UK How a VLAN works
A VLAN, or virtual LAN, is a group of switch ports that behave as their own network, even though they share the same switch and cabling as other groups. Devices in one VLAN can talk to each other directly; to reach a device in another VLAN, their traffic has to pass through a router or Layer 3 switch.
A managed switch keeps VLANs apart by tagging frames. The IEEE 802.1Q standard adds a 4-byte tag to each Ethernet frame that carries a 12-bit VLAN ID, giving 4,094 usable VLANs (0 and 4095 are reserved), and a 3-bit priority field used for quality of service. The switch only forwards a frame to ports that belong to the same VLAN ID.
Each VLAN is its own broadcast domain. Broadcasts, such as ARP requests or discovery traffic from cameras, stay inside the VLAN instead of flooding every device on the switch.
VLANs are a logical layer on top of the physical design. The cabling still follows a star, ring or other layout, covered in our guide to network topology types, while the VLANs decide which devices on that cabling can see each other.
Access ports, trunk ports and the native VLAN
Three terms come up whenever VLANs are configured.
-
//
Access port. Belongs to one VLAN and connects an end device such as a PLC, camera or PC. The switch adds and removes the tag, so the device never sees it.
-
//
Trunk port. Carries several VLANs between switches, or to a router or server, with each frame tagged so the far end knows which VLAN it belongs to.
-
//
Native VLAN. The one VLAN on a trunk whose frames travel untagged. Both ends must agree on it, and many security guides recommend changing it from the default VLAN 1.
-
//
Voice and management VLANs. Dedicated VLANs for phones or for switch management, kept apart from user traffic.
VLAN tagging (IEEE 802.1Q)
VLAN tagging is how a switch marks which VLAN an Ethernet frame belongs to when that frame shares a link with other VLANs. The 802.1Q tag sits between the source MAC address and the EtherType field and has four parts: a 16-bit tag protocol identifier (TPID) set to 0x8100, a 3-bit priority code point (PCP) that carries the 802.1p priority, a 1-bit drop eligible indicator (DEI) and the 12-bit VLAN ID. The tag grows the largest standard frame from 1,518 to 1,522 bytes, which every 802.1Q-aware switch accepts.
Whether a frame carries a tag depends on the port. Each port has a port VLAN ID (PVID), and untagged frames arriving on it are placed in that VLAN. When a frame leaves, the port either strips the tag, as an untagged member of that VLAN, or keeps it, as a tagged member. Some switch interfaces use the access and trunk terms; many industrial switches instead show a grid of tagged, untagged and PVID settings for each port, which describes the same thing.
| Port setting | Frames it sends | Frames it accepts | Typical connection |
|---|---|---|---|
| Access (untagged) | Untagged, for one VLAN | Untagged, placed in the PVID | PLC, camera, HMI or PC |
| Trunk (tagged) | Tagged for each member VLAN, with the native VLAN untagged | Tagged frames for member VLANs; untagged frames go to the native VLAN | Links between switches, and to routers, firewalls and servers |
| Hybrid (vendor-specific) | Untagged for one VLAN, tagged for others | Both | An IP phone with a PC behind it, or a virtualised industrial PC |
Because the native VLAN is the untagged VLAN on a trunk, any untagged frame on that trunk ends up in it. If the native VLAN is also used for devices, an attacker can send double-tagged frames that hop into another VLAN, so a common hardening step is to set the native VLAN to an unused ID, or to tag it as well. Service providers go further and stack a second, outer tag (IEEE 802.1ad, often called Q-in-Q) to carry customer VLANs across their network.
End devices normally send untagged frames and let the switch tag them. Servers, hypervisors and industrial PCs that sit in several VLANs at once can tag their own traffic instead, using the VLAN settings of the network interface card driver, which saves a switch port for each VLAN.
VLAN vs LAN vs subnet
VLANs are often confused with subnets, because the two are usually set up together.
| Term | Layer | Defined by | Crossing it needs |
|---|---|---|---|
| LAN | Layers 1 and 2 | Physical switches and cabling | A router to reach other networks |
| VLAN | Layer 2 | 802.1Q VLAN ID on a managed switch | Inter-VLAN routing |
| Subnet | Layer 3 | IP address range and mask | A router or Layer 3 switch |
In practice, each VLAN is given its own IP subnet, and a router or Layer 3 switch routes between them. Our Layer 3 switch vs router FAQ explains which device does that routing, and our guide to Layer 2 vs Layer 3 switches covers when you need it.
Why use VLANs in industrial networks
Factories, utilities and transport systems often run control traffic, video, voice and office IT over the same cabling. VLANs keep those flows apart without separate switches for each. They also map neatly onto the zones and conduits of the IEC 62443 industrial security standard: each zone sits in its own VLAN, and traffic between zones passes through a firewall or router where it can be filtered.
-
//
Segmentation. Keep PLC and drive traffic, camera video and corporate traffic on separate logical networks over one set of cables.
-
//
Security. Contain a compromised device or a broadcast storm within its own VLAN.
-
//
Performance. Smaller broadcast domains mean less flooded traffic, and 802.1Q priority lets control traffic go first.
-
//
Flexibility. Group devices by function rather than by where they are wired, and move them by changing a port setting.
Setting up a VLAN
On a managed switch, setting up a VLAN takes four steps: create the VLAN ID and name it; assign access ports to it; add it to the trunk ports that link switches; and give it an IP subnet and a gateway on the router or Layer 3 switch. Document the plan, because a port in the wrong VLAN looks like a dead cable.
Our managed industrial switches support 802.1Q VLANs alongside QoS and ring redundancy, and the managed vs unmanaged switch guide helps decide when a network needs them.
Common VLAN mistakes
Most VLAN faults come from a handful of configuration slips rather than from the switches themselves.
-
//
Mismatched native VLANs. If the two ends of a trunk use different native VLANs, untagged traffic leaks between VLANs and some devices lose their connection.
-
//
A VLAN missing from a trunk. Devices in that VLAN work on one switch but cannot reach the same VLAN on the next one.
-
//
No route between VLANs. Separation works, but nothing can cross it, because no router or Layer 3 switch has an interface in each subnet.
-
//
Everything left in VLAN 1. The default VLAN carries management and user traffic together, which defeats the purpose of segmenting the network.
-
//
No documentation. A port silently placed in the wrong VLAN looks like a broken cable to whoever troubleshoots it next.
Quick answers on VLANs
VLANs: common questions
What does VLAN stand for?
Virtual local area network. A logical network defined in switch configuration rather than by physical wiring.
What is VLAN tagging?
Adding an 802.1Q tag to a frame. The 4-byte tag carries the VLAN ID and a priority value, so switches on a trunk know which VLAN each frame belongs to.
Can a VLAN span several switches or sites?
Yes. Trunk links carry a VLAN across many switches in a site. Between sites, VLANs are usually carried over a tunnel or overlay, though routing between sites is often the cleaner design.
Do VLANs slow a network down?
No. Tagging is done in switch hardware at full speed. Routing between VLANs can add a little delay, depending on the device doing it.
Can Wi-Fi use VLANs?
Yes. Access points usually map each wireless network name (SSID) to a VLAN, so guest and staff Wi-Fi stay apart on the wired network.
What is the difference between tagged and untagged VLAN ports?
Whether frames keep their 802.1Q tag. A tagged port sends frames with the VLAN tag, so the next switch knows which VLAN each belongs to. An untagged port strips the tag for end devices that do not use tags.
We supply managed industrial switches from our partners and specify the VLAN, QoS and redundancy features to suit how your network is segmented.