Lessons · Network switches · broadcast domains

What a VLAN actually separates

A VLAN is one broadcast domain: a broadcast sent by a device in VLAN 20 reaches every port in VLAN 20 and no port outside it.

Hone is a place to practise programming. This is one of its lessons, written out in full and free to read without an account.

What it is for

Broadcasts are how devices find each other, and they are also how a small problem becomes a whole-building problem. A VLAN is the wall that stops it spreading.

How to think about it

When a fault is 'everything is slow and it started at once', ask how big the broadcast domain is. Smaller VLANs mean a smaller blast radius.

Worked example

enable

The # prompt.

configure terminal

Into configuration mode.

vlan 10

One broadcast domain.

name STAFF

Named.

exit

Back out.

vlan 40

A second, entirely separate one.

name CCTV

The cameras. Their traffic will never reach the staff ports.

end

Out.

show vlan brief

Two domains on one box. A broadcast in one is invisible in the other, and that is the only guarantee a VLAN makes.

Your turn

Give VLAN 40 the name CCTV, from inside VLAN configuration.

 CCTV

The trap

Thinking a VLAN is a security boundary on its own. It separates broadcast traffic; it does not stop a router that has been told to join the two, and it does not encrypt anything.

Practise broadcast domains on HoneA question on it now, a coding challenge where there is one, and it is remembered for review. Free, no email needed.