Switching and VLANs

Switching in practice: split the network into VLANs, set up access and trunk ports, route between VLANs at L3 and secure L2.

Lesson 1: Everyone on one network

An office with no walls

Let’s start with the problem, not the technology. Most small companies never designed their network – as they grew, whatever came along was simply plugged into one switch: staff laptops, a guest laptop, the printer, the accounting server, the database, cameras and a smart bulb in the meeting room. It works – but it created something dangerous: one big flat network where no boundary separates the devices. Anyone can reach anyone. Click through to see what can talk to what (and absolutely shouldn’t).

Step by step

One flat network: guest, printer, accounting, database and a smart bulb – all in one switch, nothing between them. It grew this way over time; nobody “drew it up” like this.
A visitor connects to the network. Their laptop – possibly carrying malware they don’t know about – can scan the whole network, try logging into shared drives and reach the accounting server. This (not a clever hack, just a flat network) is how many breaches start.
A smart bulb or IP camera often has weak security and rarely gets firmware updates. Yet on a flat network it sits right next to the database – if someone takes it over (often easy with IoT), they have a path to company data from there.
Even the printer can “see” accounting. It doesn’t need to, but nothing stops it. Every extra device on a flat network = another possible entry point through which an attack spreads.
Bottom line: on a flat network everyone sees everyone – no boundaries. So one hacked device reaches practically everything (a large blast radius). The next module breaks this into three concrete problems – security, performance and chaos.

Three problems

One big flat network brings three concrete problems, and each costs a company real money and headaches: security (who can reach whom), performance (traffic "for everyone" burdens even those it doesn’t affect) and chaos (nobody knows what’s actually running on the network). We’ll go through them one by one, with concrete situations.

Step by step

Security. A hacked PC reaches the server through the switch – nothing is in its way. One piece of malware can work its way across the whole network (lateral movement): from a PC to a shared drive, then a server, then the database. It spreads not because the attacker is clever, but because the network has no internal boundaries.
Performance. Some traffic doesn’t go to one receiver but to everyone (a broadcast – e.g. "who has this IP?"). The switch floods it to all ports. A few devices won’t notice, but on a network with hundreds of devices there are so many broadcasts that every device and switch processes lots of messages that don’t concern it at all – the network gets "noisy" and slows down.
Chaos. On a large flat network, over time nobody really knows what runs on it and who talks to whom. A device is added here, another there – and a year later it’s hard to tell what is what, harder to manage and harder still to watch. Without segmentation you have neither overview nor control.

The physical fix is costly

How do you split a network? The simplest idea is physically: for each group (offices, servers, guests) buy its own switch and run its own cabling. The groups are then truly separated – no wire runs between them, so they can’t see each other. How a network is actually wired is called the physical topology. It works perfectly… but at what cost, and how flexibly?

Step by step

Three groups = three switches and three sets of cables. Offices, servers and guests are physically separated – no wire runs between them. This is the physical topology: a split you literally see in the cabling. And it works – no one in one group can reach another.
The cost: 3× hardware + 3× cabling. And the switches are often half-empty – you buy three 24-port switches but use maybe 6 ports each. You pay for 72 ports and use 18. The more groups, the more boxes, cables and rack space.
And above all inflexible: when an employee moves to a different part of the office, you have to physically re-cable them to another switch (maybe even move their desk). A new group, say cameras? Buy a fourth switch.
Notice: here the physical wiring = the network split – physical and logical topology are the same. A VLAN does the same split logically on ONE switch: it separates groups by port configuration alone, not wires. Moving a person = re-assign the port’s VLAN (seconds), not pulling cables. That’s the logical topology – and it’s the next lesson.

▶ Open in the simulator

Lesson 2: VLAN: a wall you can’t see

Broadcast: a message for everyone

A switch forwards frames by MAC address (you know MAC and IP addresses from the How networks work course: a MAC is a device’s factory label, an IP its postal address) – it never looks at IP (that’s the router’s job). But some frames have no single receiver: their destination is the "to everyone" address and they’re called broadcasts (typically an ARP request, "who has this IP?"). That "to everyone" address is also a MAC (ff:ff:ff:ff:ff:ff) – the target IP being looked up sits inside the request, which the switch doesn’t read. The switch recognizes that "to everyone" address and floods the frame to all ports – still by address, not by content. The set of devices a broadcast reaches is a broadcast domain. In one large flat network it is huge: every broadcast disturbs everyone, there is more and more of it, and anyone can see it (including sensitive things). The fix is to split the network – which is exactly what VLANs do (next module).

Step by step

A sends a broadcast – a frame whose destination is the "to everyone" address (e.g. ARP "who has this IP?"). It reaches the switch.
The switch floods it to all ports → B, C and D all get it. This group = the broadcast domain.
In a flat network this domain is huge: more noise and everyone sees foreign traffic. Fix: split it into VLANs (next module).

What a VLAN is

A VLAN (Virtual LAN) is a logical network built on top of the physical switches. One switch carries several separate networks at once – as if you had several standalone switches, but it’s just one. Each port gets a VLAN number (e.g. 10 or 20) and the device on it belongs to that VLAN. Devices in different VLANs cannot see each other – their broadcasts are separated (each VLAN = its own broadcast domain). This splits a large flat network into smaller ones: offices apart, cameras apart, guests apart – for security, performance and order. (How a VLAN is assigned to a port is the next lesson: access and trunk.)

Step by step

A (VLAN 10) sends a broadcast – it travels to the switch.
The switch forwards it only within VLAN 10 → only B gets it. C and D (VLAN 20) do not – they’re in another VLAN, as if hung off a completely different switch.
Each VLAN = its own broadcast domain. For VLAN 10 and 20 to talk at all, you need an L3 device (a router / L3 switch) – that’s the next lesson.

How the switch knows where a frame belongs

How does the switch know where each frame belongs? Simple: every physical port is assigned to a VLAN (P1 and P2 to VLAN 10, P3 and P4 to VLAN 20). Note – the VLAN sits on the port (that RJ-45 socket), not on the device’s IP: whatever you plug into P1, it’s VLAN 10. The switch remembers each port’s VLAN and will not pass traffic between different VLANs – it acts as if they were two separate switches.

Step by step

Each port has its VLAN: P1, P2 → VLAN 10, P3, P4 → VLAN 20. The switch remembers this per port (not by IP).
A → B: both ports are in VLAN 10 → the switch connects them. Same VLAN, no problem.
A → C: A’s port is in VLAN 10, C’s in VLAN 20 → the switch STOPS it. It won’t pass traffic between different VLANs.

VLAN ID

How do we tell VLANs apart? In the previous modules you saw the numbers 10 and 20 next to ports – and exactly these numbers are VLAN IDs. Every VLAN has its own, in the range 1 to 4094, and the switch uses it to remember which VLAN each port belongs to. The number itself doesn’t "do" anything – it’s just a label. That’s why in practice it pays to follow a convention, so the numbers still make sense a year later.

Step by step

A VLAN ID is a number 1 to 4094. The switch tells VLANs apart by it – it’s just a label.
VLAN 1 always exists (the default) and all ports start in it. In practice it is not relied on (all devices start in it — including an attacker — and it is usually the default native VLAN of trunks) – you put production in its own VLANs (security).
In practice VLANs are numbered by role: e.g. 10 = users, 20 = servers, 99 = management. It’s a team convention, not a rule.

What a VLAN does not solve

A VLAN is great for separating traffic, but it helps to know what it does NOT solve. By itself it is not a security wall: it relies on being configured correctly. Put a port in the wrong VLAN – or misconfigure a trunk (the link between switches that carries several VLANs at once; we’ll cover it in detail in the very next lesson) – and the isolation falls apart.

Step by step

A VLAN separates traffic at L2 – VLAN 10 and 20 don’t see each other. That’s good and correct.
But it is not a security wall by itself: a misconfigured port (in the wrong VLAN) or a misconfigured trunk (the switch-to-switch link) and the isolation falls apart.
Real security = VLAN + rules for the traffic between VLANs. Those come from an ACL on a managed L2 / L3 switch, or from a firewall – depending on where the inter-VLAN traffic passes. The VLAN divides, the rules guard. More in the security course.

▶ Open in the simulator

Lesson 3: Trunk: how a VLAN crosses a cable

The multiple-switch problem

So far VLANs lived on one switch. What if you want VLAN 10 on switch A and on switch B (a company with two floors)? VLAN 10 hosts must be linked over a cable between the switches – and so must VLAN 20. How do you do it without the VLANs getting mixed up?

Step by step

Two floors, two switches. Both have VLAN 10 and VLAN 20. You want VLAN 10 on A to reach VLAN 10 on B – but not VLAN 20.
You add one cable between the switches for VLAN 10. It works – VLAN 10 gets through. But what about VLAN 20?
A second cable for VLAN 20. Now both work – but one cable per VLAN. One cable for every VLAN.
10 VLANs = 10 cables between every pair of switches. It doesn’t scale. You want ONE cable that carries all VLANs – that’s a trunk (next module).

The 802.1Q tag

A trunk is a link between switches (a port switched into trunk mode) where traffic of several VLANs runs over a single cable at once. But how does the other switch tell which VLAN a frame belongs to? On the trunk the switch attaches a small tag with the VLAN number – this is the 802.1Q tag. The other switch reads the tag, knows where the frame belongs, and removes it again before delivering to the end device. Follow one frame.

Step by step

A host in VLAN 10 sends a frame. On the access port (a port for an end device, belonging to one VLAN – next module) it is untagged – the host knows nothing about VLANs.
SW-A puts it on the trunk and attaches the 802.1Q tag "10". On the trunk the frame now travels tagged – the other switch knows it’s VLAN 10.
SW-B reads the tag (→ VLAN 10), removes it and delivers the frame to the VLAN 10 host – untagged again. The receiver also knows nothing about VLANs.

Access port vs trunk port

A switch port has two main roles: access and trunk. (There is also automatic mode negotiation – DTP; it is a security risk and gets disabled in practice – covered in detail in the switch in depth course.) An access port carries one VLAN and shows no tags – an end device sits on it (PC, printer) that knows nothing about VLANs. A trunk port carries several VLANs with tags – it runs between switches, to a router or an L3 switch. Watch the difference.

Step by step

Access ports: on the left. The PC is in one VLAN (V10), the printer in another (V20). No tags – end devices don’t know about VLANs.
Trunk port: on the right, the cable to the other switch. It carries both VLANs (V10 and V20) tagged at once – one cable for everything.
Rule: access to end devices (one VLAN, untagged), trunk between switches/to a router (several VLANs, tagged). That’s the whole difference.

Native VLAN

Almost everything on a trunk is tagged. But what about a frame with no tag (untagged traffic is sent for instance by older devices or by the switch’s own management protocols — not everything can do tags)? It belongs to the native VLAN – the trunk’s default VLAN (usually VLAN 1). Key rule: the native VLAN must match on both ends of the trunk – the receiving switch files an untagged frame into its own native VLAN (it has no idea what the sender meant), so on a mismatch it lands in the wrong VLAN.

Step by step

Frames cross the trunk tagged (here VLAN 10). The switch knows where they go by the tag.
But a frame arrives untagged. Where does it go? To the native VLAN – the trunk’s default VLAN (typically VLAN 1).
So the native VLAN must match on both ends. If it doesn’t, untagged traffic lands in the wrong VLAN – a mess and a security hole. Keep it the same everywhere.

▶ Open in the simulator

Lesson 4: Why VLANs can’t talk to each other

The wall works too well

We split the VLANs so well that we now hit the opposite problem. A is a user in VLAN 10 and needs to reach the company server in VLAN 20. But the switch won’t pass traffic between VLANs – to it they are two completely foreign networks. The isolation works too well: it also separates what should talk.

Step by step

A (VLAN 10) wants to reach the SERVER (VLAN 20). Two different VLANs = two different networks.
A sends traffic – the switch receives it, but won’t pass it between VLANs. To the switch VLAN 20 is a foreign world. Stopped.
This is correct (isolation), but sometimes VLANs must talk. A switch (L2) can’t do it – it only looks at MAC (you know the L2 and L3 layers from the ISO/OSI course — the data-link and network layers). We need something that understands IP addresses and can cross between networks: an L3 device (next module).

L3 as a translator

Between VLANs we need an L3 device – typically a router (or an L3 switch, next lesson). The trick is this: the router has one IP address in each VLAN – it is the default gateway for both (.1 = the usual last digit of a gateway’s address, e.g. 10.0.10.1). When A wants the SERVER in another VLAN, it sends it to its gateway first (the router). The router has a foot in each network, so it receives in VLAN 10 and hands out in VLAN 20 – it works as a translator between networks.

Step by step

A doesn’t know the way to VLAN 20, so it sends the traffic to its default gateway = the router’s IP in VLAN 10 (.1). The traffic reaches the router via the switch.
The router looks at the destination IP, sees it belongs to VLAN 20, and sends the traffic out its other leg – in VLAN 20. Via the switch it reaches the SERVER. Done.
Key: the router has a gateway (IP) in each VLAN and routes traffic between them by IP. The VLANs stay separated at L2 – only something with a foot in both links them. How that cable to the router runs is the next module.

Router-on-a-stick

The router would need one physical port per VLAN – the same problem as cables on a trunk. The fix: a single trunk runs to the switch, and on the router that port is split into subinterfaces (logical sub-ports) – one per VLAN. Each subinterface holds its VLAN’s gateway (G0/0.10 = .1 in V10, G0/0.20 = .1 in V20). This is called router-on-a-stick – the router hangs off one cable "on a stick".

Step by step

Between the switch and the router runs a single trunk carrying both VLANs tagged. On the router the port splits into subinterfaces: G0/0.10 (V10) and G0/0.20 (V20).
A (V10) sends traffic to the gateway. It travels the trunk tagged as VLAN 10 and the router receives it on subinterface G0/0.10.
The router reroutes to VLAN 20, sends it back over the same trunk tagged as VLAN 20, the switch removes the tag and delivers to the SERVER.
Router-on-a-stick is cheap (one cable), but all inter-VLAN traffic flows up to the router and back – that single link is a bottleneck. A better fix inside the switch is the L3 switch (next lesson).

▶ Open in the simulator

Lesson 5: The L3 switch

Where router-on-a-stick falls short

Router-on-a-stick works, but it has a weakness. All inter-VLAN traffic must go up to the router and back over that single trunk. The more users and servers talk across VLANs, the more that one cable clogs up – it’s a bottleneck. And every packet takes a needless detour out of the switch and back (a "hairpin"). In a big network it isn’t enough.

Step by step

Recap: between the switch and the router there is one trunk, and all inter-VLAN traffic flows through it.
More and more inter-VLAN traffic crowds onto one cable. It becomes a bottleneck – the router and the link can’t keep up.
And even a single packet takes a detour: A → switch → out to the router → back into the switch → SERVER. A pointless round trip (a hairpin).
What if the switch could route inside itself – with no detour to an external router? That’s exactly what an L3 switch does (next module).

SVI: a gateway inside the switch

An L3 switch is a switch that can also route. Instead of an external router it has, for each VLAN, a virtual interface – an SVI (Switch Virtual Interface). The SVI is that VLAN’s gateway (.1), but it lives inside the switch. Inter-VLAN traffic is then switched within one device, at full hardware speed and with no detour out. No hairpin, no single-trunk bottleneck.

Step by step

The L3 switch has an SVI for each VLAN inside: SVI 10 (.1) and SVI 20 (.1). Each is its VLAN’s gateway – right inside the switch.
A (VLAN 10) sends traffic to its gateway = SVI 10. It’s right inside the switch – nothing leaves the box.
The switch internally routes from SVI 10 to SVI 20 and delivers to the SERVER (VLAN 20). No detour to a router, full speed.
An SVI = a switch’s virtual L3 interface for one VLAN. The gateway lives in the switch and inter-VLAN traffic is switched inside – cleanly and fast. How the switch knows where to route is the next module.

A routing table on the switch

How does the L3 switch know where to send a packet? It has a routing table – a list of networks and how to reach them. Each VLAN with its SVI is a directly connected network for the switch: VLAN 10 = 10.0.10.0/24 (the /24 notation = the network size, which you know from subnetting in the ISO/OSI course) out via SVI 10, VLAN 20 = 10.0.20.0/24 out via SVI 20. The switch looks at the destination IP, finds the row and sends the packet out the right SVI.

Step by step

The table has two rows – one per VLAN. Both networks are directly connected via their SVIs, the switch knows them on its own.
A sends a packet to 10.0.20.5. The switch scans the table and finds a match: 10.0.20.0/24 = VLAN 20.
Per the row it sends the packet out via SVI 20 into VLAN 20 – to the server. Routing happened inside the switch.
An L3 switch knows directly-connected VLANs automatically (thanks to SVIs). For destinations outside these networks (e.g. the internet) it needs a default route to a router – that’s the routing course.

When a router, when an L3 switch

So when a router and when an L3 switch? Both move traffic between networks, but each is good at something different. A router sits at the network edge: internet uplink (WAN), NAT, firewall (you’ve met NAT and the firewall briefly in the ISO/OSI course; they’re covered in depth in the routing course and the network security course), a few interfaces – it can do inter-VLAN too, but more slowly (in software). An L3 switch is the backbone inside the LAN: many ports and very fast inter-VLAN routing in hardware – but no WAN or NAT. In practice they work together: the L3 switch routes inside, the router holds the edge.

Step by step

Two tools for moving between networks. They look similar but suit different spots.
A router = the network edge: internet (WAN), NAT, firewall. It can route between VLANs, but it’s slower (done in software).
An L3 switch = the backbone inside the LAN: many ports and very fast inter-VLAN routing in hardware. But no WAN or NAT.
Rule: inter-VLAN inside the company → L3 switch, network edge (internet, NAT, firewall) → router. In a large network commonly both together.

▶ Open in the simulator

Lesson 6: Guests and IoT: isolation in practice

Three worlds on one network

In a real company not all devices are equal. There are three worlds with very different levels of trust: corporate (employee PCs, servers – sensitive data), guests (strangers’ phones and laptops on Wi-Fi – you trust them not at all) and IoT (cameras, bulbs, sensors – weakly secured, rarely updated). When they all hang on one flat network, a guest and a camera sit right next to the accounting server. That’s a problem.

Step by step

Three kinds of device, three trust levels: corporate (green, sensitive), guest (cyan, foreign), IoT (amber, vulnerable).
On a flat network a guest reaches the company SERVER – nothing stops it. A stranger’s phone right next to the accounting server. That’s wrong.
And a vulnerable IoT camera sits right next to corporate PCs. If someone takes it over, they get straight in further. The weak link infects the whole.
You know the fix: put each world in its own VLAN and control who may cross. Corporate, guest and IoT apart. How to do it in practice – next modules.

Guest VLAN in practice

A guest VLAN is completely routine – visitor Wi-Fi in an office, café, clinic. The guest gets their own VLAN from which they only see the internet, but not the company network. A rule (ACL / firewall) between the guest VLAN and the corporate VLANs enforces it: "out to the internet yes, into the LAN no." The guest can browse, but can’t reach servers, printers or cameras. We’ll show exactly how such a rule is written in a moment.

Step by step

The guest is in their own guest VLAN. Now we decide where they may go: to the internet, or into the company?
To the internet: traffic passes through the switch and out – the guest browses normally. This is allowed.
To the company SERVER: the inter-VLAN rule blocks it. The guest cannot reach corporate data.
The guest-VLAN rule: internet yes, LAN no. Visitors get Wi-Fi, the company stays safe. You’ll try exactly this in the guest-iso task.

IoT and blast radius

IoT devices (cameras, bulbs, sensors) tend to be weakly secured: default passwords, no updates, cheap firmware. An attacker takes over such a camera easily. The question is then: how far can they get from there? That’s the blast radius. On a flat network it’s huge – from the camera they hop to servers and data. In a dedicated IoT VLAN it’s tiny – the camera reaches nowhere further.

Step by step

The camera has a default password and years without updates. The attacker takes it over. Now what?
Flat network: from the camera the attacker hops onward – to the SERVER and the DATA. The blast radius is huge, one weak device endangers everything (lateral movement).
Dedicated IoT VLAN: the camera is boxed in. The attacker has it, but can’t get further – the SERVER and DATA are safe. Blast radius tiny.
Principle: isolate weak devices (IoT) into their own VLAN. If one falls, the damage stays small. That’s defense in depth – more in the security course.

ACL: who may cross between VLANs

You’ve seen the guest VLAN and IoT isolation – but what exactly decides that a guest may reach the internet and may not reach the corporate LAN? A VLAN can only separate (it builds a wall). What may pass through is decided by a list of rules = an ACL (Access Control List). Without an ACL, it’s either everything or nothing between VLANs – no fine control. Let’s see what such a rule looks like and how it’s evaluated.

Step by step

A VLAN is a wall – by itself it lets either everything or nothing between VLANs. An ACL (Access Control List) is a list of rules that decides exactly what may pass through. It is what provides the fine control "this yes, that no".
Where does an ACL sit? On the device the inter-VLAN traffic passes through – an L3 switch, a managed switch or a firewall. The VLAN divides, the rules guard. Without such a device the VLANs wouldn’t meet at all (you know that from earlier lessons).
What a rule is made of: source → destination, protocol/port and an action (permit / deny). Example: "guest → internet: permit" and "guest → corporate LAN: deny". Exactly these two rules make the guest VLAN from the previous module.
How it’s evaluated: rules are read top-down and the FIRST MATCH wins. The "guest → internet" packet skips rule 1 (different destination), matches rule 2 → permitted, and no further rule is read. If nothing matched, the default policy applies (rule 3, "deny all"). Rule order matters.
In the simulator: on an L3 / managed switch open the ACL rules section (on a firewall the Rules tab) and write source → destination → action rules. You’ll use exactly this in the guest-iso and vlan-design tasks. More advanced topics (shadowed rules, a stateful firewall) come in the network security course.

▶ Open in the simulator

Lesson 7: The whole path together

The whole topology, layer by layer

Let’s put it all together. This is a whole small-company network built from exactly what you know: access switches with VLANs on ports, trunks between them, an L3 core switch that routes between VLANs via SVIs, and a router at the edge to the internet. Corporate (V10), servers (V20), guests and IoT – each in its own VLAN. A network is built in tiers: the access layer (switches end devices plug into), the core / backbone (a powerful L3 switch in the middle where VLANs meet and route) and the edge (a router out to the internet). In large networks there is also a distribution layer between access and core – we skip it here for simplicity. We’ll walk it layer by layer.

Step by step

The whole network together. Four kinds of device, four VLANs, one smart topology. Let’s go layer by layer from the bottom.
Access layer: end devices hang off the access ports of switches SW-A and SW-B. Each port has its own VLAN (V10 corporate, V20 servers, guest, IoT).
Trunks: between the access switches and the core run trunk links that carry all VLANs at once (with 802.1Q tags).
L3 core switch: this is where VLANs meet. Via SVIs (each VLAN’s gateway) it routes traffic between them – fast, inside one device.
Edge: the router connects the network to the internet (NAT, firewall). Corporate may go out, guests only to the internet, IoT nowhere out. The whole path makes sense.

A packet across the whole network

And now the best part: we’ll send one packet from a corporate PC (VLAN 10) to the SERVER (VLAN 20) and follow it all the way – through the access port, the trunk, the L3 core and back. You’ll see how every piece fits together. At the end we’ll add a guest to the internet too.

Step by step

Goal: PC (V10) → SERVER (V20). A different VLAN, so it must go via the L3 core. Watch the packet.
The PC sends the packet to its gateway (an SVI on the core). Over the V10 access port it reaches SW-A – untagged.
SW-A sends it over the trunk to the L3 core – now tagged as VLAN 10 (802.1Q).
The L3 core routes from V10 to V20 (via SVIs) and sends the packet over the trunk to SW-B – now tagged as VLAN 20.
SW-B removes the tag and over the V20 access port delivers the packet to the SERVER. Done – all the way across the network.
And the guest? Their traffic goes via the core straight to the router (and from there to the internet) – the rule keeps it out of corporate VLANs. Everyone goes where they belong.

What is still missing

You can do a lot – but one thing is still missing in this network: reliability. What if that single cable between the switches fails? Half the network goes down. The fix is a backup link – except two active paths between switches create a loop, which can completely flood the network. How to have a backup without a loop is solved by Spanning Tree – and that’s the whole redundancy and STP course.

Step by step

Between the switches there’s a single cable. It works – until it doesn’t. It’s a single point of failure.
If that cable breaks, SW-B is cut off – half the network is offline. We want a backup link.
But two active links form a loop: each switch forwards the broadcast out every port – including back over the other link – so one frame becomes two, four, eight… and the network drowns (a broadcast storm; an L2 frame has no time-to-live counter — it never "expires"). This kills the network.
The fix = Spanning Tree (STP): it keeps one link active and the backup blocked until needed. A backup without a loop. That’s the redundancy and STP course – we'll come back to it there.

▶ Open in the simulator