What Is a VLAN?
A VLAN (Virtual Local Area Network) logically divides a single physical network into separate, isolated broadcast domains — so devices can be grouped by function instead of by physical location.
Segmentation Without New Cabling
Isolation
Separate management, production, and storage traffic on the same switches.
Performance
Contain broadcast traffic so it does not flood the whole network.
Flexibility
Group devices logically with 802.1Q tags, regardless of where they sit.
Tags, Trunks, and Access Ports
Each VLAN is identified by a VLAN ID carried in an 802.1Q tag. Access ports connect end devices to a single VLAN; trunk ports carry multiple VLANs between switches. In the data center, out-of-band management interfaces are usually placed on a dedicated management VLAN, isolated from production traffic.
How 802.1Q Tagging Actually Works
802.1Q works by inserting a 4-byte tag into the Ethernet frame header, between the source MAC address and the EtherType field. Twelve bits of that tag carry the VLAN ID, which is how a switch knows which broadcast domain a frame belongs to. When a frame arrives on an access port, the switch adds the port's configured VLAN ID internally; when it forwards the frame out another access port in the same VLAN, the tag is removed again. End devices never see the tag — tagging is a conversation between switches.
Trunk ports are where tags appear on the wire. A trunk carries frames for many VLANs over a single physical link, and the 802.1Q tag is what keeps them separated: a frame tagged VLAN 20 on one switch is delivered only to VLAN 20 ports on the next. One VLAN on each trunk — the native VLAN — travels untagged, which is a common source of misconfiguration when the two ends disagree.
The practical consequence: a device's network membership is decided by switch configuration, not by cabling. Moving a server from production to a quarantine segment is a one-line port change. That is also why VLAN configuration belongs in monitoring scope — a wrong port assignment looks exactly like a dead network to the affected host. Sensaka discovers switch configuration agentlessly over SNMP and correlates it with the physical topology, so a mis-assigned port shows up as configuration drift rather than a mystery outage.
Two Different Boundaries
VLANs and subnets are often conflated because they usually travel together — one subnet per VLAN is the norm. They are still different mechanisms operating at different layers.
| Dimension | VLAN | Subnet |
|---|---|---|
| OSI layer | Layer 2 (Ethernet) | Layer 3 (IP) |
| What it defines | A broadcast domain — which devices see each other's frames | An IP address range and its routing boundary |
| Enforced by | Switch port configuration and 802.1Q tags | IP addressing, masks, and routers |
| Crossing the boundary | Requires a trunk to extend, or routing to leave | Requires a router or Layer 3 gateway |
| Typical practice | One VLAN per function or tenant | One subnet mapped to each VLAN |
Planning address ranges for new VLANs? The subnet calculator works out masks and host counts.
Common Segmentation Patterns
Most data center VLAN designs converge on the same handful of segments. The out-of-band segment matters most for monitoring: Sensaka collects hardware telemetry from that VLAN over Redfish and IPMI, independent of production network health.
Management VLAN
Switch, router, and appliance management interfaces live on a dedicated VLAN, reachable only from admin jump hosts and monitoring systems — never from production workloads.
Out-of-band (OOB) network
Server BMCs — iDRAC, iLO, XCC, iBMC — sit on their own VLAN, often with a physically separate switch. If production networking fails, the OOB path still reaches every server.
Storage VLAN
iSCSI or NFS traffic gets its own segment so storage I/O never competes with user traffic for the same broadcast domain, and jumbo-frame settings can be tuned per segment.
Production and tenant VLANs
Application traffic is split by environment (prod, staging, dev) or by tenant, so one environment's broadcast traffic and security exposure stays contained.
Migration and replication
vMotion, live migration, and storage replication move large east-west flows; a dedicated VLAN keeps that burst traffic from disturbing latency-sensitive segments.
DMZ and edge
Internet-facing services sit in a VLAN whose only routed paths pass through a firewall, keeping compromised edge hosts one enforced hop away from internal segments.
Common Questions About VLANs
What is the difference between a VLAN and a subnet?
A VLAN is a Layer 2 construct: it defines a broadcast domain enforced by switch configuration and 802.1Q tags. A subnet is a Layer 3 construct: a range of IP addresses defined by an address and mask. In practice most networks map one subnet to one VLAN, but the standard does not require it — the VLAN controls which devices can reach each other with Ethernet frames, and the subnet controls how they are addressed and routed.
How many VLANs can a network have?
The 802.1Q VLAN ID field is 12 bits, which allows 4,094 usable VLANs (IDs 1 through 4094; 0 and 4095 are reserved). Environments that need more segments than that — large multi-tenant data centers, for example — typically move to overlay technologies such as VXLAN, which extends the ID space while still using VLANs at the access edge.
What is a native VLAN?
The native VLAN is the one VLAN on a trunk port whose frames are sent untagged. Any untagged frame arriving on the trunk is assumed to belong to it. Both ends of a trunk must agree on the native VLAN; a mismatch silently merges two segments that were supposed to be separate, which is why many teams tag all VLANs on trunks and leave the native VLAN unused.
Do VLANs make a network secure?
VLANs provide isolation, not access control. Devices in separate VLANs cannot exchange Ethernet frames directly, but traffic routed between VLANs passes unfiltered unless an ACL or firewall inspects it. Treat VLANs as the segmentation boundary and place policy enforcement at the points where segments interconnect.
Why should the out-of-band management network be on its own VLAN?
BMC interfaces (iDRAC, iLO, XCC, iBMC and similar) expose low-level control of servers — power, console, firmware. Placing them on a dedicated management VLAN keeps that attack surface off the production network and keeps the management path alive when production segments have problems. Sensaka monitors hardware through exactly this path, collecting agentlessly over Redfish and IPMI from the management VLAN.
Authoritative Sources
See VLAN topology and the devices behind it
Sensaka maps network topology alongside the physical hardware, so you can trace a business service from VLAN to switch port to server.