How to Configure VLANs on Managed Switches for IoT and Servers

Why segment your network with VLANs?

Imagine an office where guest network traffic, security cameras, and database servers all share the same cables and switches. In such a scenario, any compromised device on the IoT network could theoretically attempt to access your sensitive data directly. A VLAN (Virtual Local Area Network) is the technique that divides this large single network into smaller, isolated segments, acting as if there were multiple independent switches running inside one single piece of equipment.

In practice, this means a packet sent by a temperature sensor does not reach your servers unless you explicitly configure a route between them. This isolation is vital for corporate security, reducing the risk of lateral movement by attackers and optimizing performance, as each VLAN maintains its own broadcast domain. If you need more stability in complex environments, understanding how to use storm control on switches is the next logical step.

Understanding the difference between Access and Trunk ports

VLAN configuration on a switch relies on two main port types: Access and Trunk. The Access port is the most common; it connects an end device (like a computer, printer, or IoT sensor) and carries traffic only for a specific network, without the device knowing it is part of a VLAN. The switch strips any tags before delivering the data to the device.

The Trunk port, however, acts as a highway for multiple VLANs simultaneously. It is used to connect the switch to a router or another switch. For this to work, the switch adds a special identifier to each packet, the 802.1Q standard, which dictates which network that traffic belongs to. If you are building a more robust setup, you might want to check our guide on how to configure Port-Based VLANs on Managed Switches for CCTV to see specific applications.

Step-by-step: Configuring VLANs on your switch

Below, we present the logical procedure to create segmentation. While each manufacturer (such as Cisco, Aruba, or Ubiquiti) has its own interface, the CLI logic follows a standard. Replace the values with the IDs you have defined for your infrastructure.

1. Create the VLAN in the switch database: vlan 10 (for IoT) and vlan 20 (for servers).
2. Define the IoT device port as access: interface GigabitEthernet 0/1, switchport mode access, switchport access vlan 10.
3. Configure the server port in access mode as well: interface GigabitEthernet 0/2, switchport mode access, switchport access vlan 20.
4. Configure the trunk port to the router (the 'brain' that handles traffic between them): interface GigabitEthernet 0/48, switchport mode trunk, switchport trunk allowed vlan 10,20.

Final considerations on security and routing

Creating VLANs on the switch is only half the battle. Because the devices are in isolated segments, they will not communicate on their own. It is necessary for the router or a Layer 3 switch to perform Inter-VLAN routing. At this point, you should apply Firewall rules or Access Control Lists (ACLs) to allow only necessary traffic, such as a server collecting telemetry data from IoT sensors, without allowing the sensor to initiate connections to other network assets.

Maintaining network hygiene also involves continuous monitoring. If you notice unexpected traffic coming from ports that should be quiet, you may need to perform deeper analysis, as detailed in how to monitor network traffic on specific ports with tcpdump. Effective segmentation is not a one-time task, but a process of constant review to ensure that if a device is breached, the impact remains confined to its original segment.