What Is a VLAN? A Complete Explanation

A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if they're on the same physical network segment — even if they're not. VLANs are one of the most important concepts in enterprise networking and a core topic on the CompTIA Network+ exam.

The problem VLANs solve

In a flat network, every device shares the same broadcast domain. A broadcast frame sent by one device (like an ARP request) is forwarded to other ports in that VLAN on each participating switch. In a network with hundreds of devices this creates noise, reduces performance, and provides no logical separation between departments.

VLANs solve this by creating multiple logical broadcast domains on a single physical infrastructure. The finance team, the guest Wi-Fi, and the IP phones can share the same switches while remaining logically separated; routing, ACLs and correct trunk configuration are still needed for security.

How VLANs work — 802.1Q tagging

VLANs are defined in the IEEE 802.1Q standard. When a frame crosses a trunk port (a link between two switches carrying multiple VLANs), the switch inserts a 4-byte tag into the Ethernet frame header:

Original frame:  | Dst MAC | Src MAC | EtherType | Payload |
Tagged frame:    | Dst MAC | Src MAC | 802.1Q Tag | EtherType | Payload |

802.1Q Tag breakdown:
  - TPID (16 bits): 0x8100 — identifies this as an 802.1Q frame
  - PCP  ( 3 bits): Priority Code Point (QoS)
  - DEI  ( 1 bit ): Drop Eligible Indicator
  - VID  (12 bits): VLAN ID (0–4094)

The receiving switch reads the VLAN ID from the tag, strips it, and forwards the frame only to ports that belong to that VLAN.

Access ports vs trunk ports

• Access port — belongs to a single VLAN. End devices (PCs, phones, printers) connect here. The device has no awareness of VLANs — the switch adds and strips the tag invisibly.
• Trunk port — carries frames from multiple VLANs. Used between switches, and between switches and routers. Frames are tagged with their VLAN ID.
• Native VLAN — frames on trunk ports that arrive untagged are assigned to the native VLAN (default VLAN 1). Mismatching native VLANs between switches is a common misconfiguration.

Inter-VLAN routing

Because VLANs are separate broadcast domains, traffic between VLANs must go through a Layer 3 device — a router or a Layer 3 switch.

Router-on-a-stick

A single router interface is split into sub-interfaces, one per VLAN. The router receives tagged frames on a trunk port and routes between VLANs. Simple to configure, limited throughput for high-traffic environments.

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

Layer 3 switch (SVI)

A Switched Virtual Interface (SVI) is a virtual Layer 3 interface on a switch, one per VLAN. The switch routes traffic internally — far higher throughput than a router-on-a-stick and the preferred approach in modern designs.