Network Segmentation and VLANs: What to Separate First

Most business networks start flat — everything on one network, everything able to reach everything else. That works until it does not, and the failure is usually either a security incident that spreads further than it should have, or a device doing something unexpected to traffic it should never have seen.

What a VLAN does

A VLAN divides one physical network into several logical ones. Devices on different VLANs cannot communicate directly, even plugged into the same switch, unless something explicitly routes between them.

That is the whole idea: separation without separate cabling. Before VLANs, isolating a network meant physically separate switches and cable runs. Now it is configuration.

Two consequences that matter beyond security. Broadcast traffic stays within its VLAN, so a chatty device does not affect the whole site. And problems become easier to isolate, because a fault in one segment does not spread across everything.

What should be separated

Not everything needs its own VLAN, and over-segmentation makes networks difficult to run. These are the divisions that earn their complexity.

Management interfaces. Server management controllers, switch management, PDU and UPS management. These have full control over hardware and should be reachable only from where administrators work. Our remote management guide covers why a compromised controller is worse than a compromised operating system.

Storage traffic. iSCSI and similar block storage should be on its own segment, for performance as much as security — storage traffic is sensitive to latency and does not want to compete with general traffic. Our storage architecture guide covers this.

Guest and public access. Visitor Wi-Fi should reach the internet and nothing else internal. This is the most universally applicable separation.

Operational devices. Cameras, door controllers, building systems, printers and scanners. These are frequently the weakest security in a building — long-lived embedded devices that rarely get firmware updates — and they generally need to talk to one or two servers rather than to everything.

Point of sale. Payment infrastructure is usually subject to requirements that make separation mandatory rather than advisable.

Why operational devices matter here

Worth expanding, because it is the segment most often left flat.

A label printer or a network camera runs embedded firmware that may not have been updated since installation, and may not have available updates at all. It sits on the network for years.

Those devices need to reach the systems that drive them — a WMS, a POS platform, a recording server. They do not need to reach finance systems, domain controllers or anything else, and nothing else needs to reach them.

Segmenting them limits what a compromised device can do, and it limits what can reach the device in the first place.

Routing between segments

Separation is only useful if crossing between segments is controlled.

Traffic between VLANs passes through a routing point — a layer 3 switch or a firewall — and that is where policy is applied. Two approaches.

Route on a switch for performance-sensitive traffic between segments, with access control lists limiting what can cross.

Route through a firewall where inspection matters, at some cost in throughput and complexity.

The common failure is creating VLANs and then permitting everything between them, which produces the management overhead of segmentation with none of the benefit. If the rules allow any-to-any, the network is flat with extra steps.

Practical implementation points

Trunk and access ports. A port carrying one VLAN to an endpoint is an access port. A port carrying several between switches is a trunk. Misconfiguring these is the most common cause of a device that has network access but reaches nothing.

Native VLAN handling. Untagged traffic on a trunk goes to the native VLAN, and leaving this at the default is a common weak point.

Voice VLANs. IP phones typically use a dedicated VLAN with a computer connected through the phone on another. This needs configuring on the switch port and is a frequent source of confusion.

Wireless SSIDs map to VLANs. This is how guest wireless is separated. Access points need trunk ports carrying the relevant VLANs — a common oversight when adding an SSID later.

Document it. VLAN numbering, what each is for, and which ports belong to which. An undocumented segmented network is considerably harder to troubleshoot than a flat one, and this is where the operational cost of segmentation actually lands.

Switch capability

Not every switch supports what you need.

Unmanaged switches have no VLAN support at all. Adding one to a segmented network breaks the segmentation for everything behind it — a genuinely common problem when someone plugs in a cheap switch to add ports.

Layer 2 managed switches support VLANs but cannot route between them.

Layer 3 switches can route between VLANs, which is what you need for inter-segment traffic without sending everything through a firewall.

When buying, particularly refurbished, confirm the capability rather than assuming from the port count. Our switch buying guide covers what else to check, including whether required features sit behind a licence.

Where to start

If the network is currently flat, the highest-value separations first: guest wireless, management interfaces, and operational devices such as cameras and printers.

Those three cover the largest share of the risk with the least disruption, and none of them requires re-addressing the main network. Further segmentation can follow once the approach is established and documented.

Common questions

Planning segmentation? Tell us your switch models and we will confirm whether they support what you need.