VLAN in the Enterprise: Network Segmentation for Security and Order

A VLAN (Virtual LAN) is a logically separated network within the same physical infrastructure. Instead of separate cables and switches for each segment, we set up VLANs that managed switches separate using 802.1Q tags. The result: fewer cables, more security, and easier management.

TL;DR — Key Points

• VLAN separates broadcast domains — less noise, better performance
• VLAN is the foundation of a Zero Trust network — access between VLANs is explicitly controlled
• For VLANs, you need a managed switch and a router with 802.1Q support
• VLAN design flaws are typically exposed by IoT devices and guest WiFi

Why VLAN and not a separate physical network

In practice, separate physical networks would mean double the hardware and cabling — not only expensive but also complex to maintain. VLANs provide the same logical isolation while multiple networks run through the same switch. For truly separate environments (e.g., critical infrastructure), both approaches can be complementary.

Recommended VLAN design for SMBs

What you need for a VLAN

• Managed switch with 802.1Q support (at minimum) — HPE Aruba, MikroTik, Cisco, Ubiquiti UniFi, TP-Link Omada
• Router / Firewall with VLAN interface support (e.g., pfSense)
• Access points with multiple SSIDs mapped to VLANs
• IP addressing plan and documentation

Typical implementation errors

1. All ports are trunk — a port to a workstation should be an access port, not a trunk.
2. Missing native VLAN or incorrect native VLAN between trunks (leaving default VLAN 1).
3. All VLANs can communicate with each other — firewall rule configuration on the router is overlooked.
4. Access points do not separate SSIDs by VLAN (guest and staff on the same VLAN).
5. IoT VLAN has full internet access — cameras send traffic wherever they please.

VLAN and WiFi

Modern access points allow each SSID to belong to its own VLAN. This means: internal SSID → VLAN 10, guest SSID → VLAN 30, IoT SSID → VLAN 40. Users do not see this — they only see a list of Wi-Fi networks, while they are actually in separate logical segments. This is the fastest way to limit exposure from guests and IoT devices.

Measurement and Documentation

Document every VLAN: purpose, VLAN ID, subnet, DHCP range, target communications, responsible person. Good documentation is the best protection during team changes or in the event of an incident.

Zero Trust: What follows VLANs

VLANs are a great foundation, but they are not the final goal. The next step is microsegmentation and Zero Trust, where identity is verified at every access point, not just when entering the network. In practice, we implement this through Entra Private Access, Azure Application Gateway, or specialized ZTNA solutions. Read more about the approach in our article on phishing and identity security.

Do I need VLANs if I only have 10 computers?

Yes, at least minimal segmentation — at least a separate VLAN for guests and IoT. This alone reduces the risk of lateral movement by an attacker.

Which switches do you recommend for SMBs?

Ubiquiti UniFi and TP-Link Omada for basic environments due to ease of management, and HPE Aruba or MikroTik for more demanding ones. Always check for IGMP snooping support (for VoIP and multicast).

Does VLAN affect network performance?

Negligible. The benefits (smaller broadcast domains, better isolation) far outweigh the few microseconds of processing.

How do I perform inter-VLAN routing?

Via a router (pfSense, MikroTik) or an L3 switch. Always define explicit firewall rules between VLANs — default to deny.