Skip to content
IT Atlas

Networking · Segmentation

VLANs

Virtual LANs partition one physical switched infrastructure into multiple isolated layer 2 broadcast domains.

IntermediateUpdated 2026-09-01

Overview

A VLAN is a logical broadcast domain. Devices in different VLANs cannot reach each other at layer 2 even when plugged into the same switch; traffic between them must pass through a routed interface, where policy can be applied.

IEEE 802.1Q defines the tag that carries VLAN identity between switches. Access ports usually carry a single untagged VLAN for an end device, while trunk ports carry tagged traffic for many VLANs between switches, hypervisors and firewalls.

How it works

  1. 01Each VLAN is identified by a 12 bit VLAN ID (1, 4094). The 802.1Q tag is inserted into the Ethernet header and includes a priority field used for QoS.
  2. 02Inter VLAN routing is performed by a layer 3 switch (switched virtual interfaces), a router on a stick, or a firewall acting as the default gateway for each VLAN, the last option is preferred when you want inspection between segments.
  3. 03A voice or auxiliary VLAN allows an IP phone and a workstation to share one access port with different tags.
  4. 04802.1X with dynamic VLAN assignment lets the network place a device into a VLAN based on the identity it presents rather than the port it uses.

Why it matters

  • Segmentation shrinks broadcast domains and contains the blast radius of a compromised host.
  • It allows one cabling plant to serve users, servers, voice, management, guest and IoT with different policy.
  • VLAN design directly determines how effective firewall and NAC investments can be.

Security considerations

  • Never leave the native VLAN as VLAN 1 on trunks, and never use the native VLAN for user traffic, because it is the basis of VLAN hopping via double tagging.
  • Disable dynamic trunking protocols on access ports and explicitly configure port mode.
  • VLANs isolate broadcast domains; they are not a security boundary on their own. Pair them with routed ACLs or a firewall and with 802.1X or NAC.
  • Keep switch and firewall management interfaces in a dedicated out of band VLAN.

Common misconfigurations

  • Allowing all VLANs on every trunk instead of pruning to the VLANs a link needs.
  • Mismatched native VLANs at either end of a trunk.
  • Flat 'one big VLAN' campuses that grow past the point where broadcast and failure domains are manageable.
  • Assuming inter VLAN traffic is inspected when a layer 3 switch is routing it without ACLs.

IT vs OT

OT environments use VLANs heavily as well, but segmentation there follows zone and conduit models (IEC 62443) and cannot be changed as freely because process availability outranks change velocity. See OT Atlas.

IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.

Primary sources