Network segmentation without re-cabling
Isolation: split management, production, and storage traffic on the same switches. Performance: contain broadcast traffic so it does not flood the entire network. Flexibility: use 802.1Q tags to group devices logically, independent of physical location. A VLAN logically divides a single physical network into isolated broadcast domains, so devices are grouped by function rather than physical location.
Tags, Trunk and Access ports
Each VLAN is identified by a VLAN ID carried inside the 802.1Q tag. Access ports put an end device on a single VLAN; Trunk ports carry multiple VLANs between switches. In data centers, out-of-band management interfaces usually sit on a dedicated management VLAN, isolated from production traffic. Key advantages: isolated management network, tenant/environment separation, smaller blast radius for broadcasts, segment-specific security policies, simpler compliance boundaries.