What is a VLAN?

A Virtual Local Area Network (VLAN) is a logical grouping of switch ports and devices that forms its own broadcast domain, independent of physical location or cabling. VLANs cut unnecessary broadcast and multicast flooding, isolate traffic between groups of devices, and let administrators reorganize a network by changing configuration instead of running cable.

Key takeaways

• VLANs group devices into isolated broadcast domains, not by cabling.
• Segmentation reduces unneeded broadcast and multicast flooding.
• Trunk ports carry multiple tagged VLANs across one physical link.
• Access ports map untagged traffic to a single explicit VLAN ID.
• Versa VOS ties VLAN IDs to bridge domains and subinterfaces.

On this page: Why it matters · How it works · Types · VLANs & Versa · FAQ

Why is a VLAN important?

Flat, unsegmented switched networks put every connected device into one broadcast domain: a printer, a guest laptop, and a finance server all see each other’s broadcast traffic, and separating them means re-cabling ports to different switches. VLANs turn that separation into a configuration change – a port’s VLAN assignment, not its cable run, decides which broadcast domain a device joins.

That has direct security and performance payoffs. Confining broadcast and multicast traffic to a VLAN keeps unnecessary flooding off the rest of the network, and keeping guest, IoT, voice, and corporate traffic in separate VLANs limits what a compromised device can reach elsewhere. VLANs also enable identity-based segmentation: an 802.1X-authenticated device can be placed into a VLAN chosen by a RADIUS server, with a guest VLAN as the fallback for devices that never authenticate.

What is a VLAN?

Each VLAN is identified by a VLAN ID, an integer from 1 through 4094 under the IEEE 802.1Q standard. A switch port reaches a VLAN in one of two modes: an access port carries traffic for exactly one VLAN, with untagged frames treated as belonging to that VLAN’s ID; a trunk port carries multiple VLANs over a single link, each frame tagged with the ID of the VLAN it belongs to.

Each VLAN forms its own learning and forwarding domain on the switch – MAC addresses are learned separately per VLAN, and traffic entering on one VLAN’s ports floods only to other ports in that same VLAN, never across the boundary. Routing between VLANs requires a Layer 3 hop, since a VLAN by itself is a Layer 2 construct.

Types of VLANs

Access VLANs are the simplest case: a port gets one explicit VLAN ID, and any untagged frame arriving on it is treated as belonging to that VLAN – the common configuration at the network edge. Trunk (tagged) VLANs carry several VLANs across one uplink; trunk configuration typically accepts a VLAN ID list, including ranges, rather than a single ID. The native VLAN is the one VLAN on a trunk port that a switch treats as untagged, so a device that can’t tag traffic can still reach the trunk. Dynamic VLANs are assigned per device at authentication time: an 802.1X exchange with a RADIUS server determines which VLAN a device joins, with a guest VLAN as the fallback when authentication fails.

VLANs & Versa

Versa Operating System (VOS) devices apply VLAN IDs at the interface level: an Ethernet, aggregated Ethernet, or IRB subinterface configures in access mode with one VLAN ID or trunk mode with a VLAN ID list, plus an optional native VLAN ID. VOS groups Layer 2 interfaces into virtual switch instances (VSIs); within a VSI, each bridge domain ties to a unique VLAN ID with its own MAC forwarding table, and interfaces join a bridge domain by matching VLAN IDs. VLAN translation lets an interface use a different VLAN ID from its bridge domain – see Configure Layer 2 Forwarding.

On Titan branch devices, VLANs configure through Titan Portal as Routed (Layer 3) or Switched (Layer 2), with a VLAN Name, VLAN ID, and, for switched VLANs, an IRB interface; Titan Portal also supports dynamic VLAN assignment via 802.1X and RADIUS, with guest and default fallbacks – see Configure LAN Connections. Device templates apply the same access/trunk model, plus VLAN lists for EVPN virtual switches, per Configure Basic Features.

Frequently asked questions

What is the difference between a VLAN and a subnet?

A VLAN is a Layer 2 broadcast domain defined by switch configuration and 802.1Q tags. A subnet is a Layer 3 IP addressing block. Deployments often map one subnet to one VLAN, but the two are conceptually separate – a VLAN can exist without a routed IP subnet on it.

What is the difference between an access VLAN and a trunk VLAN?

An access port carries exactly one VLAN and treats untagged frames as belonging to it – typical for end-device ports. A trunk port carries several VLANs over one link, tagging each frame so the receiving switch sorts traffic into the correct domain.

What is a native VLAN, and why does it matter?

The native VLAN is the one VLAN on a trunk port that a switch does not tag; untagged frames on the trunk are assigned to it. A mismatched native VLAN between two connected switches can leak traffic between VLANs meant to stay separate.

How many VLANs can a network support?

The IEEE 802.1Q tag field allows VLAN IDs 1 through 4094, the same range Versa VOS interfaces expose. The usable count on a given deployment is bounded by switch and platform scale limits before that ceiling matters.

How does routing between VLANs work on Versa VOS?

An IRB (integrated routing and bridging) interface associates a Layer 3 interface with a Layer 2 bridge domain, so packets route to and from the VLAN tied to that domain. Standard Layer 3 settings, such as DHCP and VRRP, configure on the IRB interface.

More on VLAN

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about VLANs, these are worth looking at next.