The Logical Slice
Deconstructing VLAN Segmentation
1. Why VLANs? The Death of the Hub
In a large office, if every computer were on the same physical network, Broadcast Traffic (like ARP requests) would overwhelm the devices. A VLAN logically separates devices so they only receive broadcasts from their own "Virtual" group, even if they share the same physical cable or switch.
2. The 802.1Q Tag: How it Works
When a "Tagged" packet moves through the switch, four bytes are inserted into the Ethernet header.
- TPID (0x8100): Identifies the frame as an 802.1Q frame.
- PRI: Sets the priority for Quality of Service (QoS).
- VLAN ID (VID): A 12-bit number identifying the specific network (1 to 4094).
3. Access Ports vs Trunk Ports
Understanding the difference between port types is the foundation of network engineering.
| Port Type | Behavior |
|---|---|
| Access Port | Assigned to ONE VLAN. Traffic is always "untagged" on the wire. |
| Trunk Port | Carries traffic for MULTIPLE VLANs. Traffic is "tagged" with the VLAN ID. |
4. Inter-VLAN Routing: The Bridge between Worlds
By default, devices in VLAN 10 cannot talk to devices in VLAN 20. To bridge them, you need a Layer 3 device.
- Router on a Stick: A single physical router link with many "Sub-interfaces."
- SVI (Switch Virtual Interface): A Layer 3 switch acts as the default gateway for each VLAN natively in hardware (ASICs).
5. Native VLAN Vulnerabilities
The Native VLAN is the ID used for untagged traffic on a trunk. By default (on Cisco and others), this is VLAN 1.
6. Voice VLANs: The QoS Advantage
A single port can often carry both a Data VLAN (for the PC) and a Voice VLAN (for the VoIP phone). The switch identifies the phone via LLDP/CDP and automatically places its sensitive audio traffic in the higher-priority Voice VLAN.
Conclusion: Simplicity through Complexity
VLANs allow us to build a physically simple network that is logically complex. We can separate HR from Finance, and Guests from Servers, without ever pulling a new cable through the walls. As corporate security requirements grow, the mastery of 802.1Q and inter-VLAN routing remains the most vital skill in a network engineer's toolkit.
Frequently Asked Questions
Can I have more than 4096 VLANs?
No, not with standard 802.1Q. If you need more (common in massive Service Provider or Cloud networks), you must use VXLAN or QinQ (Double Tagging), which provide millions of virtual network segments.
Does a VLAN increase bandwidth?
Indirectly, yes. By reducing the number of devices in a broadcast domain, you waste less bandwidth on background noise (ARP/LLMNR), leaving more room for actual user data.
What is 'VTP'?
VTP (VLAN Trunking Protocol) is a Cisco-proprietary protocol that synchronizes VLAN databases across multiple switches. Be careful: a wrong configuration can accidentally delete all your VLANs across the entire building!