Introduction to VLANs

Hi Hussein,

First of all, it is indeed confusing. By default VLAN1 is the native VLAN and it’s untagged.

I do believe however that “control” frames like VTP, CDP, DTP, etc. don’t really belong to a VLAN. They are untagged and like you have seen, even when you block VLAN1 then this traffic is still sent and received.


1 Like

I must agree with every one else that you are a talented teacher.

Brilliant work.

Hi Rene, what do you think what is a sensible number of hosts to have in a broadcast domain before splitting up the network into VLANs? Do you have any experience from the field about that? Thanks, Daniel

Hi Daniel,

There’s a “technical” and “practical” aspect to this question :slight_smile:

Let’s start with the technical part…a lot of networking people will tell you that you shouldn’t have > 200 hosts in a subnet since there will be too much broadcast traffic and it will slow down your network. This might be true 10 years ago but nowadays, your computers won’t be bothered much with broadcast traffic and it shouldn’t be an issue for your switches. You could probably put ~1000 hosts in a single subnet and not notice any performance issues.

The more important issue (the practical aspect) is that a single subnet/VLAN is one failure domain. Let’s say we put 1000 hosts in a single subnet and one computer has a broken NIC, sending non-stop garbage broadcast frames. This will affect the entire VLAN and your 999 remaining hosts.

By breaking down this big VLAN into four smaller VLANs, a broken NIC would only affect one VLAN…not the other three.

So for practical reasons I think it’s best to stick with /24 subnets. They are easy to work with and you’ll have multiple failure domains.



So if I have a 48 port switch on the network…… and all 48 ports are connected to host. All the host have IP addresses on the network. And lets say I create 4 VLANs. Help Desk is on VLAN 10 (interface 1-12), MGMT is on VLAN 20 (int 13-24), Accounting is on VLAN 30 (int 25-36), and Supply is on VLAN 40 (int-37-48). OK…. So these 4 VLANs would basically share the same network ( right? VLANS don’t have to be on different networks/subnets?
What if there were some other MGMT host on another router on a network…. Could those join the above VLAN 20 as well?

Except in the unusual case of Private VLANs, VLANs are 1:1 with subnets. When you assign ports to VLANs on your switch, you will have to think about what will be the layer 3 device that connects them together. If your switch is a layer 3 switch, the switch itself can route traffic between your VLANs. Otherwise, you will need a separate router to do it.

Your MGMT host could be part of VLAN 20, but you would need to make sure that all the hosts in VLAN 20 share the same network as MGMT.

Forgive me for asking so many questions…. But I am new to networking… this question pertains to IP address on routers and switches (which will make me understand VLANs better).

I was under the assumption that a routers interface has only one IP address configured on it. So R1’s int fa0/1 will have On that R1 int fa0/1, is a switch (24 port). So I thought every port on that switch had to have an IP address in the network. So Switch port 1 host would be, port 2 would be, port 3 would be, etc, etc.

All these ports could be in the same VLAN, or it could be chopped up to multiple VLANs…… How does a switch – connected to a router interface with a address… how does this switch have other IP addresses (,, etc, etc) on it?

I was under the impression… IP address were like a water hose. The primary source of water ( is flowing into the switch from R1’s interface 0/1. R1’s 0/1 can have only one IP address configured on it. How can Switch 1 ports have any other IP address other than the network configured on it? If is on Switch port 4.

How would that IP address traffic travel up to R1’s fa0/1 if only is configured on the router?

If you are talking about a switch that has IP addresses on, it this implies you are speaking about what’s known as a Layer-3 switch. Layer 3 switches have something called “Switch Virtual Interfaces” (SVIs) which are just logical interfaces–they don’t necessarily correspond to physical ones. An SVI is paired with a particular vlan. So, for example, you could have a VLAN 168, and you would assign ip address to that VLAN. The syntax to do this is:

(config)#interface vlan 168
(config-if)#ip address

You can repeat this for any number of vlans you want. So, for, say, VLAN 10:

(config)#interface vlan 10
(config-if)#ip address

Next, you can assign a particular physical switch port to a vlan, in this case Fa0/1 to VLAN 168

(config)#interface fa0/1
(config-if)#switchport mode access
(config-if)#switchport access vlan 168

Now, if you plug in a device to port Fa0/1, and configure it to use an IP in the range of - 192.168.1 254, it will be able to use the SVI for vlan 168 ( as its gateway to get elsewhere.

If you repeat this process by assigning another physical port to VLAN 10, configure a host plugged into that port in the range, then the hosts on ports 1 and 2 will be able to talk even though they are in different subnets.

1 Like

Users are only able to communicate within the same VLAN unless you use a router. Or MLS

Not sure I’d but this down as an advantage.

Depends on the situation. If you have a large number of computers, it is certainly an advantage to have a reduced size broadcast domain. Additionally, grouping similar users into the same VLANs, but separating different kinds of users/departments across VLANs gives you much more flexibility from a security standpoint.


A quick question about VLAN and ip assignment. Let’s say we have 3 offices. Can we do the same VLAN at different locations?

Paris HQ-

VLAN 10 guest -

Barcelona branch-

VLAN 10 guest -

Amsterdam branch-

VLAN 10 guest -

Can we deploy the upper design or should we do this–

Paris HQ-

VLAN 10 guest -

Barcelona branch-

VLAN 20 guest -

Amsterdam branch-

VLAN 30 guest -

VLAN information is carried within an 802.1Q tag (discounting Cisco’s legacy ISL), and 802.1Q tags are created on trunk ports. In most circumstances you will not have sites connected in such a way that 802.1Q tags can traverse the links between them, but it is possible. For example, there is a technology called MPLS ATOM that will allows direct layer 2 connectivity between sites.

So, in most circumstances this won’t matter, but since VLANs are just an arbitrary number, I would still ensure that each site has unique vlans to “future-proof” your design.

Thank you for information. Just wanted to make sure. So, this is the design I should go with?

Paris HQ-

VLAN 10 guest –

Barcelona branch-

VLAN 20 guest –

Amsterdam branch-

VLAN 30 guest –

In my opinion it is better to use different VLAN numbers even across sites. It appears as though your design has done that–so not knowing anything else about your network, yes, what have listed is better than using the same VLAN numbers everywhere.

1 Like

Thank you. Also lets say the network design is for some high frequency trading company and we have 2 data center in different location like one in Amsterdam and another in Barcelona. Both of them has same number of servers like trade execution, trade application, emergency trade, expert trade system etc. In this case what type of VLAN and addressing should we go for? I mean like this-

Option A

Vlan 100 - trade execution
vlan 101- trade application etc

vlan 110- trade execution
vlan 101- trade application etc


Option B

Vlan 100- trade execution, trade application etc

vlan 101- trade execution, trade application etc

There is simply not enough information to answer this question. Considerations like security, the number of devices in a vlan, and how the applications should communicate with each other all factor in. Keep in mind that in the NetworkLessons forum we do not give advice about how to design your network.

If you have a specific question about Lesson that you don’t understand, we are happy to help!

hi Rene,

I very basic doubt :
in above example - If many computers are connected to a Layer 2 switch (no vlans) , how the hosts will communicate with each other ? I mean will they have any IP address on them ? if yes what will be the gateway IP ?


In an ethernet network, where all computers are on the same subnet, all computer communication happens without the need for an IP gateway (which is only for communication off the subnet). I would recommend you read the lesson about Address Resolution Protocol (I have linked it here) which is responsible for translating the Layer 3 IP address to a Layer 2 MAC address.

All computers will have IP addresses, but they have no need for a gateway address, and they will ultimately use ARP and layer 2 for communication with each other.

Explanations are very much understandable to the depth with easy writings. Your lessons are a complete package to clear the basic concepts.