VLANs Explained: Tagging, Trunks, and the Native VLAN

A VLAN divides one physical switch into several logical ones. Ports assigned to different VLANs behave as though they were on separate switches with no cable between them, even though the frames pass through the same silicon.

The reason this exists is broadcast domains, not security, and starting from the wrong reason leads to the most common mistakes in VLAN design.

The Problem VLANs Solve

Every device on a switch hears every broadcast frame on that switch. Address resolution, discovery protocols and various chatty services all broadcast. As the number of devices grows, the proportion of every device’s network interface time spent discarding broadcasts meant for someone else grows with it.

Splitting the network into smaller broadcast domains bounds that. It also bounds the blast radius of a misbehaving device flooding the network.

Doing it physically means separate switches and separate cable runs. VLANs do it logically, which is why almost every managed switch supports them.

Access Ports

An access port belongs to exactly one VLAN. Frames arriving on it are associated with that VLAN internally, and frames leaving it are sent plain, with no VLAN information attached.

The device plugged into an access port does not need to know VLANs exist. A printer, a laptop or a camera plugged into an access port behaves exactly as it would on an unmanaged switch. This is the correct port type for ordinary end devices and it is what most ports should be.

Trunk Ports and Tagging

A trunk carries several VLANs over one physical link. Because frames from different VLANs share the wire, each one needs a label saying which VLAN it belongs to.

The 802.1Q standard defines that label: a small tag inserted into the frame carrying the VLAN identifier. The switch at the far end reads the tag, places the frame into the matching VLAN, and removes the tag before sending it out an access port.

Trunks are used between switches, between a switch and a router that routes several VLANs, and between a switch and a device that genuinely handles multiple VLANs itself, such as a hypervisor host or a wireless access point serving several networks.

The Native VLAN

On a trunk, one VLAN can be designated to travel untagged. That is the native VLAN, and it exists for backward compatibility with devices that do not tag.

It is also the most reliable way to bridge two networks by accident. Frames from the native VLAN cross the trunk with no label. The switch at the other end receives an untagged frame and places it into whatever it considers its own native VLAN. If the two ends disagree, traffic leaves one VLAN and arrives in a different one, and nothing reports an error.

Configure the native VLAN identically on both ends of every trunk. Where the equipment allows it, tagging all VLANs including the native one removes the ambiguity entirely.

Getting Between VLANs

A VLAN is a separate broadcast domain and, in practice, a separate subnet. Reaching a different one requires routing, exactly as reaching any other subnet does.

That routing happens either on a router with a trunk to the switch, handling each VLAN on a subinterface, or on a layer 3 switch that routes internally between VLAN interfaces. See how routing works for what the router is doing once the frame reaches it.

This routing step is the control point. Rules applied there decide which VLANs can reach which, and on what ports. Without rules, routing between VLANs restores full connectivity and removes most of the separation you configured.

VLANs Are Not a Firewall

Separation at layer 2 is real: a device in one VLAN cannot address a device in another without going through a router. That is worth having.

It is not isolation. Once routing exists, reachability exists unless something denies it. A guest VLAN that routes freely to the internal VLAN is a guest network in name only.

Design the VLANs around groups that need different rules, then write the rules at the routing point. The VLAN is the handle the policy attaches to.

A Worked Layout

A small office might separate staff devices, guest wireless, voice handsets and cameras. Four VLANs, each a subnet, all present on the switch.

Staff ports and camera ports are access ports in their respective VLANs. The wireless access points get trunks, because each one serves both the staff and guest networks over the same cable. The link to the router is a trunk carrying all four.

Handsets often need two VLANs on one port, because a computer is daisy-chained through the phone. That combination, an access VLAN for the computer and a tagged voice VLAN for the phone, is a standard arrangement on switches that support it.

What People Get Wrong About This

The first mistake is mismatched native VLANs on the two ends of a trunk. Traffic crosses into the wrong network, and nothing logs it.

The second is treating VLAN membership as security. Once a router joins them, the separation is only as strong as the rules on that router.

A third is configuring an end device’s port as a trunk because a guide said trunks carry more traffic. An ordinary device does not tag, so it ends up in the native VLAN and the other VLANs on that trunk are simply exposed at that port.

A fourth is forgetting that every VLAN needs its own address plan. Two VLANs sharing a subnet range works until routing is introduced and then breaks in ways that are very hard to read. IP addressing and subnets covers the planning.

And the last is building more VLANs than there are distinct policies. Every additional VLAN is another subnet, another interface and another set of rules. If two groups are treated identically everywhere, they do not need separating.

Where This Connects

VLANs sit at layer 2, which is the same layer as ARP and MAC addresses: each VLAN has its own address resolution and its own MAC address table on the switch. Above them, each VLAN is a subnet that how routing works describes reaching.