What is a VLAN?

Basic Principles of Data Transmission

        A Local Area Network (LAN) operates as what is known as a Broadcast Domain. This means that in addition to unicast data communicated directly between a source and a destination device, there is also non-targeted data broadcast to all devices across the network. This type of communication is called a Broadcast.

       Broadcasts are essential messages within a LAN environment, as network protocols rely on broadcast traffic to facilitate efficient communication between computers on the network. For instance, the Address Resolution Protocol (ARP) uses broadcasts to enable a computer to discover the MAC address of a destination host.

      However, as a network scales up with hundreds of computers operating within a single broadcast domain, the cumulative volume of broadcast traffic generated by each host increases substantially. This accumulation degrades overall network performance and causes noticeable slowdowns.

      To address the aforementioned problem and reduce broadcast traffic, networks are partitioned into smaller sub-networks through Virtual Local Area Networks (VLANs). In practice, implementing a VLAN segments endpoint computers into smaller logical groups as though they were on separate LANs, allowing devices to communicate directly only with members of their own VLAN. Devices belonging to the same VLAN do not necessarily have to be connected to the same physical switch; they can be distributed across multiple switches depending on network design. VLANs are primarily classified into two main types:

Static VLAN

      Static VLAN, also known as port-based membership, assigns VLAN membership directly at the switch interface (port) level, designating which port belongs to which VLAN. Even if devices are physically connected to the same switch, belonging to different VLANs isolates them as if they were connected to entirely separate, disconnected switches. To enable inter-VLAN communication, a routing device — such as a router or a Layer 3 switch — is required.

Dynamic VLAN

Dynamic VLAN assigns VLAN membership to user computers based on their MAC addresses. When a computer connects to a switch port, the switch inspects its MAC address and queries a centralized database on a server to determine which VLAN that MAC address belongs to. It then dynamically maps the association between the MAC address and the corresponding VLAN. This requires a centralized database hosted on a server functioning as a VLAN Membership Policy Server (VMPS).

Advantages of Implementing VLANs

• Restricting the propagation of broadcast traffic so that it does not degrade overall network performance. Typically, many network applications as well as protocol drivers (such as TCP/IP or IPX/SPX) periodically transmit broadcast frames to facilitate their operational tasks.
• Enhancing security: In an organization with various departments — such as Accounting, Finance, and Human Resources — each department maintains confidential information that should only be accessible internally. Without network segmentation, unauthorized individuals may attempt to access sensitive data outside their department.