.svg){kind=small}
A VLAN, or Virtual Local Area Network, divides a physical switched network into separate logical broadcast domains. Devices can be connected to the same physical switches while belonging to different VLANs, allowing the organisation to separate departments, device types, guest users, voice traffic or other groups without needing a completely separate physical switch for every network.
VLANs are a core enterprise networking concept and an important part of Cisco CCNA. They are commonly used alongside IP subnetting, trunk links and inter-VLAN routing.
What does VLAN stand for?
VLAN stands for Virtual Local Area Network.
A traditional Ethernet switch creates one Layer 2 broadcast domain unless it is divided logically. VLANs allow administrators to create several separate Layer 2 networks on the same switching infrastructure.
Why are VLANs used?
Organisations use VLANs for several reasons.
Logical separation
Users can be grouped by purpose rather than simply by which switch they happen to plug into.
For example:
- VLAN 10 - Finance
- VLAN 20 - Sales
- VLAN 30 - Voice
- VLAN 40 - Servers
- VLAN 50 - Guest Wi-Fi
Finance users on different floors can still belong to the same logical VLAN if the network is designed that way.
Smaller broadcast domains
Broadcast traffic inside one VLAN is not normally forwarded into another VLAN. This prevents every Layer 2 broadcast from reaching every device in the organisation.
Security and policy boundaries
Traffic moving between VLANs requires Layer 3 routing. That allows administrators to apply access controls or firewall policies between groups.
VLANs themselves are not a security system, but they provide useful segmentation boundaries.
Operational flexibility
Networks can be reorganised logically without rewiring the entire building or purchasing separate switching hardware for each department.
What is a broadcast domain?
A broadcast domain is the group of devices that can receive a Layer 2 broadcast.
Without VLANs, ports on a basic Layer 2 switch normally belong to the same broadcast domain.
When VLANs are configured, each VLAN becomes a separate broadcast domain.
A broadcast generated in VLAN 10 remains inside VLAN 10 unless a Layer 3 device performs some specialised forwarding behaviour.
What is an access port?
An access port normally belongs to one VLAN and connects an end device such as:
- a desktop computer
- a printer
- a server
- a camera
- an access point in some designs
If switch port GigabitEthernet 1/0/10 is assigned as an access port in VLAN 20, traffic received from the connected computer is associated with VLAN 20.
What is a trunk port?
A trunk carries traffic for multiple VLANs across one physical link.
Trunks are commonly used:
- between switches
- between switches and routers
- between switches and firewalls
- between switches and virtualisation hosts
Without trunks, separate physical links could be required for every VLAN that needed to cross between network devices.
What is 802.1Q tagging?
IEEE 802.1Q is the widely used Ethernet VLAN tagging standard.
When traffic crosses a trunk, an 802.1Q tag can identify which VLAN the Ethernet frame belongs to. The receiving network device reads the VLAN information and keeps traffic associated with the correct logical network.
End-user devices connected to ordinary access ports do not normally need to understand these tags because the switch handles the VLAN association.
What is a native VLAN?
On an 802.1Q trunk, the native VLAN is the VLAN whose frames are normally sent untagged by default.
Both ends of a trunk should agree on the native VLAN. A mismatch can cause connectivity and security problems and should be corrected during troubleshooting.
VLANs and IP subnets
A VLAN is a Layer 2 concept. An IP subnet is a Layer 3 concept.
In normal enterprise design, one VLAN is commonly associated with one IP subnet.
For example:
| VLAN | Purpose | IP subnet |
|---|---|---|
| 10 | Finance | 10.10.10.0/24 |
| 20 | Sales | 10.10.20.0/24 |
| 30 | Voice | 10.10.30.0/24 |
| 40 | Servers | 10.10.40.0/24 |
This creates a clear relationship between Layer 2 segmentation and Layer 3 addressing.
See What Is Subnetting? for the IP side of the design.
Can devices in different VLANs communicate?
Yes, but not directly at Layer 2.
Traffic between VLANs must be routed by a Layer 3 device. This is called inter-VLAN routing.
The routing function can be provided by:
- a router
- a multilayer or Layer 3 switch
- a firewall
The Layer 3 device has an interface or logical gateway associated with each relevant VLAN and routes traffic between their IP subnets.
What is a default gateway in a VLAN?
End devices need a default gateway to communicate with destinations outside their local IP subnet.
If VLAN 10 uses 10.10.10.0/24, the gateway might be:
10.10.10.1
When a Finance computer needs to reach a server in VLAN 40, it sends the packet to its default gateway. The Layer 3 device then makes the routing decision.
What is router-on-a-stick?
Router-on-a-stick is an inter-VLAN routing design where one physical router interface carries multiple VLANs using an 802.1Q trunk.
The router creates logical subinterfaces, with each subinterface associated with a VLAN and IP network.
It is useful for learning and smaller environments but larger enterprise networks often use Layer 3 switching for higher-performance inter-VLAN routing.
What is a switched virtual interface?
A Switched Virtual Interface, or SVI, is a logical Layer 3 interface associated with a VLAN on a multilayer switch.
An SVI can provide the default gateway for devices in that VLAN.
For example:
- VLAN 10 → interface VLAN 10 → 10.10.10.1
- VLAN 20 → interface VLAN 20 → 10.10.20.1
A Layer 3 switch can then route between those networks when IP routing is enabled and policy permits it.
What is a voice VLAN?
Many enterprise switches support a separate voice VLAN for IP phones.
A phone and a computer can sometimes share the same physical switch port while their traffic belongs to different VLANs. The phone's voice traffic is associated with the voice VLAN and the connected computer's traffic with the access VLAN.
This helps organisations apply different addressing, quality-of-service and security policies to voice traffic.
What is VLAN 1?
On Cisco switches, VLAN 1 has historically been the default VLAN for switch ports and some control-plane functions.
Production designs commonly avoid placing ordinary user traffic in VLAN 1 and follow organisational security standards for management and native VLAN configuration.
The exact recommended configuration depends on the platform and network design.
Can VLANs span multiple switches?
Yes. A VLAN can exist across several interconnected switches if the VLAN is configured and permitted across the relevant trunk links.
This can make VLANs very flexible, but organisations should also consider the size and failure domain of Layer 2 networks. Modern designs do not necessarily stretch every VLAN everywhere simply because it is technically possible.
VLAN vs subnet
| VLAN | Subnet |
|---|---|
| Layer 2 segmentation | Layer 3 IP addressing boundary |
| Configured primarily on switches | Defined through IP addresses and subnet masks/prefixes |
| Creates a broadcast domain | Defines an IP network |
| Frames stay within the VLAN unless routed | Packets need routing to reach another subnet |
They usually work together, but the terms should not be used interchangeably.
VLAN vs physical LAN
A physical LAN describes devices connected within a local network environment. A VLAN allows that physical switching infrastructure to contain several separate logical LANs.
The benefit is that network structure does not have to match the exact physical layout.
What is VLAN segmentation?
VLAN segmentation means separating devices into different VLANs based on a design objective.
Common examples include separating:
- corporate users from guests
- servers from general users
- IP phones from computers
- IoT devices from business systems
- management interfaces from production traffic
For meaningful security, VLAN segmentation should be combined with appropriate Layer 3 controls rather than assuming that creating a VLAN alone prevents all unwanted communication.
What is VLAN hopping?
VLAN hopping is a category of attack in which an attacker attempts to send traffic into a VLAN they should not normally access.
Network administrators reduce this risk through secure switch configuration, including careful trunk configuration, disabling unused ports, avoiding unnecessary dynamic trunk negotiation and following current vendor hardening guidance.
Common VLAN troubleshooting problems
Wrong access VLAN
A device is physically connected but the switch port belongs to the wrong VLAN.
VLAN missing on a switch
The port configuration references a VLAN that has not been created or is not active on the switch.
VLAN not allowed on a trunk
The VLAN exists on both switches but the trunk configuration does not carry it.
Native VLAN mismatch
The two ends of the trunk use different native VLAN settings.
Incorrect IP subnet
The VLAN is correct but the device has an address from the wrong IP network.
Default gateway problem
Devices communicate locally but cannot reach other VLANs because the gateway address or Layer 3 routing configuration is wrong.
What commands do CCNA learners use for VLANs?
Cisco IOS commands vary by platform and software version, but CCNA-level learners commonly become familiar with concepts such as:
- creating VLANs
- assigning access ports
- configuring trunks
- verifying VLAN membership
- checking trunk status
- configuring inter-VLAN routing
The objective is not simply to memorise commands. You should understand what the configuration is trying to achieve and be able to troubleshoot when traffic does not flow as expected.
Frequently asked questions
Does each VLAN need a different IP subnet?
In normal enterprise network design, yes. Each VLAN is usually associated with its own IP subnet.
Can two VLANs use the same VLAN number on different switches?
Yes, and if the switches are connected appropriately, they may represent the same Layer 2 VLAN. VLAN configuration and propagation must be designed deliberately.
How many VLANs can a switch support?
The supported number depends on the switch platform and software. IEEE 802.1Q uses a 12-bit VLAN identifier field, although some values are reserved and individual products may have their own limits.
Does a VLAN improve security?
It can support security by creating segmentation boundaries, but VLANs should be combined with routing, firewall or access-control policies and secure switch configuration.
Is a guest Wi-Fi network a VLAN?
It may use one or more VLANs as part of its design. Wireless systems commonly map different SSIDs or user groups to different VLANs.
Do home networks use VLANs?
Some advanced home and small-business networks do, particularly to separate IoT devices, guests and trusted systems. Many basic consumer routers hide VLAN complexity from the user.
Develop your Cisco switching skills with ExperTrain
ExperTrain offers instructor-led Cisco training covering switching, routing, wireless, security, automation and specialist Cisco technologies.
The Implementing and Administering Cisco Solutions (CCNA) course provides hands-on coverage of VLANs, trunks, routing, IPv4 and IPv6 and other essential network technologies.
You can also explore the Cisco Glossary, read What Is Subnetting? or compare CCNA vs CCNP.
Further reading
Found this article useful? Add ExperTrain as a Preferred Source on Google to help surface more of our training guides, articles and learning resources.
.png){kind=small}
