How it works
A VLAN separates devices logically without requiring separate physical hardware. Devices on the same switch can be assigned to different VLANs and behave as though they were on different networks.
Use segmentation to keep groups apart that have no reason to interact, then decide deliberately which crossings are permitted.
Common error
Separating groups means traffic between them now needs an explicit path. Segmentation without that decision breaks things people needed.
Worked example
Separate a shared switch into staff and guest networks while keeping approved internet access.
Evidence
VLAN 10: staff, 10.0.10.0/24
VLAN 20: guests, 10.0.20.0/24
Guests need: internet onlyAssign access ports or wireless profiles to the intended VLANs, provide gateways, and enforce an explicit inter-network policy. VLAN membership separates local broadcast domains, but a router with permissive rules can reconnect them. Verify guest-to-staff denial as well as guest internet access.
Exercises
3.4.1
After assigning two devices to different VLANs, their required cross-VLAN application stops working. What functions must be checked?
Show solution
Check the inter-VLAN routing path, each device gateway, the allowed service policy, and the return path. Separation deliberately removes automatic local reach; required crossings need configuration.
3.4.2
Why is a VLAN label by itself insufficient evidence that guests cannot reach a staff server?
Show solution
Routing and access rules may still permit guest-to-staff traffic. Inspect the actual policy and test the relevant source, destination, and service.