What is VLAN Segmentation?
A Virtual LAN (VLAN) divides a single physical network into multiple logical broadcast domains. This means devices on different VLANs cannot communicate directly — traffic must pass through a router or Layer 3 switch first. For small businesses, this provides better security, improved performance, and easier management without buying separate physical switches for each department.
When You Need VLANs
- You have more than one department on the same network
- Guest WiFi users can currently access internal file servers
- IP cameras and printers share the same subnet as workstations
- You want to isolate VoIP traffic for better call quality
- Compliance requirements demand network segmentation (PCI-DSS, etc.)
VLAN Design for a Typical Small Business
Here's a proven VLAN scheme I use for offices with 50-200 users. Adjust the subnet sizes based on your actual device count.
| VLAN ID | Name | Subnet | Purpose |
|---|---|---|---|
| 10 | Management | 192.168.10.0/24 | Switches, APs, UPS, management interfaces |
| 20 | Staff | 192.168.20.0/24 | Employee workstations and laptops |
| 30 | VoIP | 192.168.30.0/24 | IP phones and call systems |
| 40 | Servers | 192.168.40.0/24 | File server, AD, DNS, DHCP |
| 50 | CCTV | 192.168.50.0/24 | IP cameras and NVR |
| 60 | Printers | 192.168.60.0/24 | Network printers and MFPs |
| 100 | Guest | 10.10.100.0/24 | Guest WiFi (internet only) |
Network Architecture
Implementation Steps
1. Configure the Core Switch
Create VLANs and assign SVIs (Switched Virtual Interfaces) for inter-VLAN routing:
# Create VLANs
vlan 10
name Management
vlan 20
name Staff
vlan 30
name VoIP
vlan 40
name Servers
vlan 50
name CCTV
vlan 60
name Printers
vlan 100
name Guest
# Create SVI for inter-VLAN routing
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
interface vlan 40
ip address 192.168.40.1 255.255.255.0
no shutdown
# Trunk port to access switch
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,60,1002. Configure Access Ports
Assign each port to the correct VLAN based on what's plugged into it:
# Workstation port
interface FastEthernet0/1
switchport mode access
switchport access vlan 20
# IP Phone + PC (voice VLAN)
interface FastEthernet0/5
switchport mode access
switchport access vlan 20
switchport voice vlan 30
# IP Camera port
interface FastEthernet0/10
switchport mode access
switchport access vlan 50
# Printer port
interface FastEthernet0/15
switchport mode access
switchport access vlan 603. Configure DHCP Scopes
Set up a DHCP scope per VLAN so devices get the correct IP address automatically. You can run DHCP on the core switch, a server, or your firewall.
4. Firewall Rules Between VLANs
Access Control Best Practices
- Guest → Internet only — Block all access to internal VLANs
- CCTV → NVR only — Cameras talk to the recorder, nothing else
- Staff → Servers, Printers — Allow needed services (SMB, HTTP, printing)
- VoIP → Internet — Allow SIP/RTP to your provider, block everything else
- Management → All VLANs — IT team can access everything for troubleshooting
Verification & Testing
After implementation, verify each VLAN works correctly:
- Ping test — Can a VLAN 20 device reach VLAN 40 (servers)? It should.
- Isolation test — Can a VLAN 100 (guest) device reach VLAN 40? It should NOT.
- DHCP test — Plug a device into each VLAN and verify it gets the correct subnet
- Trunk verification —
show interface trunkon switches to confirm allowed VLANs - MAC table check —
show mac address-table vlan 20to see learned addresses
Quick Wins After VLAN Implementation
- Broadcast traffic drops significantly — Each VLAN is its own broadcast domain
- Guest users are completely isolated — No accidental access to company files
- VoIP call quality improves — QoS is easier to apply per-VLAN
- Troubleshooting is faster — Issues are contained within a VLAN
- Future expansion is simpler — Add a new department? Just create a new VLAN