In many companies, every device sits on the same network: staff computers, servers, printers, security cameras, IP phones and even guests’ phones on Wi-Fi. This is called a “flat network.” While the network is small, no problems show up. But as the business grows, two serious issues appear: security and performance.
What’s Wrong with a Flat Network?
- Security: if one computer or one cheap camera is infected, it has direct access to the finance server and every other device. This is exactly how ransomware spreads across a network.
- Excess traffic: broadcast messages that every device must hear increase as the network grows and drag down performance.
- Difficult troubleshooting: when everything is on one network, finding the source of a problem or controlling a specific group’s access is very hard.
What Is a VLAN?
A VLAN, or virtual local area network, is a way to divide one physical switch into several separate logical networks. Devices in each VLAN only see each other. For traffic to flow between VLANs, it must pass through a router or firewall, and that is where you can define exactly who can access what.
In other words, you segment the network without running new cables or buying a separate switch for each department. All you need is managed switches.
A Sample Design for a Midsize Company
- Users VLAN: staff computers.
- Servers VLAN: domain, file and finance servers, and virtual machines.
- Management VLAN: management interfaces for switches, the firewall, server iLOs and UPS units; for the IT team only.
- Voice VLAN: IP phones, with prioritization for voice traffic.
- Cameras and smart devices VLAN: cameras, time and attendance devices, and devices that rarely receive security updates.
- Guest VLAN: guest Wi-Fi with internet access only.
Golden rule: devices you trust less (cameras, guests, smart devices) should never have access to your servers.
Rules Between VLANs
The real value of VLANs lies in the rules between them. For example:
- Users can reach only the required ports on servers, not every port.
- The management VLAN is accessible only from IT team computers.
- Cameras communicate only with the recorder (NVR) and have no access to the internet or the rest of the network.
- Guests have internet access only.
Rollout Steps Without Downtime
- Inventory: document all devices and their current IP addresses.
- Addressing plan: assign a separate address range to each VLAN, for example 10.10.X.0/24 where X is the VLAN number, so it stays readable.
- Prepare switches and the firewall: create the VLANs, the trunk ports between switches and an interface for each VLAN on the firewall or router, and configure DHCP for each segment.
- Phased migration: move devices group by group, usually starting with guests and cameras, which carry less risk.
- Tighten the rules: start with open rules and log the traffic, then allow only the connections that are needed.
- Documentation: record the VLAN map, address ranges and rules.
Common Mistakes
- Using the default VLAN (VLAN 1) for users or management.
- Creating VLANs without rules between them, which means segmentation exists only on paper.
- Forgetting DHCP and DNS for new VLANs.
- Not documenting changes; a few months later, nobody knows which port belongs to which VLAN.
Network segmentation is one of the most effective, low-cost security measures you can take. If your network is still flat, ITPlus724 engineers can design a VLAN plan that fits your company and roll it out without disrupting work.