VLAN explained for Network Plus: why your company has 12 of them
A VLAN explained simply is "one physical switch carved into multiple separate networks." Network Plus N10-009 objective 2.2 wants you to know how that carving works at the frame level, what 802.1Q tagging actually does to a frame, how access and trunk ports behave differently, and why a typical small business has somewhere between four and twelve VLANs running on the same physical gear. Here is the version that holds up on the exam and on the job.
What is a VLAN, really
A VLAN (virtual LAN) is a Layer 2 broadcast domain that exists logically on a switch instead of being defined by physical ports. Without VLANs, every device plugged into a switch sees every other device's broadcast traffic. With VLANs, the switch enforces separation so that only devices tagged for the same VLAN see each other's broadcasts.
The IEEE 802.1Q standard, published in 1998 and revised since, defines how VLAN information rides along inside an Ethernet frame. That tag is the entire mechanism. Strip the tag and a VLAN is just an Ethernet network. Add the tag and the switch knows which devices belong together.
802.1Q tagging: what the switch actually adds to the frame
802.1Q inserts a 4-byte tag into the Ethernet frame between the source MAC and the EtherType field. That tag carries a VLAN ID (12 bits, so IDs 0 through 4095, with 0 and 4095 reserved, leaving 4,094 usable), a priority field (used for QoS), and a couple of other small fields.
The part worth getting solid is where the tag goes on and where it comes off. Access ports strip the tag before sending the frame to the end device. Trunk ports leave the tag on so the next switch knows which VLAN the frame belongs to. The frame leaves a workstation untagged, gets tagged when it crosses an access port into the switch, rides through trunks tagged, and gets untagged again when it exits another access port to its destination.
Access ports vs trunk ports: who carries which VLANs
Every switch port operates in one of two modes for VLAN purposes. Picking the right one comes down to reading the topology and knowing which mode fits where.
- Access port. Belongs to exactly one VLAN. Sends and receives untagged frames to the connected device. Used for end hosts: laptops, desktops, printers, cameras, phones. The device on the other end has no idea VLANs exist.
- Trunk port. Carries traffic for multiple VLANs between switches or between a switch and a router. Frames stay tagged so the receiving device knows which VLAN they belong to. Used for switch-to-switch links and switch-to-router uplinks.
A device plugged into an access port behaves like it is on a normal network. A device plugged into a trunk port has to speak 802.1Q itself, which means hypervisors, certain access points, and routers.
Native VLAN: where double tagging comes from
On a trunk port, one VLAN can be designated as the "native VLAN." Frames belonging to the native VLAN are sent untagged across the trunk. Frames belonging to any other VLAN are sent tagged. The default native VLAN on most switches is VLAN 1.
Why does this matter? Security, and specifically the double-tagging flavor of VLAN hopping. The precondition is not a native VLAN mismatch between the two ends of a trunk. It is an attacker on an access port whose VLAN is the same ID as the native VLAN of an 802.1Q trunk further along. The attacker sends a frame carrying two tags: an outer tag matching that native VLAN and an inner tag for the VLAN they want to reach. The first switch treats the frame as native VLAN traffic, strips the outer tag, and forwards it over the trunk untagged at the outer level. The next switch reads the inner tag and drops the frame into the target VLAN. Traffic moves one direction only, because there is no matching path back, and one direction is still enough to push something unwanted into a segment you thought was sealed off. The mitigations follow straight from that precondition: set the native VLAN to an unused ID with no devices on it, keep VLAN 1 out of production traffic, and prune VLANs off trunks that have no reason to carry them.
Inter-VLAN routing: how VLANs talk to each other
VLANs are isolated by design, but most networks need them to talk to each other through controlled paths. Two ways to do it.
- Router-on-a-stick. One physical link between a switch and a router carries every VLAN as tagged traffic. The router has subinterfaces, one per VLAN, each with its own IP that acts as the default gateway for that VLAN. Cheap. Easy. Bottlenecked by the single physical link.
- Layer 3 switch. A multilayer switch that routes between VLANs internally at wire speed. Each VLAN has a switch virtual interface (SVI) configured with the gateway IP. Fast. Scales. The standard for any office big enough to care about throughput.
Either way, the firewall between VLANs becomes the policy enforcement point. "Guests cannot reach the corporate VLAN" is a firewall rule, not a switch rule. Keep that split straight and VLAN segmentation stops being confusing.
Real-world: a property management office with four VLANs
A property management office with about twenty staff has four VLANs riding on the same physical switch and access points.
- VLAN 10 (Corp). Staff laptops and desktops. 192.168.10.0/24. WPA2-Enterprise on Wi-Fi. Default gateway on the L3 switch.
- VLAN 20 (Voice). VoIP phones. 192.168.20.0/24. Tagged into a separate VLAN so QoS marking is straightforward and PoE power budget is easier to track.
- VLAN 30 (Guest). Visitor Wi-Fi. 192.168.30.0/24. Captive portal, full firewall block back to Corp and Voice, only allowed out to the internet.
- VLAN 40 (Cameras). Security cameras and the NVR. 192.168.40.0/24. No internet access at all (egress blocked). NVR allowed to reach Corp for management access only.
Eight physical access points carry all four VLANs over tagged trunks back to the L3 switch. Each SSID maps to a VLAN. End users have no idea any of this exists. They just connect to "OfficeWiFi" or "OfficeGuest" and get the right network. That is the entire pitch of VLANs: segmentation without doubling the cabling.
What this looks like in our platform
The Study Mode deck for objective 2.2 walks through 802.1Q tagging, access vs trunk, native VLAN, and inter-VLAN routing patterns. The Help Desk Simulator has tickets where a phone shows up on the wrong VLAN, a guest device gets a corporate IP, or a trunk port loses one VLAN and not another. The Net+ track page shows where VLANs fit alongside switching, routing, and security.
The reason businesses have a dozen VLANs
Most companies do not start with a dozen VLANs. They grow into them. One for staff. Then guest Wi-Fi gets added. Then VoIP phones move in. Then cameras. Then IoT thermostats and badge readers. Then a separate management VLAN for the network gear itself. Each new device category that should not see the others becomes its own VLAN. By the time you sit down at a switch with 12 VLANs configured, every one of them has a reason it exists. Learn the patterns once and you can read the running config of any unfamiliar network and figure out the story.
Sources
- CompTIA. CompTIA Network+ certification overview. Exam code N10-009. Domain weights and objective list.
- IEEE 802.1 Working Group. IEEE 802.1Q VLAN tagging standard. Authoritative source for the VLAN tag format, native VLAN, and trunk behavior.
About the authors
IT Service Center Manager and former CTE / IT teacher. Owner of Revtek IT Solutions. Writes everything that ships under his name and reviews every line of Revy-assisted drafting before publish.
LinkedIn ↗Revy helps draft and structure these posts. Every piece is reviewed, edited, and fact-checked by Nick before publish. We disclose this here because it is the right thing to do. See the AI Policy for the full stance.
Who writes this, and who checks it
Nick writes and edits these posts. AI helps with research, outlines, and first drafts. Nick reviews the draft before it goes live, and he is the only reviewer, so this is one person checking his own work. That catches a lot and it misses some.
When a post turns out to be wrong, the fix and the date it happened go on the corrections log, in public, including the ones nobody outside noticed. We do not use confidential, recalled, or leaked exam content. These posts are written from CompTIA's published objectives and authoritative technical sources. The AI policy has the longer version.
LinkedIn ↗