VLAN
In plain English
Plain definition
A concise technical definition of a VLAN (virtual local area network): what it is, how it segments a shared switch fabric into separate broadcast domains, and where its security limits lie.
Technical Definition
At the switching layer, a VLAN is a logical broadcast domain created inside a shared Layer 2 infrastructure. Ports on a switch are assigned to a VLAN either statically (access ports) or dynamically, and frames are tagged with a VLAN identifier as they cross links that carry traffic for more than one VLAN (trunk ports). The IEEE 802.1Q standard is the commonly cited mechanism for this tagging; its specific field widths and numbering should be confirmed against the current IEEE text before being relied on for compliance-grade documentation, since this entry’s verified source base covers general standards-publication practice rather than the 802.1Q specification itself. Functionally, each VLAN forms its own broadcast domain: frames sent to the broadcast address within one VLAN are not flooded into another VLAN by the switch.
Operational Relevance
Operationally, VLANs let a single switch fabric serve multiple logically separate groups of hosts — for example finance, engineering and guest Wi-Fi — without deploying dedicated switches for each group. This reduces broadcast traffic per segment, supports coarse-grained policy separation, and gives network operators a unit of change (a VLAN) that can be assigned to ports, moved between switches, or extended across sites without altering physical cabling. Because VLAN membership is a configuration state rather than a physical fact, incorrect port assignment is a routine and low-cost check during any connectivity investigation.
Architecture Relationship
A VLAN sits between the physical switching layer and the IP addressing layer. Conventional designs map one VLAN to one IP subnet, so a device’s VLAN determines which subnet, gateway and access-control policy applies to it. Traffic that must move between VLANs is handled by a Layer 3 device — a router or a switch with routing capability — which is also where inter-VLAN access control is normally enforced. VLANs interact closely with Spanning Tree Protocol (loop prevention is frequently run per VLAN), with trunk-port configuration (which VLANs a shared link is permitted to carry), and with overlay technologies such as VXLAN, which extend VLAN-style segmentation beyond the numeric ceiling of classic VLAN tagging across routed or cloud infrastructure.
Example
Consider a small office with two switches connected by a single uplink. Finance workstations are placed in one VLAN and engineering workstations in another. The uplink between the switches is configured as a trunk so that frames from both VLANs can share the one physical link, each frame carrying a tag that identifies which VLAN it belongs to. A finance workstation on the first switch can reach a finance workstation on the second switch directly, but cannot reach an engineering workstation on either switch unless a routing device is configured to permit and log that specific path.
Misunderstanding
A frequent misunderstanding is treating VLAN separation as equivalent to physical network isolation for security purposes. A VLAN is a logical, configuration-defined boundary enforced by switch software, not a physical barrier. Misconfigured trunk ports, unnecessary VLANs left enabled on a trunk, or techniques such as VLAN double-tagging can allow traffic to cross a VLAN boundary that was assumed to be closed. VLANs are a useful segmentation and traffic-management tool, but the residual risk of misconfiguration means they should be paired with explicit access control and periodic configuration review rather than treated as a self-sufficient security boundary.
Related Terms
- Broadcast domain
- Trunk port and access port
- 802.1Q tagging
- Spanning Tree Protocol
- Subnet
- VXLAN
- Private VLAN
Further Reading
The RFC Editor’s RFC Series is the authoritative publication channel for Internet technical specifications generally and is a useful starting point for understanding how standards documentation is maintained and referenced. For VLAN-specific tagging behaviour, readers should consult the current IEEE 802.1Q standard text directly and their switch vendor’s implementation documentation, since exact field definitions, VLAN ID ranges and default behaviours can vary by platform and firmware version and were not independently verified within this entry’s source base.