What is a VLAN?
Learn what a VLAN is, how 802.1Q tagging works, and why VLANs improve security and performance — with networking interview Q&A.
Expected Interview Answer
A VLAN (Virtual Local Area Network) is a logical grouping of switch ports into a separate broadcast domain, letting devices on different physical switches (or different ports on the same switch) behave as if they were on isolated networks, without needing separate physical switches for each group.
Normally, all ports on a switch belong to one broadcast domain, meaning a broadcast frame from any device reaches every other device. VLANs let an administrator tag ports (or entire trunk links, using the IEEE 802.1Q standard) with a VLAN ID, so traffic is only broadcast to and switched among ports sharing that same ID, effectively creating multiple isolated logical LANs on shared physical hardware. This improves security by keeping, say, a finance department’s traffic separate from a guest Wi-Fi VLAN even though both traverse the same switch, and it improves performance by shrinking broadcast domains. Devices in different VLANs cannot talk to each other directly at Layer 2 — they need a router or Layer-3 switch to route between VLANs, a process called inter-VLAN routing. Trunk ports carry traffic for multiple VLANs between switches by inserting an 802.1Q tag into each Ethernet frame identifying its VLAN.
- Isolates broadcast domains without needing separate physical switches
- Improves security by segmenting traffic (e.g., guest vs corporate)
- Reduces broadcast domain size for better performance
- Enables flexible logical grouping independent of physical wiring
AI Mentor Explanation
A VLAN is like a stadium operator painting different colored wristbands onto sections of seating that are physically scattered across several stands, so that an announcement meant for VIP wristband holders only reaches those exact seats regardless of which stand they sit in. Two fans sitting right next to each other can hold different wristband colors and never receive each other’s messages directly. A steward checking wristband color before relaying an announcement is exactly what a switch does when it checks a VLAN tag before forwarding a frame. Painting logical groups onto physical seating is precisely what a VLAN does to switch ports.
Step-by-Step Explanation
Step 1
Assign VLAN IDs
An administrator assigns switch ports to a VLAN ID, grouping them into a logical broadcast domain.
Step 2
Tagging
Trunk links between switches insert an 802.1Q tag into each frame identifying which VLAN it belongs to.
Step 3
Isolated switching
Switches forward broadcast and unicast Layer 2 traffic only within ports sharing the same VLAN ID.
Step 4
Inter-VLAN routing
A router or Layer-3 switch is required for devices in different VLANs to communicate.
What Interviewer Expects
- Clear definition: logical broadcast domain independent of physical wiring
- Knows 802.1Q tagging and trunk ports
- Understands VLANs need a router/Layer-3 switch to communicate across them
- Can explain the security and performance benefits
Common Mistakes
- Thinking VLANs alone route traffic between each other
- Confusing VLAN tagging with IP subnetting (they are often paired, not the same thing)
- Forgetting trunk ports carry multiple VLANs over one physical link
- Assuming VLAN membership requires separate physical switches
Best Answer (HR Friendly)
“A VLAN is a way to logically split one physical network into several separate ones without running new cables — think of it like painting different colored tags on office phones so calls for one department never ring on another’s line, even though they all share the same wiring. It is widely used to keep, say, guest Wi-Fi separate from the corporate network on the same switches.”
Code Example
# Create a VLAN-tagged sub-interface (VLAN ID 10) on eth0
sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 192.168.10.1/24 dev eth0.10
sudo ip link set eth0.10 up
# Verify the VLAN interface
ip -d link show eth0.10
# eth0.10@eth0: <BROADCAST,MULTICAST,UP> vlan protocol 802.1Q id 10Follow-up Questions
- What is 802.1Q trunking and how does tagging work?
- How does inter-VLAN routing actually forward traffic between VLANs?
- What is a native VLAN and why can it be a security risk?
- How do VLANs interact with subnetting in a typical design?
MCQ Practice
1. What does a VLAN primarily create?
A VLAN logically separates broadcast domains without requiring separate physical switches.
2. What standard defines VLAN tagging on trunk links?
IEEE 802.1Q defines the VLAN tag inserted into Ethernet frames on trunk links.
3. What is required for devices in two different VLANs to communicate?
VLANs are isolated at Layer 2; a router or Layer-3 switch is needed to route between them.
Flash Cards
What is a VLAN? — A logical grouping of switch ports into a separate broadcast domain on shared physical hardware.
How is VLAN traffic tagged on trunks? — Via IEEE 802.1Q, which inserts a VLAN ID into the Ethernet frame.
Can two VLANs talk without a router? — No — a router or Layer-3 switch is required for inter-VLAN communication.
Main VLAN benefit? — Segments traffic for security and shrinks broadcast domains for performance.