Vlans - blame None – Fire Secure UK

Blame

148ec1	R. Bishop	2025-03-07 22:37:20	1	# Understanding VLANs (Virtual Local Area Networks)
			2
			3	## What is a VLAN?
			4
			5	A VLAN (Virtual Local Area Network) is a logical network segmentation technique that allows devices on different physical networks to communicate as if they were on the same LAN. VLANs improve network efficiency, security, and scalability by isolating traffic without requiring separate physical infrastructure.
			6
			7	---
			8
			9	## Why Use VLANs?
			10
			11	### 1. Improved Network Performance
			12	- Reduces network congestion by limiting broadcast domains.
			13	- Enhances data flow efficiency in large networks.
			14
			15	### 2. Increased Security
			16	- Isolates sensitive data from unauthorized users.
			17	- Prevents broadcast storms and unauthorized access.
			18
			19	### 3. Better Network Management & Scalability
			20	- Allows network administrators to logically group devices.
			21	- Simplifies adding or moving devices without rewiring.
			22
			23	### 4. Enhanced Traffic Control
			24	- Enables Quality of Service (QoS) for prioritizing data traffic.
			25	- Ensures critical applications get priority bandwidth.
			26
			27	---
			28
			29	## How VLANs Work
			30
			31	VLANs function by tagging network traffic with an identifier (VLAN ID) to separate it from other traffic on the same physical switch.
			32
			33	### 1. VLAN Tagging (IEEE 802.1Q)
			34	- Adds a 4-byte VLAN header to Ethernet frames.
			35	- Helps switches identify which VLAN traffic belongs to.
			36
			37	### 2. VLAN Types
			38	\| VLAN Type \| Function \| Use Case \|
			39	\|--------------\|------------\|-------------\|
			40	\| Default VLAN \| All switch ports belong to this VLAN by default \| General network traffic \|
			41	\| Data VLAN \| Segregates user traffic from management data \| Corporate networks \|
			42	\| Voice VLAN \| Prioritizes VoIP traffic to reduce latency \| IP Telephony \|
			43	\| Management VLAN \| Isolates network control traffic \| Network administration \|
			44	\| Guest VLAN \| Provides internet-only access for visitors \| Hotels, public Wi-Fi \|
			45	\| Native VLAN \| Unused VLAN assigned to untagged traffic \| Interoperability between VLAN-capable devices \|
			46
			47	---
			48
			49	## VLAN Configuration & Implementation
			50
			51	### 1. Port-Based VLANs
			52	- Assigns specific switch ports to a VLAN.
			53	- Devices connected to the same VLAN can communicate.
			54	- Common in small business and enterprise networks.
			55
			56	### 2. Tagged vs. Untagged VLANs
			57	\| VLAN Type \| Tagging Method \| Purpose \|
			58	\|--------------\|----------------\|-------------\|
			59	\| Tagged VLAN \| Uses 802.1Q tagging to carry multiple VLANs on a trunk port \| Used between switches \|
			60	\| Untagged VLAN \| Traffic is not tagged and belongs to a single VLAN \| End-user devices \|
			61
			62	### 3. Trunking & VLAN Propagation
			63	- Trunk ports allow multiple VLANs to pass between switches.
			64	- Uses VLAN tagging (802.1Q) to differentiate traffic.
			65
			66	### 4. VLAN Routing (Inter-VLAN Communication)
			67	- Layer 3 devices (routers or Layer 3 switches) route traffic between VLANs.
			68	- Requires SVI (Switched Virtual Interface) configuration.
			69
			70	---
			71
			72	## VLANs vs. Traditional LANs
			73
			74	\| Feature \| VLAN \| Traditional LAN \|
			75	\|------------\|------------\|----------------\|
			76	\| Network Isolation \| Logical separation \| Physical separation \|
			77	\| Scalability \| Highly scalable \| Requires more cabling \|
			78	\| Security \| Stronger isolation \| Less secure \|
			79	\| Traffic Control \| Supports QoS & bandwidth management \| Limited control \|
			80	\| Flexibility \| Can be reconfigured via software \| Requires hardware changes \|
			81
			82	---
			83
			84	## VLAN Security Best Practices
			85
			86	### 1. Use VLANs for Network Segmentation
			87	- Separate user, voice, and management traffic.
			88	- Prevents unauthorized access to critical systems.
			89
			90	### 2. Secure VLAN Trunks
			91	- Restrict trunking to necessary ports only.
			92	- Use Native VLAN pruning to block unused VLAN traffic.
			93
			94	### 3. Enable VLAN Access Control
			95	- Use MAC address filtering and 802.1X authentication.
			96	- Implement Access Control Lists (ACLs) for additional security.
			97
			98	### 4. Prevent VLAN Hopping Attacks
			99	- Disable Dynamic Trunking Protocol (DTP).
			100	- Use private VLANs (PVLANs) for sensitive devices.
			101
			102	---
			103
			104	## VLANs in the Fire & Security Industry
			105
			106	VLANs are widely used in fire safety, security monitoring, and building automation, enabling:
			107
			108	- Isolated CCTV traffic for secure video surveillance.
			109	- Segregated access control systems to prevent cyber threats.
			110	- Dedicated VLANs for fire alarms and emergency communication.
			111	- QoS-enabled voice VLANs for critical communication systems.
			112
			113	---
			114
			115	## Conclusion
			116	VLANs provide a cost-effective and scalable solution for network segmentation, security, and traffic optimization. They are essential in corporate networks, security infrastructure, and data centres, ensuring efficient, secure, and organized network management.