VLANs — Segmentation, Access vs Trunk Ports, 802.1Q Tagging

Concrete Example

Take one 24-port switch serving three departments. Without VLANs, a broadcast from an engineering workstation is delivered to every finance and HR machine on the switch — wasted bandwidth, wasted CPU on every NIC, and zero isolation. Three VLANs fix that with configuration alone:

! Create the VLAN
Switch(config)# vlan 10
Switch(config-vlan)# name ENGINEERING

! Access port — one VLAN, facing a PC
Switch(config)# interface FastEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Trunk port — many VLANs, facing another switch
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 999    ! unused VLAN — hardening

Two lines carry almost all of the meaning. switchport mode access + switchport access vlan 10 says: whatever arrives on this wire untagged belongs to VLAN 10, and nothing from any other VLAN may ever leave here. switchport mode trunk says the opposite: this wire carries several VLANs, so label everything. switchport trunk allowed vlan then prunes the trunk down to the VLANs that genuinely need to cross it — a performance and a security practice at once, because a VLAN not on the allowed list simply cannot traverse that link.

The tag those trunk frames carry is four bytes wide, and it is deliberately placed where a receiver that has never heard of VLANs would look for the EtherType:

The TPID trick is the elegant part. A receiver reads the two bytes where the EtherType normally lives, sees 0x8100 — a value that is not a real Layer 3 protocol — and concludes "this frame is tagged; the real EtherType is four bytes further along." In-band signalling that costs nothing when unused and stays backwards compatible.

Twelve bits give 4096 IDs, of which 1–4094 are usable (0 and 4095 are reserved). VLAN 1 is the default — every port starts there — and precisely because it is the default, production traffic should not live on it. The tag also pushes the maximum Ethernet frame from 1518 to 1522 bytes, which is why switch and NIC hardware must explicitly support "baby giant" frames on trunk links.

Finally, VLANs and IP subnets are paired 1:1 almost universally:

That convention is not arbitrary — it falls out of the mechanics. A VLAN is one broadcast domain; hosts in one subnet must be able to resolve each other's MAC addresses, and that resolution is a broadcast; therefore a subnet has to fit inside a single broadcast domain. VLAN boundary = broadcast boundary = subnet boundary. Crossing VLANs therefore means crossing subnets, which means routing — a Layer 3 device (a router, or a switch doing routing on a virtual interface). Switches segment; routers connect the segments.

Visual Model

Think of the tag as a visitor badge that only exists inside the corridor between two buildings. Inside a building, everyone in a department already knows where they belong — no badge needed. But the shared corridor carries people from every department at once, so at the door you get a badge stamped with your department, and at the far door the badge is taken off you before you walk in. Nobody in either building ever sees a badge. That is exactly the life of an 802.1Q tag: it is applied entering a trunk and removed leaving to an access port, so end devices stay completely VLAN-unaware.

Step through the diagram below and watch the four tag bytes physically appear on the frame as it enters the trunk and vanish as it leaves. The last two steps switch to the harder case — what happens when the destination MAC is unknown and the switch has to flood.

Two things are worth pinning down from that walkthrough. First, the tag never touches an end device — which is the entire reason VLANs deploy against unmodified PCs, printers and appliances. Second, every lookup is scoped to a VLAN: SW2 does not consult "its MAC table", it consults the VLAN 10 table, chosen by the VID it just read off the tag. Everything else about VLAN behaviour follows from those two facts.