LAN Switching, VLANs, and Segmentation

Inside a building, campus, or data center, devices talk over local area networks (LANs) built from Ethernet switches. Switches forward frames based on MAC addresses, learn where devices are, and — with VLANs — divide one physical network into many logical ones. Those divisions are the foundation of network segmentation: keeping laptops, servers, cameras, printers, guest devices, and management interfaces in separate zones, so an infected device or a compromised smart TV cannot freely reach everything else.

Flat networks are simple until something goes wrong. A broadcast storm from a loop takes down a floor; ransomware spreads from one workstation to every file server; a guest on Wi-Fi reaches the payroll system. This page explains how switching works, how VLANs and trunks carry segmented traffic, how segments connect through routers and firewalls, and which switch features prevent common attacks.

TL;DR

Quick Example

Access and trunk ports on a managed switch (Cisco IOS-style syntax):

A VLAN interface on a Linux host attached to a trunk port:

Core Concepts

Frames, MAC Learning, and Flooding

Ethernet frames carry source and destination MAC addresses. A switch records which port each source MAC appeared on in its MAC address table and forwards frames only to the right port. Frames to unknown destinations, broadcasts (such as ARP requests and DHCP discovery), and many multicasts are flooded to every port in the same broadcast domain. Large flat networks therefore carry a lot of broadcast traffic, and every device can see — and talk to — every other device at Layer 2.

ARP maps IPv4 addresses to MAC addresses inside a subnet (IPv6 uses Neighbor Discovery). Because ARP has no authentication, devices on the same segment can spoof it to intercept traffic — one reason to keep untrusted devices in separate segments.

Loops and Spanning Tree

Redundant links between switches create loops; Ethernet frames have no hop limit, so a loop multiplies broadcasts until links saturate — a broadcast storm. Spanning Tree Protocol (today usually Rapid STP or Multiple STP) elects a root bridge and blocks redundant paths, unblocking them if an active link fails. Mark edge ports with PortFast for fast connection and BPDU guard to shut down ports where someone plugs in a switch or creates a loop.

VLANs and Trunks

A VLAN is a separate broadcast domain on shared switches. Access ports belong to one VLAN and carry untagged frames for end devices. Trunk ports carry many VLANs between switches, routers, hypervisors, and access points, marking each frame with an 802.1Q tag containing a 12-bit VLAN ID (1–4094). The native VLAN on a trunk carries untagged frames; set it to an unused VLAN to avoid tagging attacks.

Inter-VLAN Routing

Devices in different VLANs are in different IP subnets and need a router to communicate — a dedicated router ("router on a stick" over a trunk), a Layer 3 switch with VLAN interfaces (SVIs), or a firewall. That routing point is where segmentation becomes policy: ACLs or firewall rules decide which segments may talk on which ports. See Routing, NAT, and Firewalls and IP Addressing, Subnets, and IPv6.

Link Aggregation

LACP (IEEE 802.1AX, formerly 802.3ad) bundles several physical links into one logical link for bandwidth and redundancy. Traffic is distributed per flow, so a single flow still uses one member link.

Segmentation Design

Default to deny between segments and allow specific flows. 802.1X (with RADIUS and network access control) authenticates devices at the port and assigns VLANs dynamically; MAC authentication bypass covers devices that cannot do 802.1X, with more caution. Segmentation complements, rather than replaces, identity-based controls. See Zero Trust.

Larger Networks: VXLAN and EVPN

Data centers and large campuses outgrow 4,094 VLANs and the limits of Layer 2 domains. VXLAN encapsulates Layer 2 frames in UDP with a 24-bit segment ID (about 16 million segments), and EVPN (BGP-based control plane) distributes MAC and IP reachability across a routed underlay. Cloud VPCs achieve similar isolation with software-defined networking.

Switch Security Features

Troubleshoot with the switch's MAC table, ARP table, and spanning-tree state, and capture traffic on mirrored (SPAN) ports. See Packet Capture and Network Diagnostics.

Best Practices

Segment by Trust, Not Org Chart

Group devices by what they are and what they must reach, and keep management interfaces in their own tightly restricted segment.

Route Through Policy Enforcement Points

Send inter-VLAN traffic through firewalls or ACLs with default deny, logging, and documented allowed flows.

Lock Down Edge Ports

Configure access ports statically with BPDU guard, port security, and 802.1X, and disable unused ports.

Document VLANs and Subnets

Keep an up-to-date map of VLAN IDs, subnets, gateways, and purposes — in an IP address management tool or version-controlled files.

Common Mistakes

One Flat Network

Users in the Native VLAN

VLANs Without Inter-VLAN Policy

FAQ

What is a VLAN?

A virtual LAN: a logically separate broadcast domain on shared switches. Devices in different VLANs cannot communicate at Layer 2 and must be routed, where policy can be applied.

What is the difference between an access port and a trunk port?

An access port belongs to one VLAN and connects an end device with untagged frames. A trunk port carries multiple VLANs between network devices, using 802.1Q tags to identify each frame's VLAN.

What does spanning tree do?

It prevents loops in switched networks by electing a root bridge and blocking redundant paths, then reopening them when an active path fails.

Is VLAN segmentation enough for security?

It is a strong foundation but not sufficient alone. Combine segmentation with firewall policy between segments, device authentication, switch hardening, and identity-based access controls.

What is VXLAN?

An encapsulation that carries Layer 2 frames over a routed Layer 3 network with a 24-bit segment identifier, enabling millions of isolated segments in data centers.

Related Topics

References