Introduction
A VLAN (Virtual LAN) is a logical grouping of devices on a switch (or across multiple switches) that behaves as if it were its own separate physical LAN, even though the underlying hardware is shared. VLANs let network administrators segment traffic for security, performance, and organizational reasons without needing separate physical switches for every department or function.
Cricket analogy: A VLAN is like assigning players to separate practice groups (batters, bowlers, fielders) using the same shared training ground, letting each group train as if they had their own dedicated facility without building separate grounds for each.
Explanation
Without VLANs, every device connected to a switch belongs to a single broadcast domain: broadcast traffic (like ARP requests) reaches every port, and any device can potentially see traffic meant for the local segment. VLANs divide a switch's ports into separate broadcast domains identified by a VLAN ID (typically 1-4094). Devices in different VLANs cannot communicate directly at Layer 2, even if physically connected to the same switch; traffic must be routed between VLANs by a Layer 3 device (a router or a Layer 3 switch performing 'router-on-a-stick' or inter-VLAN routing) to cross VLAN boundaries.
Cricket analogy: Without VLANs, every fielder hears every call shouted across the ground, a single broadcast domain; VLANs are like dividing the ground into numbered zones (1-4094) so a call in the slip cordon doesn't reach the boundary fielders, and moving info between zones requires the captain, a router, to relay it.
The IEEE 802.1Q standard defines how VLAN membership is signaled on Ethernet frames: a 4-byte VLAN tag (including a 12-bit VLAN ID field) is inserted into the frame header. A switch port can be configured as an access port, which belongs to exactly one VLAN and sends/receives untagged frames to/from the connected end device (the device itself has no awareness of VLANs), or as a trunk port, which carries traffic for multiple VLANs simultaneously between switches (or to a router) by tagging each frame with its VLAN ID so the receiving device knows which VLAN the frame belongs to. Trunk links are essential for extending the same set of VLANs across multiple switches in a network.
Cricket analogy: 802.1Q tagging is like stamping each player's kit with a numbered team badge; an access port is like a single-team locker room where players don't need to show the badge, untagged, one VLAN only, while a trunk port is like a shared team bus carrying multiple teams' tagged kits at once between venues.
Example
# Conceptual Cisco IOS-style switch configuration
interface GigabitEthernet0/1
description Access port for HR workstation
switchport mode access
switchport access vlan 10
interface GigabitEthernet0/2
description Access port for Engineering workstation
switchport mode access
switchport access vlan 20
interface GigabitEthernet0/24
description Trunk link to core switch (carries VLAN 10 and 20)
switchport mode trunk
switchport trunk allowed vlan 10,20Analysis
The core benefit of VLANs is that they decouple logical network topology from physical wiring: devices can be grouped by function (HR, Engineering, Guest Wi-Fi, VoIP phones) regardless of which physical switch or port they connect to, and broadcast traffic and Layer 2 attacks (like ARP spoofing within a segment) are contained within each VLAN rather than flooding the entire network. This also improves security, since traffic in one VLAN is isolated from another unless explicitly permitted to route between them, and it improves performance by shrinking each broadcast domain. The tradeoff is added configuration complexity: trunk ports must be configured consistently across switches, and inter-VLAN routing must be planned wherever VLANs need to communicate.
Cricket analogy: VLANs let you group players by role (batters, bowlers, fielders) regardless of which changing room they physically sit in, containing a rowdy dressing-room argument to just that group rather than disrupting the whole team, though coordinating shared team buses (trunk links) across venues adds scheduling complexity.
Key Takeaways
- A VLAN creates a separate logical broadcast domain on top of shared physical switch hardware.
- 802.1Q tagging inserts a VLAN ID into the Ethernet frame header so switches and routers know which VLAN a frame belongs to.
- Access ports belong to one VLAN and carry untagged traffic to end devices; trunk ports carry tagged traffic for multiple VLANs between switches/routers.
- Devices in different VLANs cannot communicate without Layer 3 routing between the VLANs.
Practice what you learned
1. What does an 802.1Q VLAN tag primarily add to an Ethernet frame?
2. What is the difference between an access port and a trunk port?
3. How can two devices in different VLANs on the same switch communicate?
4. What is a primary benefit of using VLANs on a network?
Was this page helpful?
You May Also Like
MAC Addressing and Switching
How 48-bit MAC addresses identify devices and how switches learn and use them to forward frames.
Ethernet Standards
Common Ethernet naming and speeds (10BASE-T to Gigabit and beyond) and why CSMA/CD is largely obsolete on modern switched networks.
Hubs, Switches, and Routers
Learn how hubs, switches, and routers operate at different OSI layers and how they shape collision and broadcast domains.