What is VLAN?

A VLAN (Virtual LAN) is a separate layer-2 network created inside shared switches, so devices on the same hardware can be kept in different broadcast domains.

Without VLANs, every port on a switch is in one broadcast domain: a broadcast from any device, such as an ARP request, reaches every other device. VLANs divide the switch logically. Each VLAN has a number from 1 to 4094, and the switch only forwards frames between ports in the same VLAN, as if they were separate switches. Ports facing ordinary devices are access ports: they belong to one VLAN and send and receive untagged frames, so the device doesn't know VLANs exist. Links between switches, or to a router, are trunks that carry many VLANs at once, marking each frame with an 802.1Q tag: 4 bytes inserted after the source MAC address, holding a 12-bit VLAN ID and a 3-bit priority. Untagged frames arriving on a port are placed in its PVID, the VLAN often called "native" on trunks.

Network engineers use VLANs to separate staff, guests, printers, phones and servers, which limits broadcast traffic and lets a firewall control what passes between groups. Because the VLANs are separate networks, hosts in different VLANs can only talk through a router, either a router with a tagged sub-interface per VLAN on a trunk ("router on a stick") or a layer-3 switch using an SVI per VLAN. Each VLAN normally gets its own IP subnet and gateway. Common mistakes include a VLAN missing from the allowed list on one trunk, mismatched native VLANs at the two ends of a link, and assuming VLANs alone are a security boundary when the router between them allows everything. The Switching basics lesson builds access ports, a trunk and inter-VLAN routing on a real switch and VyOS router.