What Is a VLAN and Why Office Networks Use Them
Basics4 minInnovialabs editorial team
In short
A VLAN splits one physical network into several isolated logical ones, so guests, staff, cameras, phones and servers share the same switches and cables but cannot reach each other unless the router allows it.
The short answer
A VLAN (Virtual Local Area Network) is a logical network created on top of the same physical switches and cables. Devices in different VLANs behave as if they were plugged into separate switches: they do not see each other's traffic, and they can talk only through the router or firewall, according to its rules.
Without VLANs, everything in the office lives in one flat network: a guest's phone, the accountant's laptop, the camera recorder and the file server are neighbours. With VLANs, each group gets its own segment.
How it works: VLAN IDs and tags
Each VLAN has a number — a VLAN ID from 1 to 4094. The switch marks which ports belong to which VLAN. When traffic for several VLANs needs to travel over one cable, the switch adds a small tag (the IEEE 802.1Q standard) to every frame, saying which VLAN it belongs to.
That gives two kinds of ports:
| Port type | What it carries | Typical connection |
|---|---|---|
| Untagged (access) | One VLAN, frames without tags | Computers, printers, cameras — devices that know nothing about VLANs |
| Tagged (trunk) | Several VLANs, each frame tagged | Switch to switch, switch to router, switch to access point |
A simple example: an access point broadcasts two Wi-Fi networks, "Office" and "Guest". The cable to the access point is a tagged port carrying VLAN 10 and VLAN 30. The access point maps each SSID to its VLAN, and the traffic stays separated all the way to the router.
An IP phone with a PC plugged into it is a classic mixed case: the phone uses the voice VLAN tagged, while the computer behind it stays untagged in the staff VLAN.
Typical office segments
| VLAN | Who lives there | Access rules (example) |
|---|---|---|
| Staff | Employee computers, laptops | Internet, servers, printers |
| Guests | Visitors' phones and laptops | Internet only, isolated from everything else |
| Cameras | IP cameras, recorder | No internet; only the recorder and authorised viewers can reach them |
| Phones (Voice) | IP phones, PBX | Phone system and provider; traffic prioritised |
| Servers | NAS, file and accounting servers | Only from staff VLAN and specific services |
| Management | Switch, router and access point admin interfaces | Only from the administrator's devices |
The numbers you choose do not matter much; consistency and documentation do. Each VLAN usually gets its own IP subnet and DHCP scope, for example 192.168.10.0/24 for staff and 192.168.30.0/24 for guests.
Why bother: security and performance
Security
- A guest or an infected laptop cannot scan or attack servers and cameras directly.
- Cameras and other "smart" devices with weak firmware are cut off from the internet and from staff computers.
- Admin interfaces of network equipment are hidden from ordinary users.
- Firewall rules between segments make it clear who is allowed to reach what.
Performance and order
- Broadcast traffic stays within its VLAN, so a large network does not drown in background chatter.
- Voice traffic can get QoS priority, so calls do not stutter during large downloads.
- Troubleshooting is easier: you know which segment a device is in by its address.
What you need and common mistakes
You need a managed switch that supports 802.1Q, a router or firewall that can route between VLANs and filter traffic, and access points that can map SSIDs to VLANs. Unmanaged switches pass tagged frames unpredictably, so avoid them in the middle of a VLAN network.
Common mistakes:
- Creating VLANs but allowing everything between them. Segmentation without firewall rules gives no security benefit.
- Mismatched trunk settings. A VLAN missing on one trunk link means devices in that segment get no address in one part of the building.
- Leaving the management interface in the staff or guest VLAN.
- Locking yourself out. Change VLAN settings on the port you are connected through last, and keep a console or backup access path.
- No documentation. Record VLAN IDs, subnets, ports and rules in one table.