Lesson 3 of 3
VLANs explained
2 min
A VLAN splits one physical switch into several separate networks. Devices in different VLANs can't talk to each other unless a router or firewall allows it.
Why use them
- Security: guest Wi-Fi and cameras can't reach staff computers or servers.
- Less noise: broadcast traffic stays inside its VLAN.
- Flexibility: move a desk to a new floor without re-cabling the network design.
Access and trunk ports
- An access port belongs to one VLAN. A computer plugged in there joins that VLAN and doesn't know VLANs exist.
- A trunk port carries many VLANs between switches, or to a router, by tagging each frame with its VLAN number (802.1Q).
interface Gi0/5
switchport mode access
switchport access vlan 10
interface Gi0/48
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99Routing between VLANs
Traffic between VLANs goes through a router or firewall, where you write rules: staff may reach printers, guests may only reach the internet.
Don't use VLAN 1 for anything real, and restrict trunk ports to the VLANs they need. Both reduce the damage of a misconfigured port.