Quick Summary
- A VLAN (Virtual LAN) divides one physical switch into multiple isolated networks -- devices on different VLANs cannot talk to each other by default
- Access ports carry traffic for a single VLAN, while trunk ports carry traffic for multiple VLANs using 802.1Q tags
- To communicate between VLANs, you need a router or Layer 3 switch performing inter-VLAN routing
The Office Building Analogy
Imagine a large office building with several departments: Accounting, Engineering, and Human Resources. Everyone works in the same building and shares the same hallways, but each department has its own locked section. An accountant cannot walk into the engineering lab, and an engineer cannot browse HR's filing cabinets. Each department has privacy within the same building.
That is exactly what a VLAN does for your network. Without VLANs, every device plugged into the same switch is on the same network -- like an open-plan office where everyone can hear everyone else's conversations. A VLAN creates invisible walls inside that switch, grouping certain ports together into their own private network. Devices on VLAN 10 cannot see or talk to devices on VLAN 20, even though they are all plugged into the same physical switch.
VLAN stands for Virtual Local Area Network. The word "virtual" is key: you are not running new cables or buying new switches. You are using software configuration to logically separate traffic on hardware you already own. This makes VLANs one of the most cost-effective tools in networking.
How VLANs Work on a Switch
Here is a switch with eight ports. Ports are assigned to different VLANs by color, and a trunk port carries all VLANs between switches:
Notice the red dashed line between the two groups. Even though all these devices share the same physical switch, the blue ports (VLAN 10) and green ports (VLAN 20) are completely isolated. The yellow trunk port carries tagged traffic for both VLANs to a second switch.
VLANs Step by Step
Why VLANs Exist
Without VLANs, every device on a switch shares one big broadcast domain. When any device sends a broadcast (like an ARP request asking "who has this IP?"), every other device on the switch hears it. In a small home network with five devices, this is not a problem. In an office with 500 devices, broadcasts create a constant storm of noise that wastes bandwidth and exposes traffic to devices that have no business seeing it. VLANs solve this by creating smaller, isolated broadcast domains. Broadcasts in VLAN 10 never reach VLAN 20 -- just like shouting in one department's office does not disturb the other.
Access Ports vs Trunk Ports
There are two types of switch ports. An access port belongs to exactly one VLAN. You plug an end device (a PC, printer, or phone) into an access port, and all its traffic stays within that VLAN. The device does not even know VLANs exist -- the switch handles everything silently. A trunk port is different: it carries traffic for multiple VLANs simultaneously. Trunks are used to connect switches to each other, or to connect a switch to a router. Think of access ports as doors into a specific department, and trunk ports as the main hallway that connects all departments.
802.1Q Tagging: How Trunk Ports Work
When a frame travels across a trunk port, the switch needs a way to say "this frame belongs to VLAN 10" or "this frame belongs to VLAN 20." It does this by inserting a small 802.1Q tag -- a 4-byte header -- into the Ethernet frame. The tag contains the VLAN ID number (a value from 1 to 4094). When the frame arrives at the other switch, that switch reads the tag, knows which VLAN it belongs to, and forwards it only to the correct access ports. The tag is added when a frame enters a trunk and removed when it exits to an access port, so end devices never see it.
Inter-VLAN Routing
By design, VLANs block communication between each other. But what if Accounting needs to reach a shared file server on Engineering's VLAN? You need a router (or a Layer 3 switch) to move traffic between VLANs. This is called inter-VLAN routing. The router has an interface (or sub-interface) in each VLAN and forwards packets between them, applying security rules along the way. Without a router in the middle, VLANs are completely isolated -- which is the whole point for security, but means you must deliberately enable cross-VLAN communication when needed.
VLANs in the Real World
VLANs are everywhere in modern networks. Here are three common uses you will encounter:
Guest WiFi Isolation
When you connect to "Guest WiFi" at a coffee shop or office, you are placed on a separate VLAN from the company's internal network. You can reach the internet, but you cannot access the company's printers, file servers, or internal systems. The same wireless access point serves both networks, but VLANs keep them apart.
IoT Device Segregation
Smart thermostats, security cameras, and badge readers are often placed on their own VLAN. These devices frequently have weak security and rarely receive updates. Isolating them on a dedicated VLAN means that even if a camera is compromised, the attacker cannot pivot to your main corporate network where sensitive data lives.
Department Separation
A university might put students on VLAN 100, faculty on VLAN 200, and administrative staff on VLAN 300. Each group gets its own IP subnet, its own DHCP scope, and its own firewall policies. This keeps student traffic from flooding faculty systems and allows IT to apply different bandwidth and security rules to each group.
Common VLAN Mistakes
VLANs are straightforward once you understand them, but these errors trip up beginners constantly:
Forgetting the Trunk Port
You configure VLANs on two switches but leave the link between them as an access port. Result: only one VLAN's traffic crosses between the switches. The other VLANs appear completely dead on the second switch. Always configure inter-switch links as trunk ports and verify that all needed VLANs are allowed on the trunk.
Wrong VLAN Assignment
A user calls the helpdesk saying they cannot reach anything. You troubleshoot for an hour before discovering their port is assigned to VLAN 99 (a test VLAN) instead of VLAN 10 (their department). Always double-check which VLAN each port belongs to with show vlan brief. A single wrong number silently drops a device into the wrong network.
No Inter-VLAN Router
You set up VLANs perfectly, but now nobody can reach the shared printer or file server on a different VLAN. VLANs isolate by design -- if you want traffic to cross VLAN boundaries, you must configure a router or Layer 3 switch to route between them. Forgetting this step is the most common reason new VLAN deployments feel "broken."
Beyond the Basics: Native VLANs and VLAN Ranges
Every trunk port has a native VLAN -- this is the VLAN used for any untagged traffic that arrives on the trunk. By default, the native VLAN is VLAN 1 on most switches. Security best practices recommend changing the native VLAN to an unused VLAN number, because attackers can exploit the default VLAN 1 in a technique called VLAN hopping. In this attack, a malicious device sends double-tagged frames to trick the switch into forwarding traffic to a VLAN it should not reach.
VLANs are identified by a number from 1 to 4094. VLAN 1 is the default VLAN and cannot be deleted. VLANs 1002 through 1005 are reserved for legacy Token Ring and FDDI networks. In enterprise environments, administrators often follow a naming convention -- for example, VLAN 10 for management, VLAN 20 for employees, VLAN 30 for guests, and VLAN 100 for servers. Consistent numbering and documentation prevent confusion as the network grows.
VLAN Security: Why Segmentation Matters
VLANs are a critical layer of defense in depth. If a malware infection hits one department's network, VLAN boundaries contain the spread. The malware cannot send broadcast traffic to other VLANs, and without a route, it cannot reach devices in other segments. This buys your security team valuable time to detect and respond to the incident before it becomes a company-wide breach.
Combining VLANs with firewall rules at the inter-VLAN routing point gives you fine-grained control. You can allow the guest VLAN to reach only the internet, permit the IoT VLAN to talk only to its cloud management platform, and let employees access internal servers but not each other's workstations. VLANs provide the boundaries; firewalls enforce the policies at those boundaries.
Try It Yourself
Click each port to cycle its VLAN assignment, then send a frame to see which ports receive it.
Frequently asked questions about VLANs
What does VLAN stand for?
VLAN stands for Virtual LAN. It is a logical grouping of switch ports into an isolated broadcast domain, so that one physical switch can carry multiple separate Layer 2 networks that cannot communicate with each other without a router.
How do VLANs work?
Each switch port is assigned a VLAN ID. Frames entering an access port are kept within that VLAN. On trunk ports between switches, frames are tagged with the VLAN ID using the 802.1Q header so the receiving switch can place them back into the correct VLAN on the other side.
What is the difference between an access port and a trunk port?
An access port belongs to exactly one VLAN and carries untagged frames; it is what you connect end devices like PCs and printers to. A trunk port carries traffic for many VLANs simultaneously, tagging each frame with its VLAN ID, and is used between switches or between a switch and a router-on-a-stick.
How do devices on different VLANs communicate?
They cannot communicate at Layer 2 — VLAN isolation is the entire point. To allow controlled communication, traffic must pass through a router or a Layer 3 switch performing inter-VLAN routing, where ACLs and firewall rules decide what is allowed between segments.
Why use VLANs instead of separate physical switches?
VLANs let you reuse the same physical infrastructure for many logical networks, cutting hardware, cabling, and power costs. They also make segmentation policy-driven instead of wiring-driven: moving a host to a different security zone is a configuration change, not a recabling job.
Try VLAN segmentation
You just learned how VLANs and 802.1Q tagging let one switch carry many isolated networks. Now split a switch into VLANs, trace to verify the isolation, route between them through a router, and see what one port in the wrong VLAN does.
Launch the VLAN lab →