame, it forwards that frame according to its VLAN membership and learned MAC addresses. Broadcast traffic in VLAN 10 does not automatically get forwarded into VLAN 20.
The common standard for carrying VLAN information across Ethernet links is IEEE 802.1Q. It adds a VLAN tag to frames when a link needs to carry traffic from multiple VLANs. On many ordinary device-facing links, frames are untagged.
Access ports versus trunk ports
An access port typically connects one device to one VLAN. For example, a desktop computer plugged into an access port assigned to VLAN 10 normally sends and receives untagged frames. The switch associates that traffic with VLAN 10.
A trunk port can carry several VLANs over one cable. Trunks are useful between managed switches, or between a switch and a VLAN-aware router, firewall, hypervisor, or wireless access point. The switch and the device at the other end must agree on which VLANs are allowed and how untagged traffic is handled.
Do not assume every vendor uses the words access and trunk identically. Some interfaces use terms such as tagged, untagged, and PVID instead.
Tagged versus untagged traffic
A tagged Ethernet frame includes a VLAN identifier so a receiving VLAN-aware device can determine which VLAN it belongs to. An untagged frame has no VLAN identifier in the frame itself; the receiving switch uses the port's configuration to classify it.
On a trunk, one VLAN may be configured as the native or untagged VLAN, depending on the platform. Mismatched native VLAN settings can cause confusing connectivity problems and potentially unsafe traffic placement. For predictable behavior, explicitly configure allowed VLANs and avoid relying on defaults.
Can devices in different VLANs talk to each other?
Not directly at Layer 2. Traffic between VLANs normally passes through a router, firewall, or Layer 3 switch. This is called inter-VLAN routing.
Routing does not automatically mean access is safe. A router might permit traffic between all connected networks unless you add restrictions. For a guest network, you would typically block access to internal subnets while allowing necessary DNS, DHCP, and internet connectivity.
Do VLANs improve security?
VLANs help reduce unnecessary exposure by separating classes of devices. They also make firewall policy easier to express: for example, camera devices can be prevented from initiating connections to employee laptops.
But VLANs are not a complete security boundary on their own. Misconfigured trunks, permissive routing rules, insecure management interfaces, and compromised devices can undermine the design. Keep switch firmware updated, restrict management access, and verify the actual traffic paths.
Common VLAN mistakes
Forgetting DHCP: A device in a new VLAN may need a DHCP scope and, depending on the topology, a DHCP relay. Otherwise it may never receive an address.
Missing the VLAN on a trunk: If VLAN 30 is configured on one switch but not allowed across the uplink, guest devices connected downstream may appear offline.
Assuming isolation without checking firewall rules: Separate subnets can still be fully reachable through inter-VLAN routing.
Misconfigured Wi-Fi mapping: A guest SSID must be mapped to the intended VLAN on both the access point and its switch uplink.
Losing management access: Changing a switch's management VLAN remotely can disconnect the administrator. Plan a rollback path before applying changes.
How to plan your first VLAN deployment
Start with a simple inventory: which devices need to communicate, which should be isolated, and which services they depend on. Choose VLAN IDs and IP subnets, then configure the router/firewall interfaces, DHCP, and access policies. Configure the switch ports and uplinks afterward.
Test one device in each VLAN. Confirm its IP address, DNS resolution, internet access, and permitted internal connections. Just as importantly, test that blocked connections really fail. Document the port assignments and save a known-good configuration.
If you're learning on a home lab, begin with two VLANs and a single managed switch. Add a third network only after you can explain how traffic crosses the boundary between the first two.
When should you use VLANs?
VLANs are useful when a network has devices with different trust levels or operational needs: guest Wi-Fi, office computers, cameras, VoIP phones, lab equipment, or building-management systems. They are less useful when introduced without a clear purpose or without someone available to maintain the routing and firewall rules.
A good VLAN design is usually boring: clear names, consistent port configuration, a small set of documented rules, and tests that prove the rules work.
Need Help With Your Network?
FOO.XYZ helps Los Angeles-area businesses plan and troubleshoot switches, VLANs, Wi-Fi, firewalls, and network infrastructure. Whether you're separating guest traffic or cleaning up an existing network, we can help make the configuration understandable and maintainable.
Call (213) 212-8317 or email hello@foo.xyz. Based in Los Angeles, serving Greater Los Angeles and Beverly Hills.