VLAN

A VLAN creates isolated broadcast domains on the same physical switches and cabling. IEEE 802.1Q inserts a 4-byte tag into the Ethernet frame: a TPID field with value 0x8100, a 3-bit priority (PCP, 802.1p), a 1-bit DEI and a 12-bit VLAN ID (VID). Because 0 and 4095 are reserved, usable VLAN IDs are 1–4094.

Switch ports work in two basic modes. An access port belongs to one VLAN and carries untagged traffic, while a trunk port carries several VLANs tagged. Untagged frames arriving on a trunk end up in the native VLAN, which must match on both ends. Otherwise traffic can leak into the wrong network or VLAN-hopping attacks become possible. Parking unused ports in an empty VLAN and not using VLAN 1 as the native VLAN are good practice.

ISP and fiber networks rely heavily on VLANs to separate services. Internet, IPTV and VoIP can each ride their own VLAN (service VLAN model), or every subscriber can be isolated in a dedicated VLAN (per-subscriber model). To go beyond 4,094 IDs, IEEE 802.1ad (QinQ) adds a second service tag (S-VLAN) with TPID 0x88A8. The VLAN plan between OLT, ONT and BNG should be designed consistently from day one for security, QoS prioritisation and troubleshooting.

The tag makes each frame 4 bytes larger, so transport MTU must be raised on QinQ links. In hotels and campuses, keeping guest Wi-Fi, staff network, IP cameras and management traffic in separate VLANs improves security and makes it easier to collect guest access logs from the right network.