The simple version
Without VLANs, every device plugged into your switches, or on your Wi-Fi, sits on one flat network. The guest's laptop, the lobby camera, the smart TV and the accounting PC can all see each other. If one of them is infected, it can try to reach all the others.
A VLAN (virtual local area network) draws walls inside that network using the switches you already have. Each VLAN behaves like its own separate network, even though it shares the same cables and switches.
How it works
Each switch port and each Wi-Fi network is assigned to a VLAN. When traffic needs to travel between switches, it's tagged with its VLAN number using the IEEE 802.1Q standard, so the next switch knows which network it belongs to. The standard allows up to 4,094 VLANs, far more than any office needs.
Traffic between VLANs has to go through your firewall or a router, which is where you decide what's allowed. For example: staff can print to the printer VLAN, but guests can't reach anything except the internet.
A typical office layout
| VLAN | What's on it | What it can reach |
|---|---|---|
| Staff | Company laptops and desktops | Servers, printers, internet |
| Voice | Desk phones | Phone system and its provider |
| Cameras | Security cameras and recorder | Recorder only, plus approved remote viewing |
| Guest | Visitors' devices | Internet only |
| Management | Switches, access points, firewall | IT administrators only |
Why it matters
- Security. A compromised camera or guest device can't reach your business systems.
- Performance. Broadcast traffic stays within each VLAN instead of reaching every device.
- Voice quality. Phones on their own VLAN are easier to prioritize.
- Compliance. Card readers and sensitive systems can be kept separate, which many security frameworks expect.
Do you need managed switches?
Yes. VLANs need managed switches and a firewall that understands them. Unmanaged switches from an office supply store can't do it. If your network was built with consumer gear, adding VLANs usually means replacing the switches, which is a good time to look at Meraki or FortiGate with FortiSwitch.
Sources
Technical figures checked against the sources above. Standards and product details change; confirm with the manufacturer for your equipment.
