A VLAN creates separate Layer 2 broadcast domains on the same physical switch. Devices in the same VLAN communicate directly at Layer 2; communication between VLANs requires routing. VLANs improve security, performance and network structure.
Key points (CCNA)
| Point | Explanation |
|---|---|
| Purpose | Segment the network |
| Layer | Layer 2 |
| Broadcast | One broadcast domain per VLAN |
| VLAN ID | 1–4094 |
| Access port | Belongs to one VLAN |
| Trunk port | Carries multiple VLANs |
| Tagging | 802.1Q |
| Native VLAN | Untagged frames – should be changed from VLAN 1! |
| Inter-VLAN | Requires routing (SVI / router) |
| Default VLAN | VLAN 1 (cannot be deleted) |
Why does Cisco care about VLAN 1?
Cisco recommends avoiding VLAN 1 because it carries default control traffic and increases security risk when used as the native VLAN.
- VLAN 1 is the default VLAN AND the default native VLAN
- By default it carries: CDP, VTP, STP control, PAgP, DTP – plus management traffic if not moved
- Untagged trunk traffic goes to the native VLAN – if native = VLAN 1: control traffic is exposed, VLAN hopping risk increases, troubleshooting gets harder
- Changing the native VLAN does not change that VLAN 1 remains the default VLAN for access ports
Best practices
- Do NOT use VLAN 1 for user traffic
- Change the native VLAN (e.g. to VLAN 999)
- Remove VLAN 1 from trunk allowed lists if possible
- Use a dedicated management VLAN