Introduces the fundamental concepts, purpose and applications of computer networks.
Explores different network classifications based on geographical coverage, purpose and architecture.
Introduces different physical and logical network structures and how network devices are organised.
Provides practical knowledge of the hardware used to build and connect computer networks.
Introduces the physical and wireless technologies used to transmit data across networks
Explains how network communication is structured using standard models and protocols.
Introduces Ethernet technology and the role of MAC addresses in local network communication
Develops practical understanding of IPv4 addressing and network identification
Teaches learners how to divide networks into smaller subnets and introduces IPv6 addressing.
Introduces network switching and provides practical skills for configuring and managing switches.
Teaches learners how to logically separate networks and carry traffic between network segments.
Introduces routing and explains how routers forward traffic between different networks.
Explores essential network services that support addressing, name resolution and internet connectivity.
Provides practical knowledge of wireless networks and access point configuration.
Introduces fundamental techniques for protecting networks, devices and network traffic.
Develops practical skills for managing, monitoring and troubleshooting computer networks.
Introduces modern networking technologies and the role of networking in cloud and virtualised environments.
Enables learners to apply their networking knowledge by designing, configuring, testing and documenting a complete network solution
A Virtual Local Area Network, commonly called a VLAN, is a logical network created within a physical network.
VLANs allow network administrators to divide one physical network into multiple logical networks.
For example, a school may have one physical network infrastructure containing computers, printers, access points and switches. Instead of placing every device in the same logical network, the administrator can create separate VLANs for:
Administration
Teachers
Students
ICT department
Guests
Security systems
The devices can remain connected to the same physical switches while being logically separated into different VLANs.
VLANs are therefore an important networking technology for improving network organisation, traffic management and security.
By the end of this lesson, the learner should be able to:
Define a VLAN.
Explain why VLANs are used.
Explain the difference between a physical LAN and a VLAN.
Describe how VLANs logically divide a network.
Identify common VLAN types.
Explain access ports and trunk ports.
Explain VLAN tagging.
Describe the purpose of VLAN IDs.
Explain inter-VLAN communication.
Explain the relationship between VLANs and IP subnets.
Describe the security benefits of VLANs.
Create a simple VLAN design.
Perform basic VLAN configuration on a network switch.
Troubleshoot common VLAN problems.
VLAN stands for Virtual Local Area Network.
A VLAN is a logical grouping of devices within a switched network.
The word "virtual" means that the grouping is created through network configuration rather than by physically separating the computers and switches.
For example, one switch could have:
Port 1–8 assigned to VLAN 10
Port 9–16 assigned to VLAN 20
Port 17–20 assigned to VLAN 30
Although all devices are connected to the same physical switch, they belong to different logical networks.
Without VLANs, all devices connected to the same basic Layer 2 network may belong to the same broadcast domain.
Consider a school with 100 computers.
If every computer is placed in one network, broadcast traffic from one part of the network can reach many other devices.
VLANs allow the administrator to divide the network.
For example:
VLAN 10 – Administration
VLAN 20 – Teachers
VLAN 30 – Students
VLAN 40 – ICT Department
VLAN 50 – Guests
This provides better organisation and allows different network policies to be applied to different groups.
One of the most important purposes of VLANs is to divide broadcast domains.
A broadcast is traffic intended for devices within a particular broadcast domain.
By default, devices in different VLANs are separated at Layer 2.
For example:
Computer A → VLAN 10
Computer B → VLAN 10
Computer C → VLAN 20
Computer D → VLAN 20
A Layer 2 broadcast from Computer A is normally received by devices in VLAN 10, but not by devices in VLAN 20.
This helps control unnecessary broadcast traffic.
Imagine a computer laboratory with 30 computers.
The network administrator wants to create three groups:
Students
Instructors
Administrators
The physical network may use the same switches and cables.
The administrator can create:
VLAN 10 – Students
VLAN 20 – Instructors
VLAN 30 – Administrators
This creates logical separation without requiring three completely separate physical networks.
Each VLAN is normally identified using a VLAN ID.
A VLAN ID is a numerical identifier assigned to a VLAN.
Examples include:
VLAN 10
VLAN 20
VLAN 30
VLAN 40
The number helps switches identify which logical network a frame belongs to.
Network administrators should use a consistent VLAN numbering plan.
For example:
| VLAN ID | Purpose |
|---|---|
| 10 | Administration |
| 20 | Staff |
| 30 | Students |
| 40 | ICT |
| 50 | Guests |
| 60 | CCTV |
Administrators can also assign meaningful names to VLANs.
For example:
VLAN 10 – ADMIN
VLAN 20 – STAFF
VLAN 30 – STUDENTS
VLAN 40 – ICT
VLAN 50 – GUEST
Meaningful names make network management easier.
VLANs are commonly associated with different IP subnets.
For example:
VLAN 10 – Administration
Network: 192.168.10.0/24
VLAN 20 – Staff
Network: 192.168.20.0/24
VLAN 30 – Students
Network: 192.168.30.0/24
This makes it easier to identify which IP network belongs to which VLAN.
A common design principle is:
One VLAN → One IP subnet
Although this is common practice, the two concepts are not exactly the same.
A VLAN is a Layer 2 logical network, while an IP subnet is a Layer 3 logical network.
VLANs operate primarily at Layer 2 of the OSI model.
They are associated with Ethernet switching.
IP addressing and routing operate at Layer 3.
This distinction is important.
A switch can separate VLANs at Layer 2, but communication between different VLANs normally requires Layer 3 routing.
An access port is a switch port normally assigned to one VLAN.
For example:
Switch Port 1 → VLAN 10
Switch Port 2 → VLAN 10
Switch Port 3 → VLAN 20
A computer connected to an access port generally sends and receives ordinary Ethernet frames without needing to understand VLAN tagging.
Access ports are commonly used for:
Desktop computers
Printers
IP phones
Cameras
Other end devices
A trunk port is a switch port that can carry traffic for multiple VLANs.
For example, suppose two switches need to support:
VLAN 10
VLAN 20
VLAN 30
Instead of creating a separate physical cable for every VLAN, a trunk connection can carry traffic from all three VLANs over one physical link.
Example:
Switch A
↓ Trunk
Switch B
The trunk allows multiple VLANs to travel between switches.
| Feature | Access Port | Trunk Port |
|---|---|---|
| VLANs carried | Normally one | Multiple |
| Typical connection | End device | Switch-to-switch |
| VLAN tagging | Usually handled by switch | Used to identify VLANs |
| Example | PC to switch | Switch to switch |
| Main purpose | Connect devices | Carry multiple VLANs |
When traffic from multiple VLANs travels over a trunk, the network needs a way to identify which VLAN each frame belongs to.
VLAN tagging provides this information.
The most common standard associated with VLAN tagging on Ethernet networks is IEEE 802.1Q.
An 802.1Q VLAN tag identifies the VLAN associated with the frame.
IEEE 802.1Q is an important standard for VLAN tagging.
It allows VLAN information to be carried within Ethernet frames.
When a tagged frame travels across a trunk link, the receiving switch can determine which VLAN the frame belongs to.
802.1Q is widely used in switched Ethernet networks.
On some trunk configurations, one VLAN may be designated as the native VLAN.
Frames associated with the native VLAN may be transmitted without an 802.1Q tag depending on the equipment and configuration.
Network administrators should configure native VLANs carefully because incorrect configurations can create connectivity and security problems.
Devices in the same VLAN can communicate at Layer 2 if other network conditions permit.
For example:
PC 1 → VLAN 10
PC 2 → VLAN 10
They can communicate within VLAN 10.
However:
PC 1 → VLAN 10
PC 2 → VLAN 20
These devices are in different Layer 2 broadcast domains.
Communication between them normally requires routing.
Inter-VLAN routing is the process of allowing communication between different VLANs.
For example:
VLAN 10 → Router/Layer 3 Switch → VLAN 20
A router or Layer 3 switch can route traffic between the VLANs.
Consider a company with:
VLAN 10 – Administration
VLAN 20 – Staff
VLAN 30 – Students
Administration computers may need to access a central server located in another VLAN.
Inter-VLAN routing can allow authorised communication while network security policies control which traffic is permitted.
Router-on-a-stick is one method of performing inter-VLAN routing.
A single physical router interface can use multiple logical subinterfaces.
The connection between the switch and router operates as a trunk.
Conceptually:
VLAN 10
↓
Switch → Trunk → Router
VLAN 20
↓
Switch → Trunk → Router
The router uses different subinterfaces to route traffic between VLANs.
A Layer 3 switch can perform both switching and routing functions.
It can create switched VLANs and route traffic between VLANs.
This is useful in larger networks where routing between VLANs is required.
VLANs can improve network security by logically separating groups of devices.
For example:
Guest users can be separated from staff.
Student computers can be separated from administration systems.
CCTV devices can be separated from ordinary computers.
Servers can be placed in dedicated network segments.
However, VLANs alone should not be treated as complete security.
Firewalls, access-control rules, authentication and other security technologies may also be required.
A guest VLAN can be used to provide network access to visitors without giving them direct access to internal organisational systems.
For example:
VLAN 50 – GUEST
Guest devices may be allowed to access the Internet while being prevented from reaching sensitive internal servers.
A management VLAN can be used for managing network devices.
Network administrators may place management interfaces for switches, access points and other infrastructure into a dedicated VLAN.
Example:
VLAN 99 – MANAGEMENT
This can help separate network administration traffic from ordinary user traffic.
Voice VLANs are used to separate IP telephone traffic from normal data traffic.
For example:
VLAN 10 – DATA
VLAN 20 – VOICE
An IP phone can therefore use the voice VLAN while a computer connected through the phone can use the data VLAN, depending on the network design and equipment.
A data VLAN is used for ordinary user data traffic.
Examples include:
Web browsing
File access
Office applications
Learning systems
Network switches commonly have a default VLAN when they are initially configured.
The exact behaviour depends on the switch manufacturer and configuration.
Administrators should understand the default VLAN and configure the network according to the organisation's security and management requirements.
On a Cisco-style switch, a simple VLAN configuration may look like:
Switch(config)# vlan 10
Switch(config-vlan)# name ADMIN
Switch(config)# vlan 20
Switch(config-vlan)# name STAFF
Switch(config)# vlan 30
Switch(config-vlan)# name STUDENTS
A port can then be assigned to a VLAN.
Example:
Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
This assigns the port to VLAN 10.
Commands vary between vendors, so learners should consult the documentation for the particular switch being used.
A simplified Cisco-style trunk configuration may look like:
Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# switchport mode trunk
The trunk can then carry the VLANs permitted by the configuration.
Network administrators need to verify VLAN configuration.
On many Cisco switches, commands such as the following are useful:
show vlan brief
This can display VLAN information and assigned ports.
A trunk can be checked using:
show interfaces trunk
The exact commands depend on the network device.
Suppose a school has two switches.
Switch A has:
Students
Teachers
Switch B also has:
Students
Teachers
The switches can be connected using a trunk.
The trunk carries:
VLAN 10 – Students
VLAN 20 – Teachers
This allows students on both switches to remain in the same logical VLAN while teachers remain in another.
Consider a training centre with:
20 student computers
5 instructor computers
3 administrative computers
2 network printers
A possible VLAN design is:
VLAN 10 – Students
VLAN 20 – Instructors
VLAN 30 – Administration
VLAN 40 – Printers
This improves organisation and makes it easier to apply different network policies.
A bank may separate:
VLAN 10 – Staff
VLAN 20 – Customer Service
VLAN 30 – ATMs
VLAN 40 – CCTV
VLAN 50 – Management
VLAN 60 – Guest
This can help reduce unnecessary traffic and provide logical separation between different types of systems.
A school could use:
VLAN 10 – Administration
VLAN 20 – Teachers
VLAN 30 – Students
VLAN 40 – Library
VLAN 50 – ICT Laboratory
VLAN 60 – Guest Wi-Fi
Each group can have appropriate network policies.
VLANs provide several advantages:
Logical network segmentation.
Reduced broadcast domains.
Better network organisation.
Improved traffic management.
Greater flexibility.
Easier user grouping.
Improved security when combined with access controls.
Easier network administration.
Better use of existing switching infrastructure.
Support for different network policies.
VLANs can also introduce challenges.
Configuration can be complex for beginners.
Incorrect configuration can cause connectivity problems.
Inter-VLAN communication requires routing.
Troubleshooting can be more difficult.
Trunk configuration must be correct.
Security must be properly configured.
Larger networks may require careful VLAN documentation.
Different vendors may use different configuration procedures.
Common problems include:
Wrong VLAN assigned to a port
VLAN does not exist
Trunk is not configured
Incorrect trunk configuration
VLAN not permitted on trunk
Incorrect native VLAN
Incorrect IP subnet
DHCP problems
Inter-VLAN routing failure
Firewall blocking traffic
Incorrect gateway configuration
A technician can follow these steps:
Check whether the device is connected.
Check the switch port.
Confirm the assigned VLAN.
Confirm that the VLAN exists.
Check the IP address.
Check the subnet mask.
Check the default gateway.
Check trunk configuration.
Check whether the VLAN is allowed across the trunk.
Test communication within the same VLAN.
Test inter-VLAN communication.
Check router or Layer 3 switch configuration.
Using a network simulator such as Cisco Packet Tracer:
Create:
VLAN 10 – ADMIN
VLAN 20 – STAFF
VLAN 30 – STUDENTS
Assign three switch ports to each VLAN.
Verify the configuration.
Create two switches.
Configure:
VLAN 10
VLAN 20
Assign ports on both switches to the appropriate VLANs.
Connect the switches with a trunk.
Test communication between devices in the same VLAN.
Create:
PC1 – VLAN 10
PC2 – VLAN 10
PC3 – VLAN 20
Assign IP addresses appropriately.
Test communication.
Observe that devices in different VLANs require routing to communicate.
Using a router or Layer 3 switch:
Create VLAN 10.
Create VLAN 20.
Assign ports.
Configure a trunk.
Configure Layer 3 interfaces or router subinterfaces.
Assign gateway addresses.
Configure PCs.
Test communication between VLANs.
Design a VLAN network for a training institution.
Create VLANs for:
Administration
Trainers
Students
ICT
Guests
Printers
For each VLAN, provide:
VLAN ID
VLAN name
IP subnet
Default gateway
Purpose
What does VLAN stand for?
Define a VLAN.
Why are VLANs used?
What is a broadcast domain?
What is a VLAN ID?
What is an access port?
What is a trunk port?
What is VLAN tagging?
What is IEEE 802.1Q?
Why are VLANs commonly associated with IP subnets?
What is inter-VLAN routing?
What is a guest VLAN?
What is a management VLAN?
What is a voice VLAN?
State five advantages of VLANs.
State four disadvantages of VLANs.
What is the difference between an access port and a trunk port?
Why is a Layer 3 device required for normal communication between different VLANs?
What is router-on-a-stick?
Give three common VLAN configuration problems.
Design a VLAN network for a computer training centre with:
30 student computers
5 instructors
5 administrative computers
3 network printers
4 wireless access points
Guest users
CCTV cameras
Your design must include:
VLAN IDs.
VLAN names.
IP networks.
Switch ports.
Trunk connections.
Default gateways.
Inter-VLAN routing.
Security controls.
Guest network isolation.
A labelled network diagram.
VLAN – Virtual Local Area Network.
VLAN ID – Numerical identifier assigned to a VLAN.
Access Port – A switch port normally associated with one VLAN.
Trunk Port – A switch port that carries traffic for multiple VLANs.
VLAN Tag – Information identifying the VLAN associated with a frame.
802.1Q – IEEE standard for VLAN tagging.
Broadcast Domain – A group of devices that receive a particular Layer 2 broadcast.
Inter-VLAN Routing – Routing traffic between different VLANs.
Layer 3 Switch – A switch capable of performing routing functions.
Native VLAN – VLAN associated with untagged traffic on a trunk under applicable configurations.
Voice VLAN – VLAN used for voice/IP telephone traffic.
Guest VLAN – VLAN used to separate guest network users.
Management VLAN – VLAN used for managing network infrastructure.
A VLAN is a logical network created within a physical switched network.
VLANs allow network administrators to divide a network into logical groups without necessarily requiring separate physical networks.
Important VLAN concepts include:
VLAN IDs
Access ports
Trunk ports
VLAN tagging
IEEE 802.1Q
Broadcast domains
IP subnets
Inter-VLAN routing
VLANs are widely used in schools, businesses, banks, government institutions, hospitals and other organisations.
They can improve network organisation, traffic management and security when properly designed and combined with appropriate security controls.
More learning will be delivered through the Senior ICT Academy Campus by either a physical instructor or an online instructor.
Learners can continue with practical VLAN configuration, trunking, inter-VLAN routing, Layer 3 switching, VLAN security and enterprise network design.
Campus: https://campus.seniorictacademy.com/login
Senior ICT Academy: https://seniorictacademy.com