Advanced Network Segmentation Course
Setting Up VLAN Segmentation
Virtual Local Area Networks, commonly known as VLANs, allow administrators to divide a physical network into separate logical network segments.
This improves security, performance and manageability by controlling how devices communicate across departments, services and device groups.
In this advanced course, you will learn how to plan a VLAN structure, configure managed-switch ports, create tagged trunk links, assign IP subnets, configure DHCP scopes and enable controlled inter-VLAN routing. You will also learn how to apply access-control rules, isolate sensitive systems and troubleshoot common VLAN connectivity problems.
Learning Outcomes
What you will be able to do after completing this course.
By the end of this course, you should be able to design, implement, secure, verify and document a scalable VLAN-based network.
- Explain how a VLAN differs from a physical LAN.
- Describe the security and performance benefits of segmentation.
- Identify suitable systems and device groups for separation.
- Create a VLAN plan with IDs, names, subnets and gateways.
- Relate VLANs to IP subnets and broadcast domains.
- Configure VLANs on a managed switch.
- Assign access ports to the correct VLAN.
- Configure tagged trunk ports.
- Distinguish tagged and untagged traffic.
- Configure an appropriate native VLAN.
- Avoid using the default VLAN for sensitive production traffic.
- Create user, server, management, guest, printer, CCTV and IoT VLANs.
- Assign a unique subnet and gateway to each VLAN.
- Create separate DHCP scopes.
- Configure DHCP relay when required.
- Enable inter-VLAN routing.
- Understand router-on-a-stick.
- Apply firewall policies or access-control lists.
- Allow only required services between segments.
- Prevent guest access to internal systems.
- Restrict the management VLAN.
- Isolate servers and sensitive systems.
- Map wireless SSIDs to VLANs.
- Verify VLAN membership and trunk configuration.
- Test same-VLAN and inter-VLAN communication.
- Use ping, tracert and ipconfig for troubleshooting.
- Diagnose incorrect assignments, tags and trunk mismatches.
- Resolve DHCP, gateway and DNS problems.
- Identify native- and allowed-VLAN inconsistencies.
- Document VLANs, ports, gateways and access rules.
- Back up network-device configurations.
- Implement changes gradually.
- Review segmentation rules regularly.
- Design a scalable small or medium organisation VLAN structure.
Course Roadmap
Follow the design and implementation sequence or select a lesson.
Understanding VLAN Fundamentals
Learn how logical network separation differs from a physical LAN.
Lesson objective:
Explain VLANs, broadcast domains and logical segmentation.
Physical LAN
Devices are connected through shared physical switching infrastructure and may belong to the same broadcast domain.
Virtual LAN
Devices are grouped logically by configuration, even when they use the same physical switches.
Key VLAN Concepts
- Each VLAN forms a separate Layer 2 broadcast domain.
- Devices in different VLANs require routing to communicate.
- VLAN membership can be assigned by switch port or another supported method.
- VLAN tags identify traffic crossing tagged trunk links.
- VLANs improve organisation but do not replace firewall policy.
Two devices connected to the same physical switch may be unable to
communicate directly when their ports belong to different VLANs.
Practice Activity
- Draw one physical switch with six connected devices.
- Place the devices into three logical VLAN groups.
- Mark the resulting broadcast domains.
- Identify where routing would be required.
Defining Segmentation Goals
Identify why systems and departments should be separated.
Lesson objective:
Match business, security and operational requirements to suitable
network segments.
Common Reasons to Segment
- Limit lateral movement after a device compromise.
- Reduce unnecessary broadcast traffic.
- Separate trusted and untrusted devices.
- Protect servers and management interfaces.
- Apply different internet or service-access policies.
- Simplify monitoring and troubleshooting.
- Support compliance and audit requirements.
Typical Segmentation Candidates
User Devices
Office desktops, laptops and approved mobile devices.
Servers
Application, database, file and infrastructure servers.
CCTV and IoT
Cameras, sensors, controllers and embedded devices.
Segmenting without defining required communication paths can break
printing, authentication, application access and monitoring.
Segmentation Exercise
- List departments and device groups in a sample organisation.
- Identify sensitive and untrusted groups.
- Document required communication between groups.
- Mark traffic that should be blocked by default.
Building a VLAN Plan
Define IDs, names, subnets, gateways and intended use.
Lesson objective:
Create a clear VLAN design before configuring network devices.
| VLAN ID | Name | Subnet | Gateway | Purpose |
|---|---|---|---|---|
| 10 | USERS | 10.10.10.0/24 | 10.10.10.1 | Standard user devices |
| 20 | SERVERS | 10.10.20.0/24 | 10.10.20.1 | Application and infrastructure servers |
| 30 | VOICE | 10.10.30.0/24 | 10.10.30.1 | IP telephony |
| 40 | GUEST | 10.10.40.0/24 | 10.10.40.1 | Internet-only guest access |
| 99 | MGMT | 10.10.99.0/24 | 10.10.99.1 | Network-device management |
Planning Principles
- Use consistent names and numbering.
- Reserve space for future VLANs.
- Assign one subnet per VLAN.
- Document gateway ownership and routing location.
- Include DHCP, DNS and firewall requirements.
- Avoid undocumented temporary VLANs.
Planning Exercise
- Create VLANs for users, servers, management, guest and IoT.
- Assign unique VLAN IDs.
- Assign a subnet and gateway to each VLAN.
- Document required communication paths.
Creating VLANs on a Managed Switch
Define VLAN records before assigning ports.
Lesson objective:
Create VLANs on a managed switch using the vendor interface or CLI.
General Configuration Sequence
- Back up the current switch configuration.
- Confirm management access and recovery methods.
- Create the required VLAN IDs.
- Assign clear VLAN names.
- Save or apply the configuration.
- Verify that the VLANs appear in the VLAN table.
Vendor-Neutral CLI Concept
vlan 10
name USERS
vlan 20
name SERVERS
vlan 40
name GUEST
vlan 99
name MGMT
Exact commands and terminology vary by manufacturer. Some switches
use tagged and untagged membership tables instead of access and trunk
terminology.
Switch Exercise
- Back up a lab switch configuration.
- Create VLANs 10, 20, 40 and 99.
- Assign descriptive names.
- Verify the VLAN table.
- Save the configuration.
Assigning Access Ports
Place endpoint devices into the correct VLAN.
Lesson objective:
Configure endpoint-facing switch ports as access or untagged members
of the intended VLAN.
Access-Port Behaviour
- The connected endpoint normally sends untagged Ethernet frames.
- The switch associates incoming untagged traffic with the access VLAN.
- Traffic leaving the access port is normally untagged.
- One endpoint-facing port usually belongs to one data VLAN.
Vendor-Neutral CLI Concept
interface ethernet 1/0/10
description Finance-PC
switchport mode access
switchport access vlan 10
Assigning the wrong access VLAN may place a device in the wrong subnet
or prevent it from receiving the expected DHCP settings.
Access-Port Exercise
- Choose two lab switch ports.
- Assign one to VLAN 10 and one to VLAN 20.
- Connect a test device to each port.
- Verify the received IP address.
- Document the port descriptions.
Configuring Tagged Trunks
Carry multiple VLANs between network devices.
Lesson objective:
Configure tagged links and understand tagged, untagged and native
VLAN traffic.
Tagged Traffic
The Ethernet frame carries VLAN information so the receiving device can identify its VLAN.
Untagged Traffic
The Ethernet frame arrives without a VLAN tag and is associated with an access or native VLAN by the receiving device.
Trunk Design Checklist
- Confirm both ends use compatible trunk settings.
- Allow only required VLANs.
- Use a consistent native VLAN.
- Avoid using the default VLAN for sensitive traffic.
- Document every trunk and allowed-VLAN list.
interface ethernet 1/0/48
description Uplink-to-Core
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,40,99
A native-VLAN mismatch can create unexpected traffic handling and
difficult troubleshooting. Configure both ends consistently.
Trunk Exercise
- Create a trunk between two lab switches.
- Allow VLANs 10, 20 and 99.
- Configure the same native VLAN on both ends.
- Verify trunk status and allowed VLANs.
- Test devices in the same VLAN across both switches.
Designing a Production VLAN Structure
Create dedicated segments for major device and service groups.
Lesson objective:
Build a practical VLAN structure without placing sensitive traffic
on the default VLAN.
| VLAN Type | Typical Devices | Typical Policy |
|---|---|---|
| Users | Desktops and laptops | Access approved internal services and internet |
| Servers | Application and database servers | Restricted inbound access from approved VLANs |
| Management | Switches, firewalls and access points | Accessible only from authorised admin systems |
| Guest | Visitor devices | Internet only |
| Printers | Network printers and multifunction devices | Reachable only from approved user VLANs |
| CCTV and IoT | Cameras, sensors and controllers | Restricted to required servers and internet destinations |
Keep the design understandable. Excessive segmentation can create
operational complexity without meaningful security benefit.
Structure Exercise
- Create VLANs for seven common device groups.
- Assign a clear purpose to each one.
- Identify the minimum allowed communication paths.
- Mark the default-deny boundaries.
Assigning IP Subnets and Gateways
Provide each VLAN with a unique Layer 3 network.
Lesson objective:
Assign a unique IP subnet and default gateway to every VLAN.
Core Relationship
- One VLAN normally maps to one IP subnet.
- The VLAN gateway provides Layer 3 routing.
- Hosts use the gateway to reach other VLANs and external networks.
- Overlapping subnets must not be used.
Example Gateway Interfaces
VLAN 10 gateway: 10.10.10.1/24
VLAN 20 gateway: 10.10.20.1/24
VLAN 40 gateway: 10.10.40.1/24
VLAN 99 gateway: 10.10.99.1/24
If two VLANs use the same subnet, routing and host communication will
become unreliable or impossible.
Addressing Exercise
- Assign a unique subnet to six VLANs.
- Reserve the first usable address as the gateway.
- Reserve ranges for infrastructure devices.
- Document the DHCP range for each VLAN.
Configuring DHCP for Multiple VLANs
Create separate scopes and relay requests when required.
Lesson objective:
Provide correct addressing, gateway and DNS settings to each VLAN.
DHCP Scope Requirements
- Network address and subnet mask
- Available address range
- Default gateway
- DNS servers
- Lease duration
- Excluded or reserved addresses
DHCP Relay
DHCP broadcasts normally remain inside their VLAN. When the DHCP server is located elsewhere, the VLAN gateway must relay the request to the DHCP server.
interface vlan 10
ip address 10.10.10.1 255.255.255.0
ip helper-address 10.10.20.10
The relay address and exact configuration vary by platform. Confirm
firewall policy also permits the required DHCP traffic.
DHCP Exercise
- Create scopes for VLANs 10, 20 and 40.
- Configure the correct gateways and DNS servers.
- Configure DHCP relay for a remote server.
- Renew a client lease on each VLAN.
- Verify the assigned settings.
Enabling Inter-VLAN Routing
Route controlled traffic through a Layer 3 switch, router or firewall.
Lesson objective:
Configure gateway interfaces and understand where routing occurs.
Layer 3 Switch
Routes using switch virtual interfaces at high internal speed.
Router
Routes VLAN traffic using physical or logical interfaces.
Firewall
Routes while applying security policy between VLANs.
Layer 3 Switch Concept
interface vlan 10
ip address 10.10.10.1 255.255.255.0
interface vlan 20
ip address 10.10.20.1 255.255.255.0
ip routing
Enabling routing without access controls may allow all VLANs to reach
one another. Apply least-privilege policy after routing is enabled.
Routing Exercise
- Create gateway interfaces for VLANs 10 and 20.
- Enable routing on the lab device.
- Test communication between VLANs.
- Record the path and gateway addresses.
Understanding Router-on-a-Stick
Route several VLANs through one physical router interface.
Lesson objective:
Configure a tagged trunk to router subinterfaces.
Design Overview
- VLAN Endpoints
- Managed Switch
- 802.1Q Trunk
- Router Subinterfaces
interface ethernet 0/0.10
encapsulation dot1q 10
ip address 10.10.10.1 255.255.255.0
interface ethernet 0/0.20
encapsulation dot1q 20
ip address 10.10.20.1 255.255.255.0Advantages and Limitations
| Advantage | Limitation |
|---|---|
| Uses one physical router interface | All inter-VLAN traffic shares the same link |
| Suitable for smaller environments and labs | May become a bandwidth or availability bottleneck |
Router-on-a-Stick Exercise
- Configure a trunk from the switch to the router.
- Create subinterfaces for VLANs 10 and 20.
- Assign gateway addresses.
- Test same-VLAN and inter-VLAN traffic.
Applying Firewall Policies and ACLs
Permit only required services between network segments.
Lesson objective:
Build least-privilege communication rules between VLANs.
Policy Design Process
- Start with a communication requirements matrix.
- Identify source VLAN, destination and service.
- Allow only required protocols and ports.
- Place broader deny rules after required allows.
- Enable logging for important denied traffic.
- Test the business application after each change.
Example Policy Matrix
| Source | Destination | Service | Action |
|---|---|---|---|
| USERS | DNS Servers | DNS | Allow |
| USERS | Application Server | HTTPS | Allow |
| GUEST | Internal Networks | Any | Deny |
| MGMT | Network Devices | Approved management protocols | Allow |
A rule that is too broad can defeat segmentation. Review source,
destination, service and direction carefully.
Policy Exercise
- Create a communication matrix for five VLANs.
- Define required allows.
- Add default-deny rules.
- Test approved and blocked paths.
- Document the final rule order.
Isolating Guests, Management and Sensitive Systems
Apply stronger restrictions to higher-risk or higher-value segments.
Lesson objective:
Protect internal systems from guests, IoT devices and unauthorised
management access.
Recommended Controls
- Guest VLAN: internet access only.
- Management VLAN: accessible only from authorised administrator systems.
- Server VLAN: allow only approved application and management traffic.
- Printer VLAN: allow printing from approved user VLANs.
- CCTV VLAN: allow cameras to reach only the recorder and required services.
- IoT VLAN: restrict access to internal systems.
Management VLAN Protection
- Do not expose management interfaces to guest or user VLANs.
- Use dedicated administrator workstations or a secure jump host.
- Use encrypted management protocols.
- Log management access.
- Apply strong authentication.
Segmentation is strongest when VLAN separation, firewall policy,
secure management and endpoint controls work together.
Isolation Exercise
- Block GUEST from all internal RFC1918 networks.
- Permit GUEST to the internet and required DNS services.
- Restrict MGMT access to one authorised admin subnet.
- Test expected allows and denies.
Mapping Wireless SSIDs to VLANs
Extend wired segmentation to wireless users and devices.
Lesson objective:
Configure access points and switch trunks so each SSID uses the
intended VLAN.
Example SSID Mapping
| SSID | VLAN | Purpose |
|---|---|---|
| Corporate-WiFi | 10 | Approved staff devices |
| Guest-WiFi | 40 | Internet-only visitors |
| IoT-WiFi | 60 | Smart and embedded devices |
Integration Checklist
- Create the VLAN on all required switches.
- Allow the VLAN on the access-point trunk.
- Map the SSID to the correct VLAN ID.
- Create the DHCP scope and gateway.
- Apply the intended firewall policy.
- Test a client on each SSID.
An SSID may appear and accept clients even when the VLAN is missing
from the switch trunk. The client may then fail to receive an IP
address.
Wireless VLAN Exercise
- Create staff and guest SSIDs.
- Map them to VLANs 10 and 40.
- Allow both VLANs on the access-point trunk.
- Verify DHCP and firewall behaviour.
Verifying VLAN Configuration
Confirm membership, trunks, gateways and expected communication.
Lesson objective:
Validate each layer before declaring the VLAN deployment complete.
Verification Sequence
- Verify that each VLAN exists.
- Verify access-port membership.
- Verify trunk state and allowed VLANs.
- Verify the native VLAN.
- Verify gateway interfaces are up.
- Verify DHCP scope and relay settings.
- Test same-VLAN communication.
- Test inter-VLAN communication.
- Test blocked communication paths.
- Review logs and counters.
Client-Side Tests
ipconfig /all
ping 10.10.10.1
ping 10.10.20.10
tracert 10.10.20.10
nslookup internal.example
Test both expected success and expected failure. A segmentation
project is incomplete if allowed traffic works but blocked traffic
has not been verified.
Verification Exercise
- Test two hosts in the same VLAN.
- Test an approved inter-VLAN service.
- Test a blocked guest-to-server path.
- Record all results.
Troubleshooting VLAN Connectivity
Diagnose assignments, tags, trunks, addressing and policy.
Lesson objective:
Use a layered process to isolate common VLAN faults.
| Problem | Likely Checks |
|---|---|
| Wrong client subnet | Access-port VLAN, DHCP scope and stale lease |
| No DHCP address | Trunk VLAN, DHCP relay, scope status and firewall |
| Same VLAN fails across switches | Allowed VLAN list, tagging and trunk state |
| Inter-VLAN traffic fails | Gateway interface, routing, ACL or firewall policy |
| Only one direction works | Stateful policy, return route or asymmetric routing |
| Unexpected untagged traffic | Native VLAN and port-mode mismatch |
Layered Troubleshooting Process
- Confirm the physical link and port status.
- Confirm VLAN existence and access membership.
- Confirm trunk tagging and allowed VLANs.
- Confirm IP address, mask and gateway.
- Confirm DHCP and DNS.
- Confirm routing and return routes.
- Confirm firewall or ACL policy.
- Compare both ends of every trunk.
Avoid changing several settings at once. Make one controlled change,
test it and record the result.
Troubleshooting Exercise
- Remove VLAN 20 from one trunk's allowed list.
- Observe the failure.
- Use verification tools to locate the mismatch.
- Restore the correct configuration.
- Document the symptoms and fix.
Documenting and Maintaining VLAN Segmentation
Protect availability through backups, staged changes and regular review.
Lesson objective:
Maintain accurate records and implement VLAN changes safely.
Documentation Requirements
- VLAN IDs and names
- Subnets and gateway addresses
- DHCP scopes and relay destinations
- Access-port assignments
- Trunk ports and allowed VLANs
- Native VLANs
- Wireless SSID mappings
- Firewall and ACL rules
- Device-management addresses
- Configuration backup locations
Safe Change Workflow
- Document the current state.
- Back up switch, router and firewall configurations.
- Define the change and rollback plan.
- Test in a lab or staging environment where possible.
- Implement one stage at a time.
- Validate after every stage.
- Update diagrams and port records.
- Review segmentation rules periodically.
A VLAN change can disconnect management access. Confirm out-of-band
or local recovery options before modifying trunks or management VLANs.
Documentation Exercise
- Create a VLAN register.
- Create a switch-port assignment table.
- Create an inter-VLAN policy matrix.
- Write a rollback plan for one trunk change.
Final Project: Design and Implement VLAN Segmentation
Apply the complete advanced segmentation workflow.
Project objective:
Design, configure, secure, test and document a scalable VLAN
structure for a small or medium-sized organisation.
Project Requirements
- Create a VLAN plan with IDs, names, subnets and gateways.
- Create dedicated user, server, management, guest, printer, CCTV and IoT VLANs.
- Avoid the default VLAN for production traffic.
- Create VLANs on all required switches.
- Assign endpoint-facing access ports.
- Configure tagged trunks.
- Configure a consistent native VLAN.
- Limit trunks to required VLANs.
- Create gateway interfaces.
- Create DHCP scopes.
- Configure DHCP relay where required.
- Enable inter-VLAN routing.
- Create firewall or ACL policy.
- Block guest access to internal networks.
- Restrict management access.
- Map SSIDs to their VLANs.
- Test same-VLAN traffic.
- Test approved inter-VLAN traffic.
- Test blocked paths.
- Back up all device configurations.
- Document ports, trunks, subnets and rules.
Recommended Project Workflow
- Plan
- Create VLANs
- Assign Ports
- Build Trunks
- Configure IP
- Enable Routing
- Apply Policy
- Validate
Final Verification Checklist
- Every VLAN exists on all required switches.
- Access ports match the port-assignment plan.
- Trunks allow only required VLANs.
- Native VLANs match on both ends.
- Every VLAN has a unique subnet and gateway.
- Clients receive correct DHCP settings.
- Same-VLAN communication works where expected.
- Approved inter-VLAN services work.
- Guest access to internal networks is blocked.
- Management access is restricted.
- Wireless SSID mapping works.
- DNS and internet access work where permitted.
- Device configurations are backed up.
- Documentation matches the final configuration.
Perform the final project only in a lab, staging network or an
authorised production change window with a tested rollback plan.
Congratulations!
You have completed Setting Up VLAN Segmentation.
You can now plan VLANs, configure access and trunk ports, assign subnets and gateways, provide DHCP, enable controlled routing, integrate wireless networks, apply access rules and troubleshoot common segmentation problems.
17 Lessons
Completed
VLAN Segmentation
Designed
100% Progress
Course Completed
Continue reviewing VLAN usage, access-control policy, trunk configuration and network documentation as business requirements and connected devices change.
