vlan ip assignment

Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Why does a VLAN have an IP address?

A dumb question for the majority, but I am interested to know "why does a VLAN have an IP address?"

Is this address different from the default gateway? Or is this address, same as broadcast address for this VLAN?

IP address 192.168.4.100 255.255.255.0

• What kind of hardware are you talking about? –  Bill Weiss Commented Mar 2, 2010 at 21:56
• This is part of configuring a vlan on a netgear switch, after enabling routing on the vlan. –  RainDoctor Commented Mar 2, 2010 at 22:15

7 Answers 7

I believe this is merely an IP address for the VLAN-aware device that happens to be on that VLAN. You need it if the device in question is going to be doing routing involving that VLAN, or if you expect to manage the device (ie through SNMP) on that VLAN.

(after your update) I see you are enabling routing through the Netgear switch this VLAN is defined on. This IP is the address that local systems will use as the router.

A VLAN doesn't have an IP address. It's the devices communicating on the VLAN which have IP addresses

• 6 +1 - A vlan (an 802.1q vlan anyway) in and of itself doesn't have any IP addresses: It's an ethernet-header-level thing and doesn't much care what you're running on top of it (IP, IPX/SPX, whatever). VLAN-aware devices tend to be managed devices though, and they usually have IP addresses like David said in the other answer. –  voretaq7 Commented Mar 2, 2010 at 20:30

You can think of a VLAN as a network if that helps. So where I work we have all kinds of networks, ones for PLCs, Servers, Networking Devices, Wireless, etc. To make things easy with our networking environment we created VLANs for each one of these. This way we can have multiple devices from each main category connected to any switch we want but we can have that device in it's own VLAN.

In other words, without VLANs you would need a lot more networking devices because each access layer switch would have to be on it's own network, just like your home network. Any switch(es) you plug into your router or modem at home is going to be on the same network. With VLANs we can plug a server, PLC, regular user, and wireless AP into the same switch if needed and still have them all be in their respective VLANs.

VLANs themselves do not have IPs assigned to them like computers and servers do. Instead they are assigned networks. Which is why many people exchange the word VLAN for network and vice versa. So at home your probably have a 192.168.0.0 255.255.255.0 network or something similar. Well for VLANs we do the same thing...

We might assign 192.168.1.0 255.255.255.0 to servers, 192.168.2.0 255.255.255.0 to PLCs, 192.168.3.0 255.255.255.0 to regular users, and 192.168.4.0 255.255.255.0 to wireless. This means a server will get a different IP than a PLC, etc. Thus our segregation with VLANs. And if you understand how IPs and Subnet masks work, you will know that each VLAN above will have its own network and communication and be separate from each other.

Your IP you mentioned above, 192.168.4.100 255.255.255.0, is likely an IP within a VLAN and not a gateway for that VLAN or anything like that. Typically the gateway is the first or last usable IP in the network range but it doesn't have to be. The broadcast address is always the last IP in the range and can never be assigned to anything, in your case the broadcast IP would be 192.168.4.255.

I hope this ramble helps...

From the wikipedia (since it says it well):

Virtual LANs are essentially Layer 2 constructs, compared with IP subnets which are Layer 3 constructs. In an environment employing VLANs, a one-to-one relationship often exists between VLANs and IP subnets, although it is possible to have multiple subnets on one VLAN or have one subnet spread across multiple VLANs. Virtual LANs and IP subnets provide independent Layer 2 and Layer 3 constructs that map to one another and this correspondence is useful during the network design process.

The IP address the OP listed as:

ip address 192.168.4.100 255.255.255.0

This would indeed be the IP addressed assigned to the VLAN itself. Specifically, it is the IP address of the "switch" the VLAN is on. It doesn't necessarily have to be the gateway IP for the VLAN but typically is since you typically setup IP addresses on the VLAN at the Layer 3 "router" for the VLAN and thus use this IP address for the gateway for clients on that VLAN. The Layer3 switch will have IP routing/forwarding enabled if necessary.

The mask basically says that the VLAN is the 192.168.4.0/24 network. It's up to you to decide if you want to actually use the 192.168.4.100 as the actual client gateway IP or if this is simply a management IP for the switch/vlan.

For most Level 3 switches out there, the line you specified represents the gateway address of the VLAN.

Don't confuse it with default gateway, which only applies when routing is turned OFF.

Informally, yes, a VLAN can have an IP address. Technically this is called a VLAN interface, as you configure it from interface configuration mode and it will be listed in the config as interface VLAN 100 (example). These are virtual interfaces (not physical ports) and are named "VLAN #"

On a layer two switch you are generally limited to only having one active VLAN interface. On a multilayer switch there can be multiple. These VLAN interfaces are virtual interfaces and can be pinged as well as provide the connection point for remote management. This IP address can only be used as the default gateway on a multilayer switch.

A VLAN (Virtual Local Area Network) is its own logically segregated broadcast domain. You assign networks, or subnets, just as you would with a physically separated broadcast domain.

@TheCleaner:

This would indeed be the IP addressed assigned to the VLAN itself

VLANs do not really have IP addresses assigned to them. They have a network assigned to them, or a subnet, or a network range, however you want to refer to it. The address the OP supplied us is an assignable address within the range of 192.168.4.1-255. So lets say the range is applied to a group of servers so on a Cisco switch and we give the VLAN a description of "Server VLAN", 4.100 would be an address that can be given to an individual server. When referring to the Server VLAN, generally one may use the VLAN number or the network address, but typically not a specific address and the whole mask. At least the network admins I work with do not.

As I mentioned above, the OPs address can be a gateway address, but typically would not be because when you think of an environment like a large corporation, if you do not have a system of how gateway addresses are assigned, keeping track of them can be rather difficult. Thus most network admins use the first or last assignable address of a given range for the gateway. In the case of the OP, that would be 192.168.4.1 or 192.168.4.254. I'm not saying this is always the case, rather best practice and generally makes the most sense.

Specifically, it is the IP address of the "switch" the VLAN is on. It doesn't necessarily have to be the gateway IP for the VLAN but typically is since you typically setup IP addresses on the VLAN at the Layer 3 "router" for the VLAN and thus use this IP address for the gateway for clients on that VLAN.

This statement is confusing to me. We don't know anything about the address the OP gave us except the range it exists in, because the OP never said on what device it was found. We do not know if it is the address of a switch, a server, an AP, a computer, a printer, etc. So how you would know that from the small post from the OP wrote is beyond me.

I agree it doesn't have to be the gateway and I have already mentioned this. As I already explained, when you look at most large companies (but this is Cisco's best practice and is usually applied to most businesses) you actually find that gateway addresses will be the last or first assignable address in a range. 4.100 would be in the middle and would make no sense to be a gateway address. While some network admins might assign it that way, keeping track of this would be cumbersome, especially in increasing network sizes. This becomes even more true when HSRP and such technologies are used which take up two address on each layer 3 interface and give out a third address for the gateway. Keeping track of hundreds of such gateways when HSRP is being used becomes very difficult if there isn't a system for assigning addresses. Think of a company that might have 100 different VLANs...

• 1 @"this statement is confusing to me"...the OP clarified in his comments that it was an IP on the netgear switch...that's how I knew. –  TheCleaner Commented Mar 7, 2010 at 2:49
• Yes he did, I just saw that. With a /24 I have to say that is an odd IP to use as a mask. I know some home routers can configure themselves that way, but in a business environment it seems to make more sense to stick to the last or first usable IP of a range. –  Webs Commented Mar 9, 2010 at 16:24

You must log in to answer this question.

Not the answer you're looking for browse other questions tagged networking ip-address vlan ..

• The Overflow Blog
• Where does Postgres fit in a world of GenAI and vector databases?
• Mobile Observability: monitoring performance through cracked screens, old...
• Featured on Meta
• We've made changes to our Terms of Service & Privacy Policy - July 2024
• Bringing clarity to status tag usage on meta sites

Hot Network Questions

• Book or novel about an intelligent monolith from space that crashes into a mountain
• Sidenotes with a long argument fail: how to add processing of long arguments?
• Slicing Graph by path
• 2 in 1: Twin Puzzle
• Why does a halfing's racial trait lucky specify you must use the next roll?
• If a trigger runs an update will it ALWAYS have the same timestamp for a temporal table?
• Is there a phrase for someone who's really bad at cooking?
• How can judicial independence be jeopardised by politicians' criticism?
• What is the difference between a "Complaint for Civil Protection Order" and a "Motion for Civil Protection Order"?
• How do we reconcile the story of the woman caught in adultery in John 8 and the man stoned for picking up sticks on Sabbath in Numbers 15?
• Reference request: acceleration/curvature of curve in metric space
• How does the summoned monster know who is my enemy?
• Infinite suspension is cotangent complex
• What would be non-slang equivalent of "copium"?
• What are the 270 mitzvot relevant today?
• Took a pic of old school friend in the 80s who is now quite famous and written a huge selling memoir. Pic has ben used in book without permission
• Is it possible to calculate FPS (frames per second) of video using statistical data?
• What are some refutations to the etymological fallacy?
• Why are complex coordinates outlawed in physics?
• How can moral disagreements be resolved when the conflicting parties are guided by fundamentally different value systems?
• Is it possible to have a planet that's gaslike in some areas and rocky in others?
• What is opinion?
• Image Intelligence concerning alien structures on the moon
• Cannot open and HTML file stored on RAM-disk with a browser

VLAN Configuration Commands Step by Step Explained

Switches do not understand broadcast messages. They forward them from all ports. VLAN is a switch feature. It allows us to create a group of devices that share broadcast messages.

We use the vlan command in global configuration mode to create a new VLAN or to update an existing VLAN. We use the switchport mode access vlan command in the interface configuration mode of a port to assign it to a VLAN.

Let's take an example to understand how to use these commands on Cisco switches.

Create a Packet Tracer lab as shown in the following image.

I explained the steps to create this practice lab in the following tutorial.

VLAN Practice Lab Setup in Packet Tracer

Packet Tracer is a network simulator software. You can download it from the following link.

Download Packet Tracer

In this lab, we have three switches and six PCs. Each switch has a connection to two PCs. All PCs have IP configurations. Three PCs have an IP configuration from the network 10.0.0.0/8, and the remaining three have an IP configuration from the network 20.0.0.0/8. The lab also has a router to provide connectivity between VLANs.

Configuring VLANs on switches

We will configure two VLANs in this network: VLAN-10 and VLAN-20 . We will use VLAN-10 for the network 10.0.0.0/8. We will use VLAN-20 for the network 20.0.0.0/8. We will keep one PC from each switch in a VLAN.

Access the first switch's CLI prompt. Enter global configuration mode and use the vlan command to create a new VLAN. This command needs a VLAN number as an argument. It checks the specified VLAN number for an existing VLAN before creating a new VLAN. If it finds an existing VLAN having the specified number, it does not create a new VLAN. It enters VLAN configuration mode for the existing VLAN. If it does not find an existing VLAN having the specified number, it creates a new VLAN and enters VLAN configuration mode for the new VLAN.

VLAN configuration mode allows us to configure additional options such as name and RSPAN . In a basic configuration, we do not need to configure these options. Use the exit command to exit VLAN configuration mode.

The following commands create VLAN-10.

The following commands create VLAN-20.

Since all three switches have PCs in these VLANs, you need to run the above commands on all switches.

After creating VLANs, we need to assign them to the switch ports. The switchport mode access vlan command assigns a VLAN to the switch port. It accepts a VLAN number as an argument. It runs in the interface configuration mode of the port. It assigns the specified VLAN number to the port. The device connected to the port becomes a member of the specified port.

The following commands make the device connected to port-1 a member of VLAN-10 .

The following commands make the device connected to port-2 a member of VLAN-20 .

You need to run the above commands on all switches.

A switch port can work in two modes: access and trunk. In access mode, it works with a single VLAN. In trunk mode, it works with multiple VLANs.

Access mode is the default mode on all switch ports. If you connect an end device to a switch port, you do not need to change the default mode. But if you connect a switch port to another switch port, you need to change the default mode to trunk mode on both ports.

Change default mode to trunk mode on ports you used to connect switches. Use the switchport mode trunk command to change the default mode. Run this command in the interface configuration mode of the port.

The following commands change the default mode to trunk mode on GigabitEtherent 0/1 .

The following commands change the default mode to trunk mode on GigabitEtherent 0/2 .

Run the above commands on all switches.

Testing and verifying VLANs

To test and verify VLAN configuration, you can check connectivity between PCs in the same VLAN.

Click the PC icon, click Desktop , and click Command prompt . Use the ping command to test connectivity.

PC0 is a member of VLAN-10. As we can see in the above image, it has connectivity with PC2 and PC4. PC2 and PC4 are other members of VLAN-10.

Similarly, you can also test connectivity between PC1, PC3, and PC5. These are members of VLAN-20.

PCs in the same VLAN have connectivity. It verifies VLAN configuration.

Connecting different VLANs

VLANs are logical subnets. PCs in different VLANs do not have connectivity. To provide connectivity between different VLANs, you need to configure a router. The last tutorial in this tutorial series explains how to configure a router to provide connectivity between different VLANs.

This tutorial is a part of the tutorial series on VLAN, VTP, and DTP Concepts and Configurations on Cisco Routers. Other parts of this series are the following.

Chapter 01 VLAN Basic Concepts Explained with Examples

Chapter 02 Advantages and Disadvantages of VLANs

Chapter 03 Static and Dynamic VLAN Membership Explained

Chapter 04 Access Link and Trunk Link Explained

Chapter 05 VLAN Tagging Explained with DTP Protocol

Chapter 06 DTP Modes and Protocol Explained

Chapter 07 802.1Q Native VLAN concept Explained

Chapter 08 Cisco Inter-Switch Link (ISL) Explained

Chapter 09 Trunk Tagging and Frame Tagging Explained

Chapter 10 VTP Modes and VTP Protocol Explained

Chapter 11 VTP Pruning on switches Explained

Chapter 12 VLAN Practice Lab Setup in Packet Tracer

Chapter 13 Configure VTP Server and Client in Switch

Chapter 14 VLAN Configuration Commands Step by Step Explained

Chapter 15 Router on Stick Configuration Explained

That's all for this tutorial. In this tutorial, we learned how to configure, test, and verify VLANs on switches.

By ComputerNetworkingNotes Updated on 2024-06-09

ComputerNetworkingNotes CCNA Study Guide VLAN Configuration Commands Step by Step Explained

• EtherChannel Load Distribution Explained
• Link Aggregation Control Protocol (LACP) Explained
• Port Aggregation Protocol (PAgP) Explained
• EtherChannel Manual Configuration
• EtherChannel Basic Concepts Explained
• STP, RSTP, PVST, RPVST, and MSTP
• Similarities and Differences between STP and RSTP
• RSTP / RPVST Explained with Examples
• PVST/RPVST and EtherChannel Explained
• STP/RSTP Timers Explained

We do not accept any kind of Guest Post. Except Guest post submission, for any other query (such as adverting opportunity, product advertisement, feedback, suggestion, error reporting and technical issue) or simply just say to hello mail us [email protected]

How to Set Up a VLAN in 12 Steps: Creation & Configuration

Shelby Hiter

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More .

Key Takeaways

• • Setting up a VLAN is a 12-step process. The steps include preparing unique VLAN IDs, creating a network diagram, configuring switch ports, and assigning switch ports to VLANs. (Jump to Section)
• • Static and dynamic VLANs serve different purposes. They are compared based on advantages based on network size, complexity, and requirements. (Jump to Section)
• • It’s imperative to get the VLAN setup process right and periodically reassess VLAN performance to ensure network security and efficiency. (Jump to Section)

Setting up a virtual local area network (VLAN) can be a complicated process, especially if you’re operating a large enterprise network, a network with legacy or hybrid architectures, or a network with specific workloads that require additional security and regulatory compliance safeguards.

Each VLAN configuration process will look a little different, depending on the specifications you bring to the table, and some of these steps — particularly steps five through eight — may be completed simultaneously, in a slightly different order, or even in a more automated fashion if you choose to set up a dynamic VLAN.

Still, in general, your network stands the best chance of success if you complete the following 12 VLAN configuration steps and document your processes, strategies, and requirements along the way.

Table of Contents

1. Brainstorm VLAN Groupings

In a traditional local area network with no virtualized barriers, all devices and network components communicate and share information with each other; you’re likely setting up a VLAN in the first place because this foundational setup is too loose for your requirements. But what are the ideal segments that will make your network function optimally and securely?

At this point in VLAN creation and configuration, it’s time to determine what VLAN groupings make the most sense for your network’s strategic complexities. Consider not only how many VLANs you’ll need but also the purpose each VLAN will serve and how they need to be set up to fulfill that purpose. While many organizations stick to more traditional boundaries like physical locations or departments, there may be more effective and secure ways for you to group and set up VLAN rules.

For example, if your company works closely with a third-party professional services firm that needs access to certain HR and security applications and data but not others, you could divide your VLANs based on which ones need looser versus stricter identity and access management controls. From there, determine which users and devices will align with and be assigned to each grouping.

2. Prepare Unique VLAN IDs

Every single VLAN you set up will need a unique VLAN identification number so you can segment network traffic to the appropriate places and keep documentation organized for multiple VLANs simultaneously. VLAN IDs are purely numeric and range from one to 4,095. While you don’t necessarily “need” these VLAN IDs to be operational yet, it’s a good idea to figure them out now so you can use them when labeling your network diagram in the next step.

3. Create a Logical Network Diagram or Map

Before you even begin setting up your VLANs and connecting devices and switches, the best way to ensure a successful VLAN network setup is to map out the specificities and relationships of your network with a network diagram. The labels and connections you illustrate at this stage of VLAN creation will give you the labels and organizational structure you need to keep track of all the devices, switches, routers, and other components necessary to fulfill your architectural plans.

Your team may choose to create this diagram manually or with tools that are already in your portfolio. However, a number of free and low-cost network diagramming tools specifically offer templates and icons that make it easier to illustrate the network you’re setting up, often with low-code/no-code interfaces and tools. If you’re interested in finding a network diagramming tool to make this step more efficient, consider investing in one of these top network diagram software and tooling solutions .

4. Optional: Purchase Additional Equipment

Based on the VLAN grouping requirements and design(s) you’ve developed in the previous three steps, you should have a clearer picture of any missing hardware or software that you need to purchase. Perhaps you have more VLAN groupings than you expected and need to bring in additional switches and routers. Or maybe your organization is growing quickly, and you want to purchase new switches with more ports for more devices. There’s also the possibility that you are moving from a primarily on-premises network setup to a hybrid or cloud setup that requires new software or third-party relationships.

Regardless of your new requirements, start by creating an inventory list of any networking equipment you currently own, including information about switch and router formats, configurations, port counts, speeds, and other details pertinent to VLAN setup. From there, make a separate list of the networking tools you’re missing, the cost of these missing tools, and any other specialized information that should be considered during the buying process. 

5. Connect Network Devices to Appropriate Switch Ports

You should now connect VLAN servers, end-user devices, and other relevant network devices — as long as their IP addresses are already configured — to the switch ports that have been selected for the corresponding VLAN group. While individual devices, ports, switches, and routers have not yet necessarily been configured in their settings to align with a certain VLAN and function, you should still know which devices and network components have been set aside for which VLANs. If you’re unsure about the switch ports that should be connecting to each device, reference your network diagram (or go back to the network diagramming stage and create a more detailed diagram). 

If you are opting to create a dynamic VLAN instead of a static VLAN, steps five through eight may look a little different for you. For example, you may spend these steps creating or identifying the appropriate rule-based protocols for your devices and setting up automation rules rather than manually connecting ports and devices to VLANs.

6. Configure Switch Ports

Now that your devices are connected to the correct switch ports, it’s time to configure the switch ports so they can perform according to their assigned functions. Many of your ports will simply need to be set up as access ports in the switch’s settings; an access port is a simple connection that allows devices to connect to only one VLAN. Access ports are most appropriate for devices and users that will not be using VLAN tagging or participating in inter-VLAN routing. 

Trunk ports are also configured in a switch’s settings, but they are designed to manage higher bandwidth traffic and can manage traffic for more than one VLAN. Devices should only be connected to trunk ports if they have been authorized and configured for VLAN tagging and inter-VLAN routing. Before moving on to the next step, double-check that devices are connected to the correct type of switch port for their operational needs.

7. Set up VLAN Specifications via Network Switch Settings

All of the prework is done: It’s time to actually create the virtual local area networks you want through network switch settings. You’ll do this by accessing your network switch management interfaces and going to the section where you can create VLANs. Create the number of VLANs you determined were necessary in previous steps and assign them the unique VLAN IDs you selected in step two.

8. Assign Switch Ports to VLANs

Again, keep in mind that steps five through eight may go in a slightly different order, depending on your team and their preferences. So if you have not yet assigned switch ports to the appropriate VLAN, it’s time to do that now. Tagged ports (trunk ports) are likely already associated with the correct VLANs, but you should confirm that they are set up correctly at this time. For untagged ports (access ports), you’ll need to manually connect them to the correct VLAN. Remember, trunk ports can be associated with more than one VLAN, if appropriate.

9. Optional: Add VLAN Tags

VLAN tagging is the process through which VLAN network traffic is further segmented and specialized. When VLAN tags are in use, associated devices and ports automatically interact with devices and ports that share those same tags; however, tags also give network administrators the power to further direct traffic and support case-by-case inter-VLAN routing scenarios. 

VLAN tagging is most appropriate for networks with complex traffic patterns and a diverse range of users, devices, and security permissions. If you choose to set up trunk ports with multiple VLANs running through them, as demonstrated in step six, you’ll need to make sure at least some of your VLANs receive tags so traffic doesn’t get muddled in trunk ports. 

If you’re not sure if your network would benefit from VLAN tags, read this in-depth article on the topic to help you make your decision: Tagged vs. Untagged VLAN: When You Should Use Each .

10. Optional: Configure Inter-VLAN Routing

If your network requires VLAN-to-VLAN communication as a part of its regular operations, you’ll want to use the VLAN tags you set up in the previous step to direct inter-VLAN routing. While it sounds counterintuitive to open traffic flow between VLANs, many organizations choose to do this because the different layer at which routers operate makes it possible for them to still control what types of traffic flow across VLANs and when and how devices and users move from VLAN to VLAN. As part of the inter-VLAN configuration step, you may also need to set up or double-check your VLAN access controls, ensuring only approved users and devices can take advantage of inter-VLAN routing.

11. Quality-Test Your VLAN

Now that everything’s set up, it’s time to test network connectivity and performance. Make sure that all devices within the same VLAN are able to interact with each other and, conversely, that they are not able to reach devices in other VLANs. Ping and traceroute are both effective tools for testing VLAN connectivity and performance, but a number of other network security and management tools may be appropriate as well.

12. Document and Reassess VLAN Performance Periodically

Enterprise networks in particular frequently change as more devices and users, new hardware and software requirements, and new operational and security use cases arise. Network administrators and/or network security team members should maintain an up-to-date network diagram, equipment inventory, changelogs, and other configuration documentation so it’s easy to see what the network looks like now, if and where any vulnerabilities have reared their heads, and if any other changes are necessary to improve network performance. Each time you go through this process, update your documentation so you have a full history of the network and what you’ve done to maintain it.

Should You Use a Static VLAN or Dynamic VLAN?

Static and dynamic VLANs bring different advantages to network administrators, depending on the size, complexity, and requirements of their network. Below, we’ve explained how each type works and when you should use it.

Static VLAN

Static VLANs exist when network administrators manually connect network devices to physical switch ports and those devices receive their VLAN assignment based on that connection. If the device ever needs to be reassigned to a new VLAN, the network administrator would physically connect it to a new switch port that is already associated with that VLAN. In other words, a static VLAN is one in which switch ports are assigned to VLANs and devices are not assigned to VLANs; they receive their orders directly from the switch port they’re connected to.

This type of VLAN is best for smaller networks, or networks that change infrequently and include fewer VLAN segments because network administrators have to manually connect (and sometimes reconnect) devices to the right ports for them to work. With a larger network that’s changing frequently, this task alone could become a full-time job and riddled with errors. Static VLANs are most advantageous for network administrators who need an easy-to-setup VLAN with predictable infrastructure and limited authentication needs.

Dynamic VLAN

A dynamic VLAN is one in which devices are assigned to that VLAN on a dynamic and semi-automated basis. Specialized criteria determine which devices are assigned to which VLANs and when. These criteria may include specialized network access controls and protocols, VLAN membership policy servers (VMPS) and databases, or some other combination of servers and data-driven rules. With a dynamic VLAN, devices are assigned to VLANs while ports frequently are not assigned to particular VLANs; they are simply the conduit through which pre-assigned device traffic flows.

Dynamic VLANs are best for larger and more complex networks that need to maintain frequently changing authentication and usage rules. It’s a much more difficult implementation process when compared to static VLAN, but for more strenuous network rules and requirements, dynamic VLAN ultimately saves network professionals time in the long run, as they can simply update protocols and VMPS entries when new VLAN assignments are needed across multiple devices.

Bottom Line: The Importance of Preparation for Optimal VLAN Performance

While the actual process of setting up a VLAN can be as simple as updating network switch settings and connecting devices to VLAN switch ports, the strategy behind a successful VLAN setup can be much more daunting. You’ll need to consider any specialized security or compliance requirements, the different device types that need access, and the resources and monitoring it will take to set up and sustain an efficient VLAN. 

All the steps listed above are crucial aspects of creating and configuring a sustainable VLAN network. But perhaps the most important step of all is documenting your thought process and your network architecture, especially as they change over time. Maintaining detailed documentation will help your existing network and security team members stay on top of the most pertinent network updates and issues while simultaneously ensuring that any future members of the team receive the foundational training necessary to successfully work in your VLAN ecosystem.

Read next: What Is Network Security? Definition, Threats & Protections

Get the Free Cybersecurity Newsletter

Strengthen your organization’s IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday

Previous article

Next article

Subscribe to Cybersecurity Insider

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.

IT Security Resources

Bitdefender vs. mcafee: comparing features, pricing, pros & cons.

Vulnerability Recap 8/27/24 – Wide Range of Vulnerabilities This Week

NordLayer Review: Pricing, Features & Specs

How Does a VPN Work? A Comprehensive Beginner’s Overview

Top Cybersecurity Companies

Get the free newsletter.

Subscribe to Cybersecurity Insider for top news, trends & analysis

Related Articles

How to Get a VPN on Any Device (+ Installation Tips)

Thank you for taking the time to respond. The NETGEAR documentation team uses your feedback to improve our knowledge base content.

Rating Submitted

Do you have a suggestion for improving this article?

Characters Left : 500

MyNETGEAR® Account

Welcome back

Access your NETGEAR

NETGEAR Support

What is an IP subnet-based VLAN and how does it work with my managed switch?

Was this article helpful?    Yes      No

For more information, see the follwoing support articles:

• What is a virtual LAN (VLAN) and how does it work with my managed switch?
• How do I create an IP subnet-based VLAN using CLI commands on my managed switch?

This article applies to the following managed switches and their respective firmware:

• M5300 - firmware version 10.0.0.x
• M5300-28G (GSM7228S)
• M5300-5G (GSM7252S)
• M5300-28G3 (GSM7328Sv2h2)
• M5300-52G3 (GSM7352Sv2h2)
• M5300-28G_POE+ (GSM7228PSv1h2)
• M5300-52G-POE+ (GSM7252PSv1h2)
• M5300-28GF3 (GSM7328FSv2)
• M4100 - firmware version 10.0.1.x
• M4100-26G (GSM7224v2h2)
• M4100-50G (GSM7248v2h2)
• M4100-26G-POE (GSM7226Pv1h1)
• M4100-50G-POE+ (GSM7248Pv1h1)
• M4100-26G-POE (FSM7226Pv1h1)
• M4100-50-POE (FSM7250Pv1h1)
• M4100-D12G (GSM5212v1h1)
• M4100-D10-POE (FSM5210Pv1h1)
• M7100 - firmware version 10.0.1.x
• M7100-24X (XSM7224)
• XSM7224S - firmware version 9.0.1.x

Last Updated:03/10/2023 | Article ID: 21609

Was this article helpful?

This article applies to:.

• GSM4230PX (TAA)
• GSM4248PX (TAA)
• M4200-10MG-PoE+ (GSM4210P)
• M4250-10G2F-PoE+ (GSM4212P)
• M4250-10G2XF-PoE+ (GSM4212PX)
• M4250-10G2XF-PoE++ (GSM4212UX)
• M4250-12M2XF (MSM4214X)
• M4250-16XF (XSM4216F)
• M4250-26G4F-PoE+ (GSM4230P)
• M4250-26G4F-PoE++ (GSM4230UP)
• M4250-26G4XF-PoE+ (GSM4230PX)
• M4250-40G8F-PoE+ (GSM4248P)
• M4250-40G8XF-PoE+ (GSM4248PX)
• M4250-40G8XF-PoE++ (GSM4248UX)
• M4250-8G2XF-PoE+ (GSM4210PX)
• M4250-9G1F-PoE+ (GSM4210PD)
• M4300-12X12F (XSM4324S)
• M4300-16X (XSM4316PA)
• M4300-16X (XSM4316PB)
• M4300-24X (XSM4324CS)
• M4300-24X24F (XSM4348S)
• M4300-24XF (XSM4324FS)
• M4300-28G (GSM4328S)
• M4300-28G-PoE+ (GSM4328PA)
• M4300-28G-PoE+ (GSM4328PB)
• M4300-48X (XSM4348CS)
• M4300-48XF (XSM4348FS)
• M4300-52G (GSM4352S)
• M4300-52G-PoE+ (GSM4352PA)
• M4300-52G-PoE+ (GSM4352PB)
• M4300-8X8F (XSM4316S)
• M4500-32C (CSM4532)
• M4500-48XF8C (XSM4556)
• M5300-28G-POE+ (GSM7228PSv1h2)
• M5300-52G (GSM7252S)
• MSM4214X (TAA)
• M4100-26-POE (FSM7226Pv1h1)
• M4100-26G-POE (GSM7226LPv1h1)

Looking for more about your product?

Get information, documentation, videos and more for your specific product.

Can’t find what you’re looking for?

Quick and easy solutions are available for you in the NETGEAR community.

Need to Contact NETGEAR Support?

With NETGEAR’s round-the-clock premium support, help is just a phone call away.

Complimentary Support

NETGEAR provides complimentary technical support for NETGEAR products for 90 days from the original date of purchase.

NETGEAR Premium Support

Gearhead support for home users.

GearHead Support is a technical support service for NETGEAR devices and all other connected devices in your home. Advanced remote support tools are used to fix issues on any of your devices. The service includes support for the following:

• Desktop and Notebook PCs, Wired and Wireless Routers, Modems, Printers, Scanners, Fax Machines, USB devices and Sound Cards
• Windows Operating Systems (2000, XP or Vista), MS Word, Excel, PowerPoint, Outlook and Adobe Acrobat
• Anti-virus and Anti-Spyware: McAfee, Norton, AVG, eTrust and BitDefender

ProSUPPORT Services for Business Users

NETGEAR ProSUPPORT services are available to supplement your technical support and warranty entitlements. NETGEAR offers a variety of ProSUPPORT services that allow you to access NETGEAR's expertise in a way that best meets your needs:

• Product Installation
• Professional Wireless Site Survey
• Defective Drive Retention (DDR) Service

Where to Find Your Model Number

To find the model/version number, check the bottom or back panel of your NETGEAR device.

Select a product or category below for specific instructions.

Nighthawk Routers

Powerline and Wall Plug Extenders

Cable and DSL Modem Routers

ReadyNAS Network Storage

Wireless Access Points

Other Business Products

Mobile Broadband

• Engineering Mathematics
• Discrete Mathematics
• Operating System
• Computer Networks
• Digital Logic and Design
• C Programming
• Data Structures
• Theory of Computation
• Compiler Design
• Computer Org and Architecture

Virtual LAN (VLAN)

Virtual LAN (VLAN) is a concept in which we can divide the devices logically on layer 2 (data link layer). Generally, layer 3 devices divide the broadcast domain but the broadcast domain can be divided by switches using the concept of VLAN. 

A broadcast domain is a network segment in which if a device broadcast a packet then all the devices in the same broadcast domain will receive it. The devices in the same broadcast domain will receive all the broadcast packets but it is limited to switches only as routers don’t forward out the broadcast packet. To forward out the packets to different VLAN (from one VLAN to another) or broadcast domains, inter Vlan routing is needed. Through VLAN, different small-size sub-networks are created which are comparatively easy to handle. 

VLAN ranges:

• VLAN 0, 4095: These are reserved VLAN which cannot be seen or used.
• VLAN 1: It is the default VLAN of switches. By default, all switch ports are in VLAN. This VLAN can’t be deleted or edit but can be used.
• VLAN 2-1001: This is a normal VLAN range. We can create, edit and delete these VLAN.
• VLAN 1002-1005: These are CISCO defaults for fddi and token rings. These VLAN can’t be deleted.
• Vlan 1006-4094: This is the extended range of Vlan.

Configuration –   We can simply create VLANs by simply assigning the vlan-id and Vlan name. 

Here, 2 is the Vlan I’d and accounts is the Vlan name. Now, we assign Vlan to the switch ports.e.g- 

Also, switchport range can be assigned to required vlans.  

By this, switchport fa0/0, fa0/1, fa0-2 will be assigned Vlan 2. 

Example –  

Assigning IP address 192.168.1.1/24, 192.168.1.2/24 and 192.168.2.1/24 to the PC’s. Now, we will create Vlan 2 and 3 on switch. 

We have made VLANs but the most important part is to assign switch ports to the VLANs.  

As seen, we have assigned Vlan 2 to fa0/0, fa0/2, and Vlan 3 to fa0/1. 

VLANs offer several features and benefits, including:

• Improved network security: VLANs can be used to separate network traffic and limit access to specific network resources. This improves security by preventing unauthorized access to sensitive data and network resources.
• Better network performance: By segregating network traffic into smaller logical networks, VLANs can reduce the amount of broadcast traffic and improve network performance.
• Simplified network management: VLANs allow network administrators to group devices together logically, rather than physically, which can simplify network management tasks such as configuration, troubleshooting, and maintenance.
• Flexibility: VLANs can be configured dynamically, allowing network administrators to quickly and easily adjust network configurations as needed.
• Cost savings: VLANs can help reduce hardware costs by allowing multiple virtual networks to share a single physical network infrastructure.
• Scalability: VLANs can be used to segment a network into smaller, more manageable groups as the network grows in size and complexity.

Some of the key features of VLANs include:

• VLAN tagging: VLAN tagging is a way to identify and distinguish VLAN traffic from other network traffic. This is typically done by adding a VLAN tag to the Ethernet frame header.
• VLAN membership: VLAN membership determines which devices are assigned to which VLANs. Devices can be assigned to VLANs based on port, MAC address, or other criteria.
• VLAN trunking: VLAN trunking allows multiple VLANs to be carried over a single physical link. This is typically done using a protocol such as IEEE 802.1Q.
• VLAN management: VLAN management involves configuring and managing VLANs, including assigning devices to VLANs, configuring VLAN tags, and configuring VLAN trunking.

Types of connections in VLAN –

There are three ways to connect devices on a VLAN, the type of connections are based on the connected devices i.e. whether they are VLAN-aware(A device that understands VLAN formats and VLAN membership) or VLAN-unaware(A device that doesn’t understand VLAN format and VLAN membership).

• Trunk Link – All connected devices to a trunk link must be VLAN-aware. All frames on this should have a special header attached to it called tagged frames.
• Access link – It connects VLAN-unaware devices to a VLAN-aware bridge. All frames on the access link must be untagged.
• Hybrid link – It is a combination of the Trunk link and Access link. Here both VLAN-unaware and VLAN-aware devices are attached and it can have both tagged and untagged frames. 

Advantages –  

• Performance – The network traffic is full of broadcast and multicast. VLAN reduces the need to send such traffic to unnecessary destinations. e.g.-If the traffic is intended for 2 users but as 10 devices are present in the same broadcast domain, therefore, all will receive the traffic i.e. wastage of bandwidth but if we make VLANs, then the broadcast or multicast packet will go to the intended users only.
• Formation of virtual groups – As there are different departments in every organization namely sales, finance etc., VLANs can be very useful in order to group the devices logically according to their departments.
• Security –   In the same network, sensitive data can be broadcast which can be accessed by the outsider but by creating VLAN, we can control broadcast domains, set up firewalls, restrict access. Also, VLANs can be used to inform the network manager of an intrusion. Hence, VLANs greatly enhance network security.
• Flexibility – VLAN provide flexibility to add, remove the number of host we want.
• Cost reduction – VLANs can be used to create broadcast domains which eliminate the need for expensive routers. By using Vlan, the number of small size broadcast domain can be increased which are easy to handle as compared to a bigger broadcast domain.

Disadvantages of VLAN 

• Complexity: VLANs can be complex to configure and manage, particularly in large or dynamic cloud computing environments.
• Limited scalability: VLANs are limited by the number of available VLAN IDs, which can be a constraint in larger cloud computing environments.
• Limited security : VLANs do not provide complete security and can be compromised by malicious actors who are able to gain access to the network.
• Limited interoperability : VLANs may not be fully compatible with all types of network devices and protocols, which can limit their usefulness in cloud computing environments.
• Limited mobility : VLANs may not support the movement of devices or users between different network segments, which can limit their usefulness in mobile or remote cloud computing environments. 
• Cost: Implementing and maintaining VLANs can be costly, especially if specialized hardware or software is required.
• Limited visibility: VLANs can make it more difficult to monitor and troubleshoot network issues, as traffic is isolated in different segments.

Real-Time Applications of VLAN 

Virtual LANs (VLANs) are widely used in cloud computing environments to improve network performance and security. Here are a few examples of real-time applications of VLANs:

• Voice over IP (VoIP) : VLANs can be used to isolate voice traffic from data traffic, which improves the quality of VoIP calls and reduces the risk of network congestion.
• Video Conferencing : VLANs can be used to prioritize video traffic and ensure that it receives the bandwidth and resources it needs for high-quality video conferencing.
• Remote Access : VLANs can be used to provide secure remote access to cloud-based applications and resources, by isolating remote users from the rest of the network.
• Cloud Backup and Recovery : VLANs can be used to isolate backup and recovery traffic, which reduces the risk of network congestion and improves the performance of backup and recovery operations.
• Gaming : VLANs can be used to prioritize gaming traffic, which ensures that gamers receive the bandwidth and resources they need for a smooth gaming experience.
• IoT : VLANs can be used to isolate Internet of Things (IoT) devices from the rest of the network, which improves security and reduces the risk of network congestion.

Please Login to comment...

Similar reads.

• California Lawmakers Pass Bill to Limit AI Replicas
• Best 10 IPTV Service Providers in Germany
• Python 3.13 Releases | Enhanced REPL for Developers
• IPTV Anbieter in Deutschland - Top IPTV Anbieter Abonnements
• Content Improvement League 2024: From Good To A Great Article

Improve your Coding Skills with Practice

What kind of Experience do you want to share?

• Docs »
• pfSense® software »
• Virtual LANs (VLANs)
• Give Feedback

VLAN Configuration ¶

This section covers how to configure VLANs in pfSense® software.

Console VLAN configuration ¶

VLANs can be configured at the console using the Assign Interfaces function. The following example shows how to configure two VLANs, ID 10 and 20 , with igb2 as the parent interface. The VLAN interfaces are assigned as OPT1 and OPT2 :

After a few seconds, the firewall settings will reload and the console menu will reload.

Web interface VLAN configuration ¶

In the system used for this example, WAN and LAN are assigned as igb1 and igb0 respectively. There is also an igb2 interface that will be used as the VLAN parent interface.

To configure VLANs in the firewall GUI:

Navigate to Interfaces > Assignments to view the interface list.

Click the VLANs tab.

Configure the VLAN as shown in Figure Edit VLAN .

The physical interface upon which this VLAN tag will be used. In this case, igb2

The VLAN ID number, in this case, 10

Leave at the default value, blank

Some text to identify the purpose of the VLAN, such as DMZ

Edit VLAN ¶

Click Save to return to the VLAN list, which now includes the newly added VLAN 10 .

Repeat the process to add additional VLANs, such as VLAN 20 . These can be seen in Figure VLAN list

VLAN list ¶

To assign the VLANs to interfaces:

Navigate to Interfaces > Assignments

Click the Interface Assignments tab

Select the VLAN to add from the Available Network Ports list, such as VLAN 10 on igb2 (DMZ)

Repeat the last two steps to assign VLAN 20 on igb2 (Phones)

When finished, the interfaces will look like Figure Interfaces list with VLANs

Interfaces list with VLANs ¶

The VLAN-based OPT interfaces behave as any other OPT interfaces do, which means they must be enabled, configured, have firewall rules added, and services like the DHCP Server will need to be configured if needed. See Interface Configuration Basics for more information on configuring optional interfaces.

Log in  to ask questions, share your expertise, or stay connected to content you value. Don’t have a login?  Learn how to become a member .  

• Terms and Conditions
• Communities
• Community Home
• Topic Thread
• Discussion 11.6K
• Library 219
• Members 1.2K

How do I assign IP addresses to each of my VLANs?

Erdem 06-25-2018 08:12

smanju 06-25-2018 11:08 Best Answer

1.  how do i assign ip addresses to each of my vlans.

Forgive me, I'm very new to JunOS.  On ArubaOS I was able to assign IP addresses to VLANs like this:

(vlan100)#ip address 172.16.4.3 netmask 255.255.255.0

(vlan100)#exit

(vlan 200)#ip address 172.16.5.3 netmask 255.255.255.0

And so on.  I'm trying to look for the equivalent way to configure this in JunOS.  I need to assign IP addresses to a couple different VLANs.  How can I accomplish this?  I believe the idea is that I need to assing inet to the unit #, but I'm not sure how a unit # differs from a VLAN on JunOS. 

To be clear, I do not want the switch to do the routing, I want the routing to happen at my firewall on port 23.

Here's my interface config:

2.  RE: How do I assign IP addresses to each of my VLANs? Best Answer

A vlan on a juniper switch is its own boadcast domain. It groups all devices into a specific (vlan) group as per the vlan membership of the interface on the switch through which the devices are connected.

Whenever there is a need to split a interface into multiple sub interfaces then the unit # is referenced. A unit number identifies the particular subinterface of the main interface. JunOS supports 4094 logical subinterfaces per main interface. As a general practise it is recomended to use vlan id as the unit number for better clarity and visibility of the configuration/network. 

In your case you can use irb to configure ip address to the vlans on the switch. However the switch does routing for the packets which are have gateway/nexhop as the vlan ip address on the switch. You can still point to the Firewall ip address connected to switch port 23 as the gateway for the hosts in your network so that your routing is performed by the firewall.

Following is an example vlan configuration.

set vlans vlan100 vlan-id 100

set vlans vlan100 l3-interface irb.100

set interfaces irb unit 100 family inet address 172.16.4.3/24

set interfaces ge-0/0/5 unit 0 family ethernet-switching vlan members vlan100

set interfaces ge-0/0/23 unit 0 family ethernet-switching interface-mode trunk set interfaces ge-0/0/23 unit 0 family ethernet-switching vlan members vlan100

In the above configuration the traffic from port  ge-0/0/5 will be switched to interface ge-0/0/23 as long as the default gateway for the device connected on port ge-0/0/5 is set to Firewall ip address connected to port ge-0/0/23.

Please refer to the following documentation for further details.

https://www.juniper.net/documentation/en_US/junos/topics/concept/interfaces-layer3-subinterfaces-ex-series.html

https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/vlan-id-edit-interfaces-interfaces-ex-series.html

https://www.juniper.net/documentation/en_US/junos/topics/example/interfaces-layer3-subinterfaces-ex-series.html

https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/bridging-vlans-ex-series-cli.html

New Best Answer

• Skip to content
• Skip to search
• Skip to footer

Workaround for VLAN Management IP Address Assignment

Available languages, download options.

• PDF (733.8 KB) View with Adobe Reader on a variety of devices
• ePub (615.6 KB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
• Mobi (Kindle) (755.9 KB) View on Kindle device or Kindle app on multiple devices

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

When the switch is configured with an IP address on any VLAN, the ‘fallback’ IP address on VLAN1 (192.168.1.254) will be released.To preserve connectivity, prior to assigning an IP address to any VLAN interface, ensure the management VLAN has an IP address assigned first . The IP address can be obtained via a DHCP server or statically assigned to the VLAN interface. This article provides you with a workaround for VLAN IP assignment.

Applicable Devices

250 series Switches

Software Version

Enabling ssh and confirming switch status.

If this is not your first time booting up the Switch, skip to Step 3.

Step 1. Power up the new switch and log in to the switch via the web browser by using the default username and password.

Note: The default username and password upon first boot is cisco / cisco.

Step 2. Change the default username and password. Click Apply .

Step 3. Once the main menu has opened, click Security > TCP/UDP Services . Once this page loads enable SSH on the switch. Click Apply .

Step 4. Log in to the switch via SSH, we chose to use Putty.

Note: To learn how to access an SMB switch through SSH or Telnet, click here .

Step 5. To display details of the firmware and to confirm whether the Switch is updated to the latest available firmware version or not, enter the following command.

Note: It is recommended to use the latest firmware on the Switch. To download the latest firmware, please click here.

Step 6. To display information about VLAN settings of the switch, enter the following command:

Step 7. To display information about IP interface, enter the following:

By using the above mentioned command, you can see the current IP address settings on the interfaces and decide about assigning a new IP on the new VLAN interface.

Example: Creating the VLAN and Assigning the IP address

Note: The below is an example of the steps SSH session loss. When you enter the last command, you will lose access to the switch because VLAN1 will not have an IP address and all switch ports are still assigned to VLAN1.

To skip directly to the workaround steps, click here .

Step 8. From the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following command:

Step 9. To configure the VLAN 2 on the Switch, enter the following:

switch201bd3 (config) # vlan 2

Step 10. To manage the VLAN 2 interface, enter the following:

switch201bd3 (config) # interface vlan 2

Step 11. To configure the IP on VLAN 2 interface, enter the following:

switch201bd3 (config-if) # ip address 192.168.2.254 255.255.255.0

Workaround: Preventing loss of SSH session

By assigning a static IP address to the VLAN 1 interface, you preserve the SSH connection when assigning IP addresses to VLANs 2, 3, 4 etc.

To avoid losing the connection from VLAN 1 while assigning the IP on a different VLAN interface you can perform the following:

Step 1. Enter the below commands in sequence to set the static IP address on VLAN 1.

Note: from this point you are able to assign IP addresses at will.

Step 2. Apply the below mentioned command to create a VLAN 2 and assign an IP on that.

Note: In the example above, if you were connected to the switch via gi2 then you would lose the connection.

Step 3. (Optional) You can now verify the VLAN & IP address of the switch by using the following commands.

You have now successfully assigned an IP on another VLAN interface without losing connection to VLAN1. It will be helpful to assign a static IP on the VLAN 1 interface of the Switch for management purpose.

View a video related to this article...

Was this Document Helpful?

Contact Cisco

• (Requires a Cisco Service Contract )

This Document Applies to These Products

• 250 Series Smart Switches

Log in to ask questions, share your expertise, or stay connected to content. Don’t have a login? Join now.  

• Community Home
• Topic Thread

Wireless Access

• Discussion 121K
• Library 3.2K
• Members 3.1K

VLAN IP Address assignment in AOS8

1.  vlan ip address assignment in aos8.

Good morning Aruba community! Quick question, I'm struggling to understand the proper way to assign an IP Address to a VLAN for three controllers participating in a cluster. If memory servers I was told by Aruba TAC that an IP Address can be assigned to a VLAN in the Managed Network node hierarchy, under Configuration > Interfaces > VLANs. However, when I try doing so I get a warning message saying this configuration can lead to duplicate IP Addresses, which makes sense considering that there are three controllers participating in a cluster under the Managed Network hierarchy (see photo). The crazy thing is I'm fairly certain this is where I configured an IP Address in the past, however, now that configuration is gone. Ultimately I have configured an IP Address for my VLAN under each Mobility Controller. If anyone can provide a good explanation to help me better understand the IP Addressing/VLAN settings I would greatly appreciate it!

2.  RE: VLAN IP Address assignment in AOS8 Best Answer

3.  RE: VLAN IP Address assignment in AOS8

New best answer.

• Environmental Citizenship
• Support Services
• Contact Support
• Training & Certification
• Software Downloads
• Licensing Login
• Find a Partner
• Become a Partner
• Partner Ready for Networking
• Technology Partner Programs
• Privacy policy
• Terms of service

© Copyright 2024 Hewlett Packard Enterprise Development LP All Rights Reserved.

[Wireless Router] What is VLAN and how to setup in ASUS Wireless Router?

Send the page link to your email

Please enter your email

Scan QR code to open this page with your smart phone.

Related Topics

• [Wireless Router] How do I enter my ASUS router's setting page using Web GUI?
• [Wireless Router] How to reset the router to factory default setting?
• [Wireless Router] How to change ASUS router / ExpertWiFi router login name and password?
• [Guest Network Pro] What is Guest Network Pro?

  A VLAN (Virtual Local Area Network) is a logical network that is created within a larger physical network. VLANs allow you to segment a network into smaller, virtual sub-networks, which can be used to isolate traffic and improve network performance.

  VLANs are often used in enterprise networks to separate different departments or groups, or to segment different types of traffic (such as voice, data, and video). They can also be used in home networks to isolate different devices or users, or to separate guest networks from the main network.

• Trunk port(Tagged):

A VLAN trunk port is a networking port that is used to carry traffic for multiple VLANs (Virtual Local Area Networks) over a single physical connection. Trunk ports are often used to connect switches, routers, and other networking devices in a network, and are typically configured to allow traffic for multiple VLANs to be transmitted over a single link.

• Access port(Untagged):

A VLAN access port is a networking port that is used to carry traffic for a single VLAN (Virtual Local Area Network) over a physical connection. Access ports are often used to connect devices such as computers, printers, and other end-user devices to a network, and are typically configured to allow only traffic for a single VLAN to be transmitted over the port.

Note: 

1). By creating a Guest network pro, a VLAN will be created as well in VLAN settings.

2). VLAN supported models:  

• GT-AX11000 Pro, GT-AX6000, GT-AXE16000, RT-AX86U Pro, RT-AX88U Pro
• ZenWiFi Pro ET12, ZenWIFI Pro XT12(only provide beta firmware )

3). The following feature requires router firmware version later than version 3.0.0.6.102_xxxx or above . Some models provide beta firmware (9.0.0.6.102_xxxx) to experience this feature.

     This is an early stages beta. This version can be downgraded via web GUI only. For instruction about how to update the firmware, please refer to How to update the firmware of your router to the latest version  

How to setup VLAN on ASUS Router?

1. Connect your computer to the router via wired or WiFi connection and enter your router LAN IP or router URL http://www.asusrouter.com to the WEB GUI.

2. Key in your router's username and password to log in.

3. Go to  LAN  > VLAN page.

4. Create a VLAN profile in [ Profile ] tab. You can assign your own VLAN ID.

5. Port isolation restricts access rights with different devices in the same VLAN.

    In this page, you are now creating a [ VLAN-only-Network ], which means a network with VID but without DHCP.

    If the VLAN is with a Guest Network Pro (SDN) profile, you can enable AP isolation to restrict access rights with different WiFi devices respectively.

    If you want to enable DHCP on this VLAN network, you can go to Guest Network Pro (SDN), advanced settings for customization.

6. In [ VLAN ] tab, you can select a port with specific profile and mode (Trunk/Access).

LAN port mode:

a. Factory settings: [ All(Default) ], which means allows all tagged, untagged packets.

b. Access mode: Allow a selected SDN(VLAN). You can select profiles either creating by Guest Network pro or VLAN.

    For example, if we have a Guest_01(Guest network) with VID=52, select port 4 as access mode and profile is Guest_01, this port will grant the same rights as Guest_01.

c. Trunk mode:

     Allow all tagged : All tagged packets are allowed, non-tagged will be dropped.

     With selected SDN(VLAN) : selected SDN or VLAN is allowed only.

    You can use trunk mode to connect router to management switch.

How to get the (Utility / Firmware)?

You can download the latest drivers, software, firmware and user manuals in the  ASUS Download Center .

If you need more information about the  ASUS Download Center , please refer this  link .

Was this information helpful?

What we can do to improve the article?

• Above information might be partly or entirely quoted from exterior websites or sources. please refer to the information based on the source that we noted. Please directly contact or inquire the sources if there is any further question and note that ASUS is neither relevant nor responsible for its content/service
• This information may not suitable for all the products from the same category/series. Some of the screen shots and operations could be different from the software versions.
• ASUS provides the above information for reference only. If you have any questions about the content, please contact the above product vendor directly. Please note that ASUS is not responsible for the content or service provided by the above product vendor.
• Brand and product names mentioned are trademarks of their respective companies.

This Help article is for Cisco Desk Phone 9800 Series. If you have problems with the network connection, you may need to change the network settings. Consult your administrator or the network service provider before you make changes.

Change the Internet protocol mode

If required, you may need to change the internet protocol mode on which the phone operates.

Change the IP address on your phone

As your network settings require, you may need to change or manually assign the IP address to your phone. You can set or change the IP address on your phone from the network connection menu.

Your phone supports IP version 4 (IPv4), IP version 6 (IPv6), and IPv4 and IPv6. IPv4 and IPv6 is the default setting. The IP parameters can be assigned automatically by the network, or you can set them manually.

Follow the steps in the following sections as needed to change your IPv4 or IPv6 address.

• Change IPv4 settings
• Change IPv6 settings

Follow these steps to change or set your IPv4 network.

If your network supports both IPv4 and IPv6, you may also need to set the IPv6 settings. For how to change IPv6 settings, see Change IPv6 settings .

Select Apply when done.

You can change the IPv6 settings when your phone's IP stack is set to IPv6 or IPv4 and IPv6 .

Change VLAN settings on your phone

Determines which Virtual LAN (VLAN) your phone resides in. You phone uses CDP to communicate information such as auxiliary VLAN ID, per port power management details, and Quality of Service (QoS) configuration information with the Cisco Catalyst switch.

Before you begin

Consult your administrator before you make changes to the VLAN settings.

Small Business

Solutions for.