VLAN Basics for Business: Keeping Guests, Cameras and Staff Apart

Try this: connect your phone to the guest Wi-Fi in your company's reception area and run a network-scanner app. If you can see the accounts department's printer, the CCTV recorder or a switch login page, your network is "flat". Everyone and everything sits in the same broadcast domain.

That's what we find most often in small and mid-sized offices. VLANs fix it without pulling a single new cable.

What a VLAN is, in two sentences

A VLAN (Virtual LAN) splits one or more physical switches into several logically separate networks. Devices in one VLAN don't see another VLAN's broadcasts, and can only reach each other through a router, Layer 3 switch or firewall, which is where you decide who is allowed to talk to whom.

What you actually get:

• Guests get Wi-Fi but can't reach the accounting server
• A cheap CCTV camera with vulnerable firmware can't become a way into staff PCs
• Smaller broadcast domains, so a calmer network
• IP phones isolated with QoS, so calls don't break up
• When something breaks, you know immediately which subnet a device lives in

The 802.1Q terms you need before touching anything

An access port connects an end device such as a PC or camera. It belongs to one VLAN and sends frames untagged. The device has no idea which VLAN it's in.

A trunk port runs between switches, or to a firewall or access point. It carries many VLANs on one cable by inserting a 4-byte 802.1Q tag into each frame.

The native VLAN is whichever VLAN travels untagged on a trunk. It defaults to VLAN 1 on most switches. Move it to an unused VLAN and make sure both ends match.

Usable VLAN IDs are 1–4094.

Most IP phones support a voice VLAN: one switch port sends tagged voice to the phone and untagged data to the PC plugged in behind it. One desk, one cable, two VLANs.

Sample plan: a 100-person office

Why a /23 for staff? Because 100 people with 2–3 devices each already exceeds 254. Matching the VLAN number to the third octet means the technician on the late-night phone call can remember it.

Inter-VLAN routing: where should it happen?

Two options. The firewall gives the best control and logging, so use it for sensitive traffic. A Layer 3 core switch is far faster for heavy internal traffic, but you have to write the ACLs yourself.

What we deploy most often is a mix: staff and server VLANs routed on the core; guest, CCTV and management terminated on the firewall. For offices under 50 people, letting the firewall do all of it is fine, provided it's sized correctly.

Write the policy before the config

A VLAN plan without a traffic policy is just a numbering scheme. Before anyone touches a switch, fill in a simple matrix like this one and get the department heads to agree:

Then the firewall or core switch rules are simply this table written in its syntax, ending with a deny rule that logs what it drops.

A port plan for one access switch

Print it and tape it inside the rack door. The next technician will thank you.

VLANs and Wi-Fi

Each SSID maps to a VLAN: staff SSID to VLAN 20, guest SSID to VLAN 90. Keep it to three or four SSIDs at most, because every extra SSID adds beacon traffic on every AP and wastes airtime. If you want staff and contractors on one SSID but in different VLANs, use 802.1X with a RADIUS server that assigns the VLAN per user. The AP's management address should sit in the management VLAN, untagged on the AP port if that is how the AP expects it.

Can your switches do this?

Unmanaged switches cannot. Most "smart" or web-managed switches handle 802.1Q tagging, but many cannot route between VLANs or apply ACLs, so a firewall or Layer 3 core has to do that job. Check the datasheet for the number of VLANs supported, ACL support, DHCP snooping and whether the voice VLAN works with your phone brand.

Mistakes that make VLANs pointless

Creating every VLAN, then setting the inter-VLAN policy to any-to-any. We see it constantly, and it adds exactly zero security.

Others we run into:

• Native VLAN mismatch on the two ends of a trunk, quietly leaking traffic between VLANs
• A small unmanaged switch someone put under a desk, sitting in the middle of a trunk path and breaking VLANs for the whole row
• Subnets sized too small, full within a year, forcing a complete re-addressing
• A CCTV VLAN with "no internet", then someone opens everything because the owner's phone app stopped working. Allow the one cloud service the NVR needs and keep the rest blocked
• Printers moved into their own VLAN, then nobody can find them because discovery relied on broadcasts. Add printers by IP, or use an mDNS gateway feature on the controller or firewall

Post-configuration checklist

• No user traffic on VLAN 1
• Unused ports shut down or parked in a dead-end VLAN
• Trunks allow only the VLANs they need
• DHCP snooping on, against rogue routers someone plugs in
• VLAN/IP plan written down in a form someone else can follow

Moving a live flat network to VLANs without downtime

This is the hardest part and where most mistakes happen. The order we use:

1. Discover: list every device, every static IP, and which port it's plugged into
2. Prepare: create VLANs and interfaces on the core or firewall, set up DHCP scopes per subnet, and write the inter-VLAN policy in advance
3. Start with low-impact groups: guest Wi-Fi and CCTV first
4. Servers and printers: update DNS and anything that references old IP addresses
5. Staff: after hours, one floor or department at a time
6. Review: check firewall logs for traffic blocked by accident, and tune

Every step has a rollback point. Expect surprises: old scanners with an IP hard-coded in firmware, and printers that rely on broadcasts to be discovered, are the two we hit most.

For Lao organizations

The minimum, even for a small office, is four VLANs: staff, guest, CCTV and management. Hotels and banks should give payment (POS) systems their own VLAN. Mines and factories must keep OT networks (PLC, SCADA) strictly separate from IT; older PLCs were never designed to be anywhere near the internet.

If you have provincial branches, use the same IP pattern at every site and vary only the second octet (for example Vientiane 10.10.x.x, Pakse 10.20.x.x). When the day comes to link sites with VPN or SD-WAN, nothing will overlap.

Hotels have one extra problem: guests want to cast to the room TV. That needs per-room isolation plus a casting or mDNS service designed for hotels, not a guest VLAN opened up to everything. Schools with projectors and tablets hit the same issue.

Watch for consumer routers too. Staff and tenants sometimes plug a home Wi-Fi router into a wall port, and its DHCP server starts handing out wrong addresses. DHCP snooping stops that, and it is one more reason to give every port a known VLAN.

Run the simple test first

Do the guest Wi-Fi scan from the start of this article and send us a screenshot of what you see. We'll tell you which VLANs to split out first and whether your existing switches support 802.1Q.