VLAN and Network Segmentation Reference (IEEE 802.1Q)

The short answer

A VLAN (virtual LAN) is a logical broadcast domain carved out of shared switch hardware, defined by IEEE 802.1Q. The standard works by inserting a 4-byte (32-bit) tag into the Ethernet frame, between the source MAC address and the EtherType/Length field. That tag holds a 12-bit VLAN Identifier (VID), so 2^12 = 4096 values exist, but VID 0 and VID 4095 (0xFFF) are reserved, leaving 1-4094 as usable VLAN numbers. Each VLAN is its own broadcast domain: a switch will not forward broadcast, multicast, or unknown-unicast flooding from one VLAN into another, which is why segmentation contains broadcast storms and isolates traffic. Because a switch operates at Layer 2, devices in different VLANs cannot talk directly; a Layer-3 device (a router or Layer-3 switch) must route between them.

In practice each VLAN maps to one IP subnet (a common one-to-one relationship, though not required), so the VLAN is the Layer-2 fence and the subnet is the Layer-3 address range that rides on top of it. Ports come in two roles: an access port belongs to a single VLAN and sends frames untagged to the end device; a trunk (802.1Q-tagged) port carries many VLANs to another switch or router and tags each frame with its VID. One VLAN per trunk may be the native VLAN, whose frames are sent untagged. You segment cameras, IoT, guest Wi-Fi, and VoIP onto separate VLANs to shrink broadcast domains and to stop a compromised device on one segment from reaching another. Below is the exact tag anatomy, the port rules, a segmentation plan, and how routing and subnets tie it together.

Do You Need VLANs, and How Many?

Segmentation earns its keep when a flat network mixes traffic that should not trust each other, or when broadcast noise from many devices degrades performance. A single flat /24 (254 usable hosts) sharing one broadcast domain is fine for a handful of trusted workstations. Once you add IP cameras, badge readers, thermostats, guest Wi-Fi, and VoIP phones, those devices have very different security postures and traffic patterns, and a flat network lets any one of them reach every other. VLANs let you keep the same physical switches and cabling while splitting the logical network so broadcast traffic and lateral movement stay contained.

A workable rule of thumb: give each trust boundary its own VLAN. Common separations are management (switches, controllers), servers/workstations, VoIP, IP cameras/NVR, building IoT/BMS, and guest. Each VLAN typically becomes one IP subnet; size the subnet to the device count plus growth (a /24 gives 254 hosts, a /25 gives 126, a /23 gives 510). Remember that any communication between VLANs must pass through a Layer-3 device, so plan where routing and firewall rules live before you draw the VLAN map. If every device must talk to everything with no filtering, VLANs add complexity without benefit; the value is in the boundaries you actually enforce.

For a small office, 3-5 VLANs is usually enough (data, voice, guest, cameras, management). Larger sites push toward per-function VLANs but rarely exhaust the 4094 usable IDs; the practical limit is your switch's supported active-VLAN count and its Layer-3 routing capacity, not the 12-bit ID space. Decide up front whether a Layer-3 switch will route locally at wire speed or whether a router/firewall handles inter-VLAN traffic, because that choice sets both performance and where your security policy is enforced.

• Usable VLAN IDs: 1-4094 (12-bit VID = 4096 values; 0 and 4095/0xFFF reserved).
• One VLAN = one broadcast domain; a switch never floods broadcasts between VLANs.
• Typical mapping is one VLAN to one IP subnet: /24 = 254 hosts, /25 = 126, /23 = 510.
• Any VLAN-to-VLAN traffic requires a Layer-3 device (router or Layer-3 switch).
• Small-office starting point: separate data, voice, guest, cameras, and management.
• Real ceiling is the switch's active-VLAN and routing limits, not the 4094 ID range.

Anatomy of the 802.1Q Tag

IEEE 802.1Q defines the tag inserted into a standard Ethernet frame. It is 32 bits (4 bytes) long and sits between the source MAC address and the original EtherType/Length field. The tag has two halves. The first 16 bits are the Tag Protocol Identifier (TPID), set to 0x8100, which is what tells a receiving switch the frame is 802.1Q-tagged (0x8100 sits in the position an EtherType would normally occupy, so untagged switches would read it as an unknown type).

The second 16 bits are the Tag Control Information (TCI), split into three fields. The Priority Code Point (PCP) is 3 bits, giving 8 priority levels (0-7) per IEEE 802.1p, used for class-of-service queuing, for example prioritizing VoIP. The Drop Eligible Indicator (DEI) is 1 bit (formerly the Canonical Format Indicator, CFI); when set it marks the frame as eligible to be dropped first during congestion. The VLAN Identifier (VID) is the final 12 bits, holding the VLAN number 0-4095, of which 0 and 4095 are reserved.

Adding 4 bytes raises the maximum Ethernet frame from 1518 to 1522 bytes (the 802.3ac amendment), sometimes called a baby-giant frame; the minimum frame stays 64 bytes. VID 0 means the frame carries priority information (PCP) but no VLAN assignment (a priority-tagged frame). VID 1 is the conventional default VLAN. Stacking two tags (QinQ, IEEE 802.1ad) uses an outer service tag with TPID 0x88A8 and an inner customer tag at 0x8100, letting a provider carry a customer's VLANs transparently.

• Tag size: 32 bits / 4 bytes, inserted between source MAC and EtherType.
• TPID: 0x8100 identifies an 802.1Q frame (0x88A8 for the outer 802.1ad/QinQ S-tag).
• TCI fields: PCP 3 bits (8 priorities, 802.1p), DEI 1 bit (drop eligibility, was CFI), VID 12 bits.
• VID range 0-4095; 0 = priority-tagged (no VLAN), 4095 reserved, 1-4094 assignable, 1 = default.
• Max frame grows 1518 to 1522 bytes with the tag (802.3ac); minimum stays 64 bytes.
• QinQ (802.1ad) stacks an outer S-tag (0x88A8) over an inner C-tag (0x8100).

Access, Trunk, and Native VLAN

A switch port operates in one of two roles. An access port belongs to a single VLAN and connects to an end device (PC, phone, camera, access point). Frames leave an access port untagged, and any untagged frame arriving is placed into that port's access VLAN. The end device is unaware VLANs exist; the switch handles membership. This is where you place most endpoints.

A trunk port (the standard calls it a tagged port; Cisco uses trunk) carries many VLANs over one link, typically switch-to-switch or switch-to-router. Every frame on a trunk is tagged with its VID so the far end knows which VLAN it belongs to. The set of VLANs allowed on a trunk should be pruned to only those actually needed on the far switch, which limits broadcast propagation and attack surface. Trunks are how a multi-switch network keeps VLANs consistent end to end.

A trunk may designate one VLAN as the native VLAN, whose frames are sent untagged; anything arriving untagged on the trunk is assigned to it. The default native VLAN is 1. A native-VLAN mismatch between the two ends of a trunk merges two VLANs' traffic and breaks isolation, so both ends must agree. Native VLAN 1 is also the classic vector for double-tagging VLAN hopping: an attacker sends a frame with two tags, the first switch strips the outer (native) tag and forwards the inner tag onward. Mitigations are to set the native VLAN to an unused, dedicated ID that carries no user traffic, to tag the native VLAN, to disable dynamic trunk negotiation, and to hard-set endpoint ports as access. Switch spoofing, where a host pretends to be a trunk to receive all VLANs, is prevented by disabling auto-trunking and locking access ports.

• Access port: one VLAN, frames untagged to the device; incoming untagged frames join the access VLAN.
• Trunk (802.1Q tagged) port: many VLANs, every frame tagged with its VID; prune to needed VLANs only.
• Native VLAN: the one VLAN sent untagged on a trunk; default is VLAN 1, both ends must match.
• VLAN hopping (double-tagging) abuses native VLAN 1; use a dedicated unused native VLAN or tag it.
• Switch spoofing abuses auto-trunk negotiation; disable DTP and pin endpoint ports to access mode.
• Keep management traffic off VLAN 1 and off the native VLAN.

What to Put on Separate VLANs and Why

Segmentation buys two things: smaller broadcast domains (better performance and easier troubleshooting) and enforced trust boundaries (a device on one VLAN cannot reach another without passing your Layer-3 filter). Group devices by how much you trust them and how they behave. IP cameras and their NVR generate steady multicast/broadcast and are frequently the least-patched devices on a network, so a camera VLAN both contains their chatter and keeps a compromised camera from pivoting to servers. Building IoT (thermostats, sensors, controllers) belongs on its own VLAN for the same reason.

Guest Wi-Fi should always be isolated so visitors reach the internet but not internal resources; this VLAN typically gets a firewall rule allowing outbound only and blocking the RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). VoIP phones go on a dedicated voice VLAN, which lets you apply PCP/802.1p priority so voice packets are queued ahead of bulk data, protecting call quality; many phones support an auxiliary/voice VLAN so a PC daisy-chained behind the phone lands on the data VLAN while the phone tags voice.

Keep switch and controller management on a separate management VLAN, not VLAN 1, so administrative access is reachable only from trusted hosts. The general principle: the more a device class differs in trust or traffic pattern, the stronger the case for its own VLAN. Then write inter-VLAN rules that default-deny and allow only the flows you need (for example, workstations to the NVR for viewing, but nothing from cameras back to workstations).

• Cameras/NVR: own VLAN to contain multicast and isolate often-unpatched devices.
• Guest Wi-Fi: internet-only; block private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
• VoIP: dedicated voice VLAN with 802.1p/PCP priority (0-7) to protect call quality.
• IoT/BMS: separate VLAN so sensors and controllers cannot reach business systems.
• Management: switches and controllers on their own VLAN, never VLAN 1.
• Enforce default-deny inter-VLAN rules and permit only the specific required flows.

Inter-VLAN Routing and Subnets

A VLAN is a Layer-2 construct; an IP subnet is a Layer-3 construct. In almost every design they line up one-to-one: VLAN 20 is subnet 10.0.20.0/24, VLAN 30 is 10.0.30.0/24, and so on. Devices within a VLAN reach each other directly through the switch. Devices in different VLANs are in different subnets, so a host sends cross-VLAN traffic to its default gateway, and a Layer-3 device routes it. Nothing crosses a VLAN boundary without that routing step, which is exactly what makes VLANs a security tool: the router or Layer-3 switch is where you apply access control lists between segments.

Two common ways to provide the gateway. Router-on-a-stick uses a single trunk from a switch to a router, with the router configured with one sub-interface per VLAN (each with the VLAN's gateway IP and a dot1Q tag); simple but the one link can bottleneck aggregate inter-VLAN traffic. A Layer-3 switch instead uses Switched Virtual Interfaces (SVIs) - one virtual interface per VLAN - and routes between them in hardware at wire speed, which is preferred once inter-VLAN volume is significant.

Size subnets to the VLAN's device count with headroom. A /24 yields 254 usable hosts (256 addresses minus network and broadcast); /25 = 126; /23 = 510; a point-to-point link can use a /30 (2 hosts) or /31 (2 hosts, RFC 3021). Keep the gateway address consistent (commonly .1 or .254) across VLANs for sanity. Reserve DHCP scopes per VLAN and, if you route with a firewall, treat each VLAN interface as a zone with its own inbound and outbound policy.

• VLAN = Layer-2 broadcast domain; subnet = Layer-3 address range, usually mapped one-to-one.
• Cross-VLAN traffic always goes host to gateway to Layer-3 device; that device is where ACLs live.
• Router-on-a-stick: one 802.1Q trunk, one router sub-interface per VLAN; single-link bottleneck.
• Layer-3 switch: one SVI per VLAN, routes in hardware at wire speed; better for heavy inter-VLAN flow.
• Subnet sizing: /24 = 254 hosts, /25 = 126, /23 = 510, /30 = 2, /31 = 2 (RFC 3021).
• Assign a consistent gateway (.1 or .254) and a per-VLAN DHCP scope.

Frequently asked questions