VLANs Explained

The Problem: One Physical Switch, Multiple Logical Networks

Normally, every device plugged into the same physical switch is part of the same broadcast domain - they can all see each other's broadcast traffic. But an organization often wants to separate departments (like Sales and Engineering) onto logically distinct networks, without buying a separate physical switch for each one.

What a VLAN Actually Does

A Virtual LAN (VLAN) lets a single physical switch be logically divided into multiple separate broadcast domains. Ports assigned to different VLANs behave as if they were connected to entirely separate physical switches, even though they share the same hardware.

Physical Switch
Port 1 (VLAN 10 - Sales)      Port 3 (VLAN 20 - Engineering)
Port 2 (VLAN 10 - Sales)      Port 4 (VLAN 20 - Engineering)

Devices on VLAN 10 cannot see VLAN 20's broadcast traffic, and vice versa,
even though everything is plugged into the exact same physical switch.

Why Organizations Use VLANs

• Security - keeping sensitive departments' traffic logically isolated from the rest of the network.
• Reduced broadcast traffic - broadcasts stay contained within a smaller VLAN instead of flooding the entire physical network.
• Flexible organization - grouping devices logically (by department or function) rather than being constrained by physical cabling layout.

How Frames Carry Their VLAN Information

When traffic from different VLANs needs to travel across a shared link (like between two switches), each frame is tagged with a VLAN ID (defined by the 802.1Q standard) so the receiving switch knows which VLAN that frame belongs to.

Getting Between VLANs

Since VLANs are separate broadcast domains, devices on different VLANs cannot communicate directly - traffic must pass through a router (or a router-like feature on a "Layer 3 switch") that can route between them, exactly like traffic between two entirely separate physical networks would.