VLAN Notes
The networking fundamentals page introduced switches and broadcast domains. VLANs are the next step: they let one physical switching infrastructure behave like several smaller networks, which improves performance, security, and troubleshooting.
The Problem: Life Before VLANs
Imagine a traditional network where all the computers, printers, and servers are plugged into a single physical switch. This entire setup creates one massive broadcast domain.
Whenever a device needs to find another device, such as sending an ARP request, it broadcasts that request to every device in the same domain.
The result is unnecessary noise. As the network grows, those broadcasts become harder to control, troubleshooting becomes slower, and one faulty device can affect more users than it should.
The Solution: The Virtual Switch
802.1Q is where the Virtual Local Area Network, or VLAN, steps in. Instead of buying separate, expensive physical switches for HR, IT, and Sales, a VLAN allows you to take one physical switch and logically slice it into multiple virtual switches.
Devices in VLAN 10 behave as if they are on one switch. Devices in VLAN 20 behave as if they are on another. They can share the same hardware, but they do not share the same Layer 2 broadcast domain unless a Layer 3 device routes between them.
Insider threats: If everyone is in the same domain, an employee in Sales running a packet sniffer can much more easily capture sensitive traffic meant for HR.
Malware spread: Without internal boundaries, a single infected computer can spread worms or ransomware across the entire company network unchecked.
Performance loss: A broadcast storm can overwhelm a switch and disrupt a whole segment, especially when a loop exists and loop prevention is missing or misconfigured.
VLAN hopping is an attack that specifically targets VLAN configurations. Threat actors cannot do it in the "before VLANs" scenario, but it is exactly what they may try after VLANs are implemented. A later security chapter should cover how to prevent it.
How It Works Under the Hood
Now we know we need to separate HR, such as VLAN 10, and Sales, such as VLAN 20, even though they are plugged into the exact same physical switch.
When a standard computer in HR sends data, it usually does not know what a VLAN is. It sends a normal Ethernet frame. The switch assigns that frame to the VLAN configured on the port.
Access Ports and Trunk Ports
An access port belongs to one VLAN and usually connects to an endpoint such as a laptop, printer, phone, or camera. Frames entering and leaving access ports are normally untagged from the endpoint's point of view.
A trunk port carries multiple VLANs between switches, routers, firewalls, or hypervisors. To keep traffic separated on the same physical link, the switch adds an 802.1Q tag that identifies the VLAN.
Access ports are for one local lane. Trunk ports are shared highways, so every frame needs a VLAN tag that says which lane it belongs to.
Native VLANs and Practical Checks
On an 802.1Q trunk, the native VLAN is the VLAN used for untagged traffic. In real networks, native VLAN mismatches can cause confusing reachability and security issues, so both sides of a trunk should be configured intentionally and verified.
Useful checks include confirming the access VLAN on endpoint ports, checking allowed VLANs on trunks, validating the native VLAN, and making sure inter-VLAN routing is handled by the correct router, firewall, or Layer 3 switch.