VLAN segmentation, inter-VLAN routing, and 802.1Q trunking
How one physical switch becomes many isolated networks, and how a single trunk and a handful of SVIs let those networks talk again on your terms.
Why segment: one flat LAN versus many VLANs
A switch with no VLANs is one broadcast domain. Every broadcast, every unknown-unicast flood, and every device that misbehaves is visible to every other port. A VLAN is a way to carve that single switch into several logical Layer 2 networks that behave as if they were separate switches, even though they share the same hardware.
Segmenting buys three things. First, smaller broadcast domains, so a broadcast storm or chatty protocol on one VLAN does not touch the others. Second, isolation by default: a device in one VLAN cannot reach a device in another VLAN at Layer 2 at all, which is why staff, guests, IP phones, servers, and IoT devices are commonly split into their own VLANs. Third, policy per segment, because once each VLAN maps to its own IP subnet you can attach access rules at the boundary between them. In the reference design, staff PCs sit in VLAN 10 (10.1.10.0/24), voice in VLAN 20, and servers in VLAN 30 (10.1.30.0/24), each a distinct subnet.
One physical switch carved into isolated VLAN broadcast domains
Trace
A single access switch is split into five logical Layer 2 networks. Each VLAN is its own broadcast domain and its own IP subnet, so a broadcast or a misbehaving device on one VLAN never touches the others, and no host can reach another VLAN at Layer 2 without routing.
Trunking the uplink with 802.1Q
A port that carries exactly one VLAN and expects untagged frames is an access port; you plug endpoints into it. But the uplink from the access switch has to carry many VLANs over a single cable, and the receiving device must be able to tell them apart. That is what a trunk does, and 802.1Q is the IEEE standard that makes it possible.
802.1Q inserts a four-byte tag into the Ethernet frame between the source MAC and the EtherType. Twelve bits of that tag are the VLAN ID, which is why the usable range is 1 to 4094. A frame leaving a trunk for VLAN 10 is tagged '10'; the switch on the far end reads the tag and knows which VLAN the frame belongs to without any guessing. The exception is the native VLAN: frames in the native VLAN cross the trunk untagged, and both ends must agree on which VLAN that is or traffic lands in the wrong segment. A common access-port refinement is the voice VLAN, where a single port carries the PC's data untagged in one VLAN while tagging the attached IP phone's traffic into a separate voice VLAN.
802.1Q trunking: tagged VLANs and one native VLAN over a single uplink
Trace
Endpoints connect to untagged access ports (with the IP phone tagging its own voice VLAN on a shared port). The single uplink is an 802.1Q trunk: it inserts a 4-byte tag carrying the 12-bit VLAN ID on every frame except the native VLAN, which crosses untagged. The Layer 3 switch reads each tag and de-multiplexes frames back into their VLANs.
Routing between VLANs: SVIs versus router-on-a-stick
Segmentation isolates VLANs by design, so by itself it would leave a staff PC unable to reach the app server even though both hang off the same switch. To let VLANs communicate you must route between them at Layer 3, because moving a packet from one subnet to another is a routing operation.
There are two classic ways to do it. On a Layer 3 (multilayer) switch you create a Switch Virtual Interface, an SVI, for each VLAN. The SVI is a virtual routed interface that carries the gateway IP for that VLAN's subnet; SVI 10.1.10.1 is the default gateway for VLAN 10, SVI 10.1.30.1 for VLAN 30. When the PC sends a packet to the server, it goes to its gateway SVI, the switch routes it to the VLAN 30 SVI, and it is delivered. The older approach is router-on-a-stick: a single physical router link to the switch is split into subinterfaces, one per VLAN, each tagged with 802.1Q, so one trunk plus one router interface routes every VLAN. SVIs on a Layer 3 switch are faster and are the usual modern choice; router-on-a-stick with subinterfaces still appears where only a router is available.
Two ways to route between VLANs: SVIs versus router-on-a-stick
Trace
Both methods move a packet from VLAN 10 to VLAN 30, a Layer 3 operation. Method A uses Switch Virtual Interfaces on a Layer 3 switch, one SVI per VLAN holding that subnet's gateway, and routes in hardware. Method B is router-on-a-stick: a Layer 2 switch trunks every VLAN up one cable to a router split into 802.1Q subinterfaces, one gateway per VLAN.
Applying policy and the exam takeaways
The routing boundary is exactly where control belongs. Because inter-VLAN traffic must pass through the SVIs, an access control list applied there decides which VLANs may reach which, so you can permit staff-to-server on specific ports while blocking guest-to-server entirely. North-south traffic continues past the Layer 3 switch to the edge firewall, which holds the default route and applies PAT before sending flows to the internet.
For the exam, hold onto a few anchors. Each endpoint's default gateway is the SVI (or router subinterface) for its own VLAN, and a wrong gateway or a wrong VLAN assignment is a top cause of a host that can ping its neighbors but nothing else. A trunk carries many VLANs tagged with 802.1Q; an access port carries one VLAN untagged. The native VLAN is the untagged VLAN on a trunk and must match on both ends. VLANs give you isolation; SVIs or subinterfaces give it back selectively; the ACL at that boundary is where you say who talks to whom.
Policy at the routing boundary and the north-south path to the internet
Trace
Because all inter-VLAN traffic must pass through the SVIs, the ACL applied there is where you decide who talks to whom: staff-to-server is permitted while guest and IoT to the servers is denied. Traffic bound for the internet continues north to the edge firewall, which holds the default route and applies PAT.
