VLAN

A VLAN (virtual LAN) lets one set of cables and switches behave like several independent networks. An office might plug everyone into the same switches, yet put staff laptops in one VLAN, guest Wi-Fi in another, and security cameras in a third. Devices in one VLAN see each other as if they shared a private network, and do not see the others at all.

It works by labeling traffic. Each switch port is assigned to a VLAN, and when frames travel between switches over a shared link (a trunk), each one carries a small tag with its VLAN number, defined by the standard 802.1Q. The tag has room for roughly 4,000 different VLANs. A switch never delivers a frame to a port of a different VLAN, so broadcasts and casual snooping stay inside their group.

To go from one VLAN to another, traffic has to pass through a router or a firewall, and that is the point: it becomes a checkpoint where you can write rules like 'cameras may talk to the recording server and nothing else'. This is called network segmentation. It limits the damage when one device is compromised, keeps noisy traffic contained, and lets teams reorganize who belongs where without rewiring the building.

VLANs are a tool for separation, not a security guarantee on their own. A misconfigured trunk can let traffic leak between groups, so sensitive segments also get firewall rules and monitoring. In the cloud the same idea shows up as virtual networks and subnets, configured entirely in software.