# VLAN

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/vlan

## Quick definition

A VLAN lets you split a large physical network into smaller, separate virtual networks. Devices on the same VLAN can talk to each other directly, but traffic between different VLANs must go through a router. This improves security, reduces congestion, and makes network management easier.

## Simple meaning

Imagine you work in a large office building with many different teams: sales, engineering, HR, and IT. Everyone sits in different parts of the building, but you want each team to be able to talk to each other easily without hearing conversations from other teams. You could physically move everyone into separate rooms, but that would be expensive and disrupt work. Instead, you use a clever system: you give each team a special headset that only picks up signals from other headsets in the same team. So the sales team hears only sales, engineering hears only engineering, and so on. That headset system is like a VLAN.

In the computer world, a VLAN is a way to group computers and devices together logically, even if they are plugged into different parts of the physical network. Instead of rewiring cables, you configure the network switches to treat certain ports as being in the same group. Traffic from one VLAN never leaks into another VLAN unless you specifically allow it with a router or a firewall. This is very useful because it lets you separate different types of traffic without buying separate hardware for each group.

For example, a school might put all student computers on one VLAN and all teacher computers on another. Students cannot see the teacher network, and teachers cannot accidentally mess with student data. If you need to add a new computer to the student group, you just configure the switch port it plugs into to be part of the student VLAN, no matter where in the building that port is located. This flexibility is the big advantage of VLANs over physically separate networks.

VLANs also help reduce network congestion. When a device sends a broadcast message (like asking "who has this IP address?"), that broadcast goes only to other devices on the same VLAN, not to the entire network. This keeps the network faster and more efficient. So VLANs are a fundamental tool for making modern networks secure, organized, and scalable.

## Technical definition

A VLAN is a Layer 2 (data link layer) construct that partitions a physical Ethernet network into multiple logical broadcast domains. In a standard switched network without VLANs, all ports on a switch belong to a single broadcast domain. Any device sending a broadcast frame will have that frame flooded to every port on the switch, consuming bandwidth and processing cycles. VLANs solve this by assigning each switch port to a specific VLAN ID. The switch then only forwards broadcast traffic among ports that share the same VLAN ID. Unicast and multicast traffic are also limited: a switch will only forward frames to ports that are members of the VLAN of the source device.

VLANs are defined by the IEEE 802.1Q standard, which inserts a 4-byte tag into the Ethernet frame header. The tag contains a 12-bit VLAN ID, allowing for up to 4094 usable VLANs (VLANs 0 and 4095 are reserved). This tag is inserted by the switch when a frame enters an access port (a port configured for a specific VLAN) and is removed when the frame leaves an access port. Trunk ports, on the other hand, carry traffic for multiple VLANs and keep the 802.1Q tag intact as the frame travels between switches. The native VLAN on a trunk port is an exception: frames on the native VLAN are sent untagged, allowing compatibility with devices that do not understand 802.1Q.

There are several types of VLANs based on assignment method. Port-based VLANs are the most common: each switch port is statically assigned to a VLAN. MAC-based VLANs assign membership based on the source MAC address of the connected device. Protocol-based VLANs group traffic by the Layer 3 protocol (e.g., IPv4 vs IPv6). Finally, 802.1X authentication can dynamically assign a VLAN after a user or device is authenticated. In enterprise networks, VLANs are often used to segment departments, isolate guest Wi-Fi traffic, separate management traffic from user data, or create separate networks for voice over IP (VoIP) traffic.

For inter-VLAN communication, a Layer 3 device (router or multilayer switch) is required. When a device on VLAN 10 wants to send traffic to a device on VLAN 20, it must send the frame to its default gateway, which is the IP address of the router interface on VLAN 10. The router then forwards the packet out its interface on VLAN 20. On modern networks, this is commonly done using a router-on-a-stick configuration, where a single physical trunk link connects the switch to the router, and the router uses subinterfaces, each configured with an IP address in the respective VLAN subnet. Alternatively, a multilayer switch can perform inter-VLAN routing internally using switched virtual interfaces (SVIs), which are virtual Layer 3 interfaces bound to a VLAN.

VLANs are fundamental to network design practices such as the hierarchical campus network model, where access layer switches assign users to VLANs, distribution layer switches aggregate VLANs and provide routing, and the core layer provides high-speed connectivity. Proper VLAN planning, including consistent VLAN numbering across the network, avoiding VLAN 1 for user traffic, and using private VLANs for further isolation within a VLAN, is a critical skill for network engineers. In the context of certification exams, CCNA and Network+ devote significant coverage to VLAN operation, configuration, and troubleshooting.

## Real-life example

Think of a large apartment building. The building has a single main entrance and a central hallway that runs through every floor. Each apartment is a separate unit with its own door. Without VLANs, the building would be like a giant open floor plan where everyone shares the same hallway and can hear every conversation through every door. That would be chaotic and unsafe.

Now imagine the apartment building installs a special intercom system. Each apartment is assigned a group number: all apartments on floor 2 get group 2, floor 3 gets group 3, and so on. When you use the intercom to call someone, you can only call apartments in your same group, unless you use a special operator (the router). That intercom group is like a VLAN. It creates virtual boundaries within the same physical building.

In your home, this is similar to having a guest Wi-Fi network. Your main home devices (laptops, phones, smart TV) are on one VLAN, and your guest devices are on another. Guests can access the internet but cannot see your personal files or printer. The router acts as the border between the two VLANs, allowing only the minimum traffic needed. This keeps your home network secure without running separate cables.

At a university, the library might have hundreds of computers in the same room. Each computer is physically close to the others, but the network is configured so that student computers are on one VLAN and faculty computers are on another. A student trying to connect to a faculty printer would fail, because the printer is in a different VLAN. The network administrator can manage all these groups from a central console instead of rewiring anything.

Finally, in a data center, VLANs are crucial for multi-tenant environments. Each customer’s servers are on their own VLAN, even if they are on the same physical switch. This ensures complete isolation, which is essential for security and compliance. The VLAN acts like a virtual fence that cannot be crossed without explicit permission.

## Why it matters

VLANs are a cornerstone of modern network design because they solve several real-world problems. First, they improve security by isolating sensitive systems. For example, a hospital’s patient records system can be on a separate VLAN from the public Wi-Fi, so even if a guest device is compromised, the attacker cannot reach the medical database. Without VLANs, you would need separate physical switches and cabling for each security zone, which is expensive and inflexible.

Second, VLANs reduce network congestion by limiting broadcast traffic. In a flat network with hundreds of devices, broadcast storms can bring everything to a halt. VLANs break the network into smaller broadcast domains, so a broadcast from one department does not affect another. This is especially important for voice and video traffic, which are sensitive to delays.

Third, VLANs simplify moves, adds, and changes. When an employee moves to a different floor, the network admin only needs to change the VLAN assignment on the switch port, not re-cable the wall jack. This saves time and reduces errors.

Finally, VLANs enable network virtualization, which is essential for cloud computing and SDN (Software-Defined Networking). In a virtualized environment, virtual machines (VMs) can be placed on different VLANs to segregate traffic, even if they run on the same physical host. Understanding VLANs is therefore vital for anyone working with hybrid cloud, virtualized data centers, or enterprise network infrastructure.

## Why it matters in exams

For the CCNA exam, VLANs are a core topic. You must understand how to configure VLANs on Cisco switches, how to assign ports to VLANs, how to configure trunk ports with 802.1Q, and how to troubleshoot common issues like VLAN mismatch or native VLAN mismatch. CCNA questions often present a topology and ask you to identify why two devices cannot communicate, with the answer being that they are on different VLANs or that the trunk is misconfigured. Inter-VLAN routing using router-on-a-stick or multilayer switches is also heavily tested.

For Network+, VLANs appear in the networking fundamentals and network implementation domains. You need to know the difference between access and trunk ports, the purpose of the 802.1Q standard, and how VLANs affect broadcast domains. Questions might ask you to identify the correct configuration for a given scenario, such as isolating guest Wi-Fi traffic.

For Security+, VLANs are relevant to network security segmentation. The exam covers VLAN hopping attacks and how to prevent them by disabling Dynamic Trunking Protocol (DTP) and using dedicated VLAN IDs for management traffic. You may see scenario-based questions where you must select the best way to separate sensitive data from user traffic.

For AWS SAA, VLANs are less about configuration and more about understanding how they map to AWS Virtual Private Cloud (VPC) constructs. You do not configure VLANs on AWS, but you need to know that subnets in a VPC act similarly to VLANs in terms of isolation. The exam may compare on-premises VLAN segmentation to VPC subnet segmentation in a hybrid architecture question.

For Azure AZ-104, Azure Virtual Network subnets function like VLANs. You need to understand that network security groups (NSGs) and route tables can be applied to subnets, similar to how ACLs and VLANs work in on-premises networks. Questions about Azure VPN gateways might reference VLANs in the context of site-to-site VPN configuration.

For Google ACE, the Google Cloud VPC uses subnets for segmentation, similar to VLANs. The exam may ask about firewall rules applied to subnets, and understanding VLAN concepts helps you grasp the underlying isolation model.

For A+, VLANs are light supporting knowledge. You might encounter the term in the context of home router configuration, where the guest Wi-Fi feature actually creates a VLAN. The exam may ask a basic question about separating guest traffic from the main network.

In all exams, being able to identify whether a problem is related to VLANs or to routing is a key skill. Many exam questions test your ability to read a network diagram and determine where the VLAN boundaries lie.

## How it appears in exam questions

Exam questions about VLANs often come in several patterns. The first is scenario-based: you are given a small office network with two switches and several PCs, and you are told that PC1 cannot ping PC2 even though they are on the same switch. The answer might be that the ports are in different VLANs, or that the trunk between the switches is not allowing the necessary VLAN.

Another common pattern is configuration-based: you see a command output from a switch, such as "show vlan brief" or "show interfaces trunk." You must interpret the output to find misconfigurations. For example, if the output shows that a port is in VLAN 1 but it should be in VLAN 10, you need to select the correct command to change it, like "switchport access vlan 10."

Troubleshooting questions are also frequent. You might see a topology with a router-on-a-stick and the PCs on different VLANs cannot reach the internet. The problem could be that the router subinterface is not configured with the correct encapsulation dot1q or the IP address is in the wrong subnet.

Security-focused questions appear in Security+. A typical question: "A network administrator configured a VLAN for the HR department, but an attacker on a different VLAN was able to intercept HR traffic. What is the most likely cause?" The answer would be VLAN hopping, often enabled by leaving DTP in dynamic desirable mode.

Finally, cloud exams like AWS SAA may present a hybrid scenario. "A company has an on-premises network with VLANs and wants to extend a specific VLAN to the cloud. Which AWS service should they use?" The answer might be AWS Direct Connect with VLAN tagging, or a VPN connection that maps to a specific subnet in the VPC.

In all cases, the key is to understand the logical separation that VLANs create and to know the configuration commands and concepts specific to the vendor in the exam. Cisco commands are essential for CCNA, while generic concepts suffice for CompTIA exams.

## Example scenario

You are the network administrator for a small company with three departments: Sales, Engineering, and Management. All employees are on the same floor and use the same physical network switches. One day, the Sales team complains that their network has become slow. You discover that the Engineering team is running large file transfers that are flooding the whole network with broadcast traffic. The Management team is concerned that sensitive financial data could be accessed by unauthorized users.

To solve both problems, you decide to create three VLANs: VLAN 10 for Sales, VLAN 20 for Engineering, and VLAN 30 for Management. You configure the switch so that the ports connected to Sales PCs are only in VLAN 10, Engineering ports in VLAN 20, and Management ports in VLAN 30. Now, when Engineering transfers a large file, its broadcasts only reach other Engineering computers, not the Sales or Management networks. The Sales network speeds up immediately.

To allow all employees to access the internet and the central file server, you configure a router with a trunk connection to the switch. The router has three virtual interfaces, one for each VLAN. The file server is placed in VLAN 10, and you configure specific access control lists (ACLs) on the router to allow all VLANs to reach the file server, but only Management can access the payroll server.

After the change, you verify the setup by pinging between devices on different VLANs. You find that a Sales employee cannot ping a Management printer, which is expected. However, the Sales employee can access the company-wide file server because you allowed that traffic through the router. This scenario shows how VLANs improve performance and security while still allowing controlled communication between groups.

## How VLANs Segment Networks and Improve Security

A Virtual Local Area Network (VLAN) is a logical grouping of network devices that are not necessarily on the same physical segment. By creating a VLAN, you can segment a physical network into multiple isolated broadcast domains. This is critical for both operations and security. In a traditional flat network, all devices share the same broadcast domain. Any broadcast frame, such as an ARP request, reaches every device. This consumes bandwidth and reduces performance. VLANs solve this by confining broadcast traffic only to devices within the same VLAN. This reduces unnecessary traffic and improves overall network efficiency.

From a security perspective, VLANs provide a layer of isolation. Devices in VLAN 10 cannot directly communicate with devices in VLAN 20 unless a router or Layer 3 switch is configured to route between them. This is essential for separating sensitive data traffic from general user traffic. For example, in an enterprise network, you might place finance servers in VLAN 50 and guest Wi-Fi users in VLAN 100. Even if a guest device becomes compromised, it cannot reach the finance systems. This segmentation is a core security principle tested in exams like Security+, CCNA, and Network+.

VLANs also simplify network management by grouping users by function, department, or project, regardless of their physical location. An engineer can add a user to a specific VLAN by configuring the access port on the switch, without needing to recable the network. This flexibility reduces operational overhead. In cloud environments such as AWS, VPCs and subnets function similarly to VLANs by providing logical isolation. The AWS SAA exam often tests your understanding of subnet segmentation, which is analogous to VLAN concepts.

Understanding VLAN tagging is also fundamental. When a frame travels between switches on a trunk port, it is tagged with a VLAN ID using the IEEE 802.1Q standard. This tag tells the receiving switch which VLAN the frame belongs to. The native VLAN (usually VLAN 1) is an exception and is sent untagged for management traffic. Misconfiguring the native VLAN can lead to security vulnerabilities, such as VLAN hopping attacks. The CCNA and Network+ exams frequently include questions about trunk ports, tagging, and native VLAN security.

Finally, VLANs form the foundation for more advanced networking services like Voice VLANs for VoIP phones, which require dedicated bandwidth and Quality of Service (QoS). By understanding VLAN fundamentals, you will be better prepared for troubleshooting connectivity issues, designing secure multi-tenant environments, and passing vendor-neutral and vendor-specific certifications.

## Trunking, 802.1Q Tagging, and Native VLAN Explained

Trunking is the mechanism that allows multiple VLANs to traverse a single physical link between switches or between a switch and a router. Without trunking, each VLAN would require a separate cable or port, which is inefficient and costly. The IEEE 802.1Q standard is the industry-standard protocol for VLAN tagging. When a switch sends a frame on a trunk port, it inserts a 4-byte tag into the Ethernet frame header. This tag contains the VLAN ID (12 bits, allowing up to 4094 VLANs), priority bits for QoS, and a flag. The receiving switch reads this tag to determine which VLAN the frame belongs to.

Access ports are used for endpoints like PCs and printers. An access port belongs to a single VLAN and does not tag frames. However, trunk ports are configured to carry traffic for multiple VLANs. On a Cisco switch, you use the "switchport mode trunk" command to set a port to trunk mode. You can also specify which VLANs are allowed on the trunk using "switchport trunk allowed vlan". This prevents unauthorized VLANs from traversing the link.

One of the most important concepts in trunking is the native VLAN. The native VLAN is the VLAN that is not tagged on a trunk link. By default, Cisco switches use VLAN 1 as the native VLAN. This can be a security concern because untagged traffic from the native VLAN is implicitly trusted. If an attacker connects a rogue switch and sends untagged frames, they can potentially inject traffic into the native VLAN and perform a VLAN hopping attack. Best practices recommend changing the native VLAN to an unused VLAN and disabling unused ports. This is a common test point in the Security+ and CCNA exams.

Another critical aspect is the Dynamic Trunking Protocol (DTP), which is a Cisco proprietary protocol that automatically negotiates trunking between switches. While convenient, DTP can be a security risk because it allows a neighboring device to become a trunk port without explicit configuration. It is recommended to set trunk ports to "switchport nonegotiate" to disable DTP on production networks. The Network+ exam may ask about the differences between static and dynamic trunking.

mastering trunking and 802.1Q tagging is essential for anyone managing switched networks. The ability to configure, verify, and troubleshoot trunk links is a foundational skill tested in the CCNA, Network+, and even cloud exams like AWS SAA, where you deal with hybrid networks connecting on-premises VLANs to cloud VPCs.

## Inter-VLAN Routing and Layer 3 Switching Techniques

By default, devices in different VLANs cannot communicate because they exist in separate broadcast domains. To enable communication between VLANs, you must perform inter-VLAN routing. This can be done using a router, a Layer 3 switch, or a firewall. The traditional method is router-on-a-stick, where a single physical interface on a router is configured as a trunk port, and subinterfaces are created for each VLAN. Each subinterface is assigned an IP address that acts as the default gateway for hosts in that VLAN. For example, on a Cisco router, you would configure "interface GigabitEthernet0/0.10" with encapsulation dot1Q 10 and an IP address. This is a classic CCNA lab scenario.

However, router-on-a-stick has performance limitations because all inter-VLAN traffic must pass through a single link. A more efficient solution is using a Layer 3 switch. A Layer 3 switch performs both switching and routing at hardware speed. You enable IP routing globally and create switched virtual interfaces (SVIs) for each VLAN. Each SVI acts as the gateway for that VLAN. The switch then routes packets between the SVIs using its routing table. This is faster and more scalable than using an external router. In exams like Network+ and CCNA, you might be asked to identify the benefits of Layer 3 switching over router-on-a-stick.

Security is also a major concern in inter-VLAN routing. By default, a router will route all traffic between VLANs. To restrict traffic, you can configure Access Control Lists (ACLs) on the router or Layer 3 switch. For example, you might allow VLAN 10 (HR) to access VLAN 30 (file server) on port 445, but block all other traffic. This is a common scenario in Security+ and CCNA exams, where you need to write an ACL statement to permit or deny specific traffic.

Another advanced concept is Virtual Routing and Forwarding (VRF), which allows a single router to maintain multiple independent routing tables. VRFs are often used in service provider environments to separate customer traffic, but they can also be used within an enterprise to create overlapping IP spaces without conflict. This is less common in entry-level exams but may appear in CCNP-level questions.

Understanding inter-VLAN routing is vital because it bridges the gap between Layer 2 switching and Layer 3 routing. Most modern enterprise networks rely heavily on Layer 3 switching for performance. Cloud practitioners (AWS SAA, AZ-104) also benefit from this knowledge when designing hybrid networks that connect on-premises VLANs to cloud VPCs using VPNs or Direct Connect, where routing policies and subnet segmentation are analogous.

Finally, always remember that for inter-VLAN routing to work, the hosts must have their default gateway set to the SVI or subinterface IP. Misconfigured gateways are a frequent troubleshooting issue and a favorite exam trap.

## VLAN Security Threats, VLAN Hopping, and Mitigation Strategies

While VLANs provide logical segmentation, they are not inherently secure. Several attacks can bypass VLAN isolation. The most well-known threat is VLAN hopping. This attack exploits the default behavior of trunk ports. In a basic VLAN hopping attack, an attacker configures their device to act as a switch and establishes a trunk link with the legitimate switch. If the attacker's port is set to dynamic desirable mode and the switch also negotiates trunking, the attacker can then send and receive traffic from all VLANs traversing that trunk. This gives the attacker full network access. The primary mitigation is to disable Dynamic Trunking Protocol (DTP) on all end-user ports and explicitly set them to access mode with the "switchport mode access" command. Always set the native VLAN to an unused VLAN and explicitly prune all unused VLANs from trunk links.

Another attack is double tagging, where an attacker sends a frame with two 802.1Q tags. The first tag matches the native VLAN, and the second tag belongs to a target VLAN. The first switch strips the outer tag (since native VLAN traffic is untagged), and the second switch sees only the inner tag, forwarding the frame into the target VLAN. This attack only works if the native VLAN on the first switch is the same as the attacker's VLAN. Mitigation includes never using VLAN 1 as the native VLAN, explicitly tagging the native VLAN on trunk ports (where supported), and ensuring that devices do not accept double-tagged frames. This specific attack is a favorite topic in the Security+ and CCNA exam questions.

Private VLANs (PVLANs) are another security mechanism. A private VLAN splits a broadcast domain into isolated subdomains. For example, you might have a primary VLAN (say VLAN 100) and multiple secondary VLANs. Hosts in a community VLAN can communicate among themselves, but hosts in an isolated VLAN can only communicate with the promiscuous port (usually the gateway). This is commonly used in service provider environments to isolate customer systems while sharing a common gateway. The Security+ exam may test your understanding of PVLANs as a method to prevent lateral movement.

you should secure the management VLAN. The management VLAN (often VLAN 1 by default) provides access to the switch's management interface. Never use VLAN 1 for management; instead, create a dedicated management VLAN (e.g., VLAN 999) and restrict access to it using ACLs and SSH. Also, disable unused ports, and use port security features to limit the number of MAC addresses per port, which can prevent MAC flooding attacks that might lead to VLAN hopping via CAM table overflow.

Finally, always use 802.1X authentication on switch ports to enforce user-based network access. This ties into the AAA framework and ensures that only authenticated users are assigned to the correct VLAN. These security measures are not just theoretical; they are practical configurations that you must know for the CCNA, Network+, and Security+ exams. Understanding how each attack works and the exact command to stop it will help you ace the troubleshooting and multiple-choice sections.

## Common mistakes

- **Mistake:** Assuming VLANs provide Layer 3 security without a firewall or ACL.
  - Why it is wrong: VLANs operate at Layer 2; they isolate broadcast domains but do not block all traffic. A router or multilayer switch performing inter-VLAN routing must be configured with ACLs to restrict traffic. Otherwise, any device can reach any other device if routing is enabled.
  - Fix: Always configure ACLs or firewall rules between VLANs if you want to restrict inter-VLAN communication. Do not rely on VLANs alone for security.
- **Mistake:** Using VLAN 1 for user traffic.
  - Why it is wrong: VLAN 1 is the default VLAN on most switches. It is used for management and control traffic. Putting user devices in VLAN 1 exposes them to management traffic and makes the network less secure. Also, VLAN 1 cannot be deleted or modified in many switches.
  - Fix: Create dedicated VLANs for user traffic (e.g., VLAN 10, 20) and move all user ports out of VLAN 1. Use VLAN 1 only for essential control plane communication if necessary.
- **Mistake:** Forgetting to add a VLAN to a trunk port after creating it.
  - Why it is wrong: A trunk port only carries VLANs that are explicitly allowed on it. If you create a new VLAN on one switch but do not add it to the trunk, the VLAN will not be extended to the other switches. Devices on the different switches will not be able to communicate even if they are in the same VLAN.
  - Fix: After creating a VLAN, use the command "switchport trunk allowed vlan add <vlan-id>" on the trunk interface to include the new VLAN.
- **Mistake:** Configuring different native VLANs on both ends of a trunk.
  - Why it is wrong: The native VLAN is used for untagged traffic on a trunk. If the native VLAN differs on the two ends, the switch will forward mismatched frames into the wrong VLAN, causing a native VLAN mismatch. This can lead to connectivity issues and security risks, as frames might be placed in an unintended VLAN.
  - Fix: Ensure the native VLAN is the same on both ends of the trunk. Change it using "switchport trunk native vlan <vlan-id>" on both switches.
- **Mistake:** Thinking that devices on the same VLAN across different switches must be on the same IP subnet.
  - Why it is wrong: While best practice is to use the same subnet for all devices in a VLAN, it is technically possible for devices in the same VLAN to have IP addresses from different subnets. However, they will not be able to communicate without a router, because IP routing is Layer 3, and VLAN is Layer 2. The switch will still forward broadcasts to all ports in the VLAN, but upper-layer protocols will fail.
  - Fix: Always match the VLAN to a distinct IP subnet. For example, VLAN 10 should be 192.168.10.0/24, VLAN 20 should be 192.168.20.0/24, etc.

## Exam trap

{"trap":"A question shows two PCs connected to the same switch, both assigned to VLAN 10, but they cannot ping each other. The answer choices include 'router is down' or 'need a router for inter-VLAN routing'.","why_learners_choose_it":"Learners often think that any communication between devices requires a router, so they choose the answer about needing a router. They forget that devices in the same VLAN are in the same broadcast domain and can communicate directly at Layer 2 without a router.","how_to_avoid_it":"Remember: Devices in the same VLAN can communicate directly if they are in the same IP subnet. Only traffic between different VLANs needs a router. If they are on the same VLAN but cannot ping, the problem is likely a misconfigured IP address, a disabled port, or an incorrect VLAN assignment on the port, not a missing router."}

## Commonly confused with

- **VLAN vs Subnet:** A subnet is a Layer 3 concept that divides an IP network into smaller logical networks. A VLAN is a Layer 2 concept that creates separate broadcast domains. While you typically assign one subnet per VLAN, they are not the same thing. Two devices on the same VLAN can be in different subnets, but they will not communicate without a router. (Example: A VLAN can have IP addresses 192.168.1.0/24. That whole group is both a VLAN (Layer 2) and a subnet (Layer 3). But the VLAN is about broadcast isolation; the subnet is about addressing.)
- **VLAN vs VPN:** A VPN creates a secure encrypted tunnel over a public network, connecting two remote sites or a remote user to a corporate network. A VLAN does not provide encryption; it is a way to logically separate traffic on the same physical network. VPNs can traverse the internet; VLANs are confined to a local switched network. (Example: Using a VLAN, you separate guest Wi-Fi from the main office network on the same switch. Using a VPN, a remote employee connects securely to the office network over the internet.)
- **VLAN vs Physical LAN:** A physical LAN is a group of devices connected to the same network cable segment or the same switch without any logical segmentation. A VLAN is a virtual segmentation that can span multiple physical switches. You can have ten physical devices in different buildings but all on the same VLAN, or they can be in the same room but on different VLANs. (Example: If you have one switch and plug all computers into it, they are on one physical LAN. If you configure some ports as VLAN 10 and others as VLAN 20, you have two virtual LANs on the same physical LAN.)
- **VLAN vs VXLAN:** VXLAN (Virtual Extensible LAN) is a network virtualization technology that encapsulates Layer 2 frames in UDP packets to extend VLANs over a Layer 3 network. It uses a 24-bit VNI (VXLAN Network Identifier) instead of the 12-bit VLAN ID, allowing over 16 million logical networks. VXLAN is commonly used in data center and cloud environments, while VLAN is used in enterprise campus networks. (Example: A data center uses VXLAN to stretch a VLAN across multiple physical racks in different locations, treating them as one logical network, even though they are separated by IP routers.)

## Step-by-step breakdown

1. **Plan VLAN Structure** — Before configuring anything, determine how many VLANs you need, what each VLAN will be used for (e.g., VLAN 10 for Sales, VLAN 20 for Engineering), and which switch ports belong to each VLAN. Also decide on the IP subnet for each VLAN. This planning step prevents misconfigurations and ensures the network aligns with organizational needs.
2. **Create VLANs on the Switch** — On a Cisco switch, enter global configuration mode and use the command 'vlan <vlan-id>' followed by a name. For example, 'vlan 10', then 'name Sales'. This creates the VLAN in the switch’s database. The VLAN is not active until it is assigned to at least one port.
3. **Assign Ports to VLANs (Access Ports)** — Configure each switch port that connects to an end device (PC, printer) as an access port. Use 'interface fastethernet0/1', then 'switchport mode access', then 'switchport access vlan 10'. This ensures the port is in the specified VLAN and the switch adds the 802.1Q tag for outgoing frames on trunk links.
4. **Configure Trunk Ports Between Switches** — If you have multiple switches, configure the ports connecting them as trunk ports. Use 'interface gigabitethernet0/1', then 'switchport mode trunk'. On a trunk, frames carry 802.1Q tags. By default, all VLANs are allowed on the trunk, but you can restrict using 'switchport trunk allowed vlan remove <vlan-id>'.
5. **Configure Native VLAN on Trunk** — The native VLAN is the VLAN that carries untagged frames on a trunk. By default, it is VLAN 1. It is a best practice to change the native VLAN to an unused VLAN for security. Use 'switchport trunk native vlan <vlan-id>' on both ends of the trunk to avoid a mismatch.
6. **Verify VLAN Configuration** — Use 'show vlan brief' to see all VLANs and which ports are assigned. Use 'show interfaces trunk' to verify trunk status, allowed VLANs, and native VLAN. Ping tests can confirm that devices in the same VLAN can communicate, and that devices in different VLANs cannot (without a router).
7. **Configure Inter-VLAN Routing (if needed)** — If devices in different VLANs need to communicate, set up a router or multilayer switch. For router-on-a-stick, create subinterfaces on the router's physical interface connected to the switch trunk. For each subinterface, use 'encapsulation dot1Q <vlan-id>' and assign an IP address from the VLAN's subnet. On a multilayer switch, create an SVI with 'interface vlan <vlan-id>' and assign an IP address.

## Practical mini-lesson

VLANs are one of the most frequently implemented features in campus networks, and knowing how to deploy them correctly is crucial for any network professional. The first practical step is to understand the difference between access ports and trunk ports. Access ports are used for end devices like PCs and printers. They carry traffic for only one VLAN. Trunk ports are used to interconnect switches or connect a switch to a router. They carry traffic for multiple VLANs, using 802.1Q tags to keep the traffic separated.

When configuring a trunk, you must pay attention to the native VLAN. On a Cisco switch, the default native VLAN is VLAN 1. Many administrators change the native VLAN to an unused VLAN to prevent VLAN hopping attacks and avoid mixing management traffic with user data. The native VLAN must be the same on both ends of the trunk; a mismatch can cause frames to be placed in the wrong VLAN, leading to connectivity issues and security holes.

Another practical consideration is VLAN pruning. By default, all VLANs are allowed on a trunk. In a large network, this can cause unnecessary broadcast traffic to be sent across the network. You should restrict the allowed VLANs on each trunk to only the VLANs that actually need to cross that link. Use the command 'switchport trunk allowed vlan' to specify which VLANs are permitted.

Inter-VLAN routing is often implemented using a router-on-a-stick configuration in smaller networks, but in larger enterprise networks, multilayer switches are used. A multilayer switch can route between VLANs at high speed using SVIs. The SVI is a virtual interface that represents the entire VLAN. You assign an IP address to the SVI, and that becomes the default gateway for devices in that VLAN. The switch then routes packets between SVIs internally, without needing an external router.

What can go wrong? Common issues include VLAN inconsistency across switches (a VLAN exists on one switch but not on another), native VLAN mismatch, trunk links that are down due to wrong cabling or configuration, and forgetting to add a VLAN to the trunk allowed list. Also, if DHCP is not configured for each VLAN, devices will not get an IP address. Always use 'show vlan' and 'show interfaces trunk' commands to verify the configuration.

Finally, always document your VLAN numbering plan. Use consistent numbering across the network, avoid VLAN 1, and consider using a standard like 10 for users, 20 for servers, 30 for voice, etc. Good documentation saves hours of troubleshooting later.

## Commands

```
vlan 10
name Sales
```
Creates VLAN 10 and gives it the descriptive name 'Sales' on a Cisco switch. This is the first step in VLAN configuration.

*Exam note: The CCNA and Network+ exams often ask for the exact syntax to create a VLAN. Remember that the 'name' command is optional but recommended for documentation.*

```
interface fastEthernet 0/1
switchport mode access
switchport access vlan 10
```
Configures interface FastEthernet 0/1 as an access port and assigns it to VLAN 10. This allows a single device to connect and be part of VLAN 10.

*Exam note: Exams test that 'switchport mode access' must be entered before 'switchport access vlan'. They also test that you cannot assign a VLAN that has not been created first.*

```
interface gigabitEthernet 0/1
switchport mode trunk
switchport trunk native vlan 999
```
Sets the port to trunk mode and changes the native VLAN from the default (VLAN 1) to a different unused VLAN (999). This is a critical security hardening step.

*Exam note: The Security+ exam asks why you should change the native VLAN. CCNA tests that native VLAN mismatch causes connectivity issues and that both ends must match.*

```
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
```
Creates a Switched Virtual Interface (SVI) for VLAN 10 and assigns an IP address. This SVI acts as the default gateway for devices in VLAN 10.

*Exam note: The CCNA exam may present a topology and ask for the correct configuration to enable inter-VLAN routing. SVIs are compared with router-on-a-stick subinterfaces.*

```
ip routing
```
Enables IP routing globally on a Layer 3 switch, allowing it to route between VLANs using SVIs.

*Exam note: Without this command, a Layer 3 switch will not route between VLANs even if SVIs exist. Exams test that this command is mandatory before any inter-VLAN routing on a switch.*

```
access-list 100 deny ip any 10.0.0.0 0.0.0.255
interface gigabitEthernet 0/1.20
ip access-group 100 in
```
Creates an extended ACL that denies all IP traffic from any source to the 10.0.0.0/24 network, then applies it inbound on subinterface for VLAN 20.

*Exam note: CCNA and Network+ exams test ACL syntax and application direction. They also test that extended ACLs should be placed closest to the source to minimize unnecessary traffic.*

```
vlan 20
private-vlan community
```
Configures VLAN 20 as a community Private VLAN (PVLAN). Hosts in the same community VLAN can communicate with each other and with the promiscuous port, but not with hosts in other secondary VLANs.

*Exam note: Private VLANs appear in Security+ and more advanced CCNA exams. You must know the difference between community, isolated, and promiscuous ports.*

## Troubleshooting clues

- **VLAN Mismatch on Trunk** — symptom: Devices in the same VLAN cannot communicate across two switches; ping fails between hosts on different switches but works within the same switch.. Both ends of a trunk link must have the same list of allowed VLANs. If one switch has VLAN 10 pruned or not allowed, the frames are dropped. Also, native VLAN mismatch can cause frames to be dropped or misdelivered. (Exam clue: CCNA simulation questions often show a topology with two switches where hosts on the same VLAN cannot ping across. The answer is to verify 'show interfaces trunk' and correct the allowed VLAN list or native VLAN.)
- **Port in Shutdown or Misconfigured Mode** — symptom: A specific device cannot connect to the network or cannot obtain an IP address; link lights are on but no traffic.. The switchport may be administratively down ('shutdown'), or it may be in trunk mode when the device expects an access port, or vice versa. A misconfigured port mode prevents the device from getting a VLAN assignment. (Exam clue: Network+ and A+ exams test that you use 'show interfaces status' to check if a port is ErrDisabled or down. The fix is 'no shutdown' or correct 'switchport mode'.)
- **Native VLAN Mismatch** — symptom: Console logs show CDP or DTP messages reporting 'Native VLAN mismatch discovered'. Traffic for the native VLAN (often management) fails between switches.. Native VLAN must match on both sides of a trunk. If one side expects VLAN 999 and the other uses VLAN 1, untagged frames are dropped or placed in the wrong VLAN, causing connectivity issues for management traffic. (Exam clue: This is a classic CCNA troubleshooting scenario. The 'show interfaces trunk' command will highlight the mismatch. The solution is to unify the native VLAN on both switches.)
- **Layer 3 SVI Missing or Down** — symptom: Hosts in a VLAN can communicate within the VLAN but cannot reach the default gateway or other VLANs.. The SVI for that VLAN may not be created, or it is administratively down. Without an SVI, there is no gateway for the VLAN, so inter-VLAN routing fails. (Exam clue: CCNA exams test that you must configure 'interface vlan <id>' and 'no shutdown'. Verify with 'show ip interface brief' to see if the VLAN interface is up/up.)
- **VLAN Hopping via Double Tagging** — symptom: Unauthorized traffic appears in a restricted VLAN; attacker is able to communicate with a server that should be isolated.. Double tagging occurs when an attacker sends frames with two 802.1Q tags. The first switch strips the outer tag (matching the native VLAN), and the second switch processes the inner tag, forwarding the frame into a different VLAN. (Exam clue: Security+ exams describe double tagging as a form of VLAN hopping. Mitigation involves setting the native VLAN to an unused VLAN and disabling DTP on access ports.)
- **STP Blocking Due to Loop** — symptom: Intermittent connectivity, slow performance, or complete loss of connectivity after new switch is added. Some VLANs may become unreachable.. Spanning Tree Protocol (STP) may block redundant paths to prevent loops. If the root bridge election is skewed or a switch has a lower priority, a port may be incorrectly placed in blocking state, isolating a VLAN. (Exam clue: Network+ exams ask how STP works and why some VLANs may have blocked ports. The 'show spanning-tree vlan 10' command helps identify the root bridge and blocked ports.)
- **Access Port Assigned to Wrong VLAN** — symptom: User is able to access the network but is in the wrong subnet; they may have limited access or none.. The switchport may be assigned to VLAN 20 instead of VLAN 10 due to a misconfiguration or because the port was previously used. The user's device will receive an IP from the wrong DHCP scope. (Exam clue: CCNA tests verify 'show vlan brief' or 'show interfaces switchport' to see which VLAN a port is in. The fix is 'switchport access vlan <correct>'. Also, check for voice VLAN assignment conflicts.)

## Memory tip

Think of VLAN as 'Virtual Walls', they create invisible walls between groups on the same switch, just like walls separate rooms in a house.

## FAQ

**Can two devices on the same VLAN communicate if they are on different switches?**

Yes, as long as the switches are connected by a trunk port that carries that VLAN. The trunk ensures that Layer 2 frames are forwarded correctly between switches.

**Do I need a router to use VLANs?**

No, VLANs work at Layer 2, and devices in the same VLAN do not need a router to talk to each other. You only need a router if you want devices in different VLANs to communicate.

**What is the difference between an access port and a trunk port?**

An access port belongs to a single VLAN and removes the 802.1Q tag before sending frames to the end device. A trunk port carries multiple VLANs and keeps the 802.1Q tag intact to identify which VLAN the frame belongs to.

**How many VLANs can I create on a network?**

According to the 802.1Q standard, there are 4094 usable VLANs (IDs 1–4094, with 0 and 4095 reserved). In practice, the number may be limited by the switch hardware and software.

**What is VLAN hopping?**

VLAN hopping is an attack where an attacker sends frames with 802.1Q tags to gain access to a different VLAN. It can be prevented by disabling Dynamic Trunking Protocol (DTP) on user-facing ports and setting them as access ports.

**Should I use VLAN 1 for management?**

It is not recommended. VLAN 1 is the default and cannot be deleted. Using a dedicated management VLAN (e.g., VLAN 99) improves security by isolating management traffic from user traffic.

**Can a single switch port be in multiple VLANs?**

An access port can only be in one VLAN. If you need a port to carry multiple VLANs, you must configure it as a trunk port.

## Summary

VLANs are a foundational network technology that allows administrators to create separate logical networks on the same physical infrastructure. By grouping devices into VLANs, you improve security, reduce broadcast traffic, and simplify network management. Understanding VLANs is critical for most IT certification exams, especially CCNA and Network+, where you must know how to configure, verify, and troubleshoot them.

In practice, VLANs are used everywhere, from small businesses separating guest Wi-Fi from corporate traffic, to large data centers isolating tenants. The key exam takeaway is to remember that VLANs are a Layer 2 isolation mechanism, and that routing is needed for communication between VLANs. Always pay attention to the native VLAN, trunk configuration, and VLAN consistency across switches.

Whether you are studying for a certification or working in the field, mastering VLANs will give you a solid understanding of how modern networks are organized. They are the building blocks for more advanced concepts like VXLAN, SDN, and network virtualization.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/vlan