How to configure VLANs and inter-VLAN routing on switch

Why segment your corporate network with VLANs

When a computer network grows beyond a handful of devices, keeping everything in the same physical and logical space becomes a severe operational risk. In practice, this means any smart lightbulb, security camera, or cheap printer connects to the exact same channel where sensitive financial data flows. To solve this security challenge, we use VLANs, which are virtual networks capable of slicing a single physical switch into several logically isolated compartments. Instead of buying new cables and hardware for each department, the administrator issues commands so specific switch ports belong exclusively to their own virtual universe, blocking any unauthorized direct conversation between them. This isolation is the foundation of a secure network architecture for critical services, ensuring guest or IoT traffic never collides with core business servers.

The silent danger of IoT devices on the network

Internet of Things (IoT) devices have become the Achilles' heel of many modern corporations. Cheap IP cameras, thermostats, and voice assistants run simplified operating systems, often riddled with known security flaws and lacking periodic firmware updates from manufacturers. In practice, if an attacker discovers a vulnerability in a smart lightbulb connected to the main network, they gain a free pass to scan every computer at neighboring desks, steal passwords, and encrypt files. By isolating these devices into a dedicated VLAN, we create an impassable barrier at the data link layer. Even if the IoT equipment is fully compromised, it remains confined to a digital island with no direct routes to the rest of the business infrastructure, mitigating catastrophic damage.

Understanding Access and Trunk ports on the managed switch

To make this segmentation magic happen, we must master the two fundamental port types on a managed switch: the Access port and the Trunk port. An Access port is where we connect end devices like computers and printers. It strips any identification tag from outgoing packets and adds a standard tag to everything coming in, treating the final equipment as if it were alone on the network. The Trunk port, on the other hand, is the highway interconnecting different switches or linking the switch to a central router. Across it, packets travel accompanied by a colored tag (following the IEEE 802.1Q standard), indicating exactly which VLAN each piece of data belongs to. Thus, a single network cable between two switches can carry dozens of different VLANs without mixing information streams, optimizing costs and simplifying cable routing through conduits.

How to securely enable inter-VLAN routing

As the name suggests, VLANs isolate networks in such a way that computers on one VLAN cannot see computers on another, which is great for security but terrible if an employee needs to access the file server. To allow these islands to exchange data in a controlled manner, we must enable inter-VLAN routing. In practice, this means placing an intelligent gatekeeper between networks—which can be a dedicated router or an advanced Layer 3 switch. When a computer on VLAN 10 wants to talk to the server on VLAN 20, the data packet travels to this central router. It is at this exact transit point that we apply access control rules, deciding who can talk to whom based on IP addresses, service ports, and authorized protocols.

Implementing Layer 2 and Layer 3 firewall rules

The security of a segmented network depends not only on physical or virtual isolation, but primarily on traffic policies applied at layers 2 and 3 of the OSI model. Layer 2 rules operate based on the physical (MAC) addresses of network cards, blocking connections at the hardware level before the IP protocol is even processed. Layer 3 rules, conversely, function as access control lists (ACLs) on the router, inspecting IP packets to block unwanted traffic between subnets. In practice, we can configure a rule allowing management computers to access the IoT printer, but strictly forbidding the IoT VLAN from initiating any connection back into the administrative network. This turns the firewall into a surgical filter, releasing only what is strictly necessary for business operations and blocking the rest by default.

Basic step-by-step to configure VLANs on the switch

To get hands-on with a standard market managed switch, the initial procedure requires access via command-line interface (CLI) or web GUI. Below, we detail the fundamental commands to create VLAN 10 (Corporate) and VLAN 20 (IoT), configure ports, and define a trunk port. Remember to adapt interface numbers according to your equipment model. Execute the commands below carefully to avoid losing remote access to the switch during the process. To complement this implementation in production environments, see our related technical analyses on Slow Linux disk? How to spot IOPS bottlenecks and latency and Why use Row-Level Security in PostgreSQL to isolate tenants.

1. Access the switch via console cable or SSH and enter global configuration mode by typing the initialization command.
2. Create the desired VLANs in the switch database and assign descriptive names for easier future identification.
3. Configure the access ports for end devices by associating them with the correct VLAN and define the trunk uplink port for router interconnection.

enable
configure terminal
vlan 10
name Corporate
vlan 20
name IoT
interface gigabitethernet 0/1
switchport mode access
switchport access vlan 10
interface gigabitethernet 0/2
switchport mode access
switchport access vlan 20
interface gigabitethernet 0/24
switchport mode trunk
end
write memory

Final considerations on network resilience and maintenance

Configuring VLANs and inter-VLAN routing on a managed switch is a turning point in the operational maturity of any IT infrastructure, whether in a small business or an advanced homelab environment. Keeping topology documentation up to date and periodically reviewing firewall rules ensures future changes do not open unwanted breaches. With proper isolation of IoT devices and rigorous traffic control at lower layers, you protect sensitive data against external and internal threats, ensuring technology works in favor of business productivity and peace of mind.