What is a VLAN and why would you use one?
Show the answer
Say this first
A VLAN is a separate layer 2 broadcast domain carved out of shared switch hardware. Ports in VLAN 10 and VLAN 20 cannot talk at layer 2, even on the same switch; traffic between them must be routed. We use VLANs to keep broadcast domains small, to separate groups like users, phones, cameras and guests for security and policy, and to group devices by role instead of by where they are plugged in.
Go deeper
What you get
- Smaller broadcast domains. ARP, DHCP and other broadcasts stay inside the VLAN.
- A policy point. Traffic between VLANs has to cross a router, layer 3 switch or firewall, which is where ACLs and inspection happen.
- Per-group treatment. Voice gets its own VLAN and QoS; guests get a VLAN that only reaches the internet.
- Flexibility. Two people on different floors can share a VLAN, two people at adjacent desks can be in different ones.
Conventions
One VLAN maps to one IP subnet. Hosts decide "local or via the gateway" by subnet, so mixing subnets in a VLAN or splitting one subnet across VLANs causes confusing failures.
The cost
A VLAN stretched across a whole campus is one large failure domain: a loop or broadcast storm in it reaches every switch. Modern campus designs keep VLANs inside one access block and route above it.
They will ask next
Is a VLAN a security boundary?
It separates traffic at layer 2, but misconfiguration (DTP, native VLAN, VLAN hopping) can break it, and all VLANs share the same hardware. The real enforcement point is the layer 3 boundary, with ACLs or a firewall between VLANs.
Traps
- Saying VLANs split collision domains. Every switch port already is its own collision domain; VLANs split broadcast domains.