What Is a VLAN? Definition, Operation, and Configuration

A VLAN (Virtual LAN) is a logical network within a physical network that separates traffic without requiring additional hardware. The 802.1Q standard uses a 4 bytes tag in the Ethernet header. A maximum of 4094 VLANs are supported. VLANs are an essential building block of enterprise network segmentation.

Why Use VLANs?

• Separate broadcast domains (one broadcast domain per VLAN)
• Security: isolation between departments and user groups (finance, IT, guests)
• Flexibility: users can join the correct VLAN regardless of the switch port
• Efficiency: no separate cabling required
• Policies: QoS, ACL, inter-VLAN routing

Port Modes

• Access: 1 VLAN, untagged, for an endpoint (PC, IP phone)
• Trunk: multiple tagged VLANs, for inter-switch links
• Hybrid: mixed mode (Juniper)
• Native VLAN: untagged VLAN on a trunk (VLAN 1 by default)

Basic Cisco Configuration

• vlan 10 ; name DATA
• interface Gi1/0/1 ; switchport mode access ; switchport access vlan 10
• interface Gi1/0/48 ; switchport mode trunk ; switchport trunk allowed vlan 10,20,30

Common VLANs

• VLAN 10: DATA (business workstations)
• VLAN 20: VOICE (IP telephony)
• VLAN 30: WIFI-GUEST
• VLAN 40: PRINT
• VLAN 50: CAM (cameras)
• VLAN 99: MGMT

VLAN Security

• VLAN hopping: prevent it with a dedicated, blocked native VLAN
• Port security: limit the number of MAC addresses
• DHCP snooping + DAI: anti-spoofing protection
• Private VLAN: intra-VLAN isolation

Beyond 4094

• QinQ (802.1ad): VLAN-in-VLAN, Metro Ethernet
• VXLAN: 16M VNI, L2 overlay over L3
• The 2026 standard for data centers

Order from OPTINOC

Campus VLAN design + 802.1Q trunking + inter-VLAN routing. Cisco, Aruba, Juniper, FortiSwitch. Quotes within 48h.