VLAN(VLAN)
Angleški izraz: Virtual LAN
A logically separated network on the same physical equipment that allows different groups of devices to function separately as if they were on different cables.
Kaj pomeni VLAN?
A VLAN (Virtual Local Area Network) is a technology that creates multiple logically separated networks on a single physical network. Devices in different VLANs do not 'see' each other directly, even though they are connected to the same switch.
Rules about which VLAN can communicate with which are set on the firewall or L3 switch. This means that traffic between two VLANs passes through a controlled point where we can log and restrict who accesses what.
In business environments, segmentation with VLANs is the standard today. Without it, all devices — from cameras and printers to servers and accounting systems — are in the same 'flat' network.
Zakaj je to pomembno za podjetja?
Network segmentation with VLANs is one of the cheapest and most effective security measures. If an infected laptop cannot directly reach a server or camera system, the damage during an attack is significantly reduced.
At the same time, VLANs make it easier to work with guests, IoT devices, and external contractors: each group gets its own VLAN with its own permissions. Without VLANs, every such opening is an exception that increases the risk for the entire company.
Kje se to pojavi v praksi?
A typical setup for a medium-sized company: separate VLANs for the office, servers, telephony (VoIP), IP cameras, guest Wi-Fi, and IoT devices. Each VLAN has its own address space, its own firewall rules, and its own DHCP.
Guests connecting to the guest Wi-Fi can only access the internet. Cameras can send footage exclusively to the monitoring server. Office workstations can access servers and printers, but not cameras or telephony directly.
Najpogostejše težave ali napake
The most common mistake is partial segmentation — VLANs exist, but there are no firewall rules between them. In this case, segmentation only exists on paper.
Another common issue: factory switch settings where all ports are in the default VLAN 1. One incorrectly connected IP camera in such an environment can become an entry point into the internal network.
A third mistake: guest Wi-Fi in the same VLAN as office devices — meaning every visitor has access to the internal network.
Kako pri tem pomaga VitalIT
At VitalIT, we first map existing networks — what is connected where and how things communicate with each other. Only then do we propose sensible segmentation that considers the actual structure of the company, not just technical 'aesthetics'.
In practice, this means a gradual introduction of VLANs: first, we separate the most obvious cases (guests, cameras, IoT), then internal segments. All changes are carried out in agreement with the client and in a way that minimizes disruption for users.
Sorodni izrazi
Povezane storitve
Pogosta vprašanja
- Do we need special equipment for VLANs?
- We need managed switches and a firewall that supports multiple VLANs. ISP routers and basic unmanaged switches do not support VLANs properly.
- Does a VLAN slow down the network?
- No. Modern switches handle VLANs in hardware without any measurable impact on speed. The only possible source of slowdown is traffic between two VLANs passing through the firewall — but even this is negligible with properly sized equipment.
- How many VLANs make sense to have?
- As many as we actually separate with different rules. In practice, for a small company between 3 and 6, for larger organizations, it can be dozens. More VLANs also mean more documentation and maintenance.
- Can VLANs replace a firewall?
- No. VLANs separate traffic, but rules about who can communicate with whom are set by the firewall. Without a firewall, a VLAN is just a logical label.