In modern networks, connecting devices to a switch is only the beginning. A typical enterprise network may include CCTV cameras, access control systems and other operational technology (OT) devices.
Putting all these devices into one large Layer 2 network can create unnecessary broadcast traffic, increase security risks, and make troubleshooting difficult.
This is where a VLAN (Virtual Local Area Network) becomes useful.
A VLAN allows network administrators to logically divide a physical Ethernet network into multiple isolated or controlled network segments without requiring a separate physical switch for every group of devices.
For example, an industrial plant can use the same physical switching infrastructure while logically separating:
- CCTV surveillance traffic
- SCADA and PLC communication
- Plant communication systems
- Access control
- Corporate IT systems
- Guest Wi-Fi
- Server networks
- Network management traffic
This approach is particularly useful in Indian industrial environments where Industrial plants and large commercial buildings often have multiple systems operating on a common network infrastructure.
What Is a VLAN?
A VLAN (Virtual Local Area Network) is a logical network segment created within a physical Ethernet network.
Instead of treating every device connected to a switch as part of one large broadcast domain, VLANs allow administrators to divide the network into separate logical broadcast domains.
| System | VLAN | Example IP Network |
| CCTV Cameras | VLAN 10 | 192.168.10.0/24 |
| SCADA | VLAN 20 | 192.168.20.0/24 |
| Access Control | VLAN 30 | 192.168.30.0/24 |
| Office IT | VLAN 40 | 192.168.40.0/24 |
| Voice/PA | VLAN 50 | 192.168.50.0/24 |
| Network Management | VLAN 99 | 192.168.99.0/24 |
Physically, these devices may be connected to the same group of managed Ethernet switches.
Logically, however, they belong to different networks. This is one of the primary advantages of VLAN technology.
So In Simple language, we can say, “A VLAN is a logical network created within a physical switching infrastructure to separate devices and control how they communicate.”
Why Are VLANs Required?
Without VLANs, a large Layer 2 network can become difficult to manage.
Imagine a large industrial facility with 500 Ethernet devices.
These could include:
- 200 IP cameras
- 50 access-control devices
- 40 PLCs
- And some other devices.
If all of these devices operate in the same Layer 2 broadcast domain, the network becomes unnecessarily large. VLANs allow the network administrator to logically separate these systems.
A VLAN creates a separate broadcast domain.
Broadcast traffic generated in one VLAN does not normally propagate into another VLAN at Layer 2.
What Is Broadcast domain segmentation?
A VLAN creates a separate broadcast domain.
Broadcast traffic generated in one VLAN does not normally propagate into another VLAN at Layer 2. You can see it in the diagram.
if VLAN 10 has been segmented for CCTV cameras. The broadcast will not reach to the other unnecessary segments like- VLAN 20 where scada devices are available or VLAN 30 where PLC devices are available.
This reduces the unnecessary layer 2 traffic.
How Does VLAN Work?
VLAN operation is primarily associated with Layer 2 Ethernet switching.
A managed switch can assign VLAN membership to individual physical ports. When a device sends an Ethernet frame, the switch determines how that frame should be forwarded based on several factors, including:
- Source MAC address
- Destination MAC address
- VLAN membership
- Port configuration
- VLAN tagging
- Switching table
The switch does not simply forward every frame to every connected device.
It uses its MAC address table and VLAN information to determine where the frame should go.
What Is a VLAN ID?
Every VLAN is normally identified by a numerical VLAN ID.
VLAN IDs range from 0 to 4095 in the IEEE 802.1Q VLAN identifier field, although not all values are available for ordinary VLAN assignment.
In practical network deployments, administrators commonly use IDs such as VLAN 10 For CCTV, VLAN 20 for PLC Access control etc.
The exact numbering convention is a network-design decision.
The important point is consistency.
For a large industrial project, VLAN IDs should be documented in the network architecture and configuration records.
What Is IEEE 802.1Q VLAN Tagging?
One of the most important technologies behind VLANs is IEEE 802.1Q.
802.1Q defines a method for identifying VLAN membership within Ethernet frames.
A VLAN tag is inserted into an Ethernet frame.
The VLAN tag contains information that allows network devices to identify the VLAN associated with the frame.
The VLAN tag includes a 12-bit VLAN Identifier (VID) along with other fields.
This mechanism becomes particularly important when multiple VLANs need to travel across the same physical Ethernet link.
That leads us to trunk ports.
What Is an Access Port?
An access port is generally configured to carry traffic belonging to a single VLAN. It is commonly used for end devices like- CCTV, Scada device or devices which is connected to the Switch.
The switch associates the incoming traffic with VLAN 10 based on the port configuration. An endpoint does not necessarily need to understand VLAN tagging when connected to a standard access port.
What Is a Trunk Port?
A trunk port is used to carry traffic for multiple VLANs over a single physical Ethernet connection.
Instead of requiring four physical cables between the switches, VLAN traffic can be carried over one properly configured trunk link.
This is particularly useful when multiple industrial switches are connected in a network topology. The trunk can carry multiple VLANs between these switches.
Major Difference between Access Port and Trunk Port?
| Feature | Access Port | Trunk Port |
| Typical VLANs | One | Multiple |
| Common use | End devices | Switch-to-switch |
| VLAN tagging | Usually not presented to endpoint | Used to identify VLANs |
| Example | CCTV camera | Switch uplink |
| Typical device | Camera, PC, PLC | Switch, router, firewall |
