VLANs in the Office: Segmentation

The "Guest" Problem

Imagine you run an office. You have three categories of devices that all need network access:

1. Corporate Laptops: Need access to internal file servers, printers, and cloud resources.
2. Guest iPhones: Visitors who just need internet access to check email.
3. Security Cameras: Should record footage to a local NVR (Network Video Recorder) and never touch the internet.

If you plug all three into the same switch with no segmentation, you've created a flat network. A guest device could attempt to reach your file server. A compromised camera could scan corporate laptops. A misconfigured laptop could broadcast traffic that disrupts everything else.

Virtual LANs (VLANs) solve this by taking one physical switch and dividing it into multiple isolated logical switches. Each VLAN is identified by a number (1–4094) called the VLAN ID or VID.

Switch Port Assignment:
  Ports 1–10   → VLAN 10 (Corporate)
  Ports 11–20  → VLAN 20 (Guest)
  Ports 21–24  → VLAN 30 (IoT/Cameras)

A device on VLAN 10 sends a broadcast (like an ARP request). The switch only forwards that broadcast to other ports in VLAN 10 — ports 11–24 never see it. The VLANs are invisible to each other at Layer 2.

Trunk Ports: Carrying Multiple VLANs on One Cable

When a cable needs to carry traffic for multiple VLANs — for example, the uplink from a switch to a router, or the cable from a switch to a WiFi access point that broadcasts three SSIDs — you use a trunk port. The switch tags each Ethernet frame with its VLAN ID using the 802.1Q standard. The tag is a 4-byte header inserted into the Ethernet frame that tells the receiving device which VLAN the frame belongs to.

Normal (Access) Port:  Frame has no VLAN tag. Device doesn't know about VLANs.
Trunk Port:            Frame gets a 802.1Q tag: [VLAN ID: 20] inserted into header.

Inter-VLAN Routing: The Firewall as Gatekeeper

VLANs isolate traffic at Layer 2, but sometimes you need controlled communication between them. A corporate laptop might need to reach a printer on the IoT VLAN. This traffic must leave VLAN 10, pass through a Layer 3 device (a router or firewall), and enter VLAN 30. The firewall applies rules: "Corporate laptops may reach the printer on port 9100. Nothing else." This is inter-VLAN routing, and the firewall is the only path between segments.

This architecture means a compromised guest device is contained. Even if it tries to reach the corporate file server, the packet hits the firewall, which drops it. The blast radius of any breach is limited to one VLAN.