VLANs
A Virtual LAN (VLAN) partitions a single physical Layer-2 network into multiple isolated broadcast domains. The mechanism is defined by IEEE 802.1Q, which inserts a 4-byte tag into the Ethernet frame header between the source MAC address and the EtherType field. The tag carries a 12-bit VLAN ID (VID), supporting up to 4094 usable VLANs per bridged domain. Switches use the tag to keep traffic segregated: frames from one VLAN are never forwarded into another without a router or Layer-3 device in between.
Access ports vs trunk ports
The operational model is easiest to reason about from the frame’s point of view as it crosses a switch port:
- Access port — carries traffic for exactly one VLAN. Frames arrive from the attached end device untagged; the switch internally associates them with the port’s configured VLAN, and any frames leaving the port are sent untagged. Use access ports for end devices: workstations, printers, phones.
- Trunk port — carries traffic for multiple VLANs simultaneously. Frames are sent and received with their 802.1Q tags intact so the receiving device (another switch, a firewall, a wireless AP) can tell which VLAN each frame belongs to. Use trunk ports for switch-to-switch, switch-to-firewall, and switch-to-AP links.
The native VLAN is the one VLAN on a trunk that is sent untagged. When a trunk port receives an untagged frame, it is assigned to the native VLAN. The native VLAN defaults to VLAN 1 on most vendors’ equipment. Because untagged traffic silently lands in the native VLAN, a mismatch between the two ends of a trunk is both a common misconfiguration and a security issue (VLAN-hopping adjacent); hardening guidance generally recommends moving the native VLAN away from VLAN 1 and avoiding its use for user traffic.
Security relevance
- Segmentation as defense: separating management, user, server, and guest traffic into distinct VLANs limits lateral movement — but only if the Layer-3 device routing between them enforces policy. See watchguard-firebox-configuration for how a firewall applies policies to inter-VLAN traffic.
- VLAN hopping: attacks such as switch spoofing (negotiating a trunk with DTP on Cisco gear) and double-tagging (nesting a second 802.1Q tag to pivot into the native VLAN) exploit trunk misconfiguration, not a protocol flaw.
- Assessment angle: on an engagement, discovering you are on a trunk or voice VLAN changes what you can reach; tools like nmap will only see the broadcast domain you are attached to.
Sources
Related
- watchguard-firebox-configuration — defining VLAN interfaces and tagged/untagged traffic on a Firebox
- watchguard-access-point-configuration — AP SSIDs map onto VLAN-backed networks
- nmap — host discovery is scoped to the local broadcast domain