Virtual LAN (VLAN): Short-Note Course Section

A Virtual LAN (VLAN) is a method used in switched networks to logically divide a single physical network into multiple isolated broadcast domains. In practice, VLANs let you treat devices in different groups as if they were on different networks, even when they share the same switches and cabling. This is typically standardized using IEEE 802.1Q VLAN tagging to carry the VLAN identity across links that connect switches.

Key ideas that usually appear in short notes

• VLANs provide network segmentation to limit where frames are forwarded.
• Traffic within a VLAN behaves like traffic on a standalone LAN; traffic between VLANs does not happen by switching alone.
• To allow communication across VLANs, you need inter-VLAN routing via a router or a Layer 3 switch.

Why VLANs are used

VLANs are commonly deployed to achieve practical network goals:

1. Reduce unnecessary broadcast propagation: Since each VLAN is its own broadcast domain, broadcast and unknown-unicast frames stay within that VLAN rather than flooding the entire physical LAN.

2. Improve security and separation: Devices assigned to different VLANs are separated at the Layer 2 level, so users in one VLAN are not directly reachable from another without proper Layer 3 controls.

3. Simplify management and scalability: Adding or moving devices between departments (e.g., HR, Finance) can be handled by configuration (assigning ports to VLANs) rather than rewiring or creating completely separate physical networks.

VLAN ID values identify which VLAN a frame belongs to when traversing a trunk link.

VLAN types (common in curricula)

VLAN membership can be determined in different ways. A short note often lists a few:

• Static (port-based) VLANs: An administrator assigns ports to VLANs manually. Frames entering a port are associated with that VLAN.
• Dynamic VLANs: VLAN assignment is determined by rules (often via authentication or directory/management systems). This reduces manual reconfiguration overhead in some environments.
• Protocol-based VLANs (conceptual mention): Membership may depend on protocol characteristics rather than purely on port assignment (implementation varies).

When a switch connects to another switch, it generally uses a trunk carrying multiple VLANs, implemented with VLAN tags (e.g., IEEE 802.1Q).

[Access port]{def="Switch port that carries frames for only one VLAN (untagged or single-VLAN)} and trunk port]{def="Switch port that carries multiple VLANs, usually using 802.1Q tagging"} are the most important port concepts to mention in a brief note.

VLAN communication (what switching can and cannot do)

A key exam point: switches forward frames within the same VLAN (based on MAC learning per VLAN), but frames do not cross VLANs at Layer 2.

To communicate between VLANs, you must use Layer 3 routing, typically on a router or a Layer 3 switch:

• Source host sends to destination on another VLAN → requires routing
• Router/Layer 3 switch terminates VLAN interfaces and forwards traffic to the destination VLAN

This is why inter-VLAN routing is repeatedly highlighted when describing VLANs.