VLAN Segmentation and the Limits of Layer 2 Isolation

A switch forwards frames by destination MAC address within a single broadcast domain. Every port on a plain switch belongs to that domain, so any host can reach any other by sending a broadcast or by learning its MAC. VLANs exist to break that flatness without buying a second switch: the frame gains a tag identifying which logical bridge it belongs to, and the switch forwards it only to ports in the same group. The isolation is real but narrower than it looks, because it holds only where the tagging is enforced.

The tag and where it lives

An 802.1Q tag is four bytes inserted between the source MAC address and the EtherType field. It consists of a 16-bit tag protocol identifier, conventionally 0x8100, followed by three bits of priority, one drop-eligible bit, and a 12-bit VLAN identifier. The identifier space is therefore 4096 values, of which 0 and 4095 are reserved: 0 means “priority tagged”, where the priority bits are honoured but the frame carries no VLAN membership, and 4095 is reserved by the standard and must not be used as a member identifier. That leaves 4094 usable identifiers per tagging layer.

The 4-byte insertion pushes the payload past the classic 1518-byte maximum frame size, so a tagged frame can be 1522 bytes. Anything that assumes 1518 and drops longer frames will break tagged traffic, which is why trunk ports and the devices behind them must agree on the maximum frame size. The failure is not subtle when it happens, because large frames vanish while small ones pass, but it is easy to misdiagnose as an application problem.

Membership is configured per port in one of two modes. An access port belongs to exactly one VLAN; frames leaving it are untagged, and frames arriving untagged are assigned that VLAN. A trunk port carries multiple VLANs; frames keep their tags, and the switch uses the tag to decide which logical bridge to forward into. The trunk is the point where the isolation guarantee becomes conditional, because a trunk port accepts a tag chosen by whoever is on the other end of the cable.

Forwarding, flooding, and the cost of a broadcast domain

Within a VLAN the switch behaves exactly as it would on an unsegmented switch. It learns source MAC addresses into a forwarding table keyed by VLAN as well as MAC, so the same MAC address in two VLANs produces two independent entries. Unknown destinations, broadcasts, and multicasts are flooded to every port in the VLAN except the one they arrived on.

Segmentation’s security value is mostly the reduction of that flood set. A broadcast from one host reaches only its own VLAN, so an ARP spoofing attack mounted in one segment does not poison the others. The size of the segment also bounds the damage of a single compromised host, since the set of directly reachable peers is the set of ports in the same VLAN.

The trade is that inter-segment traffic must now be routed, and the router becomes a chokepoint with a policy decision at every hop. That is the intended outcome: it converts an implicit trust relationship between hosts into an explicit policy at layer 3. The cost is throughput and latency on the routing path, plus the operational burden of maintaining a policy for every segment pair.

There is a capacity constraint that shows up at scale. A single spanning-tree domain cannot use links that would form a loop, so redundancy costs bandwidth rather than adding it. Large flat designs therefore tend to be replaced by routed segments, which is a security-motivated change that also happens to improve convergence behaviour.

Trunk links and the hopping problem

A trunk port trusts the tag on the frame. If an attacker controls a device that can send tagged frames into a trunk, they can place themselves in any VLAN the trunk carries. This is VLAN hopping, and it comes in two forms.

Switch spoofing exploits a port that negotiates trunking dynamically. Protocols such as DTP let a port become a trunk if the neighbour asks for one; a host that speaks the negotiation protocol can therefore convince the switch to hand it a trunk, after which it can tag frames with any identifier. The mitigation is to disable dynamic trunk negotiation on access ports and configure them statically.

Double tagging exploits the way a switch strips only one tag. A frame arrives on an access port with two tags: an outer tag for the attacker’s own VLAN, which the first switch strips or ignores, and an inner tag for the target VLAN. The first switch forwards the frame into the attacker’s VLAN, where a second switch sees the inner tag and delivers the frame to the target. The attack is one-directional, because replies cannot traverse the same path, which limits it to injection rather than full access, but injection into a protected segment is enough to matter. Native-VLAN handling is the root cause: frames on the native VLAN travel untagged, so the tag-stripping boundary is ambiguous. Setting the native VLAN to an unused identifier and never assigning access ports to it removes the ambiguity.

Both attacks are configuration failures rather than protocol flaws. The protocol behaves as specified; the specification assumes that a trunk endpoint is trusted.

Where the boundary actually is

A VLAN is a layer 2 construct. It has no notion of directionality, no logging of its own, and no policy beyond membership. Anything that must be enforced across segments needs a layer 3 device, and that device’s rules are what actually constrain traffic between segments. If the router permits all transit between two VLANs, the segmentation has bought broadcast containment and nothing else.

This is why segmentation programmes that stop at VLAN creation tend to disappoint. The valuable part is the inter-segment policy, meaning which pairs may talk, on which ports, and in which direction, and that policy lives in a firewall or an ACL, evaluated as described in How a Stateful Firewall Matches a Packet. The VLAN is the addressing structure that makes the policy expressible; the policy is the control.

Port-level authentication is the other half of the boundary. IEEE 802.1X gates port access on a credential exchange with an authentication server, and can assign the port’s VLAN as a result of that decision. The consequence is that a port is not permanently in one segment: an unauthenticated device lands in a quarantine VLAN and moves to its production VLAN after authentication. That dynamic assignment is more expressive than static port configuration, but it makes the segment membership depend on a RADIUS response, which makes the authentication infrastructure part of the network security boundary.

A trunk port also has to be treated as a shared failure domain. A loop or a broadcast storm on one trunk affects every VLAN carried on it, because the physical link is common. Redundant trunks with per-VLAN spanning-tree instances limit the blast radius but do not remove the shared dependency.

When the segment should not be a VLAN at all

The flat-switch-plus-VLAN model assumes hosts are physical ports. When hosts are virtual machines on a hypervisor, the switch is a software bridge inside the host, and the trunk is a virtual link whose endpoints are both software. Policy that exists only in the physical switch does not apply to traffic between two virtual machines on the same host, because that traffic may never leave the host. The usual answers are to move the enforcement point into the hypervisor or into the guest’s own stack, which is the subject of Microsegmentation and Policy at the Workload Boundary.

The underlying question is the same in every variant: what is the smallest set of hosts that share a trust domain, and what enforces the edge of that set? A VLAN answers the first half by defining a broadcast domain, and leaves the second half to whatever routes between them. Confusing the two is how a design ends up with twenty segments and one permissive router between all of them.