VLAN: segment your enterprise network

This article was machine-translated from French and is being reviewed. Prices are in Algerian dinars excl. VAT.

A VLAN (Virtual Local Area Network) is a virtual LAN. Defined by IEEE 802.1Q, it slices the same switches and cabling into several separate logical networks: one for offices, one for cameras, one for guests. Machines on different VLANs communicate only via a router or firewall, which can filter traffic. With manageable switches, it is an effective way to enhance security without duplicating cabling.

Why segment your network?

Security by isolation

If a desktop computer is infected, malware cannot reach cameras or servers directly if they are in other VLANs. To reach them it must pass through the firewall, which can deny access. Segmentation limits damage from an incident; it does not replace antivirus or updates.

Traffic control

You decide who talks to whom:

• Cameras only communicate with the recorder, not with computers.
• Guests access the Internet, not your internal data.
• The server has no outbound Internet access except what you allow (e.g., updates).

Less cabling

Instead of running a physical network per use, you use the same switches and cables, separating uses by VLAN. For cabling itself, see the price of an RJ45 point and Cat6 or Cat6A.

How a VLAN works

• Access port (access): the port belongs to a single VLAN. The connected device (PC, camera, printer) needs no configuration; it ignores the existence of the VLAN.
• Trunk port: the port carries multiple VLANs simultaneously, e.g., between two switches, to a firewall or Wi‑Fi access point. Each frame carries an 802.1Q tag of 4 bytes, containing the VLAN number in 12 bits. Usable numbers range from 1 to 4094.
• Native VLAN: on a trunk, this is the VLAN whose frames travel untagged. Both ends of the trunk must agree. Avoid using VLAN 1 or a used VLAN; reserve an unused VLAN (see limits below).
• Inter‑VLAN routing: only a layer‑3 device routes traffic from one VLAN to another. Either the firewall, which receives all VLANs via a trunk and has a gateway address per VLAN; or a layer‑3 switch, but if it routes without filtering rules the segmentation protects nothing.
• Managed switch required: an unmanaged switch (no configuration interface) does not support VLANs.

Example of an SME

Let’s take an agency of 15 people. Each VLAN has its subnet, with the firewall as gateway:

On a 24‑port managed PoE switch, the port assignment could be:

The access point emits an internal Wi‑Fi network attached to VLAN 10 and a guest network attached to VLAN 40. Some terminals require an untagged management address: check your documentation. PoE cameras need a switch whose PoE budget covers their consumption: see Wi‑Fi or wired PoE camera and price of a PoE IP installation.

For analog or HDCVI cameras connected to a coaxial XVR, nothing needs to be put in a VLAN on the camera side: only the XVR’s network port is involved (see IP or analog camera). Some recorders with integrated PoE ports already place cameras on a separate internal network.

Firewall rules between VLANs

Rules are read in order: the first matching rule applies. A stateful firewall allows return traffic for authorized connections, so creating a reverse rule is unnecessary.

If the recorder must sync to an Internet clock or be accessed remotely, allow it only to the Internet or, better, use a VPN (see also remote access to cameras). The regulation forbids connecting public structures’ CCTV systems or those filming open public spaces to the Internet (executive decree no. 09-410 amended by decree no. 16-61, art. 20 bis); check your situation before enabling remote access.

How to set up VLANs

Step 1: audit the existing setup

Note:

• Are your switches and router or firewall administrable and do they support 802.1Q? That is a manufacturer specification point. The shop references, for example, the GENATA GNT‑P5428GC, a 24‑port Gigabit PoE switch described as “manageable L2+”, at 65,000 DA HT (price on asloitech.com as of 06/11/2026, subject to availability). Verify 802.1Q support on the datasheet before purchase, and find other equipment in the network section of the shop.
• The devices connected to the network: computers, servers, cameras, printers, Wi‑Fi terminals.
• The data or devices that justify isolation.

Step 2: plan the VLANs

• One VLAN per truly distinct use (offices, servers, cameras, guests).
• A number per VLAN. A simple convention: 10, 20, 30, 40, with a subnet whose third octet is the VLAN number (192.168.10.0/24 for VLAN 10).
• A management VLAN (e.g., VLAN 99) for switch and terminal administration, reachable only from the administrator’s workstation.

Step 3: configure the switch

Here are two examples, to adapt to your equipment and test before production. The first concerns MikroTik, one of the two firewall brands we supply; the second, Cisco IOS, serves as a comparison.

MikroTik RouterOS 7 (switch with VLAN filtering), according to MikroTik documentation. ether1 is the trunk to the firewall, ether2 and ether3 are access ports of VLAN 10, ether4 an access port of VLAN 20, and VLAN 99 is for management:

``` /interface bridge add name=bridge1 frame-types=admit-only-vlan-tagged

/interface bridge port add bridge=bridge1 interface=ether1 frame-types=admit-only-vlan-tagged add bridge=bridge1 interface=ether2 pvid=10 frame-types=admit-only-untagged-and-priority-tagged add bridge=bridge1 interface=ether3 pvid=10 frame-types=admit-only-untagged-and-priority-tagged add bridge=bridge1 interface=ether4 pvid=20 frame-types=admit-only-untagged-and-priority-tagged

/interface bridge vlan add bridge=bridge1 tagged=ether1 vlan-ids=10 add bridge=bridge1 tagged=ether1 vlan-ids=20 add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=99

/interface vlan add interface=bridge1 vlan-id=99 name=MGMT /ip address add address=192.168.99.2/24 interface=MGMT

# Finally: enable VLAN filtering /interface bridge set bridge1 vlan-filtering=yes ```

Enable VLAN filtering last, from a backup access: an error on the management VLAN or trunk cuts switch access.

Switch Cisco IOS (syntax example, for comparison):

`` vlan 10 name BUREAUX vlan 20 name SERVEUR vlan 30 name CAMERAS vlan 40 name INVITES vlan 999 name NATIF-INUTILISE ! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 ! interface GigabitEthernet0/24 description To the firewall switchport trunk allowed vlan 10,20,30,40 switchport trunk native vlan 999 switchport mode trunk switchport nonegotiate ``

On some models, enter switchport trunk encapsulation dot1q before switchport mode trunk. D-Link and GENATA switches are configured via their web interface, with the same concepts: VLAN, access ports, trunk ports.

Step 4: IP addresses and DHCP

Each VLAN has its own subnet, and the firewall uses each gateway address. The firewall can be a MikroTik or a Fortinet FortiGate, the two brands we supply and install. For DHCP, two options: a DHCP server per VLAN on the firewall, or a central server with a DHCP relay on each VLAN interface. Assign static addresses to equipment that must be found (server, recorder, printer, access points).

Step 5: write firewall rules

Refer to the rule table above. End with a blanket deny, and log denials for the first days to spot an overlooked legitimate flow.

Step 6: test

Perform these tests at commissioning; AsloTech carries them out as part of acceptance testing:

• Can a host in VLAN 10 reach the server in VLAN 20? Yes, only on authorized services.
• Can an unauthorized host in VLAN 10 reach the recorder? No.
• Does a camera reach the Internet? No. Connect a temporary laptop to a camera port to check.
• Does a phone on the guest Wi‑Fi reach the Internet but not any internal address or firewall admin interface? Yes for Internet, no for the rest.

Best practices

• Document: a table with number, name, subnet, gateway and ports for each VLAN.
• Name: “VLAN 10 – Offices” is clear, just “VLAN 10” is not.
• Start simple: one VLAN per distinct use. Each added VLAN creates rules to write, test and maintain.
• Do not use VLAN 1 for your devices and choose an unused native VLAN.
• Disable unused switch ports.
• Back up the configuration of the switch and firewall after each change (see the rule 3‑2‑1).
• Keep a backup access before changing the trunk you are connected to.
• IP phones: a voice VLAN with traffic priority is common (see IP or analog telephone standard).

VLAN limits

A VLAN is not a magic solution:

• No encryption: traffic on a VLAN travels unencrypted over the cable. Anyone who plugs in physically can listen.
• No default authentication: anyone who plugs a computer into an access port of VLAN 10 enters that VLAN. Disable free ports and, depending on the switch, use 802.1X authentication or port locking (port security).
• Depends on filtering rules: a “allow all” rule between VLANs defeats segmentation. A layer‑3 switch that routes without rules does the same.
• VLAN hopping attacks: via trunk negotiation (switch spoofing) or double tagging through the native VLAN. Protect by setting access ports to access mode, disabling trunk negotiation and using an unused native VLAN.
• No protection inside a VLAN: an infected workstation reaches other workstations on the same VLAN.

Combine VLANs with a well‑configured firewall and a secure guest Wi‑Fi. To choose the gateway equipment, see MikroTik, Fortinet or Cisco.

Next steps

Check our page network security and firewall for a study of your network, and our page CCTV if cameras are your first isolation need. You can also read how to secure your guest Wi‑Fi to add a guest VLAN, or why a firewall is essential to set rules between VLANs. For housing switches and firewalls, see network rack.

Frequently asked questions

Also read