Free lesson · Computer Networking
Vlans Virtual Local Area Networks
The Problem VLANs Solve
Imagine a company with 500 employees across three departments: Engineering, Finance, and HR. Without VLANs, all 500 devices are on the same broadcast domain. Every ARP request, every DHCP discover, every network discovery broadcast from any device reaches all 499 other devices. Beyond the performance impact of processing all that broadcast traffic, there is a security problem - an engineer's laptop can reach the finance team's payment processing systems at Layer 2, and a compromised device on the HR network can sniff traffic from engineering workstations.
The old solution was to buy separate physical switches for each department, each connected to the router through a different interface. Engineering gets its own switch, Finance gets its own switch, HR gets its own switch. Three separate broadcast domains, three separate Layer 2 networks, completely isolated from each other.
This works, but it is rigid and wasteful. If the engineering team grows and needs more switch ports, you cannot use the empty ports on the finance switch - you need to buy a new engineering switch. If an employee moves from engineering to finance, the network team has to physically re-cable their connection from one switch to another. And if the same building floor has employees from multiple departments, you need cables from each department's switch running to every floor.
VLANs (Virtual Local Area Networks) solve this by doing in software what separate physical switches do in hardware. A single physical switch can be logically partitioned into multiple virtual switches, each forming its own broadcast domain. Devices on VLAN 10 (Engineering) cannot see broadcast traffic from VLAN 20 (Finance), even though they are plugged into the same physical switch. Moving an employee between departments requires changing a port's VLAN assignment in the switch configuration - no physical re-cabling needed.
The concept is analogous to virtual machines. Just as a single physical server can be partitioned into multiple isolated virtual machines - each with its own operating system, network interface, and resource allocation - a single physical switch can be partitioned into multiple isolated virtual networks. The physical infrastructure is shared, but the logical environments are completely separate. This virtualization approach is one of the most powerful ideas in networking and computing generally, because it decouples logical organization from physical constraints.
How VLANs Work
At the most basic level, a VLAN is a number (the VLAN ID) assigned to each switch port. The switch treats each VLAN as a completely separate network:
- Frames received on a port assigned to VLAN 10 are only forwarded to other ports assigned to VLAN 10
- Broadcast frames on VLAN 10 are only sent to ports on VLAN 10
- Devices on VLAN 10 cannot communicate with devices on VLAN 20 at Layer 2 - they need a router (or Layer 3 switch) to route traffic between VLANs
VLAN IDs are 12-bit numbers, ranging from 0 to 4095. In practice, VLAN 0 and VLAN 4095 are reserved, VLAN 1 is the default VLAN (all ports are on VLAN 1 unless configured otherwise), and VLANs 2-4094 are available for assignment. The 12-bit range provides up to 4,094 usable VLANs per switch - more than enough for all but the very largest enterprise networks.
Port Types: Access Ports vs Trunk Ports
A switch port is configured as either an access port or a trunk port, and understanding the difference is essential to understanding how VLANs work across multiple switches.
Access ports connect to end devices (computers, printers, servers). Each access port is assigned to exactly one VLAN. The end device has no awareness that VLANs exist - it sends and receives normal, untagged Ethernet frames. The switch internally associates all traffic on that port with its assigned VLAN. From the end device's perspective, the network looks exactly the same whether VLANs are configured or not - the VLAN mechanism is entirely transparent to the device sending and receiving data.
This transparency is important for deployment. When a network team implements VLANs, they do not need to reconfigure any end devices. They only need to configure the switches. Every laptop, desktop, server, and printer continues to work exactly as before, unaware that the network has been segmented. The only visible change is which devices they can reach at Layer 2 - devices on the same VLAN remain reachable, while devices on other VLANs become unreachable without routing.
Trunk ports connect switches to other switches (or to routers). A trunk port carries traffic from multiple VLANs simultaneously over a single physical link. To keep the VLANs separate on a shared cable, the switch adds a VLAN tag to each frame as it enters the trunk, identifying which VLAN the frame belongs to. The receiving switch reads the tag, strips it, and delivers the frame to the correct VLAN.
graph TB
subgraph Switch1["Switch 1"]
P1["Port 1<br/>Access: VLAN 10"]
P2["Port 2<br/>Access: VLAN 20"]
P3["Port 3<br/>Access: VLAN 10"]
T1["Port 24<br/>Trunk"]
end
subgraph Switch2["Switch 2"]
T2["Port 24<br/>Trunk"]
P4["Port 1<br/>Access: VLAN 10"]
P5["Port 2<br/>Access: VLAN 20"]
P6["Port 3<br/>Access: VLAN 20"]
end
ENG1["Engineering<br/>Laptop"] --> P1
FIN1["Finance<br/>Desktop"] --> P2
ENG2["Engineering<br/>Desktop"] --> P3
T1 ---|"Trunk Link<br/>Carries VLAN 10 + 20<br/>Tagged Frames"| T2
P4 --> ENG3["Engineering<br/>Laptop"]
P5 --> FIN2["Finance<br/>Desktop"]
P6 --> FIN3["Finance<br/>Laptop"]
style P1 fill:#4f46e5,stroke:#4338ca,color:#fff
style P3 fill:#4f46e5,stroke:#4338ca,color:#fff
style P4 fill:#4f46e5,stroke:#4338ca,color:#fff
style P2 fill:#7c3aed,stroke:#6d28d9,color:#fff
style P5 fill:#7c3aed,stroke:#6d28d9,color:#fff
style P6 fill:#7c3aed,stroke:#6d28d9,color:#fff
style T1 fill:#a78bfa,stroke:#8b5cf6,color:#fff
style T2 fill:#a78bfa,stroke:#8b5cf6,color:#fff
This diagram shows two switches connected by a trunk link. Switch 1 has ports 1 and 3 assigned to VLAN 10 (Engineering) and port 2 assigned to VLAN 20 (Finance). Switch 2 has port 1 on VLAN 10 and ports 2 and 3 on VLAN 20. The trunk link between the switches carries tagged frames from both VLANs. Engineering devices on VLAN 10 can communicate across both switches, and Finance devices on VLAN 20 can communicate across both switches, but VLAN 10 and VLAN 20 traffic remains isolated from each other.
IEEE 802.1Q - VLAN Tagging Standard
The standard for VLAN tagging is IEEE 802.1Q. When a frame crosses a trunk port, the switch inserts a 4-byte 802.1Q tag between the source MAC address and the EtherType field of the Ethernet frame:
| Field | Size | Purpose |
|---|---|---|
| TPID (Tag Protocol Identifier) | 2 bytes | Set to 0x8100, indicating this is an 802.1Q-tagged frame |
| TCI (Tag Control Information) | 2 bytes | Contains the VLAN ID and priority information |
The TCI field is further divided:
- PCP (Priority Code Point): 3 bits - used for Quality of Service (QoS), allowing the switch to prioritize certain types of traffic (e.g., voice traffic over file transfers)
- DEI (Drop Eligible Indicator): 1 bit - indicates whether the frame can be dropped during congestion
- VLAN ID (VID): 12 bits - the VLAN number (0-4095)
The tagged frame is 4 bytes longer than a standard Ethernet frame. When the frame reaches an access port (heading to an end device), the switch strips the 802.1Q tag before forwarding, so the end device receives a normal untagged Ethernet frame and is completely unaware that VLANs exist.
Tip: The 802.1Q tag's EtherType value of 0x8100 is significant. When a switch or network device receives a frame, it reads the EtherType field. If it sees 0x8100 instead of a normal protocol identifier (like 0x0800 for IPv4), it knows the frame is VLAN-tagged and processes the tag accordingly. This is how the presence of a VLAN tag is detected without any out-of-band signaling.
Inter-VLAN Routing - Crossing the VLAN Boundary
VLANs create Layer 2 isolation - devices on different VLANs cannot communicate directly through the switch. But in most networks, some inter-VLAN communication is necessary. The engineering team needs to access shared file servers, the finance team needs to reach the email server, and the HR system needs to communicate with the authentication server.
Inter-VLAN communication requires a Layer 3 device - either a dedicated router or a Layer 3 switch - that can route IP packets between the VLANs.
Router-on-a-stick is a classic configuration where a single router interface is connected to the switch via a trunk port. The router creates sub-interfaces - one per VLAN - each with its own IP address in the VLAN's subnet. When a device on VLAN 10 wants to reach a device on VLAN 20, the frame goes to the router (the default gateway for VLAN 10), the router routes the IP packet from VLAN 10's subnet to VLAN 20's subnet, and sends it back down the trunk to the switch, which delivers it to the correct port on VLAN 20.
Layer 3 switching is the modern alternative and the dominant approach in enterprise networks today. A Layer 3 switch can route between VLANs internally without sending traffic to an external router. This is faster because the routing happens in hardware (using ASICs) rather than in software on a CPU-based router. Most enterprise switches today are Layer 3 capable and can route millions of packets per second between VLANs with negligible additional latency compared to Layer 2 switching.
graph TB
subgraph RouterOnStick["Router-on-a-Stick Configuration"]
R["Router"]
R -->|"Sub-interface .10<br/>IP: 10.0.10.1"| TRUNK
R -->|"Sub-interface .20<br/>IP: 10.0.20.1"| TRUNK
TRUNK["Trunk Link"] --> SW["Switch"]
SW -->|"VLAN 10"| V10["Engineering<br/>10.0.10.0/24"]
SW -->|"VLAN 20"| V20["Finance<br/>10.0.20.0/24"]
end
style R fill:#4f46e5,stroke:#4338ca,color:#fff
style TRUNK fill:#a78bfa,stroke:#8b5cf6,color:#fff
style SW fill:#7c3aed,stroke:#6d28d9,color:#fff
style V10 fill:#8b5cf6,stroke:#7c3aed,color:#fff
style V20 fill:#8b5cf6,stroke:#7c3aed,color:#fff
This diagram shows a router-on-a-stick configuration. A single router connects to a switch via a trunk link. The router has two sub-interfaces: sub-interface .10 with IP address 10.0.10.1 for VLAN 10 (Engineering subnet 10.0.10.0/24), and sub-interface .20 with IP address 10.0.20.1 for VLAN 20 (Finance subnet 10.0.20.0/24). When a device on VLAN 10 needs to reach a device on VLAN 20, the traffic goes up to the router, gets routed between subnets, and comes back down the trunk to the correct VLAN.
VLANs in the Data Center and Cloud
VLANs are used extensively in enterprise networks and data centers for traffic isolation, security zoning, and organizational segmentation. Common use cases include:
Server farm segmentation. Web servers, application servers, and database servers are placed on separate VLANs. The web server VLAN can reach the application server VLAN, and the application server VLAN can reach the database VLAN, but the web server VLAN cannot reach the database VLAN directly. This limits the blast radius of a security breach.
Guest network isolation. A company provides Wi-Fi to visitors, but guest traffic is on a separate VLAN from the corporate network. The guest VLAN routes directly to the internet and has no access to internal resources.
Multi-tenant environments. A hosting provider uses VLANs to isolate different customers sharing the same physical infrastructure. Each customer gets their own VLAN, preventing one customer's traffic from reaching another's.
In cloud environments, VLANs are the underlying mechanism behind many virtual networking features. AWS VPCs, Azure VNets, and GCP VPC networks all use VLAN-like segmentation (often combined with more sophisticated overlay technologies like VXLAN) to provide network isolation between customers. The 4,094-VLAN limit of 802.1Q is one reason why cloud providers use overlay technologies - they need millions of isolated networks for millions of customers, far more than 4,094.
VXLAN (Virtual Extensible LAN) extends the VLAN concept by using a 24-bit identifier (supporting over 16 million virtual networks) and encapsulating Layer 2 frames inside UDP packets for transport across Layer 3 networks. VXLAN is the backbone of most modern cloud and data center network virtualization, and it exists specifically because the 12-bit VLAN ID space was too small for large-scale multi-tenant environments.
VLAN Security Considerations
VLANs provide Layer 2 isolation, but they are not a complete security solution on their own. Several attack vectors target VLAN implementations:
VLAN hopping is an attack where a malicious device sends frames with forged 802.1Q tags, attempting to reach a VLAN it is not assigned to. There are two main techniques: switch spoofing (the attacker pretends to be a switch and negotiates a trunk link) and double tagging (the attacker sends a frame with two 802.1Q tags - the first tag is stripped by the first switch, exposing the second tag which routes the frame to a different VLAN). Both attacks are preventable through proper switch configuration - disabling dynamic trunking on access ports and explicitly configuring trunk ports rather than relying on auto-negotiation.
Best practices for VLAN security include: assigning all unused switch ports to an unused VLAN (sometimes called a "black hole VLAN") so that unattended ports cannot be exploited, explicitly configuring trunk ports with a list of allowed VLANs rather than allowing all VLANs, changing the native VLAN from the default VLAN 1 to a dedicated VLAN that carries no user traffic, and pairing VLAN segmentation with Layer 3 access control lists (ACLs) on the router or Layer 3 switch to enforce inter-VLAN traffic policies.
VLANs should be thought of as a network organization and performance tool first, and a security boundary second. For strong isolation, VLANs must be combined with firewall rules, access control lists, and potentially physical separation for the most sensitive network segments.
Interview: VLANs appear in System Design discussions whenever the conversation touches network security, isolation, or segmentation:
"How would you isolate production traffic from development traffic?" - VLANs (or cloud VPC equivalents) are the standard Layer 2 answer. Combined with firewall rules at Layer 3, they provide defense in depth.
"How does a cloud provider isolate one customer's network from another?" - The foundational technology is VLAN-style segmentation, extended by overlay networks like VXLAN that scale beyond the 4,094-VLAN limit.
"Why can't this device reach that device?" - In troubleshooting scenarios, VLAN misconfiguration (device on the wrong VLAN, trunk port not carrying the right VLANs) is one of the most common causes of Layer 2 connectivity failures.
What Comes Next
The next topic covers ARP (Address Resolution Protocol) - the protocol that bridges Layer 2 and Layer 3 by translating IP addresses into MAC addresses. ARP operates within a single VLAN, and understanding VLANs helps explain why ARP requests only reach devices in the same broadcast domain.
Exercise: Starter: Look at your home router's admin interface (usually at 192.168.0.1 or 192.168.1.1 in a browser). Does your router support VLANs? Many consumer routers create a separate "Guest Wi-Fi" network - this is often implemented as a separate VLAN. Check if the guest network has a different IP subnet from your main network.
Intermediate: Design a VLAN scheme for a small company with three departments (Engineering, Sales, Operations) across two office floors. Each floor has one switch. How many VLANs do you need? How many trunk links? What IP subnets would you assign? Where would you place the router or Layer 3 switch for inter-VLAN routing?
Advanced: Research the 4,094-VLAN limit of 802.1Q and how VXLAN overcomes it. VXLAN uses a 24-bit VNID (VXLAN Network Identifier) instead of a 12-bit VLAN ID. How does VXLAN encapsulation work - what does the frame look like as it travels across the network? Why does VXLAN use UDP as its transport, and what are the MTU implications of adding VXLAN headers to already-full Ethernet frames?