VLANs let one physical switching infrastructure carry several logical networks. Access and trunk ports determine how those VLANs reach connected devices.
Practical example: segmenting a 45-user office
Gateway policy controls which VLANs may communicate. Guest access can be restricted to the Internet.
Scenario: One managed switching environment carries servers, staff devices, VoIP, CCTV and guest WiFi.
| Example VLAN | Purpose | Example policy |
|---|---|---|
| 10 | Servers | Accessible only from authorised business networks |
| 20 | Staff | Access to approved internal services and Internet |
| 30 | Voice | Restricted to required voice and management services |
| 40 | CCTV | Camera traffic restricted to required recording and management systems |
| 50 | Guest WiFi | Internet access, blocked from internal business networks |
Decision: VLANs provide the logical separation. The router, firewall or Layer 3 policy determines which networks may communicate.
Common mistakes and selection checklist
Common mistakes
- Creating VLANs but allowing unrestricted routing between them.
- Using VLAN IDs without documenting IP subnets, DHCP, gateways and access policy.
- Configuring trunk and access ports inconsistently across switches and access points.
What happens if you get it wrong?
The network can look segmented while providing little security benefit, or devices can lose connectivity because tagged and untagged traffic is handled differently at each hop.
Selection checklist
- Define the purpose and subnet of every VLAN.
- Document which VLANs may communicate and on which services.
- Configure gateway or Layer 3 firewall policy explicitly.
- Verify access ports, trunks and native or untagged VLAN behaviour end to end.
- Test DHCP, DNS, Internet access and blocked inter-VLAN paths after deployment.
What a VLAN does
A VLAN creates a logical Layer 2 network within the switching infrastructure. Devices in different VLANs do not communicate directly at Layer 2. Communication between them requires routing and an appropriate security policy.
Access ports
Cisco defines an access port as a port that carries traffic for the specific VLAN assigned to it. This is commonly used for ordinary endpoints such as workstations, printers and devices that are not expected to tag VLAN traffic.
Trunk ports
A trunk port can carry traffic for multiple VLANs. Trunks are commonly used between switches, between a switch and a VLAN-aware access point, and between a switch and a router or Layer 3 device.
Native or untagged VLAN
A trunk can have a native VLAN for untagged traffic. Both ends of the link must agree on how VLANs are tagged and which VLAN is treated as native. A mismatch can cause connectivity and security problems.
Example business design
| VLAN | Purpose | Typical endpoint port |
|---|---|---|
| 10 | Servers | Access port or tagged server interface |
| 20 | Staff | Access port |
| 30 | Voice | Voice-capable access port |
| 40 | CCTV | Access port |
| 50 | Guest WiFi | Tagged over AP trunk, then routed through policy |
Common mistakes
- Creating VLANs without configuring routing or firewall policy
- Allowing every VLAN over every trunk
- Using inconsistent native VLAN settings
- Connecting an ordinary endpoint to a trunk without a clear reason
- Failing to document VLAN IDs, subnets and port assignments
Technical information is based on current official documentation. Product capabilities vary by model.
Confirm the exact product specification, supported configuration and compatibility before ordering. Platform generation, firmware, licences and optional components can change what a product supports.