A VLAN (Virtual Local Area Network) is a custom network created from one or more existing physical local area networks. It enables groups of devices from multiple networks (both wired and wireless) to be combined into one logical network, regardless of their physical location on a network switch.
By default, all ports on a standard, unconfigured network switch belong to the same broadcast domain (VLAN 1). This means if one device sends a broadcast message, every other device on the switch receives it. VLANs allow network administrators to logically segment this switch into multiple, isolated broadcast domains.
Why Are VLANs Used?
VLANs solve many design and scalability challenges in modern network engineering. Their primary benefits include:
- Security: By separating departments (e.g., HR and Guest WiFi), sensitive traffic is isolated. A compromised guest device cannot easily scan or attack the HR network because they are in separate VLANs.
- Performance and Broadcast Control: In large networks, broadcast traffic (like ARP requests) can consume significant bandwidth and CPU resources on end devices. VLANs break large networks into smaller broadcast domains, containing the "noise."
- Logical Grouping: Users can be grouped by function or department rather than physical location. A user moving to a different floor can remain in the exact same VLAN without needing to change physical router interfaces.
- Cost Reduction: Instead of buying separate physical switches for different networks, one large switch can be logically partitioned into many virtual switches.
Core VLAN Concepts
VLAN IDs (Tags)
VLANs are identified by a number between 1 and 4094. VLAN 1 is usually the default, native VLAN on most vendor switches (like Cisco). Devices assigned to VLAN 10 can only communicate with other devices on VLAN 10 natively.
The 802.1Q Standard
When VLAN traffic needs to cross between two switches, the receiving switch needs to know which VLAN a packet belongs to. IEEE 802.1Q is the industry-standard networking protocol used to add a VLAN tag (a 4-byte header) to an Ethernet frame. This tag carries the VLAN ID as it travels across trunk links.
Access Ports vs Trunk Ports
To fully understand VLANs, you must understand port types. For a deeper dive, read Access Port vs Trunk Port.
- Access Port: Connects to an end device (like a PC, printer, or server). The port is assigned to a single VLAN. The end device has no idea it is on a VLAN; the switch strips the VLAN tag before sending the frame to the PC.
- Trunk Port: Connects switches to other switches or to routers. Trunk ports carry traffic for multiple VLANs simultaneously by leaving the 802.1Q tags intact so the receiving device can sort the traffic.
Inter-VLAN Routing
Because VLANs create isolated broadcast domains, devices in VLAN 10 cannot communicate directly with devices in VLAN 20, even if they are plugged into the same switch. To allow communication between different VLANs, a Layer 3 device (a router or a Layer 3 switch) is required. This process is called Inter-VLAN Routing.
Simple Real-World Example
Imagine a small company with three departments: Accounting, Sales, and Guest WiFi. They all share a single 48-port physical switch.
- Ports 1-10 are assigned to VLAN 10 (Accounting).
- Ports 11-30 are assigned to VLAN 20 (Sales).
- Ports 31-40 are assigned to VLAN 30 (Guest).
If a Sales PC on Port 11 sends a broadcast request, only ports 11-30 will receive it. The Accounting PCs will not see the traffic. If a Guest PC tries to ping an Accounting Server, the switch drops the packet entirely unless a router explicitly permits and routes the connection.
Common VLAN Problems and Troubleshooting
When setting up VLANs, several configuration mistakes are common.
1. PC is in the Wrong VLAN
If a user cannot access their department's servers, check the switchport configuration. The port might be accidentally assigned to the default VLAN 1 instead of the intended department VLAN.
2. Missing Trunk Configurations
If VLAN 10 exists on Switch A and Switch B, but PCs on Switch A cannot reach PCs on Switch B, the link connecting the two switches might not be configured as an 802.1Q Trunk. Alternatively, the specific VLAN might be pruned (blocked) from the trunk allowed list.
3. Native VLAN Mismatch
The native VLAN is used for untagged traffic crossing a trunk. If Switch A expects the native VLAN to be 1, and Switch B is configured for native VLAN 99, STP loops and traffic leakage can occur. Always ensure native VLANs match across trunk links. You can read more in our Spanning Tree Protocol (STP) and Advanced VLAN Troubleshooting tutorials.
Quick Summary
- VLANs logically divide a single physical network into multiple isolated virtual networks.
- They improve security, reduce broadcast traffic, and organize networks logically.
- Access ports connect to end-user devices (PCs).
- Trunk ports carry multiple VLANs between switches using 802.1Q tags.
- A Layer 3 router is required for different VLANs to talk to each other.