How to configure VLAN on switch port and isolate network

Why separate corporate traffic from IoT devices?

In modern businesses and even smaller offices, the number of internet-connected devices has exploded. Security cameras, smart bulbs, printers, and voice assistants share the exact same physical space as computers holding financial data and confidential spreadsheets. In practice, this means that if a cheap smart bulb suffers a breach due to a firmware vulnerability, the intruder gains free rein to roam across the entire network.

To prevent this security nightmare, network engineering uses the concept of VLAN, which stands for Virtual Local Area Network. Instead of buying multiple routers and separate physical cables for each type of device, a VLAN allows slicing a single managed switch into several logically isolated networks. Thus, the finance department computer and the security camera communicate through the same hardware equipment, but live in completely separate universes, as if they were in different buildings.

How access and trunk ports work

To configure a VLAN, you must first understand the two fundamental roles a switch port plays: the access port and the trunk port. The access port is where we plug in the ordinary end device, such as a computer, printer, or smart TV. It does not know what a VLAN is; it simply receives raw data from the device and injects it into the internal network with an invisible tag applied by the switch itself.

The trunk port, on the other hand, is the cable that connects one switch to another switch, or a switch to a core router. It needs to carry data from multiple VLANs at the same time over the same physical cable. For this to happen without confusion, the switch uses the international standard IEEE 802.1Q, which is nothing more than a numerical label attached to the data packet informing exactly which virtual network it belongs to. When configuring this setup, remember that advanced network traffic inspection techniques help validate whether VLAN tags are traveling correctly across trunk ports without drops or corrupted packets.

Step-by-step guide to configuring VLAN on a managed switch

The exact process varies slightly among brands like TP-Link, Cisco, HP, or Netgear, but the configuration logic is universal. The first step involves accessing the web interface or command line interface (CLI) of your managed switch using a browser and the equipment's management IP address. Once logged in, look for the VLAN configuration tab, often found inside the switching or L2 features menu.

Below is the typical sequence of commands in a CLI-style switch to create VLAN 20, name it IoT, and assign a specific port to it:

enable
configure terminal
vlan 20
name IoT-Devices
exit
interface gigabitEthernet 0/5
switchport mode access
switchport access vlan 20
end
write memory

In the example above, we created the numerical identifier 20, named the network IoT-Devices, and forced port number 5 to function exclusively as an access port for this VLAN. Any device connected to port 5 will now belong solely to this isolated network.

Validating isolation and testing connectivity

After applying the VLAN configurations in the switch panel, engineering work still requires a crucial validation step. Connect a test computer to the configured port and check which IP address it received via the DHCP protocol (Dynamic Host Configuration Protocol, the system that automatically distributes IP addresses on the network). If the isolation worked perfectly, the test computer will receive an IP from the range reserved for the IoT VLAN, rather than the main company network.

Another essential test is attempting to access core servers from the isolated device. Traffic should be blocked by default unless you explicitly configure routing and firewall rules on a router or edge firewall connected to the switch's trunk port. If any essential corporate service fails right after segmentation, verify that the port linking the switch to the router was correctly configured as a trunk and carries all necessary VLANs. To complement this implementation in production environments, see our related technical analyses on How to test the motherboard PWM circuit on the bench and How to clean systemd journal cache and free up disk space.

Final considerations on network segmentation

Implementing VLANs on managed switches represents one of the most cost-effective and efficient security barriers to protect corporate and residential environments against unwanted access. By preventing vulnerable devices, such as smart appliances or IoT sensors, from sharing the same logical space with sensitive data, the infrastructure attack surface is drastically reduced. Proper port planning and mastery of access and trunk concepts ensure a stable, scalable network resilient to unforeseen failures.