A VLAN (virtual LAN) is a logical network created on a switch that splits one physical switch into separate broadcast domains, grouping devices regardless of where they physically connect. It works at layer 2: each port is assigned a VLAN number, and frames carry that number as an IEEE 802.1Q tag so the switch keeps each VLAN’s traffic isolated. Devices in different VLANs cannot talk to each other without a router or layer-3 switch, which is exactly what gives VLANs their security and broadcast-control benefits. A VLAN is almost always paired one-to-one with a subnet, the layer-3 equivalent of the same separation.
What Is a VLAN?
A VLAN is a logical subdivision of a physical network that groups devices into separate broadcast domains, regardless of where the devices physically connect. One physical switch can carry several VLANs at once, and each behaves like its own isolated layer-2 network. The defining traits of a VLAN are:
- Logical grouping: devices join a network by configuration, not by which cable or switch they plug into.
- Separate broadcast domains: a broadcast stays inside its VLAN instead of reaching every device on the switch.
- Location independence: devices on different switches can share one VLAN when the switches are trunked together.
- A VLAN identifier: each VLAN gets a number (the VLAN ID) that switches use to keep its traffic separate.
A VLAN runs on the network switch that connects devices within a local network. Because each VLAN is its own broadcast domain, devices in different VLANs reach each other only through a router or layer-3 switch, the same way separate physical networks would.
How Do VLANs Work?
VLANs work by assigning switch ports to VLAN numbers and tagging frames with those numbers under the IEEE 802.1Q standard, so the switch keeps each VLAN’s traffic separate. The standard inserts a four-byte (32-bit) tag into the Ethernet frame header, and within it a 12-bit VLAN ID field marks which VLAN the frame belongs to. The mechanisms are:
- Switch port assignment: each port is placed into a VLAN, so any device on that port joins that VLAN.
- 802.1Q tagging: a VLAN ID is added to the frame header so other switches know which VLAN it belongs to.
- Broadcast containment: broadcasts stay inside their VLAN rather than flooding the whole switch.
- Inter-VLAN routing: a router or layer-3 switch is required to move traffic between separate VLANs.
Of the 4096 values the 12-bit field allows, IDs 0 and 4095 are reserved, leaving 4094 usable VLAN IDs (1 to 4094) per switching domain. Traffic that needs to cross from one VLAN to another follows the routed path described in the overview of a computer network.
What Is the Difference Between Access and Trunk Ports?
An access port carries a single VLAN to one end device and sends untagged frames; a trunk port carries many VLANs between switches and tags every frame except the native VLAN. Every switch port is configured as one or the other.
- An access port belongs to one VLAN. It connects a single end device such as a computer, printer, or access point, and the device never sees a VLAN tag.
- An access port sends and receives untagged frames. The switch adds the device to its VLAN internally, so the endpoint does not need to know VLANs exist.
- A trunk port carries multiple VLANs. It links switches to each other or to a router, passing traffic for many VLANs over one physical cable.
- A trunk tags each frame with its 802.1Q VLAN ID. The one exception is the native VLAN, whose frames cross the trunk untagged, which is why designs move it off the default VLAN 1.
This is how 802.1Q keeps VLAN traffic separate on a shared link: an access port hides the VLAN from the device, while a trunk preserves the VLAN ID in the tag so a single cable can carry many VLANs without mixing them.
What Are the Benefits of VLANs?
VLANs deliver segmentation, security isolation, broadcast control, and flexible design without adding physical hardware. Dividing one switch into isolated logical networks gives the advantages of separate networks on shared equipment. The main benefits are:
- Segmentation: groups of devices are separated into isolated logical networks on one switch.
- Security isolation: a device in one VLAN cannot directly reach another without passing through a router, where traffic can be filtered.
- Broadcast control: broadcasts are confined to each VLAN, so fewer devices process each broadcast frame and performance improves.
- Flexibility: administrators regroup devices logically without rewiring the physical network.
Containing broadcast traffic raises performance on busy networks, while the isolation between VLANs adds a security boundary covered in more depth in the overview of network security. Crossing that boundary requires a router, which is where access control can be enforced.
What Are Common VLAN Use Cases?
VLANs are most often used to separate guest, IoT, voice, and management traffic, each placed in its own segment by trust level or function. The same isolation a physical network would provide is applied logically on shared switches.
Departments such as finance and engineering are commonly separated the same way. Isolating guest and IoT devices in their own VLANs limits how far a compromised device can reach, keeping it away from sensitive internal systems.
What Is the Difference Between a VLAN and a Subnet?
A VLAN is layer-2 segmentation defined on a switch, while a subnet is a layer-3 range of IP addresses, and the two are usually paired one-to-one. A VLAN separates traffic at the switch level by VLAN tag; a subnet groups addresses at the IP level behind a subnet mask. They are different layers solving the same separation problem. The differences are:
- A VLAN operates at layer 2, separating broadcast domains on a switch by VLAN ID.
- A subnet operates at layer 3, grouping a range of IP addresses defined by a subnet mask.
- A VLAN and a subnet are commonly mapped one-to-one, with each VLAN carrying exactly one subnet.
- Routing between subnets is the same operation as routing between VLANs: both need a router or layer-3 switch.
| Attribute | VLAN | Subnet |
|---|---|---|
| OSI layer | Layer 2 (data link) | Layer 3 (network) |
| Defined by | Switch configuration and 802.1Q tag | IP address range and subnet mask |
| Separates | Broadcast domains | IP address groups |
| Crossing requires | A router or layer-3 switch | A router or layer-3 switch |
What Are the Types of VLANs?
Common VLAN types are the default VLAN, data VLANs, voice VLANs, management VLANs, and the native VLAN, each serving a specific role on a switch. A VLAN type describes the kind of traffic it carries:
- The default VLAN is VLAN 1, the VLAN every switch port belongs to until it is reassigned.
- A data VLAN carries ordinary user traffic such as files and web requests.
- A voice VLAN carries IP phone traffic separately, usually with priority over data.
- A management VLAN isolates the traffic used to administer the switches themselves.
- The native VLAN carries the untagged frames on a trunk port under the 802.1Q standard.
The native VLAN handles any untagged frame that arrives on a trunk, which is why designs change it away from the default VLAN 1 for security. A management VLAN keeps administrative access to the switch separate from user data.
What Are the Security Considerations for VLANs?
A VLAN isolates traffic only when configured correctly; the main risks are VLAN hopping, an exposed default VLAN, and over-permissive trunk ports. Misconfiguration can let traffic cross a boundary that should hold. The key considerations are:
- VLAN hopping: crafted frames exploit trunk misconfiguration to reach a VLAN the attacker should not access.
- Default VLAN risk: leaving management and user traffic together on VLAN 1 removes a layer of separation.
- Trunk restriction: each trunk should carry only the VLANs it must, not every VLAN by default.
- Disable unused ports: an inactive port left enabled lets an attacker plug into a live VLAN.
Because VLAN hopping targets trunk misconfiguration, administrators prune trunks to the needed VLANs and move sensitive traffic off the default VLAN. Crossing between VLANs still requires a router, which is the right place to apply filtering and access control.
Last Thoughts on VLANs
A VLAN is logical layer-2 segmentation that turns one physical switch into separate broadcast domains, grouping devices by configuration rather than by cabling. It works through switch port assignment and IEEE 802.1Q tagging, with access ports carrying a single VLAN to a device and trunk ports carrying many between switches. Because each VLAN is its own broadcast domain, devices in different VLANs communicate only through a router or layer-3 switch, which is what delivers the security isolation and broadcast control VLANs are valued for.
In practice a VLAN is paired one-to-one with a subnet, so the layer-2 boundary and the layer-3 address range line up, and the common deployments are guest, IoT, voice, and management segments. The hub on what a computer network is connects VLANs to switching, routing, and the wider set of networking concepts.
Key Takeaways:
- A VLAN is logical layer-2 segmentation that splits one physical switch into separate broadcast domains.
- It works through switch port assignment and IEEE 802.1Q frame tagging, with a 12-bit ID giving 4094 usable VLANs.
- An access port carries one VLAN as untagged frames; a trunk port carries many and tags each except the native VLAN.
- VLANs provide segmentation, security isolation, and broadcast control without adding physical hardware.
- Common uses are guest, IoT, voice, and management VLANs, plus separating departments.
- A VLAN is layer-2 and a subnet is layer-3, and the two are usually paired one-to-one.
Frequently Asked Questions (FAQs)
What is a VLAN in simple terms?
A VLAN, or virtual LAN, is a logical network created on a switch that groups devices into a separate broadcast domain, no matter where they physically plug in. It lets one physical switch act as several independent networks, so traffic in one VLAN stays isolated from the others.
How does a VLAN work?
A VLAN works by assigning switch ports to a VLAN number and tagging frames with that number under the IEEE 802.1Q standard. The switch keeps each VLAN’s traffic separate, and a router or layer-3 switch is needed for devices in different VLANs to communicate.
What is the difference between an access port and a trunk port?
An access port belongs to a single VLAN and carries untagged frames to one end device, such as a computer or printer. A trunk port carries traffic for multiple VLANs between switches and adds an 802.1Q tag to every frame except the native VLAN, so each frame’s VLAN is preserved across the link.
How many VLANs can you have?
The 802.1Q tag uses a 12-bit VLAN ID field, which allows values 0 to 4095. IDs 0 and 4095 are reserved, leaving 4094 usable VLAN IDs (1 to 4094) per switching domain.
What is the difference between a VLAN and a subnet?
A VLAN is layer-2 segmentation defined on a switch, while a subnet is a layer-3 range of IP addresses. They are different layers solving the same separation, so networks usually pair them one-to-one, with each VLAN carrying its own subnet.
Do VLANs improve security?
Yes. Putting devices in separate VLANs means one VLAN cannot reach another without passing through a router, where filtering can be applied. This isolation is widely used to keep guest, IoT, and voice devices away from sensitive internal systems, though trunk ports must be locked down to prevent VLAN hopping.
