Network segmentation divides a network into smaller logical or physical parts, limiting communication scope while improving security and performance. Subnets segment at Layer 3; VLANs segment a LAN at Layer 2. section 12.0 section 12.5
VLAN-based segmentation works through:
- VLANs divide one broadcast domain into multiple broadcast domains, like dividing a physical switch into virtual switches. section 12.5
- Access ports carry traffic for one untagged VLAN; trunk ports carry multiple VLANs using IEEE 802.1Q tags. section 12.5
- Hosts in different VLANs cannot communicate through Layer 2 forwarding alone; routing between VLANs requires a router or multilayer switch. section 12.0 section 12.5
Configuration check
Use show vlan brief to inspect VLANs and port membership. Create a VLAN with vlan vlan-id, name it with name vlan-name, and assign an access port with switchport mode access followed by switchport access vlan vlan-id. section 12.5
