VLANs (802.1Q)
Logical network segmentation at Layer 2
What VLANs Are and Why They Exist
A VLAN (Virtual LAN) is a logical partition of a physical switch into multiple independent broadcast domains. Without VLANs, every port on a switch belongs to one broadcast domain — a broadcast frame on port 1 reaches every other port. VLANs break that up so broadcast traffic stays contained within each VLAN, even though the hosts share the same physical switch.
Broadcast Domain Segmentation
A 48-port switch without VLANs is one broadcast domain — every ARP, DHCP, and mDNS packet hits all 48 ports. With VLANs, you can split it into multiple isolated domains. VLAN 10 traffic never reaches VLAN 20 at Layer 2.
Security Isolation
VLANs enforce L2 segmentation. Hosts on different VLANs cannot communicate without a router or L3 switch that explicitly routes between them — and that routing point is where you apply ACLs and firewall rules.
Traffic Management
Separate VLANs for different traffic types: user data, VoIP, management, storage. Each can have different QoS policies, and issues in one VLAN (broadcast storm, misbehaving host) don't cascade to others.
Note
The mental model: Think of a VLAN as turning one physical switch into multiple virtual switches. Each VLAN behaves exactly like a separate physical switch — its own MAC table, its own broadcast domain, its own STP instance (if using PVST+ / MSTP).
802.1Q Tag Structure
IEEE 802.1Q defines how VLAN membership is carried inside Ethernet frames. A 4-byte tag is inserted between the Source MAC and the original EtherType field.
Untagged Frame (Standard Ethernet)
Tagged Frame (802.1Q)
Inside the 802.1Q Tag (4 bytes / 32 bits)
Tag Field Details
| Field | Size | Purpose |
|---|---|---|
| TPID (Tag Protocol Identifier) | 16 bits | Always 0x8100 — this is what tells the receiver "this frame is VLAN-tagged." It occupies the position where EtherType normally sits, so the receiver knows to parse the next 2 bytes as TCI before finding the real EtherType. |
| PCP (Priority Code Point) | 3 bits | QoS priority (0–7). Used by switches for traffic prioritization. 0 = best effort, 5 = voice, 6 = internetwork control, 7 = network control. Maps to CoS (Class of Service). |
| DEI (Drop Eligible Indicator) | 1 bit | Marks the frame as eligible to be dropped during congestion. Formerly CFI (Canonical Format Indicator). |
| VID (VLAN Identifier) | 12 bits | The VLAN number: 0–4095. VID 0 = priority tagged (no VLAN), VID 1 = default VLAN, VID 4095 = reserved. Usable range: 1–4094 (4,094 VLANs per switch). |
Note
Frame size impact: The 4-byte 802.1Q tag increases the maximum frame size from 1518 bytes to 1522 bytes. This is called a "baby giant" frame. All 802.1Q-compliant switches handle this transparently, but some older equipment or misconfigured interfaces may drop 1522-byte frames as oversized.
Access Ports vs. Trunk Ports
Every switch port operates in one of two modes, and understanding the difference is fundamental to VLAN configuration.
- Belongs to exactly one VLAN
- Connected to end devices (servers, workstations, printers)
- Frames are untagged — the end device has no VLAN awareness
- The switch adds the VLAN tag on ingress and strips it on egress
- Configuration:
switchport mode access+switchport access vlan 10
- Carries multiple VLANs simultaneously
- Connected to other switches, routers, or VLAN-aware hosts
- Frames are tagged with 802.1Q headers
- One VLAN can be "native" (sent untagged) — see below
- Configuration:
switchport mode trunk+switchport trunk allowed vlan 10,20,30
Host (VLAN 10)
Sends untagged frame
Access Port
Switch tags: VLAN 10
Trunk Port
Forwards with 802.1Q tag
Remote Switch
Reads tag, forwards to VLAN 10 port
Access Port
Strips tag, delivers untagged
Tip
Linux hosts are VLAN-aware. Unlike a traditional "dumb" endpoint, Linux servers can handle 802.1Q tags directly. You create VLAN sub-interfaces with ip link add link eth0 name eth0.10 type vlan id 10. This means a single server NIC connected to a trunk port can participate in multiple VLANs — a pattern used heavily in virtualization, containers, and multi-tenant environments.
Native VLAN
On a trunk port, one VLAN is designated as the native VLAN. Frames belonging to the native VLAN are sent untagged across the trunk — no 802.1Q header is inserted. All other VLANs are sent tagged.
How Native VLAN Works
- Default native VLAN is VLAN 1 on most switches.
- When a switch receives an untagged frame on a trunk port, it assigns it to the native VLAN.
- The native VLAN must match on both ends of a trunk link. A mismatch causes traffic to leak between VLANs — this is both a connectivity issue and a security vulnerability.
- Control-plane protocols like CDP, VTP, and DTP are sent untagged on the native VLAN.
Warning
Security risk — VLAN hopping: If an attacker sends 802.1Q-tagged frames into an access port configured for the native VLAN (typically VLAN 1), those frames may be double-tagged and forwarded across trunk links into a different VLAN. This is the classic "double-tagging" VLAN hopping attack. Mitigations: (1) Never use VLAN 1 as the native VLAN for user traffic. (2) Set a dedicated, unused VLAN as the native VLAN. (3) On Cisco: switchport trunk native vlan 999 + vlan dot1q tag native (forces tagging of native VLAN).
Inter-VLAN Routing
VLANs isolate broadcast domains at Layer 2, which means hosts on different VLANs cannot communicate by default. To enable cross-VLAN traffic, you need a Layer 3 device (router or L3 switch) that routes between the VLAN subnets.
Option 1: Router-on-a-Stick
Gi0/0.20 — 10.0.20.1/24
trunk
How It Works
- A single physical router interface connects to the switch via a trunk link.
- The router creates subinterfaces — one per VLAN (e.g.,
Gi0/0.10for VLAN 10,Gi0/0.20for VLAN 20). - Each subinterface has its own IP address and acts as the default gateway for that VLAN's subnet.
- Traffic between VLANs traverses the trunk link twice: up to the router, routed, and back down the same trunk — hence "router-on-a-stick."
Note
Limitation: The single trunk link is a bandwidth bottleneck. All inter-VLAN traffic competes for the same 1G or 10G link. Suitable for small deployments, but not for production environments with significant east-west traffic.
Option 2: L3 Switch (SVI — Switch Virtual Interface)
SVI VLAN 20: 10.0.20.1/24
How It Works
- An L3 switch has a built-in routing engine alongside its switching ASIC.
- An SVI (Switch Virtual Interface) is created for each VLAN that needs routing:
interface vlan 10+ip address 10.0.10.1 255.255.255.0. - Routing between VLANs happens in hardware at wire speed — no hairpin through an external router.
- The SVI IP address serves as the default gateway for hosts in that VLAN.
- Single trunk = bandwidth bottleneck
- Routing in software (CPU-bound)
- Adds latency
- Suitable for small/lab environments
- Uses existing router hardware
- Wire-speed routing via hardware ASIC
- No bottleneck — traffic stays on backplane
- Microsecond latency
- Standard in production networks
- Requires L3-capable switch (virtually all modern switches)
VLANs Across Multiple Switches
VLANs span across switches via trunk links. Each switch maintains the same VLAN definitions, and trunk ports carry tagged frames between them.
trunk
Traffic Flow: Host A to Host B (same VLAN, different switches)
- Host A sends an untagged frame to Switch 1's access port (VLAN 10).
- Switch 1 knows Host B's MAC is reachable via the trunk port. It adds an 802.1Q tag (VID 10) and sends the frame out the trunk.
- Switch 2 receives the tagged frame, reads VID 10, and looks up the destination MAC in its VLAN 10 MAC table.
- Switch 2 strips the 802.1Q tag and forwards the untagged frame out Host B's access port.
Why VLANs Matter: Real-World Use Cases
Broadcast Domain Reduction
A flat L2 network with 1000 hosts generates enormous broadcast traffic (ARP, DHCP, mDNS, NetBIOS). Segmenting into VLANs of 100–250 hosts each keeps broadcast traffic manageable and reduces CPU load on every host.
Security — PCI-DSS Segmentation
PCI-DSS requires network segmentation to isolate cardholder data environments (CDE) from the rest of the network. VLANs provide the L2 boundary, combined with firewall rules between VLAN subnets. Without proper segmentation, your entire network is in-scope for PCI audits.
Traffic Isolation
Separate VLANs for different traffic types: user workstations (VLAN 10), VoIP phones (VLAN 20), server/storage (VLAN 30), management/iLO (VLAN 99). A broadcast storm in the user VLAN doesn't take down iLO access to your servers.
Multi-Tenancy
Co-location and shared infrastructure use VLANs to isolate tenants at Layer 2. Each tenant gets their own VLAN(s), ensuring traffic isolation without dedicated physical switches. In cloud/K8s contexts, this maps to network namespaces and CNI plugin VLAN modes.
VLAN Best Practices
| Practice | Rationale |
|---|---|
| Don't use VLAN 1 for user traffic | VLAN 1 is the default VLAN on all switch ports and is used for control-plane protocols (CDP, VTP, DTP, STP). It cannot be deleted. Put all user traffic on explicitly created VLANs. Leave VLAN 1 for switch-to-switch control traffic only. |
| Dedicate a management VLAN | SSH access to switch management interfaces (SVIs), iLO/iDRAC/BMC traffic, and SNMP monitoring should be on a dedicated VLAN with strict ACLs. If the user VLAN is compromised, the management plane is isolated. |
| Use a dedicated voice VLAN | VoIP phones need QoS guarantees (low latency, no jitter). A separate VLAN allows PCP/DSCP marking and priority queuing on switch ports. Cisco supports "switchport voice vlan 20" which configures the phone port as a mini-trunk. |
| Set a non-default native VLAN | Change the native VLAN on all trunk ports to an unused VLAN (e.g., VLAN 999) to prevent VLAN hopping attacks via double-tagging. Tag native VLAN traffic explicitly where possible. |
| Prune trunk links | Only allow VLANs on a trunk that are actually needed on the other side. switchport trunk allowed vlan 10,20,30. Don't trunk "all" — it defeats the purpose of segmentation and extends broadcast domains unnecessarily. |
| Document VLAN assignments | Maintain a VLAN allocation table: VLAN ID, name, subnet, purpose, which switches carry it. Without documentation, VLAN sprawl quickly becomes unmanageable. Treat it like a Terraform state file — it's the source of truth. |
| Limit VLAN size to ~250 hosts | Larger broadcast domains generate proportionally more broadcast traffic. A /24 subnet (254 hosts) per VLAN is a good balance. Larger VLANs (/22, /20) should be reserved for specific use cases with justified broadcast tolerance. |
Tip
Kubernetes context: In bare-metal K8s clusters, you'll often see a VLAN for the node management network (SSH, K8s API), a separate VLAN for Pod overlay traffic (VXLAN/Geneve underlay), and sometimes a third VLAN for storage (Ceph, NFS). The CNI plugin (Calico, Cilium, Multus) may use VLAN sub-interfaces to attach Pods directly to specific VLANs — this is common for SR-IOV and DPDK workloads that need native L2 access.
Warning
VLANs are not a firewall. VLANs provide Layer 2 isolation, but they are not a substitute for firewalling. An L3 switch routing between VLANs will happily forward all traffic unless you configure ACLs. In security-sensitive environments (PCI, HIPAA), VLANs are a segmentation mechanism, but the enforcement point is the firewall/ACL at the L3 boundary. Defense in depth: VLANs + ACLs + firewall rules + microsegmentation (Calico NetworkPolicy, Cilium).
