A VLAN, or virtual local area network, is a logical layer 2 network that divides one physical switched infrastructure into separate broadcast domains, so devices on different VLANs behave as if they were connected to different switches even when they share the same hardware. In networking fundamentals, the VLAN is the standard tool for segmenting a LAN by function, department or security level without rewiring.
VLANs are defined by IEEE 802.1Q, which adds a small tag to Ethernet frames carrying a 12-bit VLAN identifier. Switches use that identifier to decide which ports may receive a frame. Traffic between VLANs cannot flow directly at layer 2; it must pass through a router or layer 3 switch, where it can be filtered and controlled.
How 802.1Q tagging separates traffic
An 802.1Q switch keeps a separate MAC address table and flooding scope for each VLAN. When a frame arrives on a port, the switch assigns it to a VLAN, learns its source MAC address within that VLAN, and forwards or floods it only to ports that belong to the same VLAN. A broadcast from one VLAN therefore never reaches devices in another VLAN.
Between switches, frames from many VLANs share one link by carrying a 4-byte 802.1Q tag inserted after the source MAC address. The tag contains a Tag Protocol Identifier of 0x8100, a 3-bit priority code point used for quality of service, a drop eligibility bit and the 12-bit VLAN ID. The table summarizes the key values.
| Element | Size or range | Meaning |
|---|---|---|
| Tag Protocol Identifier | 16 bits, value 0x8100 | Marks the frame as tagged |
| Priority code point | 3 bits, values 0 to 7 | Class of service for QoS |
| VLAN ID | 12 bits | Identifies the VLAN |
| VLAN 0 and 4095 | Reserved | Priority-only tag and implementation use |
| VLAN 1 | Default VLAN | All ports belong to it out of the box |
| Usable range | 1 to 4094 | Normal and extended IDs |
The tag increases the maximum frame size from 1,518 to 1,522 bytes, which all modern switches accept. When providers need more than 4,094 VLANs or must carry customer tags transparently, they stack two tags with 802.1ad (Q-in-Q).
Access ports, trunk ports and the native VLAN
Switch ports are configured in one of two basic modes. An access port belongs to a single VLAN and sends untagged frames, which suits computers, printers and most end devices. A trunk port carries several VLANs with tags and connects switches, routers, hypervisors and wireless access points. The native VLAN on a trunk is the one whose frames travel untagged.
| Port mode | Frames sent | Typical connection |
|---|---|---|
| Access port | Untagged, one VLAN | Desktop, printer, camera |
| Trunk port | Tagged, many VLANs | Switch uplink, router, hypervisor |
| Hybrid port | One untagged plus tagged VLANs | IP phone with a PC behind it |
| Native VLAN on a trunk | Untagged on the trunk | Legacy and management traffic |
VLAN membership is most often port-based, but switches can also assign VLANs dynamically through 802.1X authentication with a RADIUS server, so the same wall socket places an employee laptop in the staff VLAN and an unknown device in a guest VLAN.
VLANs compared with related segmentation methods
A VLAN separates layer 2 broadcast domains, and it usually maps one to one to an IP subnet. That is different from separating physical LANs, from routing between subnets and from overlay technologies used in data centers. The comparison clarifies where VLANs fit among neighboring concepts.
| Approach | Layer | Scale | Typical use |
|---|---|---|---|
| Separate physical LANs | Layer 1 and 2 | Small | Air-gapped or very simple sites |
| VLAN | Layer 2 | Up to 4,094 segments | Enterprise campus and branch |
| IP subnetting | Layer 3 | Flexible | Addressing paired with VLANs |
| VXLAN | Layer 2 over layer 3 | About 16 million segments | Data centers and clouds |
| Private VLAN | Layer 2 | Within one VLAN | Isolating hosts in shared segments |
Designing a VLAN layout
A good VLAN plan follows security and traffic boundaries, not the building floor plan. Each VLAN receives its own subnet, a gateway on a layer 3 device, and an access policy that defines which other VLANs it may reach. Keeping broadcast domains to a few hundred hosts limits the impact of broadcast storms and ARP traffic.
| VLAN purpose | Typical members | Inter-VLAN policy |
|---|---|---|
| Staff | Employee computers | Access to servers and the Internet |
| Voice | IP phones | Priority marking, access to call servers |
| Guest | Visitor Wi-Fi | Internet only |
| IoT | Cameras, sensors, displays | Only to their management system |
| Management | Switch and access point interfaces | Administrators only |
Security pitfalls and common mistakes
VLANs are a segmentation tool, not a firewall. Their isolation is only as strong as the switch configuration and the policy on the device that routes between them. The most common errors are listed below.
- Using VLAN 1 for user or management traffic keeps everything in the default VLAN that every unconfigured port joins.
- Leaving dynamic trunking enabled lets an attacker negotiate a trunk and reach every VLAN, a technique known as switch spoofing.
- Native VLAN matching a user VLAN enables double-tagging attacks; use an unused native VLAN or tag it explicitly.
- Allowing all VLANs on every trunk spreads broadcasts and failures; prune trunks to the VLANs actually needed.
- Routing all VLANs without filtering removes the security benefit of segmentation.
The short version
A VLAN is like putting invisible walls inside one office floor. Everyone uses the same cables and switches, yet the accounting team, the guests and the security cameras each live in their own separate room and cannot overhear each other.
If people from different rooms need to talk, their messages go through a controlled doorway, the router, which decides what is allowed. This makes the network tidier and safer without laying a single new cable.
Where it makes a difference
A secondary school runs one switched network for classroom computers, teacher laptops, student Wi-Fi, IP phones and 60 security cameras. Before segmentation, a malware outbreak on a student laptop scanned and slowed every device, including the camera recorder.
The network administrator creates five VLANs, each with its own subnet: staff, students, voice, cameras and management. Access points tag student and staff Wi-Fi into separate VLANs, and the core layer 3 switch allows students only Internet access, while cameras may reach only the recording server. Unused ports are placed in a parking VLAN with no routing. A later infection on a student device stays confined to the student VLAN, and lessons, phone calls and recordings continue undisturbed.