Table of Contents
Introduction
Virtual Local Area Networks, or VLANs, let you split one physical Ethernet network into several separate logical networks. With VLANs, devices can be plugged into the same switches and share the same cables, but still behave as if they are on completely different networks. This is a key concept in modern switching, especially in larger environments such as offices, schools, or data centers.
In this chapter, the focus is on what VLANs are, why they are used, and how they behave on switches. The details of trunks and 802.1Q tagging are covered separately in the trunking chapter, so they are only referenced lightly here.
What a VLAN Actually Is
A VLAN is a logical broadcast domain that exists on one or more switches. A broadcast domain is a group of devices that can receive each other's broadcast frames at Layer 2. On a basic switch with no VLANs, all ports are in a single broadcast domain. When you create VLANs, you divide that single broadcast domain into multiple separate ones.
On a switch, every access port belongs to exactly one VLAN. The switch keeps an internal table that links each port with a VLAN ID, often shortened to VID. If a frame arrives on a port, the switch internally associates that frame with the VLAN of that port before it makes any forwarding decisions. The MAC learning logic that you will see in another chapter is then applied separately inside each VLAN.
VLANs are identified by a number, typically from 1 to 4094, and often also given a descriptive name. The number is what matters technically. The name is only for humans.
Benefits of VLANs
VLANs are not only a way to organize ports, they are a way to organize traffic and policy. The main advantages are segmentation, security, and flexibility.
Segmentation means that different groups of devices can be kept in different Layer 2 islands. For example, you can put office computers in one VLAN and IP phones in another. This reduces the size of each broadcast domain and limits how far broadcast and unknown traffic can travel.
From a security point of view, VLANs provide isolation. Frames in one VLAN do not appear in another VLAN unless a router or Layer 3 device is deliberately configured to connect them. This separation helps you prevent different departments or device types from directly talking at Layer 2.
VLANs also allow flexible design. You no longer need separate physical switches for separate groups. Users on different floors can still be in the same VLAN. You simply assign their access ports to that VLAN. If a person moves from one desk to another, you do not need to rewire the network, you only change the VLAN assignment for that new port.
Because VLANs separate traffic logically, they are often used to support multiple IP subnets on the same physical infrastructure. Each VLAN can carry a different IP subnet, which is then routed by a router or multilayer switch, but the routing concepts are part of other chapters.
VLAN IDs and Ranges
VLANs are identified by a 12 bit field in the 802.1Q standard, which allows a maximum of $2^{12} = 4096$ possible values, from 0 to 4095. In practice, only VLANs from 1 to 4094 are usable for normal traffic.
Many vendors divide VLAN IDs into ranges, such as normal range and extended range. Some VLAN IDs can be reserved for special purposes, such as the default VLAN or management VLANs. The exact details vary by platform, so what matters conceptually is that each VLAN has a unique ID within the switching domain.
Important rule: Each active VLAN on a switch must have a unique VLAN ID between 1 and 4094, and all ports in that VLAN share the same Layer 2 broadcast domain.
A simple conceptual table can help:
| VLAN ID | Example Name | Typical Use |
|---|---|---|
| 1 | default | Initial switch ports |
| 10 | USERS | Employee workstations |
| 20 | VOICE | IP phones |
| 30 | SERVERS | Application servers |
| 999 | BLACKHOLE | Unused or disabled ports |
The actual numbers and names are up to the network designer, but clear naming is essential in larger environments.
Access Ports and VLAN Membership
On a switch, an access port is a port that carries traffic for exactly one VLAN. End devices like PCs, printers, IP phones, and access points plug into access ports. These devices normally have no awareness of VLANs. They just send and receive regular Ethernet frames.
The switch handles the VLAN mapping. When a frame enters an access port, the switch records that the frame belongs to the VLAN of that port. When the switch decides to forward the frame, it only considers ports that also belong to that same VLAN. It never sends a frame from VLAN 10 out of an access port that belongs to VLAN 20.
This has a very important effect on broadcasts. If a device sends a broadcast frame to MAC address FF:FF:FF:FF:FF:FF on VLAN 10, only other ports in VLAN 10 will receive that broadcast. Devices in VLAN 20 will not see it.
Key statement: A broadcast frame sent in one VLAN is never flooded to ports in any other VLAN.
From the user's point of view, nothing special is happening. Their computer just appears to be on its own network segment. The handling of VLAN membership is completely inside the switches.
VLANs and Broadcast Domains
VLANs are essentially a tool for controlling broadcast domains. Without VLANs, one large switch or several interconnected switches behave as a single broadcast domain. Any broadcast or unknown unicast frame is flooded everywhere. As the number of devices grows, this can create high levels of unnecessary traffic.
When VLANs are introduced, each VLAN becomes its own broadcast domain, even if all the devices are still plugged into the same physical switches. This has two important effects.
First, it reduces the size of each broadcast domain. Broadcasted frames are limited to only one VLAN, which reduces unnecessary load on devices in other VLANs.
Second, it enforces logical separation between different groups, because they no longer share a common Layer 2 space. If two devices are in different VLANs, a direct Layer 2 communication such as ARP request flooding will not cross the VLAN boundary.
If communication between VLANs is needed, it must pass through a routing function. This concept, often called inter VLAN routing, is covered by routing chapters, but it is helpful to understand that VLANs mark the boundaries where routing becomes necessary.
Default VLAN and Native VLAN Concepts
Most switches come out of the box with all ports in a single default VLAN. On many devices, VLAN 1 is the default. This means that until you configure VLANs, the switch behaves like a simple multiport bridge, and every access port is in the same broadcast domain.
Network designs usually move away from using the default VLAN for user traffic, especially in production environments. It is common to assign different VLANs for users, servers, phones, or management so that traffic can be separated and controlled.
The concept of a native VLAN is related to 802.1Q trunking, which is described separately. In short, the native VLAN determines how untagged frames are treated over a trunk. Within the context of this chapter, it is enough to know that the default/native VLAN is usually where frames with no explicit VLAN tagging end up. How trunks add and remove tags is handled in the trunking chapter.
VLANs Across Multiple Switches
VLANs become much more powerful when they extend across multiple switches. A VLAN does not have to be limited to just one switch. You can create VLAN 10 on many switches, and connect them so that all devices in VLAN 10, regardless of which switch they are on, share the same broadcast domain.
To do this, the inter switch links must be able to carry traffic for multiple VLANs. A simple port that belongs to only one VLAN would not be enough when you need to carry several VLANs over a single cable. This is exactly the role of trunks and 802.1Q tagging, handled in the trunking chapter.
From the VLAN perspective, the important point is that VLAN membership is preserved across the switched network. A broadcast that originates from VLAN 10 on Switch A is flooded only to ports belonging to VLAN 10, whether they are on Switch A or on connected switches that also have VLAN 10. Frames are never copied from VLAN 10 into VLAN 20 unless a routing process does it on purpose.
If a VLAN is not configured on a particular switch, that switch is simply not part of that VLAN's broadcast domain. Devices attached to that switch cannot participate in that VLAN unless the VLAN is explicitly created and the ports are assigned.
Practical Usage Patterns
Network designers often assign VLANs based on function, department, or security level. Some common patterns include:
Separating employees and guests so that guest Wi Fi users cannot directly see internal devices. Staff ports might be in VLAN 10, while guest wireless traffic might be in VLAN 50.
Separating voice and data traffic. IP phones might be placed in a dedicated voice VLAN, often with special treatment by other systems, and user PCs might be kept in a data VLAN.
Separating servers from client devices. Servers can be grouped in one or more server VLANs, so that security policies can be applied more easily at the Layer 3 boundary between client VLANs and server VLANs.
Separating management interfaces of network devices into a dedicated management VLAN, which can be controlled tightly and is not reachable from normal user VLANs without explicit routing rules.
In all these cases, VLANs provide the underlying logical separation. Additional technologies like routing, ACLs, and firewalls then build on top of these VLAN boundaries to enforce traffic rules. Those technologies appear in other chapters, but they rely heavily on clean VLAN design underneath.
VLAN Design Considerations
When planning VLANs, you need to decide how many you need, how large each one should be, and how you will map them to IP networks. It is common for each VLAN to carry one IP subnet, although this is not a strict requirement. Keeping a one to one mapping simplifies troubleshooting and documentation.
You also need to consider the size of each VLAN. Very large VLANs with thousands of devices can still suffer from heavy broadcast traffic. On the other hand, too many small VLANs can make the network complex and hard to manage. There is a balance between segmentation and simplicity.
Naming conventions matter. Using consistent names like USERS_10 or SERVER_30 that embed the VLAN ID can reduce confusion. The exact choice is up to the organization, but clarity is important, especially in multi switch networks.
Finally, you should think about which VLAN will be used for management traffic and which VLANs, if any, should be restricted or dedicated to special uses. For example, some environments reserve a high numbered VLAN for unused ports. Those ports are placed into an isolated VLAN that has no routing and no active devices, which reduces the risk if someone plugs an unauthorized device into an empty wall outlet.
Summary
VLANs let you create multiple logical Layer 2 networks on the same physical switching infrastructure. Each VLAN is a separate broadcast domain, identified by a VLAN ID. Access ports belong to a single VLAN and carry traffic for that VLAN only. Broadcast and unknown frames are confined to the VLAN where they originate.
VLANs make it possible to segment traffic for security, performance, and organizational reasons, and they enable flexible mapping of users and devices across multiple switches. They also form the Layer 2 boundaries on which many higher level designs and security policies depend.