VLANs, or Virtual Local Area Networks, are an essential tool for efficiently managing network traffic. In this article, we will introduce you to the concept of VLANs, explain their importance, and provide you with practical examples of how they are used in real environments.

What are VLANs

Broadly speaking, a VLAN is a logical subdivision of a physical network. Instead of being limited by physical infrastructure, devices connected to a VLAN can communicate with each other as if they were on the same local network, even if they are in different geographic locations. This provides great flexibility and allows better control of network traffic.

But why are VLANs important? Here are some key reasons:

1. Security

VLANs help improve security by isolating different network segments. For example, a company may have separate VLANs for its finance, human resources, and development departments. This prevents unauthorized users from accessing confidential information from other departments.

2. Network traffic optimization

VLANs allow devices with similar traffic needs to be grouped together, which improves network efficiency by reducing the amount of unnecessary traffic. For example, if a company has IP security cameras and VoIP endpoints on the same physical network, creating a specific VLAN for each type of device can improve the quality of phone calls and reduce latency in video transmission.

3. Scalability

VLANs facilitate network expansion by eliminating the need to add physical switches. If a department needs to add new devices, they can simply be assigned to the existing VLAN, avoiding additional hardware costs.

Practical example of VLANs application.

Suppose a company has two buildings on the same campus. He building A houses the finance department, while the building B houses sales and marketing employees. Without a VLAN, sales and marketing employees would not be able to easily access Building A resources, such as printers or servers, due to physical separation.

Problem solution

By implementing a VLAN, the company can connect the sales and marketing devices in building B to the same logical network as the devices in building A. This allows employees in both buildings to share resources and collaborate more efficiently, thereby despite the physical barrier that separates them.

It is important to mention some key concepts and implementation methods for a better understanding of the topic.

Types of VLANs

There are several types of VLANs based on how devices are assigned to them. Some of the most common types are:

1. Port-based VLAN

In this approach, devices are assigned to specific VLANs based on the switch port to which they are connected. Each switch port is configured to belong to a particular VLAN. This is the most common type of VLAN implementation.

2. VLAN based on MAC address 

Here, devices are assigned to VLANs based on their MAC address. The network administrator sets up a table of MAC addresses and assigns each to a specific VLAN. This approach is more flexible but also more difficult to manage.

3. Protocol-based VLAN

Devices are assigned to VLANs based on the network protocol they use, such as IP, IPX, or AppleTalk. This setting is useful for separating network traffic based on protocol type.

VLAN Trunking and Tagging

When VLANs are used in a network, it is often necessary for switches to share VLAN information with each other. This is achieved through the use of trunking and VLAN tagging.

Trunking

A trunk is a network connection between two switches that allows traffic from multiple VLANs to pass. Trunking is necessary when you want devices in different VLANs to communicate with each other across multiple switches.

VLAN tagging

To maintain VLAN information as traffic traverses trunk links, a process called VLAN tagging is used. The most common standard for VLAN tagging is 802.1Q.

This standard adds VLAN information in the form of tags to data packets, allowing switches to identify which VLAN each packet belongs to and route it appropriately.

Example 1: Port-based VLAN configuration on a MikroTik switch

Let's imagine a network with a switch MikroTik CRS326-24G-2S+RM and three different departments: Sales, Marketing and Finance. To keep the traffic of these departments separate, port-based VLANs will be implemented. For this example, ports 1-8 will be assigned for Sales, 9-16 for Marketing, and 17-24 for Finance.

Steps to follow:

1. Access the RouterOS of the MikroTik switch through Winbox or the web interface.
2. Go to “Interfaces” and create three new VLANs: “VLAN-Sales” with ID 10, “VLAN-Marketing” with ID 20 and “VLAN-Finance” with ID 30.
3. Go to “Switch” and then to the “VLAN” tab. Add three new entries with the VLANs created in the previous step and assign the corresponding “Switch”.
4. Next, go to the “Port VLAN Configuration” tab and configure ports 1-8 with VLAN 10, ports 9-16 with VLAN 20, and ports 17-24 with VLAN 30.
5. Apply the changes and save the settings.

With this configuration, traffic from the three departments will be kept separate and each group will only be able to communicate with devices within its own VLAN.

Configuration in RouterOS