Sep 10

One Physical Switch, Multiple VLANs: How VLANs Work, How to Configure Them, and Where IP Subnets Fit In

One Physical Switch, Multiple VLANs: How VLANs Work, How to Configure Them, and Where IP Subnets Fit In

From AI tools as IS.

A single managed Ethernet switch can behave as though it were several independent switches.

This is the basic idea behind a VLAN — Virtual Local Area Network.

Suppose an organization has one 24-port switch. Without VLANs, all 24 ports could belong to the same Layer 2 network. Broadcast traffic generated by one device could potentially reach devices connected to all of the other ports.

With VLANs, the same physical switch can be divided logically:

                 One Physical Switch
        ┌──────────────────────────────┐
        │ Ports 1–8   → VLAN 10       │
        │ Ports 9–16  → VLAN 20       │
        │ Ports 17–23 → VLAN 30       │
        │ Port 24     → Trunk         │
        └──────────────────────────────┘

The result is similar to having three separate logical switches inside one physical device.

VLAN 10        VLAN 20        VLAN 30
Staff          Accounting     Guests
   │               │             │
   └──────── One Physical Switch ┘

The important question is: what actually creates the separation?

It is not the VLAN name. It is not the IP address. It is the VLAN ID and the switch configuration.

What Actually Separates One VLAN From Another?

Each VLAN has a numerical identifier.

For example:

VLAN 10
VLAN 20
VLAN 30

Names can optionally be attached:

VLAN 10 = STAFF
VLAN 20 = ACCOUNTING
VLAN 30 = GUESTS

But the names are only for administrators.

The actual distinction is:

VLAN ID 10 ≠ VLAN ID 20 ≠ VLAN ID 30

The switch maintains separate Layer 2 forwarding environments for the different VLANs.

If Port 1 belongs to VLAN 10 and Port 10 belongs to VLAN 20, traffic does not simply flow between those ports merely because they are on the same physical switch.

A broadcast arriving in VLAN 10 remains in VLAN 10.

PC-A
 │
 │ VLAN 10 broadcast
 ▼
Switch
 ├── VLAN 10 devices receive it
 └── VLAN 20 devices do NOT receive it

This is why each VLAN is normally described as a separate Layer 2 broadcast domain.

How Does a Switch Know Which VLAN a Device Belongs To?

For an ordinary user device, the administrator typically assigns the physical switch port to a VLAN.

For example:

Port 1 → VLAN 10
Port 2 → VLAN 10
Port 3 → VLAN 10

Port 4 → VLAN 20
Port 5 → VLAN 20

These ports are commonly called access ports.

A computer connected to an access port normally does not need to know anything about VLAN tagging.

The computer sends a normal Ethernet frame.

The switch already knows:

Frame entered Port 1
Port 1 belongs to VLAN 10
Therefore this frame belongs to VLAN 10

The VLAN membership is being enforced by the switch.

How Are VLANs Created?

On a managed switch, VLANs are normally created through one of several management mechanisms:

  • command-line interface;
  • web interface;
  • centralized network controller;
  • cloud management platform;
  • network-management API.

For example, on a Cisco-style command-line interface:

vlan 10
 name STAFF

vlan 20
 name ACCOUNTING

vlan 30
 name GUESTS

Then ports can be assigned to the VLANs.

For example:

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10

Another port could be placed into VLAN 20:

interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 20

The exact commands vary by manufacturer, but the concept is essentially the same.

The administrator:

creates a VLAN ID → assigns ports → optionally assigns a name → optionally configures Layer 3 addressing.

Does Creating a VLAN Require an IP Address?

No.

This is one of the most important facts about VLANs:

A VLAN can exist without any IP address.

VLANs operate primarily at Layer 2.

Ethernet switches can forward Ethernet frames based on MAC addresses without IPv4 or IPv6 being present.

For example:

PC-A ─ Port 1 ─┐
               │ VLAN 10
PC-B ─ Port 2 ─┘

PC-A and PC-B could exchange Layer 2 Ethernet frames even if neither has an IP address.

The VLAN still exists.

The switch still keeps its traffic separate from VLAN 20.

Does the Switch Need an IP Address?

A basic Layer 2 switch does not need an IP address to switch frames.

It can perform:

MAC learning
        ↓
MAC table lookup
        ↓
Ethernet frame forwarding

without an IP address assigned to the switch itself.

However, a managed switch normally has a management IP address so an administrator can remotely access it using technologies such as:

SSH
HTTPS
SNMP
Network controller

That IP address is for managing the switch.

It is not what makes Layer 2 switching possible.

A switch could even be configured through a local console connection without having an IP address at all.

Does a VLAN Require IP Subnetting?

No.

Creating VLANs and creating IP subnets are two separate operations.

A VLAN belongs to Layer 2:

VLAN 10

An IP subnet belongs to Layer 3:

192.168.10.0/24

Therefore:

Subnetting does not create VLANs, and VLAN creation does not automatically create IP subnets.

They are separate concepts.

But in ordinary modern IP networks, they are normally used together.

The Normal Design: One VLAN, One IP Subnet

A common design is:

VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24

This means:

          Layer 2                 Layer 3

VLAN 10 ───────────────→ 192.168.10.0/24

VLAN 20 ───────────────→ 192.168.20.0/24

VLAN 30 ───────────────→ 192.168.30.0/24

This is normally the best and cleanest design.

It gives each Layer 2 broadcast domain its own Layer 3 network.

VLAN and Subnet Are Not the Same Thing

They are often paired so closely that it is tempting to think they are identical.

They are not.

VLANIP Subnet
Layer 2 conceptLayer 3 concept
Divides Ethernet networksDivides IP address space
Uses VLAN IDsUses network prefixes
Example: VLAN 10Example: 192.168.10.0/24
Determines broadcast domainDetermines which IP addresses are on-link
Enforced mainly by switchesUsed by hosts and routers

A useful way to remember it is:

VLAN tells Ethernet which Layer 2 network a device belongs to.

Subnet tells IP which Layer 3 network an address belongs to.

Can a VLAN Work Without IP?

Absolutely.

For example:

VLAN 50

may contain equipment communicating through some Layer 2 protocol without using IPv4 or IPv6.

Ethernet itself does not require IP.

A VLAN can also exist simply because an administrator has created it, even if no devices are currently connected.

So this is perfectly possible:

VLAN 10
Ports 1–4
No IP addresses

The Layer 2 separation still exists.

What Changes Once IP Is Introduced?

Suppose VLAN 10 contains:

PC-A
IP: 192.168.10.10/24

PC-B
IP: 192.168.10.20/24

Both belong to:

VLAN 10
Subnet 192.168.10.0/24

Communication is straightforward.

PC-A sees that 192.168.10.20 belongs to its own subnet.

It uses ARP to discover PC-B’s MAC address.

Conceptually:

PC-A:

Who has 192.168.10.20?

The ARP request is an Ethernet broadcast.

Because PC-B is in the same VLAN, it receives the request.

PC-B responds with its MAC address.

PC-A can then send:

Ethernet:
Destination MAC = PC-B

IP:
Destination IP = 192.168.10.20

The Layer 2 switch forwards the frame based primarily on the destination MAC address.

No router is needed.

What If Two VLANs Use Different IP Networks?

This is the normal design.

For example:

VLAN 10
192.168.10.0/24

and:

VLAN 20
192.168.20.0/24

Suppose:

PC-A = 192.168.10.10

needs to communicate with:

PC-B = 192.168.20.20

PC-A realizes:

192.168.20.20 is NOT in my subnet

Therefore, it sends the packet to its default gateway.

That gateway might be:

192.168.10.1

located on a router or Layer 3 switch.

The path becomes:

PC-A
VLAN 10
192.168.10.10
       │
       ▼
Layer 3 Switch / Router
       │
       ▼
PC-B
VLAN 20
192.168.20.20

This is called inter-VLAN routing.

What If Two Separate VLANs Use the Same IP Subnet?

This is where problems begin.

Suppose:

VLAN 10
PC-A = 192.168.1.10/24

and:

VLAN 20
PC-B = 192.168.1.20/24

Both devices believe they belong to:

192.168.1.0/24

PC-A wants to reach:

192.168.1.20

It checks its subnet mask and concludes:

“That device is on my local network. I don’t need my router.”

So PC-A sends an ARP broadcast:

Who has 192.168.1.20?

But that broadcast exists in:

VLAN 10

PC-B is in:

VLAN 20

VLAN boundaries prevent the broadcast from crossing.

PC-B therefore never receives the ARP request.

PC-A cannot learn PC-B’s MAC address.

Communication normally fails.

Why Doesn’t the Router Fix It?

Because PC-A does not initially send the packet to the router.

PC-A believes:

192.168.1.20 = local address

So it tries direct Layer 2 delivery.

That is exactly what the subnet mask tells a host to do.

The host effectively thinks:

Same subnet
    ↓
Find destination MAC
    ↓
Send directly

But VLAN separation prevents the necessary Layer 2 discovery.

This creates a mismatch:

IP says:       SAME NETWORK

VLAN says:     DIFFERENT LAYER 2 NETWORK

That is why spreading the same ordinary IP subnet across separate, non-bridged VLANs is normally a bad design.

Could Special Technologies Make It Work?

Yes.

There are specialized techniques involving:

  • proxy ARP;
  • Layer 2 bridging;
  • overlays;
  • stretched VLANs;
  • certain data-centre architectures;
  • specialized gateways.

But those are exceptions.

They do not change the fundamental design recommendation:

Separate VLANs should normally use separate IP subnets.

What If One VLAN Contains Multiple IP Subnets?

Interestingly, the reverse is technically possible.

Suppose one VLAN contains devices from:

192.168.10.0/24

and:

192.168.20.0/24

Both groups exist inside the same Layer 2 broadcast domain.

This can be made to work.

For example, a router or Layer 3 switch could have gateway addresses for both subnets.

But it is usually undesirable.

Why?

Because the Layer 2 and Layer 3 boundaries no longer match.

You might have:

           ONE VLAN
              │
      ┌───────┴───────┐
      │               │
192.168.10.0/24   192.168.20.0/24

Both groups share the same Ethernet broadcasts, even though they are logically separate IP networks.

This can make:

  • troubleshooting harder;
  • DHCP design more complicated;
  • security policies less intuitive;
  • network documentation confusing;
  • broadcast domains unnecessarily large.

So although it can work:

Multiple subnets inside one VLAN are normally avoided unless there is a specific operational reason.

The Cleanest Design

The most predictable architecture is:

VLAN 10
      │
      └── 192.168.10.0/24

VLAN 20
      │
      └── 192.168.20.0/24

VLAN 30
      │
      └── 192.168.30.0/24

This creates matching boundaries:

Layer 2 boundary
       =
Layer 3 boundary

Operationally, that is much easier to understand.

Where Does a Layer 3 Switch Fit In?

A Layer 2 switch can create VLANs and switch frames within them.

But it cannot normally route traffic between different IP subnets.

A Layer 3 switch can do both.

For example:

        Layer 3 Switch
       /       |       \
      /        |        \
 VLAN 10    VLAN 20    VLAN 30
    │           │          │
192.168.10   192.168.20   192.168.30
 .0/24        .0/24        .0/24

The Layer 3 switch can create a logical Layer 3 interface for each VLAN.

These are commonly called SVIs — Switched Virtual Interfaces.

For example:

VLAN 10 gateway = 192.168.10.1
VLAN 20 gateway = 192.168.20.1
VLAN 30 gateway = 192.168.30.1

Then the switch can perform routing between the VLANs.

One Switch Can Therefore Perform Two Different Jobs

A Layer 3 switch might handle traffic in two different ways.

When two devices are in the same VLAN:

PC-A → Layer 2 switching → PC-B

The switch primarily uses MAC addresses.

When devices are in different VLANs/subnets:

PC-A
   ↓
Layer 3 routing
   ↓
PC-C

the switch examines IP addresses and performs routing.

So the same physical device can perform:

Layer 2 switching
+
Layer 3 routing

What About VLANs Across Multiple Switches?

VLANs are not limited to one physical switch.

Suppose:

Switch A                  Switch B
---------                 ---------
VLAN 10                   VLAN 10
VLAN 20                   VLAN 20
VLAN 30                   VLAN 30

One physical connection between the switches can carry traffic from several VLANs.

This is normally done using a trunk.

Switch A
   │
   │  VLAN 10
   │  VLAN 20
   │  VLAN 30
   │
   │  Trunk
   │
Switch B

Ethernet frames travelling across a trunk commonly contain an IEEE 802.1Q VLAN tag.

Conceptually:

Ethernet Frame

Destination MAC
Source MAC
VLAN ID = 20
Payload

The VLAN ID tells the receiving switch which logical network the frame belongs to.

Multiple VLANs can therefore share the same physical cable while remaining logically separated.

Access Port vs. Trunk Port

These two terms are fundamental.

An access port normally carries traffic for one VLAN and connects to an ordinary end device:

PC
 │
 │ Access port
 │ VLAN 10
 ▼
Switch

A trunk port normally carries multiple VLANs:

Switch
   │
   │ VLAN 10
   │ VLAN 20
   │ VLAN 30
   │
   ▼
Switch

Trunks are commonly used between:

  • switches;
  • switches and routers;
  • switches and servers;
  • switches and virtualization hosts;
  • switches and wireless infrastructure.

Why Use Multiple VLANs on One Switch?

Consider an office with employees, servers, security cameras, and guests.

Without VLANs:

Employees
Servers
Guests
Cameras
      │
      ▼
One large Layer 2 network

With VLANs:

VLAN 10 → Employees
VLAN 20 → Servers
VLAN 30 → Guests
VLAN 40 → Cameras

The organization gains logical separation without purchasing four completely separate sets of switches.

It can also apply different:

  • security policies;
  • firewall rules;
  • routing policies;
  • DHCP configurations;
  • access controls.

For example:

Employees → Servers       ALLOW

Guests → Internet         ALLOW

Guests → Servers          BLOCK

Cameras → Camera Server   ALLOW

Cameras → Employee PCs    BLOCK

VLANs provide the Layer 2 separation, while routers, Layer 3 switches, and firewalls provide controlled communication between the resulting networks.

Could We Simply Avoid IP Completely?

Yes, technically.

You could have:

VLAN 10
VLAN 20
VLAN 30

with no IPv4 or IPv6 configured.

The Ethernet segmentation would still exist.

But most modern corporate applications depend on IP.

Without IP, devices generally cannot participate normally in:

  • web applications;
  • Internet access;
  • DNS;
  • email;
  • cloud applications;
  • most client/server applications.

So although VLANs do not technically require IP, practical modern enterprise VLANs are normally paired with IPv4 and/or IPv6 subnets.

Which Design Is Best?

For an ordinary modern IP network, the preferred design is generally:

ONE VLAN
   ↓
ONE IP SUBNET
   ↓
ONE LAYER 3 GATEWAY

For example:

VLAN 10
192.168.10.0/24
Gateway 192.168.10.1
VLAN 20
192.168.20.0/24
Gateway 192.168.20.1
VLAN 30
192.168.30.0/24
Gateway 192.168.30.1

This aligns:

Layer 2 segmentation

with:

Layer 3 addressing

and makes routing predictable.

Which Alternatives Create Problems?

The four basic possibilities can be summarized this way:

DesignPossible?Usually recommended?
VLAN with no IP subnetYesYes for special Layer 2 purposes
One VLAN + one subnetYesBest normal design
One VLAN + multiple subnetsYesUsually no
Multiple isolated VLANs + same subnetNormally problematicAvoid

The problematic case is particularly important:

VLAN 10 ─┐
         ├── 192.168.1.0/24   ← BAD NORMAL DESIGN
VLAN 20 ─┘

because IP believes the devices are local to one another while Ethernet has separated their broadcasts.

The cleaner design is:

VLAN 10 → 192.168.10.0/24

VLAN 20 → 192.168.20.0/24

Now Layer 2 and Layer 3 agree.

Does Using the Same IP Subnet Across VLANs Cause “Chaos”?

“Chaos” may be an informal word, but it captures the practical problem reasonably well.

Several confusing symptoms can result:

ARP failures. Devices believe another address is local but cannot reach its Layer 2 broadcast domain.

IPv6 Neighbor Discovery failures. IPv6 has a similar local-neighbour discovery requirement.

Intermittent connectivity. Depending on gateways and special configurations, some communication may appear to work while other communication fails.

DHCP confusion. Separate VLANs typically require appropriate DHCP scopes and relay configuration.

Duplicate addresses. Administrators may accidentally reuse addresses because the VLANs appear isolated.

Difficult troubleshooting. IP addressing suggests one topology while the actual Layer 2 topology says something different.

Good network architecture tries to make different layers reinforce rather than contradict each other.

The Three Boundaries to Keep Separate

A useful mental model is:

Physical boundary

Which cable or switch port is being used?

Physical switch port

Layer 2 boundary

Which VLAN does the frame belong to?

VLAN ID

Layer 3 boundary

Which IP subnet does the address belong to?

IP network prefix

These are three different questions.

For example:

Physical Port 5
       ↓
VLAN 20
       ↓
192.168.20.0/24

They are related by configuration, but they are not inherently the same thing.

A Complete Example

Suppose one physical switch serves three departments.

              ONE PHYSICAL SWITCH

       ┌──────────────────────────┐
       │                          │
       │ VLAN 10                  │
       │ Staff                    │
       │ 192.168.10.0/24          │
       │                          │
       │ VLAN 20                  │
       │ Accounting               │
       │ 192.168.20.0/24          │
       │                          │
       │ VLAN 30                  │
       │ Guests                   │
       │ 192.168.30.0/24          │
       │                          │
       └────────────┬─────────────┘
                    │
               Layer 3
               Routing
                    │
                Firewall
                    │
                 Internet

Ports might be configured as:

Ports 1–8   → VLAN 10
Ports 9–16  → VLAN 20
Ports 17–23 → VLAN 30
Port 24     → uplink/trunk

IP addressing could be:

VLAN 10
192.168.10.0/24
Gateway: 192.168.10.1
VLAN 20
192.168.20.0/24
Gateway: 192.168.20.1
VLAN 30
192.168.30.0/24
Gateway: 192.168.30.1

Within each VLAN:

Layer 2 switching and MAC addresses handle local Ethernet delivery.

Between VLANs:

Layer 3 routing and IP addresses handle communication.

Toward external networks:

routers/firewalls provide connectivity and security.

Final Thought

A single managed Ethernet switch can support many VLANs because a VLAN is a logical Layer 2 boundary rather than a separate physical switch.

The separation is created through:

VLAN IDs + switch-port assignments + VLAN tags where required.

It does not depend on the VLAN name.

It does not depend on IP addressing.

And it does not require subnetting simply to exist.

However, once ordinary IP communication is introduced, the cleanest architecture is normally:

One VLAN → one IP subnet → one Layer 3 gateway.

A VLAN can exist without IP.

A subnet can exist without a VLAN.

One VLAN can technically contain multiple subnets.

Special technologies can even stretch addressing in unusual ways.

But for ordinary networks, matching one subnet to one VLAN avoids unnecessary complexity.

The key is to keep the layers conceptually separate:

VLAN controls Layer 2 membership and broadcasts.

Subnet controls Layer 3 IP addressing.

Switches forward Ethernet frames within VLANs.

Routers or Layer 3 switches route IP packets between subnets.

When those boundaries are designed to match each other, the network becomes much easier to understand, operate, secure, and troubleshoot.

Leave a Reply