What Is a VLAN? VLANs Explained for Beginners
A VLAN (Virtual Local Area Network) is a way to slice one physical switch into several separate logical networks. Ports you assign to different VLANs behave as if they were plugged into completely different switches, even though they share the same hardware and cabling.
Part of the VLANs, Trunking & Inter-VLAN Routing learning hub
Technically, each VLAN is its own broadcast domain at Layer 2. Devices in one VLAN can talk freely among themselves, but they cannot reach devices in another VLAN without a router or Layer 3 switch stepping in to move the traffic between them.
What a VLAN Actually Is
A VLAN is a logical grouping of switch ports (and the devices attached to them) that is independent of physical location. You tell the switch "these ports belong to VLAN 10, those ports belong to VLAN 20," and it keeps the two groups isolated even though they live inside the same box.
Picture a large open office with no walls: every announcement is heard by everyone. A VLAN is like adding soundproof partitions and assigning people to rooms by a label on their badge rather than by which desk they happen to sit at. Someone in the sales room and someone in the engineering room can be ten feet apart yet be on completely separate networks. On the switch, that label is just a VLAN number, and VLAN 1 is the default that every port starts in.
The Problem VLANs Solve: Broadcast Domains
A switch forwards frames by MAC address at Layer 2, and when it receives a broadcast frame it floods that frame out every port in the same network. That set of ports that all hear each other's broadcasts is called a broadcast domain. In one big flat network, every ARP request and every DHCP Discover reaches every device.
As the network grows, that flooding wastes bandwidth, and it means there is no separation between, say, guest devices and finance servers. VLANs fix this by splitting a single switch into multiple broadcast domains. A broadcast sent inside VLAN 10 stays inside VLAN 10 and never reaches VLAN 20. In practice each VLAN is paired with its own IP subnet, so segmentation at Layer 2 lines up neatly with addressing at Layer 3.
How It Works: Access Ports, Trunk Ports, and 802.1Q
Switch ports come in two main flavors. An access port belongs to a single VLAN and connects to one end device, such as a PC, printer, or IP phone. Frames on an access port are untagged; the switch simply knows which VLAN they belong to because of how the port is configured.
A trunk port is different: it carries traffic for many VLANs at once, typically between two switches or from a switch up to a router. Because several VLANs share one link, the switch needs a way to label each frame. That labeling is 802.1Q, the standard that inserts a small 4-byte tag carrying the VLAN ID into the Ethernet frame. The switch on the other end reads the tag and drops the frame into the correct VLAN.
There is one exception: the native VLAN. On an 802.1Q trunk, one VLAN's frames are sent untagged, and that untagged VLAN is called the native VLAN (VLAN 1 by default). Both ends of the trunk must agree on which VLAN is native, or frames can end up in the wrong place.
Why You Still Need a Router or SVI to Move Between VLANs
VLANs isolate traffic on purpose, so isolation is a feature, not a bug. A switch forwarding frames by MAC at Layer 2 will happily move traffic within a VLAN, but it will never carry a frame from VLAN 10 into VLAN 20 on its own. Crossing that boundary is a routing job, and routing happens at Layer 3, where a device forwards packets by IP address.
To let VLANs communicate you use inter-VLAN routing. One classic method is "router-on-a-stick," where a router connects over a single trunk and uses subinterfaces, one per VLAN. The more common modern method is an SVI (Switched Virtual Interface) on a Layer 3 switch, which is a virtual interface that represents an entire VLAN. In both cases that Layer 3 interface becomes the default gateway for its subnet, and any device sending traffic off its own subnet hands the packet to that gateway to be routed.
Common Confusions and Gotchas
The biggest one is VLAN versus subnet. A VLAN is a Layer 2 broadcast domain; a subnet is a Layer 3 grouping of IP addresses. They are separate concepts you configure independently, but in real designs they map one-to-one, which is why people casually treat them as the same thing.
Two more trip up beginners constantly. First, a native VLAN mismatch on the two ends of a trunk causes frames to land in the wrong VLAN and is also a security concern, so keep it consistent and avoid leaving everything on VLAN 1. Second, if you build VLAN 10 and VLAN 20, put a PC in each, and they cannot ping each other, that is expected behavior, not a broken switch. Nothing is wrong until you add the router or SVI that routes between them.
Where VLANs Show Up on the CCNA
VLANs are a core switching topic on the CCNA, and they connect to almost everything else in the switching world. You are expected to understand creating VLANs, assigning access ports, configuring 802.1Q trunks and the native VLAN, and setting up inter-VLAN routing with either router-on-a-stick or SVIs.
They also thread into neighboring topics: spanning tree runs per VLAN to prevent Layer 2 loops, DHCP often needs an ip helper-address to relay requests across a VLAN boundary to a server in another subnet, and VLANs underpin much of network security and segmentation. This article is the concept; the exact command sequences to build and verify all of this live in the companion step-by-step how-to guide.
Frequently asked questions
What is the difference between a VLAN and a subnet?
A VLAN is a Layer 2 construct: it defines a broadcast domain on a switch, deciding which ports hear each other's frames. A subnet is a Layer 3 construct: it groups IP addresses using a subnet mask that splits network bits from host bits. They are configured separately, but in typical designs each VLAN is mapped to exactly one subnet, so they line up one-to-one even though they are not technically the same thing.
Why can't two VLANs talk to each other by default?
Because each VLAN is its own broadcast domain, and a switch only forwards frames within a single VLAN at Layer 2. Moving traffic from one VLAN to another means going up to Layer 3 and routing by IP, which requires a router or a Layer 3 switch. Until you add that inter-VLAN routing (a router-on-a-stick trunk or an SVI acting as each VLAN's default gateway), the VLANs stay isolated, which is exactly what they are designed to do.
Does every frame on a VLAN get tagged with 802.1Q?
No. Access ports, which connect to end devices like PCs and phones, send and receive untagged frames; the switch tracks the VLAN by the port's configuration, not by a tag. Only trunk ports use 802.1Q tags, because a trunk carries many VLANs over one link and needs the VLAN ID to keep them straight. Even on a trunk there is one exception: the native VLAN travels untagged.
Now build it on real Cisco IOS
Concepts stick when you configure them. Try a free graded lab, then grade your own config against the answer key.