NETWORKING · 5 min read
Understanding VLANs and Network Segmentation
A practical introduction to access ports, trunks, and inter-VLAN routing.
What is a VLAN?
A virtual LAN divides a physical switched network into separate Layer 2 broadcast domains. Devices in different VLANs generally need Layer 3 routing to communicate.
Access ports and trunk ports
An access port normally carries traffic for one VLAN and is used for end devices. A trunk port can carry traffic for multiple VLANs using 802.1Q tagging, making it useful between switches and virtualization hosts.
Inter-VLAN routing
A router with subinterfaces or a Layer 3 switch can route traffic between VLANs. Firewall policies or ACLs should control which networks are allowed to communicate.
- Assign the intended VLAN to each access port
- Allow only necessary VLANs on trunks
- Verify the correct gateway and subnet on each client
- Test connectivity and confirm access restrictions
Lab takeaway
A good VLAN lab includes both positive tests, where permitted traffic succeeds, and negative tests, where blocked traffic is denied. Record your configuration and results.