A VLAN creates separate Layer 2 broadcast domains on the same physical switch. Devices in the same VLAN communicate directly at Layer 2, while communication between VLANs requires routing. VLANs improve security, performance and network structure.
Cisco recommends avoiding VLAN 1 because it carries default control traffic and increases security risk when used as the native VLAN.
The most important points (CCNA)
| Point | Explanation |
|---|---|
| Purpose | Segment the network |
| Layer | Layer 2 |
| Broadcast | One broadcast domain per VLAN |
| VLAN ID | 1–4094 |
| Access port | Belongs to one VLAN |
| Trunk port | Carries multiple VLANs |
| Tagging | 802.1Q |
| Native VLAN | Untagged frames – should be changed from VLAN 1! |
| Inter-VLAN | Requires routing (SVI / router) |
| Default VLAN | VLAN 1 (cannot be changed) |
Why does Cisco care about VLAN 1?
VLAN 1 is the default VLAN, the default native VLAN, and carries control and management traffic by default:
- CDP, VTP, STP control traffic, PAgP, DTP, management traffic (if not moved)
Why is that a problem? Untagged traffic on trunks goes to the native VLAN. If the native VLAN is VLAN 1: control traffic is exposed, VLAN hopping risk increases, and troubleshooting gets harder.
Cisco best practices: do NOT use VLAN 1 for user traffic · change the native VLAN (e.g. to 999) · remove VLAN 1 from trunk allowed lists where possible · use a dedicated management VLAN. Note: VLAN 1 remains the default VLAN even after the native VLAN is changed.