intermediate v1 • Updated 7 hours ago

VLANs (Virtual Local Area Networks) & 802.1Q

A VLAN is a logically segmented broadcast domain configured on Layer 2 switches that isolates network traffic without requiring physical cabling separation.

Remember This Key Rule

1 VLAN = 1 Broadcast Domain = 1 IP Subnet. Access ports connect end hosts (untagged); Trunk ports connect switches (802.1Q tagged).

In Simple Terms

By default, all ports on a switch belong to one single broadcast domain (VLAN 1). With VLANs, you can assign ports 1-10 to VLAN 10 (HR) and ports 11-20 to VLAN 20 (Engineering). Even though they are plugged into the exact same physical switch, HR and Engineering cannot communicate directly, and HR broadcasts will never reach Engineering.

Visual Diagram & Flow

VLAN 10: HR
192.168.10.0/24

802.1Q Trunk
(Tags: 10, 20)

VLAN 20: Dev
192.168.20.0/24

Why It Matters in Real Networks

VLANs provide vital department security, contain broadcast storms, optimize bandwidth, and simplify network management.

How It Works (Technical Breakdown)

- **Access Port**: Belongs to exactly one VLAN and connects to end devices (PCs, printers). Carries standard untagged Ethernet frames. - **Trunk Port**: Connects switches together (or switch to router). Carries traffic for multiple VLANs simultaneously. - **IEEE 802.1Q Tagging**: The trunk inserts a 4-byte 802.1Q tag into the Ethernet header containing the 12-bit VLAN ID (1 to 4094). - **Native VLAN**: The single VLAN whose frames travel across a trunk link without an 802.1Q tag (default is VLAN 1).

Real-World Analogy

A physical switch is like an apartment building. Creating VLANs is like installing secure keycard access on different floors so guests on Floor 2 cannot walk onto Floor 3.

Concrete Example

Switch 1 has VLAN 10 (Sales: `192.168.10.0/24`) and VLAN 20 (Finance: `192.168.20.0/24`). Port Gi0/24 is configured as an 802.1Q trunk carrying VLANs 10 and 20 to Switch 2.

Common Engineering Mistakes & Pitfalls

Assigning different VLANs to the same IP subnet, or forgetting that devices in different VLANs CANNOT communicate without a Layer 3 routing device.

Prerequisites

Layer 2 Switch vs Layer 3 Router Recommended MAC Address & Ethernet Frame Structure Recommended

Next & Related Concepts

Inter-VLAN Routing (Router-on-a-Stick & SVI) Unlocks Next → Spanning Tree Protocol (STP & RSTP) Unlocks Next → DHCP (Dynamic Host Configuration Protocol) Unlocks Next →

Concept Mastery Quiz

Test your comprehension with active-recall questions.

1. What is the function of the IEEE 802.1Q standard on a switch trunk port?

Active Recall Flashcards

Click each flashcard to reveal the answer and test your memory.

No flashcards created for this topic yet.

Content Versioning

Audit trail of revisions and updates for this knowledge topic.

Version	Change Summary	Author	Timestamp
v1 (Current)	Active production content	system	Sun, Aug 23, 2026 11:09 AM