TechKnowSurge
TechKnowSurge Catalog Videos Logical Segmentation
VideoSecurityFree

Logical Segmentation

VLANs enable logical network segmentation by dividing a single physical switch into multiple isolated networks, reducing hardware costs while maintaining traffic separation. This approach supports organized, secure network design without requiring dedicated switches for each segment.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network segmentation is a fundamental security practice, but building it entirely on dedicated physical hardware — separate switches for every segment — quickly becomes expensive and complex to manage. VLANs, or virtual local area networks, address this by allowing a single physical switch to be partitioned into multiple logically isolated networks. Ports on the switch are assigned to specific VLANs, and devices connected to ports within the same VLAN can communicate freely with each other at layer 2, while traffic between VLANs is blocked unless explicitly routed. This makes it possible to create segments such as operations, sales, server, and guest networks without purchasing additional switching hardware for each one. Logical segmentation is particularly powerful in environments that span multiple physical locations. Devices spread across different buildings can be grouped into the same VLAN based on their function or security requirements rather than their physical location, giving administrators flexible, centralized control over traffic flow. This separation helps enforce least-privilege network access and reduces the attack surface between different parts of the organization. Despite their utility, VLANs are not a universal solution. Certain regulatory frameworks, most notably PCI DSS for organizations that process payment card data, require sensitive systems to be isolated on dedicated physical networks rather than logically separated ones. VLANs do not satisfy that requirement. Understanding where logical segmentation is sufficient and where physical separation is mandated is an essential part of designing a compliant and secure network architecture.

What you'll learn

What's covered

VLANs and Logical Segmentation

Key terms

Virtual LAN
VLAN
A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Network Segmentation
The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.
Layer 2
The Data Link layer of the OSI model, responsible for MAC addressing and frame delivery on a local network.
Switch
A network device that connects devices within a LAN and forwards traffic based on MAC addresses.
Broadcast Domain
A network segment in which a broadcast sent by one device is received by all other devices within that segment; routers define the boundaries of broadcast domains by not forwarding broadcast traffic.
Physical Network Separation
The use of entirely distinct physical hardware to isolate network segments, required in some compliance scenarios such as PCI DSS where logical separation alone is insufficient.

Topics

Vlans Network Segmentation Layer 2 Broadcast Domains Pci Dss Network Security Networking

Transcript

If we're practicing proper network segmentation, it can get expensive. Let's say we're buying a bunch of switches to support all of these LANs. Maybe we're buying extra equipment, and that can get costly. But there's another way we can do that, and that's with logical segmentation.

Logical Segmentation with VLANs

Let's say we're segmenting our network into operations, sales, and guest. What we're going to do is create separate IP ranges for each one of these networks. But we have a problem, because we're also buying switches for each one of these networks. This creates a lot more switches that we have to manage. Not only that, but just the cost of each one of those switches can be very expensive. Each one of those switches could cost a lot of money.

Instead of having separate switches, we could use something called VLANs, or virtual local area networks. What it does is it allows us to break this switch into separate networks. So maybe we would assign the first few ports to be part of VLAN 1, and the next set of ports would be part of VLAN 2, and the next set of ports would be part of VLAN 3, and then the next set would be part of VLAN 4, and so on and so forth. We would assign different ports to be parts of the VLANs. Now, anything that's connected into this set of ports could communicate back and forth, but they won't communicate to another VLAN, at least from a layer 2 perspective.

Physical Versus Logical

We call this logical segmentation. Logical segmentation allows us to break things apart differently than what they actually look like from a physical perspective. Over here on the left hand side, we see how it's physically set up. We have building A with a switch, building B with a switch, building C with a switch. We've got an annex down here with a switch. But let's say we have different devices in each one of these networks that need to be assigned to an administration VLAN, or an operations VLAN, or a sales VLAN, or a server VLAN, or whatever we create to segment out these networks.

This doesn't work in all cases. For instance, PCI DSS, which is a compliance if you're going to process credit cards, needs to be broken apart on their separate physical network. You can't use VLANs. So it has its limitations, but in a lot of cases these VLANs are great to implement to create some security and be able to control the traffic on your network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →