What is a VLAN?

A VLAN (Virtual LAN) is a logical Layer 2 network carved out within the same physical switch infrastructure. It lets you split a single switch or an entire network into many independent broadcast domains, as if they were separate, physically isolated LANs. Hosts in different VLANs cannot see each other's Layer 2 traffic and only communicate through Layer 3 routing. The standard for tagging frames with VLAN membership is IEEE 802.1Q.

L2 segmentation and broadcast domains

Without VLANs, an entire switched segment forms one broadcast domain: broadcast frames and unknown unicasts reach every port. VLANs divide that domain into smaller parts, which limits the reach of broadcasts, isolates faults and tidies up security policy. Each VLAN is a separate Layer 2 segment and usually a separate IP subnet, and traffic between them must pass through a router or an L3 switch.

• Smaller broadcast domains cut broadcast noise and host resource use.
• Isolation: one group's traffic (e.g. management, guests, servers) does not mix with another's.
• Security: filtering and policy are applied at the boundary between VLANs in Layer 3.
• Flexibility: VLAN membership is logical and independent of where ports physically sit.

802.1Q tagging

IEEE 802.1Q inserts a 4-byte tag into the Ethernet frame header carrying a VLAN identifier. The VID field is 12 bits, giving 4096 values. IDs 0 and 4095 are reserved and 1 is the default VLAN, so the range from 1 to 4094 remains usable. The tag also contains a 3-bit priority field (PCP, per 802.1p) for QoS. Untagged frames belong to the native VLAN. For more segments or carrier-grade tagging, 802.1ad (QinQ) adds a second, outer tag.

Access ports and trunks

An access port belongs to a single VLAN and carries untagged traffic to the attached end device, which needs to know nothing about VLANs. A trunk port carries traffic for many VLANs over one link, tagged with 802.1Q, and is used to connect switches to one another and to routers and hypervisors. On a trunk one VLAN can be configured as native and sent untagged. A native VLAN mismatch on the two ends is a common source of faults.

VLANs and AS202520 SkyPass

VLANs and 802.1Q trunks are fundamental to how AS202520 SkyPass delivers services. We typically provision BGP sessions, IP transit and remote access to Polish exchanges (THINX, TPIX, WRIX, 1-IX) as dedicated VLANs on the customer port or on a cross-connect in our Warsaw and Wrocław PoPs. That keeps peering, transit and management traffic logically separated over the same physical link.