What a VLAN is
A VLAN (Virtual LAN) divides a switched Ethernet infrastructure into logical Layer 2 domains. Two ports on the same physical switch can behave as if they belong to different Ethernet networks, while ports on different switches can belong to the same VLAN when an appropriate transport exists between them.
A VLAN is not the same thing as an IP subnet, although many designs use a one-to-one relationship: one user VLAN has one IP subnet and one default gateway. The VLAN defines a Layer 2 broadcast boundary; the subnet defines a Layer 3 addressing boundary.
Why use VLANs
Without VLANs, a switched LAN may become one large Layer 2 domain. VLANs let an organization separate users, servers, voice, wireless guests, management traffic, or other functions without requiring a physically separate switch for every group.
This improves organization and limits the scope of broadcasts. It can also make policy enforcement easier because traffic that must cross from one VLAN to another goes through a Layer 3 boundary where routing, ACLs, or firewall rules can be applied.
VLANs are therefore a segmentation tool, not a complete security system. A secure design still needs correct access control, authentication, endpoint protection, and hardening of the switching infrastructure.
VLANs and broadcast domains
Broadcast traffic such as an ARP request is replicated only within the VLAN where it originated. A host in VLAN 10 does not receive a Layer 2 broadcast from VLAN 20 simply because both hosts are connected to the same chassis.
This behavior is one of the most important differences between physical topology and logical topology. The cabling may form one interconnected switching fabric while the VLAN configuration creates several independent Layer 2 domains on top of it.
VLAN IDs and the 802.1Q identifier space
IEEE 802.1Q carries VLAN identification information in a tag that includes a 12-bit VLAN Identifier (VID). This provides a large identifier space, although some values are reserved and platform support or operational conventions may further limit what is normally used.
The number is only an identifier. VLAN 20 is not inherently more secure or more important than VLAN 10. Consistent naming, documentation, and mapping between VLAN IDs and IP prefixes are what make the design understandable.
Access ports
An access port normally connects an endpoint and associates that untagged access traffic with one VLAN. A workstation can therefore send ordinary Ethernet frames without knowing which VLAN number the switch uses internally.
The switch applies the configured VLAN context when frames enter and removes or adds tagging as required when traffic leaves through other types of interfaces. A wrong access-VLAN assignment is a common cause of a host receiving an unexpected DHCP scope, failing to reach its expected gateway, or appearing inside the wrong security zone.
Trunks carry several VLANs
When multiple VLANs must cross one physical link between switches, routers, hypervisors, or access points, the link is commonly configured as an 802.1Q trunk. The VLAN tag lets the receiving device know which logical Layer 2 domain each frame belongs to.
A trunk does not mean every VLAN must be present. Operational designs should restrict the allowed VLAN list to what is actually required on that link and keep both ends consistent.
The native VLAN
802.1Q deployments may define a native VLAN whose traffic can be sent untagged on a trunk according to the platform configuration. A native-VLAN mismatch can create confusing connectivity and security problems because each end may interpret untagged frames differently.
Do not treat the native VLAN as a magic management network. It is an operational property of the trunk and should be configured deliberately, consistently, and according to the platform's security guidance.
Inter-VLAN routing
Hosts in different VLANs cannot communicate by Layer 2 switching alone. They send traffic to a default gateway, and a router or multilayer switch forwards the packet between IP subnets. The dedicated inter-VLAN routing guide covers router-on-a-stick, switched virtual interfaces, routed links, relay functions, and policy points.
This is why VLAN and subnet design are normally planned together. If VLAN 10 uses one prefix and VLAN 20 uses another, the gateway architecture must provide Layer 3 reachability where communication is intended.
Designing VLANs
A useful VLAN design reflects operational boundaries rather than creating arbitrary segments. Consider broadcast scope, security zones, user or device roles, voice, wireless, management, failure domains, and the locations where Layer 3 policy should be enforced.
Too few VLANs can create overly large broadcast and security domains. Too many can increase operational complexity, trunk configuration, gateway interfaces, ACLs, DHCP scopes, and troubleshooting overhead. The goal is controlled segmentation that remains understandable.
VLANs are segmentation, not complete isolation
A VLAN limits Layer 2 broadcast propagation and creates a useful boundary, but it does not automatically enforce every security requirement. Once traffic is routed between VLANs, policy must decide what is allowed. Incorrect trunking, native-VLAN configuration, unused ports, and other Layer 2 weaknesses can also undermine the design.
Use VLANs as one layer in a larger architecture that includes access control, authentication, device hardening, monitoring, and appropriate Layer 3 or firewall policy.
Common VLAN troubleshooting problems
When a host appears isolated, verify the access VLAN first. Then trace the path toward the gateway and any trunk that must carry the VLAN. Check that the VLAN exists on the relevant devices, that the trunk allows it, and that native-VLAN expectations match.
- Wrong access VLAN on the endpoint port.
- VLAN missing or inactive on part of the switching path.
- VLAN pruned or omitted from an allowed list.
- Native-VLAN mismatch.
- Correct Layer 2 segmentation but missing inter-VLAN routing.
- Gateway, DHCP, or policy configured for the wrong subnet.
What to study after VLANs
Continue with 802.1Q trunks to understand how several VLANs share a link. Then study STP/RSTP for loop prevention, EtherChannel and LACP for link aggregation, and inter-VLAN routing for Layer 3 communication between the segments you created.