Why VLANs exist and VLAN roles

Why not leave every port in one network?

Situation: an office has employees, guests and security cameras, all plugged into the same switches. Employees need company servers, guests should only reach the internet, and cameras should only talk to their recorder.

Without VLANs they'd all share one broadcast domain: broadcasts spread across the shared Layer 2 network. With VLANs (Virtual LANs), each group becomes its own logical network on the same hardware:

A VLAN (Virtual Local Area Network) groups traffic within a Layer 2 boundary. Layer 2 means Ethernet frame forwarding using MAC addresses. A broadcast is a frame addressed to all devices in its local group; that group is its broadcast domain.

A VLAN separates local Ethernet traffic; an access rule or firewall decides what routed traffic may pass between VLANs. Creating a guest VLAN does not itself configure internet access or block every path to employee servers.

A VLAN separates Layer 2 traffic; a subnet is the IP addressing plan for it. They come in pairs in this design, but they're different things: one is a switch setting, the other is IP addressing. Changing a PC's subnet mask does not move its switchport to another VLAN.

Each VLAN is a separate broadcast domain

Situation: the employee laptop needs the printer's MAC address, so it sends an ARP (Address Resolution Protocol) broadcast asking which local interface owns 192.168.10.20. The MAC identifies an Ethernet receiver; it is different from the printer's IP address.

Why: a switch only floods a frame to ports in the same VLAN as the port it arrived on. Each VLAN therefore behaves like its own physical switch.

SW1#show mac address-table vlan 10
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0200.0000.0010    DYNAMIC     Gi1/0/1
  10    0200.0000.0020    DYNAMIC     Gi1/0/2
Total Mac Addresses for this criterion: 2

The VLAN column is part of the lookup. The entries show that source frames were learned on Gi1/0/1 and Gi1/0/2 in VLAN 10. They do not prove that a print service is running or that its IP settings are correct.

Data, voice, management and other VLAN roles

Some VLAN names describe a purpose (voice, management, guest); others describe behaviour (native, default). A VLAN can have more than one role, and all of them are ordinary VLANs underneath.

Data VLAN

Carries ordinary user traffic: web, email, files, applications. Example: employee laptops and printers in VLAN 10, as above.

Voice VLAN

A VLAN-aware phone can learn its voice VLAN through Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED), depending on equipment and configuration. The phone can then label its voice traffic separately from the PC data it passes through.

Situation: a desk phone sits between the wall port and a PC, so one switch port serves both. The phone's calls should be separated from the PC's data.

This voice-port example assumes Cisco Catalyst IOS XE, with VLANs 10 and 40 already created. Enter it from global configuration mode. Phone discovery support and interface names depend on the equipment.

Separating voice makes policy and troubleshooting easier, but it doesn't guarantee call quality on its own: quality of service (QoS), which manages competing traffic, may be needed too. A separate VLAN does not create more bandwidth.

Management VLAN

Carries traffic used to manage the network equipment itself (SSH, HTTPS, SNMP). Example: administrators reach the switches at 192.168.100.2 and .3 in VLAN 100. Restrict who can reach it. It isn't an out-of-band network: if the production switches fail, management traffic fails with them.

Default VLAN

Layer 2 access ports on a factory-default Catalyst switch typically belong to VLAN 1. "Default" describes the starting configuration only; moving user and management traffic out of VLAN 1 is common practice.

Native VLAN

Decides how an 802.1Q trunk, a link carrying multiple VLANs, handles untagged frames: incoming untagged frames are placed in the native VLAN, and native-VLAN traffic leaves the trunk untagged (unless native tagging is configured). Both ends must match. Covered in detail in the native VLAN lesson.

Guest VLAN

A separate network for visitors. Example: VLAN 20 can reach the internet but not employee servers. The VLAN separates the traffic; an ACL or firewall rule enforces the "internet only" policy. ("Guest VLAN" is also the name of an 802.1X feature that places unauthenticated devices into a limited VLAN.)

Design-purpose VLANs

These are naming conventions, not different kinds of Ethernet. Use ACLs or firewall policy to enforce access between routed VLANs.

Short lab: separate ports, then verify membership

On an isolated Catalyst-style lab switch, create VLANs 10, 20 and 30 with the global vlan command. Give them the names EMPLOYEES, GUESTS and CAMERAS using name in VLAN configuration mode.

1. Under each interface, use switchport mode access and switchport access vlan <ID>. Assign Gi1/0/1 and Gi1/0/2 to VLAN 10, Gi1/0/3 to 20 and Gi1/0/4 to 30.
2. Run show vlan brief. Confirm the VLANs are active and the four ports appear under the intended IDs. A VLAN name is a label; the numeric ID determines membership.
3. Generate traffic between the employee and printer, then read show mac address-table vlan 10. Entries are learned from traffic, so an empty table immediately after startup is not proof of a broken VLAN.
4. In the isolated lab, deliberately place the printer port in VLAN 20. The employee's ARP request cannot reach it. Restore Gi1/0/2 to VLAN 10, verify membership and repeat the test.

Check the boundary

Technical references

Examples assume Cisco Catalyst IOS XE Layer 2 switchports. See Cisco's VLAN configuration guide and voice VLAN guide. Simulator support and defaults vary; outputs are written teaching examples.