How many VLANs should a small office have?

Enough to separate things that should not see each other: users, servers, guests, printers and building devices, and the management interfaces of the network gear. Five or six is typical, and one is a design that has not been made.

What is the native VLAN?

The one VLAN a trunk carries without a tag, for compatibility with devices that do not understand tagging. Leaving it at the default on every switch is the configuration that VLAN-hopping attacks exploit, and changing it is a one-line fix the security exams expect you to know.

Do VLANs replace a firewall?

No. They create the boundaries; the firewall or the routed switch's access rules decide what may cross. A network with VLANs and no rules between them has separated its broadcast traffic and nothing else.

VLAN (Virtual LAN)

Also: VLAN, virtual LAN, 802.1Q, trunk port, access port, VLAN tagging

A VLAN divides one physical switched network into several logical segments, each with its own broadcast domain, by tagging frames with a VLAN identifier so that ports and devices in different VLANs cannot reach each other without a router.

Our take. VLANs are the cheapest segmentation available and the most commonly wasted. A network where every device sits in one VLAN because that was the default has no internal boundaries at all, and the compromise of a printer is the compromise of the finance server. The work is deciding what belongs apart, and the switch has been able to enforce it for thirty years.

One switch, many networks

Without VLANs, every port on a switch is one segment: every device sees every broadcast and can reach every other device at layer two. A VLAN assigns each port a number, and the switch treats ports with different numbers as if they were on different switches with no cable between them. Between two switches, a single link carries frames from many VLANs by adding a tag to each frame that names its VLAN; that link is a trunk, and the ports facing devices, which carry one untagged VLAN each, are access ports. The tag is four bytes, the standard is old, and every managed switch supports it.

A VLAN is a layer-two boundary and almost always pairs with a layer-three one: each VLAN gets its own subnet, and a router or a layer-three switch moves traffic between them. That pairing is where the security value lives. Traffic between the user VLAN and the server VLAN has to pass a routed hop, and a routed hop is a place to filter and log; traffic within a VLAN passes only the switch and is invisible to anything else. Servers, users, guests, building systems, management interfaces of the network gear itself: each is a VLAN with a subnet, and the firewall rules between them exist only because the boundaries do.

The exams treat VLANs as core material. The vendor-neutral networking exam asks what a trunk carries and why a device in the wrong VLAN cannot reach its gateway; the Cisco associate paper has you configure access and trunk ports, name the native VLAN and troubleshoot a mismatch; the security papers ask why VLAN hopping is a risk when trunk ports are left at their defaults. The practical version of all three is that a VLAN is only a boundary if the ports at its edge are configured as such.

In practice

Before: one VLAN, one subnet, four hundred devices. A phishing compromise on a receptionist's laptop can scan and reach every server directly.
After: users, servers, printers, guest Wi-Fi and network management each in their own VLAN and subnet, with a firewall between them. The same compromised laptop can reach the printers it is allowed to print to and nothing else.
Cost: an afternoon of switch configuration and the decision about what belongs apart. No new hardware.

The mistake that undoes it: a trunk port left with its default settings on a switch in a meeting room, where a visitor's device can tag its own frames and land in whichever VLAN it names. Trunks belong only between switches, access ports belong at every desk, and the difference is one line of configuration per port.

Often confused with

Subnetting: A subnet is a layer-three range of addresses; a VLAN is a layer-two grouping of ports. They are paired one to one in almost every design, and they are still two different mechanisms enforced by two different parts of the switch.
Switching: Switching is the forwarding of frames by learned address; a VLAN is the feature that tells the switch which ports form one segment for that forwarding. Every VLAN-capable switch is a switch first.
Firewall: A VLAN separates; a firewall filters what crosses the separation. VLANs without a firewall between them are boundaries with an open door, and a firewall without VLANs has nothing to sit between.

Key takeaways

→A VLAN makes one switch behave as several; a tag on each frame carries the VLAN across trunks.
→Pair each VLAN with a subnet and put a filter at the routed hop between them.
→One flat VLAN is no segmentation; a misconfigured trunk at a desk undoes all of it.

Certifications that test this

Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.

More courses from these shelves

A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.

FAQ

How many VLANs should a small office have?: Enough to separate things that should not see each other: users, servers, guests, printers and building devices, and the management interfaces of the network gear. Five or six is typical, and one is a design that has not been made.
What is the native VLAN?: The one VLAN a trunk carries without a tag, for compatibility with devices that do not understand tagging. Leaving it at the default on every switch is the configuration that VLAN-hopping attacks exploit, and changing it is a one-line fix the security exams expect you to know.
Do VLANs replace a firewall?: No. They create the boundaries; the firewall or the routed switch's access rules decide what may cross. A network with VLANs and no rules between them has separated its broadcast traffic and nothing else.

Sources

The primary text this definition rests on. Read it before you trust ours.

IEEE 802.1Q, Bridges and Bridged Networks (2022)
NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009)

Last reviewed 13 September 2026 · Getting Digital

VLAN (Virtual LAN)

In practice

Often confused with

Key takeaways

Certifications that test this

More courses from these shelves

Networking Full Course & Network + certification

Microsoft Dynamics 365 Business Central- Manufacturing

The Ultimate AWS Networking Training Course: All In One

Linux & Networking: Real-World Scenarios - Practice Tests

The Basics of DAO (Autonomous Organization) in Blockchain

Master Full stack .NET Architecture using C#

FAQ

Sources