VLAN

networking

Virtual LAN: a logical Layer 2 broadcast domain carved out of a physical switch network, isolating traffic without separate hardware.

Defined by IEEE 802.1Q, which tags each frame with a 12-bit VLAN ID - hence the 4094 usable VLANs.

A VLAN separates one physical switched network into several logical ones, so that hosts on different VLANs cannot reach each other without passing through a router or firewall. It exists because physical separation does not scale: giving every department its own switches and cabling is expensive, and moving a person between segments should not require moving a cable.

The tagging is where the mechanics live. Access ports carry one untagged VLAN and are what end devices connect to; trunk ports carry many VLANs, tagged with the identifier, and are what connect switches to each other. The native VLAN on a trunk is the untagged one, and the mismatch between what two ends consider native is a classic source of traffic appearing where nobody intended.

The security caveat is worth stating. VLANs are a segmentation tool, not a security boundary in the way a firewall is: they separate broadcast domains and force traffic through a controlled path, but misconfiguration, double tagging, and a trunk where an access port was intended all defeat them. Treat them as the structure that makes enforcement possible, and put the enforcement at the routed boundary.

← All glossary entries