VLANs — Virtual Network Segmentation

In the early days of Ethernet, every device on a LAN shared the same broadcast domain. Every ARP request, every DHCP discover, every NetBIOS name resolution — every single one of these frames was sent to every device on the network simultaneously. With 20 computers this was tolerable. With 400 devices, broadcasts consumed significant bandwidth and CPU cycles on every endpoint. With 1,000 devices, network-wide broadcast storms could render the entire segment unusable.

The deeper problem was security. A flat network gives every device direct Layer 2 access to every other device. The accounting server sits on the same broadcast domain as the receptionist's PC. The hospital's imaging machines share a network with the administrative desktops. There is no boundary, no checkpoint. Anyone who can physically plug into any switch port can reach anything.

The traditional solution was physical segmentation: buy more routers, run more cabling, create separate physical networks for each department. Finance gets its own switch and router interface, Engineering gets another, Servers get a third. This worked but was brutally expensive, inflexible (moving a desk meant rewiring), and required significant capital expenditure for each new segment.

The Virtual Solution

IEEE 802.1Q (1998) defined a standard for Virtual LANs — logical broadcast domains that are independent of physical topology. A VLAN is software-defined: the switch administrator assigns each port to a VLAN ID, and the switch enforces isolation between VLANs in hardware. One physical switch can simultaneously carry dozens of isolated VLANs. Hosts in the same room can be in different VLANs (isolated from each other), while hosts in different buildings can be in the same VLAN (as if directly connected).

The only way traffic can cross VLAN boundaries is through a Layer 3 device — a router or a Layer 3 switch. This creates a natural security enforcement point: all inter-segment traffic must pass through a router or firewall, where access control lists (ACLs) or firewall policies can inspect, permit, or deny every flow. VLANs transform security from "physical location" to "software-defined policy."

Access Ports vs. Trunk Ports

Switch ports operate in two fundamental modes. An access port belongs to exactly one VLAN. Frames arriving on an access port are untagged — the end device (PC, printer, IP phone, server) has no knowledge of VLANs. The switch silently assigns all incoming frames to the configured VLAN and strips any VLAN tag when forwarding out to the end device.

A trunk port carries traffic from multiple VLANs simultaneously. Trunk ports are used to interconnect switches, connect to routers for inter-VLAN routing, and connect to hypervisors that host VMs in different VLANs. Frames on trunk ports carry an 802.1Q tag identifying which VLAN they belong to. The administrator configures an "allowed VLAN list" on each trunk — VLANs not in this list are pruned (blocked) from the trunk.

The 802.1Q Tag Structure

The 802.1Q standard inserts a 4-byte tag into the Ethernet frame header, inserted between the source MAC address and the original EtherType field. This makes 802.1Q-tagged frames slightly larger than standard Ethernet frames (1522 bytes max vs. 1518 bytes). The tag contains four fields:

TPID (Tag Protocol Identifier) — 2 bytes, always 0x8100. This identifies the frame as 802.1Q tagged. Devices that don't understand VLANs see 0x8100 as an unknown EtherType and may drop the frame — this is intentional.

TCI (Tag Control Information) — 2 bytes comprising three sub-fields: 3-bit PCP (Priority Code Point, 0–7 for 802.1p QoS marking), 1-bit DEI (Drop Eligible Indicator, frames may be discarded under congestion), and 12-bit VID (VLAN Identifier) ranging from 0 to 4095.

The Native VLAN

On a trunk port, one VLAN is designated the native VLAN. Frames from the native VLAN are sent untagged across the trunk (for backward compatibility with older untagged equipment). Untagged frames received on a trunk port are assigned to the native VLAN. By default on Cisco equipment, VLAN 1 is the native VLAN.

# Cisco IOS — configure access port in VLAN 10
interface GigabitEthernet0/1
  description PC-Engineering-Floor-1
  switchport mode access
  switchport access vlan 10
  spanning-tree portfast

# Cisco IOS — configure trunk port between switches
interface GigabitEthernet0/24
  description Trunk-to-SW-DIST-01
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 999
  switchport trunk allowed vlan 10,20,30,99

Dynamic Trunking Protocol (DTP)

Cisco's proprietary DTP automatically negotiates trunk formation between switches. A port in "dynamic desirable" mode will actively try to form a trunk; "dynamic auto" will form a trunk if the other end initiates. While convenient in small labs, DTP is a security risk in production: an attacker can plug in a device that sends DTP frames, causing the switch port to trunk up, potentially exposing all VLANs.

Best practice: explicitly set every port to either switchport mode access or switchport mode trunk, and disable DTP negotiation on trunk ports with switchport nonegotiate. Never rely on auto-negotiation for security-sensitive switch ports.

Router-on-a-Stick

The classic method uses a single router physical interface connected to a trunk port. The router creates logical sub-interfaces, each encapsulating a different VLAN tag and configured with the gateway IP for that VLAN. All inter-VLAN traffic must exit the switch, travel up to the router's single uplink, get routed, and return on the same trunk link.

# Cisco IOS — router-on-a-stick configuration
interface GigabitEthernet0/0.10
  encapsulation dot1q 10
  ip address 10.10.10.1 255.255.255.0

interface GigabitEthernet0/0.20
  encapsulation dot1q 20
  ip address 10.10.20.1 255.255.255.0

interface GigabitEthernet0/0.30
  encapsulation dot1q 30
  ip address 10.10.30.1 255.255.255.0

Router-on-a-stick works well for small networks and labs. The limitation is bandwidth: all inter-VLAN traffic shares the single uplink's capacity. If the link is 1 Gbps and you have Engineering at 200 Mbps, Sales at 150 Mbps, and Servers at 400 Mbps all simultaneously doing inter-VLAN transfers, you've already saturated the uplink.

Layer 3 Switches and SVIs

Modern enterprise networks use Layer 3 switches for inter-VLAN routing. A Switched Virtual Interface (SVI) is a logical Layer 3 interface for each VLAN on the switch itself. Each SVI has an IP address that serves as the default gateway for that VLAN. Routing between SVIs happens in the switch's hardware ASICs using the FIB (Forwarding Information Base), at line rate.

The performance difference is dramatic. Router-on-a-stick with software routing: ~50 µs per-packet latency. Layer 3 switch ASIC routing: ~1–3 µs. A Cisco Catalyst 9300 can route 200+ million packets per second across SVIs in hardware — orders of magnitude beyond what any router can achieve on the same budget.

# Cisco IOS — Layer 3 switch with SVIs
ip routing

interface Vlan10
  description Engineering Gateway
  ip address 10.10.10.1 255.255.255.0
  no shutdown

interface Vlan20
  description Sales Gateway
  ip address 10.10.20.1 255.255.255.0
  no shutdown

interface Vlan30
  description Servers Gateway
  ip address 10.10.30.1 255.255.255.0
  no shutdown

interface Vlan99
  description Management Gateway
  ip address 10.10.99.1 255.255.255.0
  no shutdown

CEF and the Hardware Fast Path

Cisco's CEF (Cisco Express Forwarding) pre-builds a hardware FIB from the software routing table. After the first packet of a new flow is processed in software (the "process switching" path), CEF installs a flow entry and subsequent packets are switched entirely in hardware without CPU involvement. This is called fast-path or hardware switching.

Modern switch ASICs go further: ternary content-addressable memory (TCAM) allows parallel lookups across all FIB entries in a single clock cycle, regardless of table size. A 100,000-entry routing table and a 10-entry routing table have identical lookup latency in TCAM hardware.

VLAN Trunking Protocol (VTP)

Cisco's proprietary VTP synchronizes VLAN databases across all switches in a VTP domain. The VTP Server holds the authoritative VLAN database; Client switches receive updates and propagate them. The revision number determines precedence — the switch with the highest revision wins.

The danger: any switch can be brought in from another deployment, lab environment, or storage with a higher revision number. Plugging it in propagates its (possibly empty or outdated) VLAN database to the entire campus instantly, dropping all active VLANs and crashing the network. This has caused production outages at Fortune 500 companies.

Private VLANs (PVLANs)

Private VLANs (IEEE 802.1Q-2003 extension) add isolation within a VLAN. Used primarily in hosting environments where multiple customers share a VLAN but must be isolated from each other. The PVLAN structure uses a primary VLAN containing secondary VLANs:

Promiscuous port — can communicate with all ports in all secondary VLANs. Typically the uplink to the router or gateway.

Isolated port — can only communicate with the promiscuous port. Two isolated ports in the same PVLAN cannot reach each other directly.

Community port — can communicate with other ports in the same community and with the promiscuous port, but not with isolated ports or other communities.

A typical web hosting scenario: all customer web servers are in an isolated secondary VLAN, sharing one IP subnet (e.g., 192.168.1.0/24). They can all reach the gateway (promiscuous port) for internet access, but they cannot reach each other directly — even though they share the same subnet. This prevents one compromised server from attacking others via Layer 2 techniques.

QinQ (IEEE 802.1ad)

QinQ stacks two 802.1Q tags in a single frame: an outer S-Tag (Service VLAN, 0x88a8) and an inner C-Tag (Customer VLAN, 0x8100). Service providers use QinQ to transparently carry customer VLANs across a provider backbone.

The math: 4,094 usable S-Tags × 4,094 usable C-Tags ≈ 16.7 million unique combinations. This effectively eliminates VLAN ID conflicts between customers — each customer can use VLAN IDs 1–4094 internally without interfering with other customers using the same IDs. The provider's backbone only sees the S-Tag; the C-Tag is opaque.

VXLAN — VLANs at Cloud Scale

Enterprise VLANs max out at 4,094 segments. AWS, Azure, and Google Cloud run millions of isolated tenant networks simultaneously — 4,094 VLANs is laughably insufficient. VXLAN (Virtual Extensible LAN, RFC 7348) solves this by encapsulating Layer 2 Ethernet frames inside UDP packets. The VXLAN header contains a 24-bit VNI (VXLAN Network Identifier), supporting 16,777,216 unique virtual networks.

Each hypervisor runs a VTEP (VXLAN Tunnel Endpoint) that encapsulates/decapsulates VXLAN traffic. From the VM's perspective, it's on a flat Layer 2 network. From the physical network's perspective, it's all just UDP traffic on port 4789. VXLAN enables VM mobility across physical racks, rows, and even data centers while maintaining Layer 2 adjacency.

VLAN Hopping via Double-Tagging

The most famous VLAN attack is double-tagging, exploiting the native VLAN's untagged behavior. An attacker on the native VLAN sends a frame with two 802.1Q tags: the outer tag matches the native VLAN (stripped by the first switch), and the inner tag contains the target VLAN ID. The first switch forwards the frame to the second switch, which sees only the inner tag and delivers it to the victim VLAN.

This attack is unidirectional only — the attacker can send frames into the target VLAN but cannot receive responses (responses would be tagged correctly and not reach the attacker's VLAN). Despite this limitation, it's sufficient to send exploit payloads, ARP packets, or probe for vulnerabilities in the victim VLAN.

DTP-Based VLAN Hopping

A simpler form of VLAN hopping exploits DTP. If an attacker connects to a switch port that is in "dynamic auto" or "dynamic desirable" DTP mode, they can send DTP frames causing the switch to negotiate the port into trunk mode. Once the port is a trunk, the attacker can tag frames with any VLAN ID and access any VLAN carried by that trunk.

Mitigation: explicitly configure all end-host ports with switchport mode access and switchport nonegotiate. These two commands together ensure DTP frames are never sent or honored on the port.

MAC Flooding and CAM Table Overflow

A switch maintains a CAM (Content Addressable Memory) table mapping MAC addresses to ports. If an attacker floods the switch with frames containing thousands of fake source MAC addresses, the CAM table fills up and new legitimate MACs cannot be learned. The switch enters fail-open mode, broadcasting all frames to all ports — effectively turning the switch into a hub and allowing the attacker to capture all traffic.

Defense: Port Security limits the number of MAC addresses allowed on a port (e.g., switchport port-security maximum 3). Exceeding the limit triggers an action: protect (drop), restrict (drop + log), or shutdown (disable port). 802.1X authentication provides stronger protection by authenticating devices before allowing network access.

VLAN ACLs (VACLs)

Standard router ACLs filter traffic between VLANs at Layer 3. But what about filtering traffic within a VLAN? VLAN ACLs (VACLs) on Cisco switches apply to all traffic within a VLAN — both routed and bridged. A VACL can block specific protocols, IP addresses, or port numbers between hosts in the same VLAN, where a router ACL would never see the traffic.

Leaf-Spine and VXLAN Fabric

Modern data centers use a leaf-spine topology. Leaf switches connect to servers; spine switches interconnect all leaves in a full mesh. Every leaf connects to every spine — this guarantees that any server can reach any other server in exactly two hops (leaf → spine → leaf). There is no hierarchy, no bottleneck core.

In a VXLAN-based leaf-spine fabric, each leaf switch is a VTEP. VMs on different leaves that belong to the same VXLAN segment communicate through VXLAN-encapsulated UDP tunnels between VTEPs. The spine layer is pure IP — it has no knowledge of the overlay VLANs. This separation of underlay (IP transport) from overlay (virtual networks) is the key architectural principle.

BGP EVPN Control Plane

BGP EVPN (Ethernet VPN, RFC 7432) is the control plane for VXLAN fabrics. Instead of flooding ARP requests across the fabric (as traditional VLANs do), BGP EVPN distributes MAC and IP binding information between VTEPs using BGP UPDATE messages. When a VM comes online, its local VTEP advertises the MAC/IP to all other VTEPs via BGP. ARP requests are answered locally from a distributed database rather than flooded across the fabric.

This eliminates the flood-and-learn behavior that makes traditional VLANs unscalable. BGP EVPN also enables efficient multi-site connectivity, VM live migration with preserved MAC/IP bindings, and consistent policy application across data center fabrics.

Microsegmentation

Traditional VLANs create perimeter security — you secure the boundary between VLANs but traffic within a VLAN is trusted. In modern zero-trust architectures, this is insufficient. Microsegmentation applies firewall policies at the individual workload level, regardless of VLAN.

VMware NSX and Cisco ACI implement microsegmentation using distributed firewalls in the hypervisor's vSwitch. Each VM has its own firewall policy enforced at the virtual NIC level. Two VMs in the same VLAN can be isolated from each other by policy. This is computationally expensive in software but is offloaded to SmartNICs (Data Processing Units — DPUs) in modern deployments.

Cisco IOS VLAN Configuration

! Create VLANs
vlan 10
 name ENGINEERING
vlan 20
 name SALES
vlan 30
 name SERVERS
vlan 99
 name MANAGEMENT
vlan 999
 name UNUSED_NATIVE

! Access ports
interface range GigabitEthernet0/1-10
 description Engineering-Workstations
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable

! Trunk port
interface GigabitEthernet0/24
 description Uplink-to-Distribution
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,99
 switchport nonegotiate

! Layer 3 SVIs
ip routing
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
 no shutdown
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 no shutdown
interface Vlan30
 ip address 10.10.30.1 255.255.255.0
 no shutdown

Verification Commands

# Show VLAN database
show vlan brief

# Show trunk ports and allowed VLANs
show interfaces trunk

# Show a specific interface's VLAN assignment
show interfaces GigabitEthernet0/1 switchport

# Show spanning tree per VLAN
show spanning-tree vlan 10

# Show MAC address table for a VLAN
show mac address-table vlan 10

# Show SVI status
show interfaces vlan 10

Linux (Open vSwitch) VLAN Configuration

# Create OVS bridge
ovs-vsctl add-br br0

# Add access port for VLAN 10
ovs-vsctl add-port br0 eth1 tag=10

# Add trunk port with VLANs 10,20,30
ovs-vsctl add-port br0 eth2 trunks=10,20,30

# Add VXLAN tunnel (VTEP)
ovs-vsctl add-port br0 vxlan0   -- set interface vxlan0 type=vxlan      options:remote_ip=192.168.1.2      options:key=1000

# Linux kernel VLAN (for servers)
ip link add link eth0 name eth0.10 type vlan id 10
ip addr add 10.10.10.100/24 dev eth0.10
ip link set eth0.10 up

Wireless networks need VLAN integration too. A corporate campus might have one SSID for employees (mapped to the corporate VLAN), one for guests (mapped to an isolated guest VLAN), and one for IoT devices (mapped to a restricted IoT VLAN) — all broadcasting from the same physical access point.

SSID-to-VLAN Mapping

Modern wireless controllers (Cisco WLC, Aruba, Meraki) map each SSID to a VLAN. The access point's uplink to the switch is a trunk port carrying all VLANs. When a client connects to the guest SSID, the AP tags their traffic with the guest VLAN ID before forwarding it to the switch. The switch treats this traffic identically to any wired VLAN 50 traffic.

# Cisco WLC — WLAN to VLAN mapping
(Cisco Controller) > config wlan interface <wlan-id> <interface-name>

# Example interfaces:
# SSID "CorpNet"   → management interface (VLAN 10)
# SSID "GuestWifi" → dynamic interface (VLAN 100)
# SSID "IoT-Mgmt"  → dynamic interface (VLAN 200)

# Switch AP uplink
interface GigabitEthernet0/20
 description AP-Uplink-Floor-1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,100,200

Guest VLAN Isolation

Guest VLANs require careful design. Guests need internet access but must be isolated from the corporate network. The standard architecture: guest VLAN traffic exits through a dedicated firewall rule that allows only outbound internet traffic (TCP 80, 443, DNS) while blocking all access to RFC 1918 (private) address space. Dynamic captive portal registration can be implemented by intercepting guest HTTP traffic.

The 3-bit PCP field in the 802.1Q TCI provides Layer 2 QoS marking — called 802.1p. PCP values range from 0 (best effort) to 7 (highest priority). This allows switches to prioritize voice traffic (PCP=5), video traffic (PCP=4), and drop best-effort internet traffic last (PCP=0 or 1) when queues fill under congestion.

CoS-to-DSCP Mapping

PCP (Class of Service, CoS) operates at Layer 2; DSCP (Differentiated Services Code Point) operates at Layer 3 in the IP header. As traffic crosses router boundaries, Layer 2 tags are stripped and only the IP DSCP value persists. QoS policy must map CoS to DSCP at the first L3 hop to ensure consistent treatment across the routed network.

! Cisco IOS — trust CoS marking on ingress
interface GigabitEthernet0/1
 mls qos trust cos

! Map CoS to DSCP globally
mls qos map cos-dscp 0 8 16 24 32 46 48 56

! Apply a QoS policy on voice VLAN
policy-map VOICE-POLICY
 class VOICE-CLASS
  set dscp ef
  priority 1000       ! 1 Gbps guaranteed
 class class-default
  fair-queue

Voice VLANs (Auxiliary VLANs)

IP phones create a special VLAN challenge: the phone is on an access port, but so is the PC connected through the phone's built-in switch. Cisco's auxiliary VLAN (also called voice VLAN) solves this: the port carries two VLANs simultaneously — the data VLAN (untagged, for the PC) and the voice VLAN (tagged with PCP=5, for the phone). The phone learns its VLAN from CDP/LLDP and tags its traffic accordingly.

interface GigabitEthernet0/5
 description IP-Phone-with-PC
 switchport mode access
 switchport access vlan 10           ! PC data traffic — untagged
 switchport voice vlan 40            ! IP phone voice — 802.1Q tagged
 mls qos trust cos                   ! trust CoS marking from phone
 spanning-tree portfast

Enterprise Three-Tier Model

The traditional enterprise campus uses a three-tier hierarchy: Access → Distribution → Core. VLAN assignment happens at the Access layer (end devices). Distribution layer switches (L3) terminate SVIs and route between VLANs. Core switches (L3) carry aggregated traffic between buildings.

VLAN IDs are typically standardized campus-wide. VLAN 10 is always Engineering regardless of which building. This consistency allows network engineers to troubleshoot any switch in the campus using the same mental model. Documentation and monitoring tools that reference VLAN IDs remain valid across refreshes.

VLAN Numbering Standards

There is no enforced VLAN numbering convention, but common schemes include: low numbers (10–99) for user VLANs organized by department, mid-range (100–199) for servers organized by function, high range (200–299) for wireless/IoT, and 800–899 for management. Using multiples of 10 leaves room for future sub-segmentation (VLAN 11 could be "Engineering Guest" without conflict).

VLAN Sprawl and Lifecycle Management

Large networks develop VLAN sprawl — hundreds of VLANs created for projects that have since ended, but nobody deleted them. Abandoned VLANs consume CAM table entries, generate unnecessary STP topology computations, and create security uncertainty ("who knows what's in VLAN 847?"). Best practice: document every VLAN with owner, purpose, and review date. Implement a quarterly VLAN audit that flags VLANs with zero traffic for decommissioning review.

The Five Most Common VLAN Issues

1. Native VLAN mismatch. Symptom: inter-switch connectivity works but specific VLANs have traffic issues, or STP errors appear in logs. Diagnosis: show interfaces trunk on both ends of a trunk link and compare native VLAN.

2. Missing VLAN in trunk allowed list. Symptom: hosts in a specific VLAN cannot communicate across switches even though the VLAN exists on both. Diagnosis: show interfaces trunk — the VLAN must appear in "VLANs allowed and active in management domain" column, not just "VLANs allowed on trunk."

3. VLAN exists on access port but not in VLAN database. Symptom: port is assigned VLAN X but traffic doesn't flow. The VLAN must be created in the VLAN database (vlan X) not just referenced on a port. Some platforms auto-create VLANs; others require explicit creation.

4. SVI not up/up. Symptom: hosts have correct IPs and VLAN is configured, but cannot reach their gateway IP. show interfaces vlan 10 shows "down/down." An SVI comes up only when at least one access port in that VLAN is active. No active ports = SVI stays down.

5. Spanning Tree blocking a VLAN. Symptom: intermittent connectivity in a specific VLAN. show spanning-tree vlan X to identify if a port is in BLK state that shouldn't be.

# Comprehensive VLAN troubleshooting workflow
show vlan brief                         # Is the VLAN created and active?
show interfaces GigabitEthernet0/1 swp  # What VLAN is this port in?
show interfaces trunk                   # What VLANs traverse each trunk?
show interfaces vlan 10                 # Is the SVI up?
show spanning-tree vlan 10             # Is STP blocking any ports?
show mac address-table vlan 10         # Are hosts being learned?
show ip arp vlan 10                    # Is L3 resolution working?

Healthcare: PCI DSS and HIPAA Segmentation

Healthcare networks must comply with HIPAA (health data) and PCI DSS (payment card data). HIPAA requires that protected health information (PHI) be isolated from non-clinical systems. PCI DSS requires cardholder data environments (CDE) to be network-isolated. A hospital VLAN architecture: VLAN 10 Clinical (EHR, medical devices), VLAN 20 Administrative (email, HR), VLAN 30 Guest/Patient Wi-Fi, VLAN 40 POS/Revenue Cycle, VLAN 50 Medical Imaging (huge file transfers, separate bandwidth), VLAN 99 Management.

Inter-VLAN traffic between Clinical and Administrative must pass through a next-generation firewall with application-layer inspection, not just an L3 switch with ACLs. The firewall policy explicitly permits only necessary clinical application flows and logs all traffic for compliance auditing.

Financial Services: Low-Latency Trading Networks

High-frequency trading (HFT) firms have unusual VLAN requirements: microseconds matter. Standard VLAN processing on managed switches adds ~1–5 µs of latency. HFT networks use specialized low-latency switches (Arista, Cisco Nexus 3000 series) with hardware forwarding pipelines that reduce cut-through latency to sub-microsecond. VLAN tagging still happens in ASICs, but the entire pipeline is optimized.

Market data VLANs carry multicast feeds from exchanges. Trading VLANs carry order flow. Risk management VLANs carry position monitoring. The firm's risk management systems are on a separate VLAN specifically so they can always observe trading VLANs via SPAN (Switched Port Analyzer) monitoring — even if the trading VLAN is congested, the SPAN port to risk management is never dropped.