VLAN (802.1Q)
A VLAN (Virtual LAN) is a logically separate broadcast domain on a shared physical network, created by tagging Ethernet frames with a VLAN ID per the IEEE 802.1Q standard rather than by physically separate cabling. AdminKit's guide to planning VLANs with a subnet calculator covers assigning each VLAN its own IP range once it is already segmented at this layer.
By AdminKit team, Netbase JSC · Updated
A VLAN groups a set of switch ports into one logical broadcast domain, regardless of which physical switch or port they happen to be on, so devices in different VLANs don’t see each other’s broadcast traffic even while sharing the same cabling. IEEE 802.1Q defines how this works: a trunk link between switches carries traffic for multiple VLANs by inserting a 4-byte tag into each Ethernet frame identifying which VLAN it belongs to, as Cisco’s own documentation illustrates frame by frame. This is a Layer 2 concept, distinct from the IP addressing layered on top of it: a VLAN defines which devices share a broadcast domain, while the subnet and CIDR prefix assigned to it define the IP address range — two decisions usually made together, one VLAN per subnet. Segmenting by VLAN is also a common security control: isolating IoT devices, guest Wi-Fi, or management interfaces onto their own VLAN limits what a compromised device on one segment can reach on another, before any firewall rule is even applied between them.