Network Segmentation Guide: VLANs, Layers, and Access

Network segmentation is how one physical network becomes several logical ones, so that a phone on the guest network, an accounting workstation, and a server never end up in the same broadcast domain by accident, and so that traffic between them has to pass a checkpoint where someone wrote the rules.

Think of a road network. Asphalt alone isn’t a traffic system; the lane markings are. A solid line between two lanes means no crossing: traffic in the finance lane never drifts into the guest lane. A dashed line means crossing is allowed, but only at a marked junction and under its rules. On a network, the solid lines are VLAN boundaries, and the dashed lines are the router, layer 3 switch, or firewall where traffic between segments is permitted, inspected, or refused. A flat network is a road with no markings at all: it works while traffic is light, and then everyone is in everyone’s way.

This guide is the map. Each section says what one part of segmentation does, where it goes wrong in the field, and where to go deeper. Five parts already have their own articles: what a VLAN is, what ARP does and where the broadcast domain ends, what DNS is and who actually answers a query, what a port is and which side a connection fault is on, and what NAT really keeps in its translation table. The rest is covered here until its own article exists.

Why Segment a Network?

Segmentation limits two things: how far a broadcast travels, and how far an intruder can walk. Both are costs a flat network pays silently.

The first is noise. Every device on a flat network regularly calls out to all the others: to find a neighbor’s hardware address, to ask for an IP address, to announce itself. Each of those broadcasts reaches every network card and interrupts every CPU for a moment. With a few dozen devices nobody notices. With a few hundred, including phones, cameras, and printers that handle interruptions far worse than servers, the network gets slower in ways that are hard to pin down.

The second cost is heavier. Devices in one broadcast domain discover each other without asking anyone. A laptop joining the guest network can learn the address of the accounting server with nothing in its way, and protocols like ARP accept answers from anyone. On a flat network, “someone unauthorized got in” means “someone unauthorized got in everywhere.” Segmentation doesn’t prevent the first step; it shrinks the room that step leads into.

When don’t you need it? In a three-person office with one router, segmentation buys nothing measurable and adds something to maintain. The test isn’t device count; it’s whether you can finish the sentence “this group must not reach that group.” Guests, cameras, payment terminals, and servers are the usual first answers.

The Map and the Territory: Logical vs. Physical Topology

Every network has two topologies, and the gap between them is where most segmentation plans fail.

The logical topology is the map: how traffic is supposed to flow, which segments exist, which rules sit between them. It’s drawn in a diagram tool and it’s always tidy.

The physical topology is the territory: which cable actually goes to which port, which switch is squeezed into which cabinet, and what got plugged in since the diagram was drawn. It never matches the map exactly.

The most common gap has a name in the field: the “dumb switch,” an unmanaged switch someone put under a desk because they needed two more ports. It’s a rogue floor added to a building without a permit. It usually works, which is why nobody removes it, and it quietly breaks the design above it: it extends a broadcast domain the plan meant to be small, it hides every device behind it from the managed switch’s view, and a port meant for one trusted device now serves several unknown ones. A contractor who adds one without telling anyone has planted something that nobody can find during the next outage.

You can find them without touching them. A switch port normally sees one MAC address; if a managed switch’s MAC address table shows several on one port, something behind that port is multiplying frames. The candidates are few: an unmanaged switch, a virtualization host, an IP phone with a PC port, or an access point. The lab measurement of exactly that signature is in What Is ARP?

The rule that follows: segmentation is designed on the map but enforced on the territory. Before changing anything, find out what’s really connected.

The Three-Layer Design: Core, Distribution, Access

The classic way to structure a switched network has three layers, and each has a different job in segmentation.

• Core: the backbone that carries traffic between parts of the network. It’s built for speed and availability, and a failure here cuts every segment off from every other. Keep policy out of the core; its job is to move traffic.
• Distribution: where segments meet. This is typically where the default gateways for VLANs live, where routing between them happens, and where the first access rules apply. In the road metaphor, the junctions with dashed lines.
• Access: where devices plug in. Edge switches at this layer decide which VLAN each port belongs to and whether a device is allowed to connect at all.

In smaller networks, core and distribution collapse into one pair of switches, and that’s fine. What matters is that the functions stay distinct: forwarding in the middle, policy at the junctions, admission at the edge.

Redundancy at the core is the best practice: two core switches, so one can fail without taking everything down. Budgets don’t always allow it at every site. A workable alternative for many small sites is keeping a few pre-configured spare switches at head office and a disciplined backup of every device’s configuration, so that a failed core switch at a branch is a swap, not a rebuild. That only works if configurations are backed up automatically and can be compared centrally; a spare switch with no configuration to load is just a box.

Bottlenecks hide at the layer boundaries. A building can have a gigabit internet line while a user gets ten megabits, because an old patch cable or wall module between them negotiates a lower speed. An access point that supports gigabit speeds but connects to the switch at 100 Mbps chokes the moment ten people start a video call through it. The same goes for servers: a fast server behind a slow port just builds a queue. Find these with port utilization graphs from your monitoring before you buy anything.

VLANs: Drawing the Lines

A VLAN splits one switch into several logically separate networks by attaching a 4-byte 802.1Q tag to each frame. Each VLAN is its own broadcast domain: devices on the same switch but in different VLANs don’t hear each other at all.

Two port roles carry the design. An access port belongs to one VLAN and hides the tag from the device, so PCs, printers, and cameras never need to know VLANs exist. A trunk port carries several VLANs between switches, routers, and servers, with every frame keeping its tag. Get one detail wrong, the native VLAN of a trunk, and two networks can be joined without anyone noticing; leave it at the default (VLAN 1), and every unused port on every switch lands in the same segment.

Four rules cover most field mistakes: never use VLAN 1 for anything; set the native VLAN to an unused number, identically on both ends of every trunk; put unused ports in a VLAN that leads nowhere and shut them down; and when converting a port to a trunk, pin the native VLAN before changing the mode, or you can cut off your own session.

The tag, the port roles, a lab where one cable carries two VLANs, the two capture traps that hide the tag, and a VLAN path that worked in only one direction are all in What Is a VLAN?

Broadcast Domains and ARP: Where the Wall Is

The wall a VLAN builds is a broadcast domain, and the protocol that shows you where it stands is ARP. Every device resolves a neighbor’s IP address to a hardware address by broadcasting a question; if the question can’t reach the neighbor, no traffic ever flows, no matter how correct the IP settings look.

That makes the ARP table the first diagnostic tool in a segmented network, ahead of ping. Ping can be silent for many reasons; ARP can’t. A REACHABLE entry with an unanswered ping means the device is there and something filters ICMP. An entry that never completes means the device is in another broadcast domain or not there at all, and searching routing tables or firewall rules is wasted time.

One consequence surprises people every time: two devices in the same address block aren’t necessarily in the same broadcast domain. If they sit on different VLANs, or on two sides of something that doesn’t bridge them, the mask says “neighbor” while the wire says “no,” and ARP believes the wire. The lab measurement of exactly that, along with ARP cache lifetimes, gratuitous ARP, and ARP spoofing, is in What Is ARP?

Routing Between Segments: The Dashed Lines

Devices in different VLANs can’t reach each other directly, even on the same switch. Something at layer 3 has to sit between them, and that isn’t a limitation; it’s the design. The switch looks up destinations within the VLAN only, so traffic for another VLAN has to be handed to a router.

Three designs do the job:

• Router-on-a-stick: one trunk to a router, one subinterface per VLAN. Common at small scale, but all traffic between VLANs shares that one link.
• Layer 3 switch: the switch routes between VLANs itself, with a virtual interface per VLAN. Fast, because traffic never leaves the device.
• Firewall: the choice when traffic between segments should be inspected against rules. That’s deliberate: this is the checkpoint segmentation exists to create.

Routing between VLANs doesn’t remove isolation. It concentrates it in one place. On a flat network there’s nowhere to write “guests may reach the internet but nothing internal”; with segments, there’s exactly one place, and that’s where the rules go. Each VLAN needs its own address block, and the blocks must not overlap.

One kind of traffic needs special handling at the boundary: address assignment. A device asking for an IP address broadcasts its request, and broadcasts stop at the VLAN edge, so a DHCP server in another VLAN never hears it. A DHCP relay on the router or layer 3 switch forwards the request as ordinary traffic. Other services a device used to get for free on a flat network (name resolution, time) can quietly break when it moves to a new segment; the VLAN article has a measured example of a time server that kept running on a silent fallback after exactly that.

Securing the Edge: Port Security and 802.1X

Segmentation decides what each port may reach. The access layer decides who may use the port at all. Without that, every network jack in a meeting room is an open door into whatever VLAN it happens to belong to.

Port security is the basic control: limit how many MAC addresses a port may learn, and decide what happens when that limit is exceeded. It stops the casual case (someone plugging an unmanaged switch into a desk port) but not a determined one, since MAC addresses can be copied. Pair it with shutting down unused ports and placing them in a dead-end VLAN.

802.1X is the real control. A port configured for 802.1X gives a new device no network access until it authenticates. The switch passes the credentials (a username and password, or better, a certificate) to a RADIUS server, which answers in three parts, the classic AAA:

1. Authentication: is this device or user who it claims to be?
2. Authorization: where may it go? The RADIUS server can tell the switch which VLAN to put the port in, so the same wall jack lands a finance laptop in the finance VLAN and a guest’s laptop in the guest VLAN.
3. Accounting: a record of who connected, when, for how long, and how much traffic passed.

That third part is a record many networks already have without realizing it, since it arrives with wireless or 802.1X deployments. It answers “who got in,” which no other log does as well.

Roll 802.1X out in monitor mode first. Enforced immediately, a misconfiguration blocks legitimate devices: printers, phones, and building systems that can’t authenticate. Run it in a mode that logs what would be blocked, read the logs for a few days, create exceptions for devices that genuinely can’t authenticate (with their own restricted VLAN), and only then enforce. The same order applies to Dynamic ARP Inspection and similar switch protections: monitor, read, then enforce.

The Internet Edge: NAT and the Firewall

Moving between segments inside your network is like traveling between cities in your own country: you need a route, and nobody asks for your passport at every junction. Leaving the country, going out to the internet, is different.

At the border, NAT (Network Address Translation) gives your internal devices a public address the outside world accepts, so hundreds of devices can share one public address. The translation table on the border device keeps track of which internal device each conversation belongs to, which is also why a server inside can’t be reached from outside unless someone deliberately publishes it. That table, SNAT and DNAT, double NAT, and a measured case of hairpin NAT are in What Is NAT?

The firewall is the customs post. It checks not only where traffic is going but what it carries: web filtering by category, intrusion prevention, inspection of content for malware. For segmentation, the important point is that the same device often enforces both the internet edge and the rules between internal segments, and those rule sets deserve the same care. A firewall that inspects everything leaving for the internet while allowing any internal segment to reach any other has only done half the job.

Remote access extends the network outward: a VPN gives a remote user an encrypted path back in, as if they were at their desk. That also means a stolen VPN credential puts an attacker inside, in whatever segment the VPN lands them. Land VPN users in their own segment with rules like any other, and protect the credential with a second factor.

Priority on Shared Roads: QoS

Segmentation separates traffic; QoS (Quality of Service) decides what goes first when traffic shares a link. When an ambulance turns on its siren, other cars pull over; QoS gives voice and video traffic that treatment, because a phone call tolerates neither delay nor jitter while a file download barely notices a few milliseconds.

The priority travels with the frame: the 802.1Q tag that carries the VLAN number also has a 3-bit priority field, which is why voice VLANs and QoS are usually configured together. An IP phone tags its own traffic into the voice VLAN with high priority, while the PC plugged into the phone’s second port sends untagged traffic into the data VLAN.

Two cautions. QoS only matters when a link is congested; on an idle link it does nothing, and adding it can’t fix a link that’s simply too small. And management traffic (logs, monitoring, device administration) deserves protection too: if it shares a congested link with users, it’s among the first things dropped, exactly when you need it most. A separate management VLAN and a sensible priority for it cost little.

Labels and Documentation: Making the Map Match

A segmented network is only manageable if someone can tell which cable goes where. Physical labeling is the cheapest insurance in networking. Picture being responsible for many sites: when one loses connectivity, you can’t drive there, but you can tell someone on site “check the cable with the red label that says Server_01 on switch 3.” Without labels, that sentence is a riddle.

Software port descriptions aren’t enough on their own. A technician moves a cable from port 5 to port 12 and forgets to update the description; your screen says “Camera_05” and a printer is plugged in. A physical label on the cable is the one source of truth on site, because it travels with the cable. Think of a home fuse box: a note that says the kitchen is on breaker 3 is useless if an electrician moved the kitchen to breaker 5; you switch off 3 to work in the kitchen and turn off the bathroom lights instead.

For segmentation specifically, keep one record per VLAN: number, name, purpose, address block, gateway, and which rules allow traffic in and out. Keep one per trunk: both ends, allowed VLANs, and native VLAN. And name VLANs on the switches themselves; six months later, a name is often the only clue the next person has.

Conclusion: Lines Are Cheap, Wrong Lines Are Not

Segmentation isn’t a product you buy; it’s a set of lines you draw and then enforce, at the edge, at the junctions, and at the border. The lines themselves are cheap: a VLAN is a few commands. What costs money is a wrong line: a native VLAN left at its default, a guest VLAN routed freely into the internal network, an unmanaged switch nobody knows about, a server moved into a new segment that quietly lost its time source.

A short checklist to start from:

• Know the territory: count MAC addresses per port on your managed switches and find what’s behind every port that shows more than one.
• Retire VLAN 1: no traffic uses it, no management interface lives in it, and no trunk uses it as native.
• Park unused ports: dead-end VLAN plus shutdown.
• Write the junction rules: every allowed path between segments exists because someone decided it should, and it’s written down.
• Admit at the edge: port security everywhere, 802.1X where it matters most, rolled out in monitor mode first.
• Protect management: its own VLAN, reachable only from administrators’ machines.
• Label the cables: the physical label is the record that survives.

The articles in this guide go deeper where the field fails first: What Is a VLAN? for the tag and the ports, What Is ARP? for the broadcast domain and the first thing to check when a device can’t be reached, What Is DNS? for the name layer every one of those devices depends on, and What Is a Port? for the moment a firewall rule decides whether a connection forms.