VLAN

VLANs separate one physical switched network into multiple logical broadcast domains. A device in one VLAN normally cannot receive Layer 2 broadcast, multicast, or unknown-unicast traffic from another VLAN, even if both connect to the same switch chassis. Switch ports are commonly assigned to an access VLAN, while traffic between different VLANs requires a router or a Layer 3 switch. This makes a VLAN a logical boundary rather than a security boundary by itself: routing rules, firewall policy, and switch configuration determine whether communication across that boundary is allowed.

Organizations often create VLANs for user groups, voice handsets, servers, guest access, management interfaces, or building locations. The resulting topology can follow administrative or functional needs instead of the location of cables. A workstation may therefore remain in the same IP subnet and policy group after being moved to another floor, provided its switch port receives the appropriate configuration.

IEEE 802.1Q identifies VLAN membership by inserting a tag into an Ethernet frame on links that carry multiple VLANs. The tag contains a VLAN identifier and priority-related fields, including the mechanism used by IEEE 802.1p for Layer 2 quality of service. A trunk link transports several VLANs between switches, routers, firewalls, or virtualization hosts; an access link ordinarily presents untagged traffic for one configured VLAN to an end device.

The 802.1Q identifier field is 12 bits wide, but not every numerical value is available for ordinary assignment. VLAN 0 is used for priority tagging without a VLAN identifier, and VLAN 4095 is reserved, leaving 4,094 commonly usable identifiers.¹ Native or untagged VLAN behavior differs across implementations, so trunk endpoints must agree about allowed VLANs, tagging, and the native VLAN to prevent misdelivery.

Inter-VLAN communication is normally performed by a router or Layer 3 switch, which provides a routed interface for each subnet and applies access-control policy. This design supports separate address spaces and limits the spread of broadcasts, but it does not automatically provide confidentiality or strong isolation. A compromised host can still attack another VLAN if routing policy permits it, and misconfigured trunks or access ports can expose traffic.

Good practice includes restricting trunk VLAN lists, disabling unused ports, using an explicit native-VLAN policy, and separating management traffic from ordinary users. Security controls such as 802.1X can authenticate devices or users before a switch assigns network access, while DHCP snooping, dynamic ARP inspection, and port-security features address particular local threats. VLANs are therefore best treated as one layer in defense-in-depth rather than as a substitute for firewalls, authentication, or encryption.

VLAN technology extends beyond the familiar switch-to-switch trunk. In data centers, virtual switches tag traffic from virtual machines, allowing one physical server to host workloads belonging to different logical networks. Large cloud and data-center fabrics often carry tenant networks over routed infrastructure with VXLAN, which uses a 24-bit VXLAN Network Identifier and can map virtual segments to underlying VLANs or other tunnel endpoints.²

Service providers also use VLAN-related standards such as QinQ, or VLAN stacking, to place a customer VLAN tag inside an additional provider tag; this expands scale and preserves customer identifiers across a carrier network.³ Ethernet Virtual Private Network (EVPN) control planes can distribute MAC and IP reachability for multihomed and overlay networks, reducing some limitations of large bridged domains.⁴ These uses show that VLANs are not merely departmental labels but components of virtualization, carrier transport, and automated fabric design.

Access port

A switch port ordinarily assigned to one VLAN and connected to an end device that sends and receives untagged Ethernet frames.

Trunk

A link configured to carry traffic for multiple VLANs, usually using IEEE 802.1Q tags.

Native VLAN

The VLAN a trunk treats as untagged, subject to the behavior and configuration of the connected devices.

Inter-VLAN routing

Layer 3 forwarding between VLANs, performed by a router or multilayer switch.

QinQ

VLAN stacking that adds an outer service-provider tag around an existing customer VLAN tag.