Simple definition
A VLAN logically divides one physical switching infrastructure into separate Layer 2 networks. A business can put employees, guest devices and IP phones in different VLANs without installing completely separate switches.
Technical definition
Ethernet frames may carry an IEEE 802.1Q VLAN tag. Access ports normally place untagged traffic in one configured VLAN; trunk ports can carry several tagged VLANs between network devices. Separate VLANs require Layer 3 routing to exchange IP traffic.
- PC — VLAN 10 User network
- Access port Assigned VLAN
- 802.1Q trunk Carries VLAN tags
- Second switch Stays in VLAN 10
- Another PC Same L2 broadcast domain
Traffic between VLAN 10 and VLAN 20 requires Layer 3 routing, subject to the intended security policy.
What is it used for?
Separate device groups, reduce unnecessary broadcast traffic and apply different network access policies to employees, guests, servers or phones.
Practical example
An office assigns workstations to VLAN 10, servers to VLAN 20 and guest Wi-Fi to VLAN 40. Its firewall controls which traffic can pass between these networks.
Common issues
- VLAN missing from the allowed list on an inter-switch trunk
- Access port assigned to the wrong VLAN
- Native VLAN or PVID mismatch between connected devices
- Inter-VLAN firewall policies too permissive or unexpectedly restrictive
Access ports, trunks and 802.1Q tags
A VLAN primarily separates Layer 2 broadcast domains. An access port usually places untagged frames from one device into a single VLAN. A trunk can carry multiple VLANs using IEEE 802.1Q tagging. The native VLAN or PVID handles untagged frames on certain devices. Mismatched tagging or native VLAN settings between switches can create unexpected connectivity problems and unintended traffic exposure.
The VLAN ID (such as 10 or 20) is not an IP address. Assigning VLAN 10 to subnet 192.168.10.0/24 is a network-design convention, not a protocol requirement.
Why separate VLANs cannot communicate automatically
- Devices in the same VLAN normally belong to one Ethernet broadcast domain, subject to switch policies.
- Communication between different VLANs requires Layer 3 routing via a router, firewall or multilayer switch.
- Having a route does not automatically authorize communication; firewall policies can block guests from internal servers.
- Each VLAN often has its own IP subnet, default gateway and DHCP scope; a DHCP relay may be needed.
- A Wi-Fi SSID may be mapped to a VLAN, but that is not a replacement for authentication, access control or a proper radio design.
Segmentation alone is not a security policy
VLANs are useful boundaries but not an automatic security guarantee. Protection depends on inter-VLAN filtering, switch administration and appropriate separation of users. Allowing all VLANs on a trunk to an unmanaged device undermines that goal. Poorly documented, unused or inconsistent VLANs also make troubleshooting more difficult.
In an office with IP phones, guest Wi-Fi and administrative computers, the objective is to separate traffic while allowing necessary services such as DNS, DHCP, printers and business applications under explicit rules.
Related terms
Key takeaway: VLANs separate Ethernet broadcast domains; routing connects VLANs, while security policies determine which flows are allowed.