A laptop gets infected by a drive-by download at 9:40 on a Tuesday. In a flat network, that laptop now has a route to the domain controller, the file server, the backup appliance and the IP phones down the corridor. Nothing stopped it. Nothing was even asked to. Segmentation with VLANs is the least glamorous control in cybersecurity, and often the one that decides whether a breach becomes a bad week or a very long year.
Why flat networks fail so predictably
VLANs began as a way to cut broadcast noise and simplify moves, adds and changes. Security is now the better reason to plan them properly. A single 10.0.0.0/16 with everything inside is convenient for about a month. After that, every device can ARP every other device, a port scan finishes in seconds, and lateral movement needs no exotic tooling — just SMB, RDP or WinRM with credentials someone phished.
Segmentation changes the attacker's map. Instead of one wide-open network to explore, they meet a boundary that blocks the connection and, if you have done the work, logs the attempt. You are not trying to make intrusion impossible. You are trying to make it slow, loud and contained.
Plan from data flows, not from the org chart
Most segmentation projects stall because someone draws zones around departments. Marketing needs finance, finance needs IT, IT needs everyone. The result is a diagram full of exceptions and a design nobody enforces.
Define zones by what systems actually talk to. Ask three questions for each group of devices: what must it reach, who must reach it, and what is the smallest set of ports that makes that work? A camera needs the recorder and a time source. A point-of-sale terminal needs a payment endpoint. A workstation needs file shares, the intranet and the internet. Written down, those answers produce boundaries you can defend in a change meeting.
A VLAN and addressing plan you can remember
Keep the scheme small enough that a new engineer can guess it correctly. A common approach ties the third octet to the VLAN ID, so VLAN 40 uses 10.10.40.0/24. Leave gaps between ranges for growth and keep management addressing out of the user pools.
- VLAN 10 — workstations. Reaches servers on specific ports, the internet through the proxy, nothing else.
- VLAN 20 — internal servers. Accepts traffic from VLAN 10 on defined services only; cannot initiate sessions into user subnets.
- VLAN 30 — voice. Phones reach the call manager and a time source; workstations get no route in.
- VLAN 40 — guest and contractor. Internet only, no internal routing, client isolation enabled on the wireless side.
- VLAN 50 — cameras and building systems. No internet except a vendor update relay, and no access from user subnets.
- VLAN 99 — management. Switches, hypervisors and out-of-band cards, reachable only from a hardened jump host.
Store this document next to the network configs, not in someone's notebook. When a switch dies at 2 a.m., the plan should be the first thing a colleague opens.
Configuring the switch edge without breaking the building
Access ports
Set each user-facing port to the correct access VLAN, disable dynamic negotiation, and turn on port security or 802.1X where you can support it. Disable unused ports and park them in an unused quarantine VLAN rather than leaving them enabled in VLAN 1. Patch panels and wall sockets in meeting rooms are favourite entry points for someone with a laptop and ten minutes.
Trunks and the native VLAN
On trunks, allow only the VLANs that genuinely need to cross that link. Change the native VLAN from 1 to an unused ID, and never carry user traffic on it. A misconfigured trunk with an untagged native VLAN is one of the classic ways a device ends up somewhere it should not be.
Management access
Put switch management interfaces in the dedicated management VLAN, restrict SSH to a jump host, use key-based authentication, and send logs to a collector outside the segmented zones so an attacker with switch access cannot quietly erase their footprints.
VLANs alone are not a firewall
This is where many deployments quietly fail. 802.1Q is a tagging standard, not an access control system. Traffic between VLANs is routed, and routing without policy is permission. Every inter-VLAN path needs a rule set: a firewall where the volume or sensitivity justifies it, or ACLs on the layer 3 switch where it does not.
Write the policy as default deny, then add only the flows from your data-flow map. Typical exceptions include:
- DNS and NTP to specific internal servers, from nearly every zone.
- DHCP relay to your DHCP servers, or let the switch handle it.
- Patch and software deployment servers, inbound to endpoints on management ports only.
- Domain controllers, limited to the authentication and directory ports required, and only from zones that need them.
- Backup traffic from the backup subnet to servers, initiated in one direction.
If a hostile device appears on your network, the goal is a contained, logged and investigated event — not a routed one.
Harden the layer 2 fabric
VLANs sit on top of protocols that can be abused. Enable DHCP snooping and dynamic ARP inspection on user VLANs to stop rogue servers and ARP poisoning. Turn on BPDU guard and root guard on access ports so nobody becomes your spanning-tree root by accident or on purpose. Rate-limit broadcast and unknown unicast traffic. Keep firmware current, because switch bugs are real and rarely patched on schedule.
None of this is exciting work. It is also the difference between a switch that enforces your design and a switch that merely hosts it.
Test it, then keep testing it
Segmentation only counts if it works when someone is trying to break it. From a machine in each zone, scan the subnets you are supposed to be unable to reach and confirm you get nothing back. Try to reach the management VLAN from a workstation. Check that guest devices cannot resolve internal names. Review your firewall and ACL hit counters monthly: rules with zero hits for months are either redundant or broken, and both deserve a look.
Start small if the whole network feels overwhelming. Pick one high-value zone — management, cameras, or the payment segment — build it correctly, and expand from there. Put every change through a ticket, keep the VLAN plan in version control, and revisit the design after each acquisition, office move or new cloud service. Segmentation is not a project with an end date. It is a habit, and it pays off on the worst day rather than the best one.
Photo: Brett Sayles / Pexels