VLAN

What is a VLAN?

A VLAN (Virtual Local Area Network) is a logically separated network within a single physical network infrastructure, in which a switch assigns ports and traffic to a VLAN ID according to the IEEE 802.1Q standard. Devices in the same VLAN behave as if they were on their own local network, even though they share the same switches and cables with other VLANs. This lets you apply network segmentation without additional cabling or hardware. In OT environments, the VLAN is a basic building block for separating control, operation and the office network, but on its own it is not a security boundary.

🧠 Why do you use VLANs?

• Network segmentation without extra hardware - a single managed switch can serve several separate networks
• Smaller broadcast domains - broadcast and multicast traffic, such as ARP, stays inside the VLAN; this reduces the load on PLCs and other OT equipment with limited processing power
• Security as a first layer - devices with different functions cannot reach each other directly; traffic between VLANs has to pass a filtering point
• Clearer management - traffic can be grouped, monitored and documented per function
• Traffic prioritisation - the VLAN tag contains a priority field that switches use for QoS

🔧 How does IEEE 802.1Q VLAN tagging work?

IEEE 802.1Q was published in 1998 and has been the standard for VLANs on Ethernet ever since. The switch inserts a 4-byte tag between the source MAC address and the EtherType field. As a result, the maximum Ethernet frame grows from 1,518 to 1,522 bytes.

VLAN 1 is the default VLAN on almost every switch. VID 0 means priority only, with no VLAN membership. This matters in OT, because PROFINET sends its RT frames with VID 0 and priority 6 by default. Some switches drop such frames on a port assigned to a specific VLAN, so test this before you split a PROFINET network into VLANs.

For provider networks there is a double-tag extension, IEEE 802.1ad (Q-in-Q, EtherType 0x88A8), which was incorporated into 802.1Q in 2011. You will rarely encounter it in plant networks.

🔄 What is the difference between an access port and a trunk port?

An end device usually knows nothing about VLANs: the switch places untagged traffic from an access port into the correct VLAN. A port can be assigned manually or dynamically through 802.1X and NAC, where the authentication server decides the VLAN. The native VLAN of a trunk is the VLAN whose traffic crosses the trunk without a tag; by default this is VLAN 1.

🌐 How does traffic flow between VLANs?

Devices in different VLANs can only reach each other through a layer 3 device:

• Layer 3 switch - routes quickly between VLANs and can apply ACLs, but these are usually stateless and do not see application protocols
• Router - routes between subnets, often over a single trunk with sub-interfaces (router-on-a-stick)
• Firewall or industrial firewall - filters statefully and can inspect OT protocols such as Modbus TCP; the preferred solution at zone boundaries

Each VLAN normally gets its own IP subnet. At the boundary between zones you place a firewall with a deny-all, permit-by-exception policy. A layer 3 switch that routes everything between VLANs largely cancels out the segmentation in practice.

🔐 Is a VLAN a security boundary?

No, not on its own. A VLAN separates traffic at layer 2, but a configuration error or an attack can break that separation. Well-known risks:

• Switch spoofing - an attacker makes a port with automatic trunk negotiation (for example Cisco’s DTP protocol) form a trunk and so gains access to every VLAN
• Double tagging - an attacker in the native VLAN sends a frame with two tags; the first switch strips the outer tag and the next switch delivers the frame into the target VLAN (one direction only)
• Native VLAN abuse - end devices in VLAN 1 or in the native VLAN of trunks make the attacks above possible
• Overly permissive routing - inter-VLAN routing without filtering turns separate VLANs into one large network

The US guideline NIST SP 800-82 (Revision 3, September 2023) calls VLANs a cost-effective way to segment OT, but advises considering physically separate switches for high-criticality devices, such as those supporting safety systems. IEC 62443-3-3 requires segmentation and zone boundary protection through SR 5.1 and SR 5.2; the VLAN provides the separation, the firewall provides the protection.

🏭 What does a VLAN plan for a plant look like?

An example for a medium-sized production site, organised according to the Purdue Model:

Every transition between these VLANs passes through a firewall. External suppliers do not belong in a guest VLAN with a route into the plant; they come in through secure remote access with MFA to the jump server in the DMZ. Combined with the zones and conduits model, each VLAN or group of VLANs forms a zone, and the filtered connection between two VLANs is a conduit. Cisco and Rockwell Automation describe a similar layout in Converged Plantwide Ethernet, with VLANs per cell/area zone.

🧭 Which best practices apply to VLANs in OT?

1. Design the zones first - use a risk assessment to decide which systems form a zone together, and derive the VLANs from that.
2. Never use VLAN 1 for end devices - and choose an unused native VLAN for every trunk, or tag the native VLAN explicitly.
3. Lock down access ports - disable automatic trunk negotiation and allow only the required VLANs on trunks.
4. Shut down unused ports - disable them and place them in an unused VLAN; use Port Security or 802.1X on active ports.
5. Protect layer 2 - enable DHCP Snooping and Dynamic ARP Inspection where the switch supports them.
6. Filter between VLANs with a firewall - document for each conduit which protocols and ports are needed.
7. Separate management - put management interfaces in a dedicated management VLAN, reachable only from administration workstations.
8. Monitor and document - record the VLAN plan, review changes and use network monitoring to find unexpected traffic.

For organisations that fall under NIS2, demonstrable segmentation is a logical part of the mandatory risk-management measures; a documented VLAN plan with firewall rules helps you account for it.

🛡️ How does a VLAN fit into Defense in Depth?

Defense in Depth is a cybersecurity strategy in which multiple layers of security work together. VLANs form a logical layer of defence within it, but they are not sufficient without the other layers:

• Physical security - locked cabinets and rooms, access control, camera surveillance
• Firewall and routing rules between VLANs
• Authentication and access management - for example RBAC and MFA
• Monitoring and logging of network and switch events
• Backups and recovery procedures, including switch configurations
• Secure remote access through a Jump Server or VPN

Deployed within this broader whole, VLANs ensure that intruders or errors cannot simply move from one segment to another. A VLAN is often the first step towards finer-grained microsegmentation, which also restricts traffic within a zone.

❓ Frequently asked questions

How many VLANs can a network have?

A network based on IEEE 802.1Q can have up to 4,094 VLANs, because the VLAN ID is 12 bits long and the values 0 and 4095 are reserved. In practice many switches, especially compact industrial models, support fewer simultaneously active VLANs. Always check the switch datasheet.

What is the native VLAN?

The native VLAN is the VLAN whose traffic crosses a trunk port without an 802.1Q tag. By default it is VLAN 1. Because the native VLAN enables double-tagging attacks, you should assign it an unused VLAN ID or tag it explicitly.

What is VLAN hopping?

VLAN hopping is an attack in which an attacker sends traffic into another VLAN without passing a router or firewall. The two well-known variants are switch spoofing through automatic trunk negotiation and double tagging through the native VLAN. Static access ports and an unused native VLAN prevent both.

Do I need a managed switch for VLANs?

Yes, VLANs require a managed switch that supports IEEE 802.1Q. An unmanaged switch has no VLAN configuration and cannot separate tagged traffic correctly. In OT environments you should preferably use an industrial managed switch that also forwards PROFINET frames with VLAN ID 0 correctly.

Is a VLAN enough to separate OT from IT?

A VLAN alone is not enough to separate OT from IT, because configuration errors or VLAN hopping can break the separation. Combine VLANs with a firewall and a DMZ between IT and OT. For safety systems, NIST SP 800-82 advises considering physically separate switches.

What is the difference between a VLAN and a subnet?

A VLAN separates traffic at layer 2 (Ethernet), while a subnet divides addresses at layer 3 (IP). In practice you link each VLAN to its own IP subnet, so that routing and firewall rules can be set per VLAN.

📌 In summary

A VLAN is a logically separated network within a single physical infrastructure that lets you apply network segmentation with IEEE 802.1Q tagging, without extra hardware. In IT and OT it is an essential first layer of segmentation, but only in combination with firewalls, hardened switch management and monitoring does it become a reliable boundary between zones.