Virtual LANs: Logical Segmentation on Shared Hardware
A Virtual Local Area Network (VLAN) is a logical grouping of network devices that behave as if they are connected to the same physical switch, even when they are distributed across multiple switches and locations. Defined by the IEEE 802.1Q standard, VLANs are one of the most fundamental network security and design tools available to network engineers.
How VLAN Tagging Works
Under IEEE 802.1Q, an additional 4-byte tag is inserted into the Ethernet frame header between the Source MAC Address and EtherType/Length fields. This tag contains a 12-bit VLAN Identifier (VID), allowing for up to 4,094 usable VLANs (VLAN IDs 0 and 4095 are reserved). This tagging enables a single physical switch port (a “trunk” port in Cisco terminology) to carry traffic for multiple VLANs simultaneously.
Access ports, in contrast, are assigned to a single VLAN and strip the 802.1Q tag before delivering frames to the connected endpoint device. The end device is unaware of VLAN tagging—it simply sees a normal Ethernet network.
Security Benefits of VLANs
- Network Isolation: The core security benefit of VLANs is that devices in different VLANs cannot communicate directly—traffic must pass through a router or Layer 3 switch, where access control lists (ACLs) or firewall policies can be enforced. This prevents an attacker who compromises a guest Wi-Fi device from accessing internal business systems.
- Guest Network Segregation: Best practice dictates placing guest Wi-Fi on a dedicated VLAN (commonly VLAN 100 or similar) with internet-only access. The guest VLAN should have DHCP with short lease times, DNS pointing to public resolvers, client isolation enabled at the wireless layer, and explicit deny rules preventing any traffic to internal IP ranges.
- Voice VLAN Separation: IP phones should reside on a dedicated voice VLAN (commonly VLAN 200) to separate VoIP traffic from general data traffic. This enables QoS prioritization of voice traffic, prevents congestion from data traffic impacting call quality, and isolates the phone network for security purposes.
- Departmental Segmentation: Finance, HR, and Engineering departments can each be placed on separate VLANs, with firewall policies governing which departments can communicate. Finance servers should never be directly reachable from the general office network.
Advanced: Private VLANs
Cisco Private VLANs (PVLANs) extend segmentation to the individual port level within a single subnet. A primary VLAN can contain isolated ports (can only communicate with promiscuous ports, typically the default gateway) and community ports (can communicate with other community ports and promiscuous ports). This is commonly used in hosting environments where multiple customers share a subnet but should not communicate with each other.
Cisco Best Practices
- Change the Native VLAN: The native VLAN (VLAN 1 by default) carries untagged traffic on trunk ports. Change it from VLAN 1 to an unused, dedicated VLAN on all trunk links to prevent VLAN hopping attacks.
- Use VLAN 1 Only for Management: If VLAN 1 must be used, restrict it to out-of-band management traffic only. Never place user data traffic on VLAN 1.
- Prune Unnecessary VLANs: Manually prune VLANs from trunk ports that do not need to carry them, rather than allowing all VLANs by default.
