1. The Story
Press "Next" to go through it step by step. At each step, a character steps forward and explains what they are doing.
Prologue: a quick recap
Step 1 of 11
One LAN, one Broadcast Domain
Every device plugged into me is in the same LAN (Local Area Network). When I get a Broadcast, I send it out of every other Port. That area is called the Broadcast Domain.
Animation text version (all steps)
- Prologue: a quick recap
- One LAN, one Broadcast Domain · Octo: Every device plugged into me is in the same LAN (Local Area Network). When I get a Broadcast, I send it out of every other Port. That area is called the Broadcast Domain.
- Act 1: The guests arrive
- Two guests plug in · Mac: Two guests have come to visit and plugged their laptops into Octo's P5 and P6 to get online. Welcome! But... now they're in the same LAN as us.
- Everyone gets the guest's Broadcast · Pip: Guest PC 1 sends an ARP (Address Resolution Protocol) Broadcast. Octo follows the rules and sends it out of every Port, so Mac, the desktop PC and the TV all receive it!
- Is this safe? · Mac: The guests' computers can see every device in our home, and could even try to open my shared folder. If one has a virus, it could come straight after us. Can we keep the guests separate?
- Problem 1: Privacy - everyone can see everyone
- Problem 2: Security - a virus can go straight after home devices
- Problem 3: Efficiency - more Broadcasts keep everyone busier
- Act 2: Enter the VLAN
- Octo puts up a screen · Octo: No need to buy another Switch! I'll group my Ports: P1 to P3 are the family zone, VLAN 10, and P5 and P6 are the guest zone, VLAN 20. This is called a VLAN (Virtual LAN), and each zone is a separate LAN.
- V10 = VLAN 10 (family zone); V20 = VLAN 20 (guest zone)
- A Port that connects an ordinary device and belongs to one VLAN is called an Access Port
- The computer doesn't know its VLAN; Octo decides by Port
- Broadcasts stay in their own zone · Pip: Guest PC 1 sends another Broadcast. This time Octo only sends me to P6, which is also in VLAN 20. The family zone doesn't get it at all!
- Same for the family zone · Pip: When Mac sends a Broadcast, I only go to the desktop PC and the TV. Now there are two completely separate Broadcast Domains inside one Switch.
- Cross zones? No way through · Octo: Guest PC 1 wants to send a Frame straight to Mac. But Mac is in VLAN 10. I can't find him in my VLAN 20 notebook, and I won't send the Frame over.
- Different VLAN = different LAN
- If the recipient isn't found, it is flooded only within VLAN 20 (e.g. to P6); Mac never gets it
- To talk across zones, go through a Router, where rules can be set (Story 10)
- A new column in the notebook · Octo: With VLANs, my MAC Address Table gets an extra "VLAN" column. When delivering, I only look for the recipient in that VLAN's records. Mac to the TV? Got it! Delivering to the right port right now!
- VLAN 10:
…:01→ P1,…:04→ P2,…:02→ P3 - VLAN 20:
…:05→ P5,…:06→ P6
- VLAN 10:
- One VLAN, one Subnet · Mac: Each zone usually gets its own range of IP Addresses too: the family zone is
192.168.1.0/24and the guest zone is192.168.20.0/24. One VLAN is one network.- Family zone VLAN 10:
192.168.1.0/24(Mac192.168.1.10) - Guest zone VLAN 20:
192.168.20.0/24(Guest PC 1192.168.20.10)
- Family zone VLAN 10:
- Wrap-up: one house, two zones · Octo: With just one Switch and no rewiring, I split the home into two zones. But there's another Switch upstairs with family and guest devices too. How many cables do we need between the two Switches? Find out in the next story!
- VLAN: splits one Switch's Ports into separate LANs
- Broadcasts and Frames only travel within the same VLAN
- Crossing VLANs needs a Router
2. Where Is the Problem
Devices plugged into the same Switch are all in the same LAN (Local Area Network). That also means they share one Broadcast Domain: the area a Broadcast Frame can reach.
When guests plug their computers into Octo, three problems appear:
| Problem | What happens |
|---|---|
| Privacy | A guest's ARP (Address Resolution Protocol) Broadcast reaches every device in the home, so everyone can see everyone else |
| Security | A guest's computer can try to open Mac's shared folder; if it has a virus, it can go straight after the home devices |
| Efficiency | More devices means more Broadcasts, and every device has to spend time handling them |
The most obvious fix is to buy a separate Switch for the guests and run a whole new set of cables. But that is expensive and a hassle, and every time you want to change the groups, you have to rewire.
3. How the Network Solves It
It's like putting a folding screen in the living room to split one house into a family zone and a guest zone. It's still the same house, but people in the two zones can't see or hear each other.
A VLAN (Virtual LAN) groups the Ports of one Switch so that each group becomes a separate LAN. Broadcasts and Frames only travel within the same VLAN.
No new Switch, no rewiring: just change a few settings.
4. A Closer Look
Octo's Port groups
Each VLAN is identified by a number called the VLAN ID. In the story, Octo is set up like this:
| Port | Connected to | VLAN |
|---|---|---|
| P1 | Mac | 10 (family zone) |
| P2 | Desktop PC | 10 (family zone) |
| P3 | TV | 10 (family zone) |
| P4 | Access Point (family phones) | 10 (family zone) |
| P5 | Guest PC 1 | 20 (guest zone) |
| P6 | Guest PC 2 | 20 (guest zone) |
A Port like this, which connects an ordinary device and belongs to just one VLAN, is called an Access Port.
Note: the computer itself has no idea which VLAN it is in. It sends out an ordinary Frame, and Octo decides which VLAN it belongs to based on "which Port did this Frame come in on".
A VLAN ID is a 12-bit number, and the usable range is 1 to 4094. Many Switches come from the factory with every Port in VLAN 1 by default.
The settings look roughly like this
Different brands write it differently. Here is one common way to make P5 an Access Port in VLAN 20:
vlan 20
name guest
interface P5
switchport mode access
switchport access vlan 20
(On real equipment, the interface name would be something like GigabitEthernet0/5. We use P5 here so it's easy to match up.)
A new column in the notebook
With VLANs, Octo's MAC Address Table gets an extra "VLAN" column:
| VLAN | MAC Address | Port | Device |
|---|---|---|---|
| 10 | 00:00:5E:00:53:01 |
P1 | Mac |
| 10 | 00:00:5E:00:53:04 |
P2 | Desktop PC |
| 10 | 00:00:5E:00:53:02 |
P3 | TV |
| 20 | 00:00:5E:00:53:05 |
P5 | Guest PC 1 |
| 20 | 00:00:5E:00:53:06 |
P6 | Guest PC 2 |
Octo's rules are the same as before: Learning, Flooding and Forwarding. The only difference is that everything happens inside the same VLAN:
- Flooding: only goes to the other Ports in the same VLAN.
- Forwarding: Octo only looks for the recipient in that VLAN's records. If Guest PC 1 (VLAN 20) sends a Frame to Mac, Octo can't find Mac in the VLAN 20 records. At most, he floods it within VLAN 20. It will never reach a VLAN 10 Port.
One VLAN, one Subnet
Each VLAN is a separate LAN, and it usually gets its own range of IP Addresses too:
| VLAN | Name | Subnet | Example |
|---|---|---|---|
| 10 | Family zone | 192.168.1.0/24 |
Mac 192.168.1.10 |
| 20 | Guest zone | 192.168.20.0/24 |
Guest PC 1 192.168.20.10, Guest PC 2 192.168.20.11 |
A VLAN splits up the LAN at Layer 2, while a Subnet splits up IP Addresses at Layer 3. They are different things, but they are usually paired one to one.
Crossing VLANs means going through a Router
Different VLANs are different networks. To talk to each other, traffic has to be passed along by a Router or a Layer 3 Switch. This is called Inter-VLAN Routing, and Story 10 covers it in detail.
The bonus: the Router can have rules, such as "the guest zone can use the Internet but can't connect to the family zone".
Back to guest Wi-Fi
Many Access Points can broadcast several SSIDs (Wi-Fi network names) and map each SSID to a VLAN. For example, "Mac's Home" → VLAN 10 and "Mac's Home - Guest" → VLAN 20.
A phone on the guest Wi-Fi is like a device plugged into a guest-zone Port: it can use the Internet but can't see the computers in your home. The "guest network" feature on home routers uses a similar kind of separation.
5. Try It Yourself
Mission: find the "guest network"
- Look at the label under your home Wi-Fi router. Find the address of its admin page (usually something like
192.168.1.1) and how to log in. - Once you're logged in, look for an option called "Guest Network" (the name depends on the brand).
- See if there's a setting like "Allow guests to access the local network". Think about it: if you turn it off, can guests still open your shared folder?
If you're not the one who manages the router, ask your family first and don't change settings on a whim.
Mini game
Where will Octo send the Frame?
Octo has set P1 to P3 as VLAN 10, and P5 and P6 as VLAN 20. In each case below, where does the Frame end up?
-
1Mac (P1) sends a Broadcast
-
2Guest PC 1 (P5) sends a Broadcast
-
3Mac (P1) sends a Frame to the TV (P3)
-
4Guest PC 1 (P5) sends a Frame directly to Mac (P1)
-
5Guest PC 2 (P6) sends a Frame to Guest PC 1 (P5)
-
6Mac (P1) sends a Frame directly to Guest PC 2 (P6)
All sorted correctly! Within the same VLAN, delivery works as usual. Different VLANs are different LANs, so the Switch won't pass Frames between them directly. They have to go through a Router.
6. Where the Analogy Breaks
- The screen isn't a real object. A VLAN is just a grouping setting in Octo's memory. The Ports and cables don't change at all, which is why it's called a "virtual" LAN.
- The screen isn't an all-purpose security guard. If the VLAN settings are wrong (for example, a guest Port is put in the wrong VLAN), the separation stops working. Important networks also need other protection, such as a Firewall.
- The two zones aren't completely cut off. They can talk across VLANs through a Router, and rules decide what is allowed. The screen only blocks "direct" Frames.
- One Switch can be split into many zones. The story only uses two, but in real life one Switch can have dozens or even hundreds of VLANs.
- Octo isn't the only device that can be set up with VLANs. A VLAN can stretch across several Switches, and Access Points and Routers understand VLANs too. How they tell which VLAN each Frame belongs to is the topic of the next story.
7. Quiz
8. Key Notes
- A VLAN (Virtual LAN) splits the Ports of one Switch into groups. Each group is a separate LAN, which means a separate Broadcast Domain.
- A Port that connects an ordinary device and belongs to just one VLAN is called an Access Port. The device itself doesn't know which VLAN it is in.
- The Switch's Learning, Flooding and Forwarding all happen only within the same VLAN.
- One VLAN usually matches one Subnet. Crossing VLANs means going through a Router, where rules can be set.
- The guest Wi-Fi can't see the computers in your home because it is placed in a different VLAN (or a similar separated network).
Further reading
Just by changing settings, Octo split one house into a family zone and a guest zone. But there's another Switch upstairs, with family and guest devices too. Do we need to run one cable per VLAN between the two Switches? In the next story, we'll see how one cable can carry many zones: Trunks and 802.1Q Tags.