What Is a VLAN? Virtual Local Area Network Explained

VLANs logically segment a physical network without extra hardware. Learn the difference between a hub and a switch, how VLAN tagging works, and why VLANs are essential for network security.

Hubs, Switches, and the Problem VLANs Solve

To understand VLANs, you first need to understand the evolution from hubs to switches.

The Hub (Legacy)

A hub is a simple repeater: any signal received on one port-the-internets-core-protocol)-and-UDP-ports-explained) is broadcast-address-resolution-protocol-explained) to all other ports. Every device on a hub sees every frame — there is zero privacy, and collisions are frequent. Hubs are essentially obsolete.

The Switch

A switch is smarter. It maintains a MAC address-address-resolution-protocol-explained) table and sends each Ethernet frame only to the port-the-internets-core-protocol)-and-UDP-ports-explained) where the destination device is connected. This eliminates collisions and improves performance dramatically.

However, a standard switch still treats all devices on it as part of one broadcast-address-resolution-protocol-explained) domain-kerberos-directory-services-explained) — ARP requests, DHCP, and other broadcasts are sent to every port-the-internets-core-protocol)-and-UDP-ports-explained).

The Problem

You have Finance (sensitive data), Engineering (test systems), and Guest Wi-Fi (untrusted users) — all physically plugged into the same switches. Finance computers can broadcast-address-resolution-protocol-explained) and be reached by Engineering or Guests. This is a security risk.

VLANs solve this by creating multiple logical networks on the same physical switch infrastructure.

What Is a VLAN?

A VLAN (Virtual Local Area Network) is a logical subdivision of a network created in software — it groups switch ports together as if they were on a separate physical switch, even if they are spread across multiple switches.

Physical reality:
Switch with 48 ports — all physically connected

Logical VLANs:
VLAN 10 (Finance):      Ports 1, 5, 9, 17
VLAN 20 (Engineering):  Ports 2, 3, 4, 10, 11
VLAN 30 (Guests):       Ports 40, 41, 42

Devices in VLAN 10 cannot communicate with devices in VLAN 20 at Layer 2-address-resolution-protocol-explained) — they are in completely separate broadcast-explained) domains, as if they were on separate physical switches.

Access Ports and Trunk Ports

Switch ports operate in two modes:

Access Port

  • Belongs to a single VLAN
  • End devices (computers, printers, IP phones) connect to access ports
  • The device does not know it is on a VLAN — the switch handles everything transparently
  • Frames on access ports carry no VLAN tag

Trunk Port

  • Carries traffic for multiple VLANs simultaneously
  • Used to connect switches together, or a switch to a router-network-address-translation-explained)
  • Each frame is tagged with a VLAN ID so the receiving device knows which VLAN it belongs to
  • Uses the IEEE 802.1Q standard for tagging
[Switch A] ──── trunk port ────> [Switch B]
               (carries VLAN 10 + 20 + 30 tagged frames)

IEEE 802.1Q VLAN Tagging

802.1Q inserts a 4-byte tag into the Ethernet frame header containing:

  • EtherType 0x8100: Signals this is an 802.1Q tagged frame
  • PCP (Priority Code Point): Quality of Service priority (0 to 7)
  • DEI (Drop Eligible Indicator): Whether frame can be dropped under congestion
  • VLAN ID: 0 to 4094 (0 and 4095 are reserved; 1 is often the default native VLAN)

The VLAN ID is a 12-bit field, allowing up to 4,094 VLANs on a single network.

Native VLAN

On a trunk port-the-internets-core-protocol)-and-UDP-ports-explained), the native VLAN is the VLAN whose traffic is sent untagged. By default, this is VLAN 1 on most switches.

Security risk: If two switches have different native VLAN configurations, frames can jump from one VLAN to another — this is called VLAN hopping. Best practice: change the native VLAN to an unused VLAN and explicitly tag all traffic.

Inter-VLAN Routing

VLANs separate Layer 2-address-resolution-protocol-explained) broadcast-explained) domains, but devices in different VLANs cannot communicate by default. To enable communication between VLANs, you need a Layer 3 device (router-network-address-translation-explained) or Layer 3 switch):

Router-on-a-Stick

One router-network-address-translation-explained) interface connected to a trunk port-the-internets-core-protocol)-and-UDP-ports-explained) with sub-interfaces for each VLAN:

Switch ──── trunk ──────> Router
                          - Sub-interface for VLAN 10 (192.168.10.1)
                          - Sub-interface for VLAN 20 (192.168.20.1)
                          - Sub-interface for VLAN 30 (192.168.30.1)

Layer 3 Switch (SVI)

A managed Layer 3 switch can route between VLANs internally using Switched Virtual Interfaces (SVIs) without a separate router-network-address-translation-explained). [firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) can be applied at the inter-VLAN [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) point to control which VLANs can talk to each other.

VLANs and Security

VLANs are a foundational security control:

| Security benefit | How VLANs help | |---|---| | Isolation | Compromised device in Guest VLAN cannot reach Finance VLAN | | Contain broadcasts | ARP storms and broadcast-explained) floods stay within the VLAN | | regulatory [compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained)](/learning-center/gdpr-hipaa-pci-dss-cybersecurity-the-internets-core-protocol)-the-backbone-of-reliable-internet-communication)-compliance-frameworks-explained) | PCI DSS requires cardholder data to be on an isolated network segment | | DMZ implementation | Public-facing servers in a dedicated VLAN with strict [firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) | | IoT isolation | Smart TVs, cameras, printers on a separate VLAN from workstations |

Important: VLANs alone are not a security boundary — they are a network segmentation tool. Security requires [firewall rules](/learning-center/what-is-a-firewall-and-how-does-it-protect-your-network) at the inter-VLAN [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) point to enforce what traffic is allowed between segments.

VLAN Hopping Attacks

Switch Spoofing: An attacker device negotiates a trunk link with the switch using DTP (Dynamic Trunking protocol), gaining access to all VLANs. Defence: disable DTP on all access ports.

Double Tagging: An attacker sends a frame with two 802.1Q tags. The outer tag matches the native VLAN and is stripped by the first switch; the inner tag causes the frame to be forwarded to a different VLAN. Defence: change the native VLAN to unused and disable double-tagging.

Practical VLAN Design

A simple, secure VLAN design for a small office:

| VLAN ID | Name | subnet-subnets-and-CIDR-explained) | Purpose | |---|---|---|---| | 10 | Management | 10.0.10.0/24 | Network devices (switches, APs) | | 20 | Servers | 10.0.20.0/24 | Internal servers | | 30 | Workstations | 10.0.30.0/24 | Employee computers | | 40 | IoT | 10.0.40.0/24 | Printers, cameras, smart devices | | 50 | Guests | 10.0.50.0/24 | Visitor Wi-Fi (internet only) | | 99 | Native | (unused) | Trunk native (no traffic) |

Summary

  • VLANs logically segment a physical network into isolated broadcast-address-resolution-protocol-explained) domains
  • Access ports carry traffic for one VLAN; trunk ports carry multiple VLANs tagged with 802.1Q
  • VLANs require a Layer 3 device for inter-VLAN communication
  • They are essential for security, compliance-PCI-DSS-cybersecurity-compliance-frameworks-explained), and network performance
  • VLAN hopping attacks exploit DTP and double tagging — disable DTP and change the native VLAN