VLANs and Access Ports

In our last lesson, we saw how a single flat network becomes noisy and unsafe as more people join the office. The old-fashioned way to separate teams was blunt: buy one switch for Sales, buy another switch for Engineering, and buy a third switch for HR. But mounting three half-empty switches in your office closet costs three times as much money, takes up valuable rack space, and turns cabling into an untidy mess.

Modern networks solve this cleanly with Virtual Local Area Networks (VLANs). Instead of buying extra metal boxes, your switch software creates virtual walls between its ports. You can think of a 24-port switch as having multiple independent mini-switches running side by side inside the same physical case.

Understanding Access Ports

To put this idea to work, an administrator configures the switch ports. On enterprise switches, ports generally operate in one of two modes: Access Ports or Trunk Ports. In this lab, we focus entirely on Access Ports.

An access port belongs to exactly one team or department (one VLAN). You plug normal computers, laptops, and printers into access ports. What makes this design so friendly is that user computers never even know VLANs exist:

• Normal Computer Traffic: Your laptop sends standard, everyday network frames. It does not know or care which VLAN it belongs to.
• Switch Adds an Internal Sticker: The split second that frame enters port Fa0/1, the switch notes: "This came through the Sales door (VLAN 10)."
• Hardware Wall Enforcement: When the switch decides where to forward that frame, it follows an iron rule: "Traffic that entered on VLAN 10 can only leave through ports assigned to VLAN 10." Even if someone broadcasts a message to everyone, ports on VLAN 20 will stay completely quiet.
• Clean Delivery: As the frame leaves port Fa0/2 on its way to another Sales computer, the switch removes its internal sticker, delivering a clean, standard frame to the destination.

Switch Port	VLAN Number	Department	IP Subnet	Connected Device
FastEthernet 0/1	VLAN 10	Sales	192.168.10.0/24	Sales Laptop 1 (.10)
FastEthernet 0/2	VLAN 10	Sales	192.168.10.0/24	Sales Laptop 2 (.11)
FastEthernet 0/3	VLAN 20	Engineering	192.168.20.0/24	Engineer PC 1 (.10)
FastEthernet 0/4	VLAN 20	Engineering	192.168.20.0/24	Engineer PC 2 (.11)

Why IP Subnets Match VLANs

Notice how VLAN 10 uses 192.168.10.0/24 and VLAN 20 uses 192.168.20.0/24. As a best practice in network engineering, every VLAN gets its own unique IP subnet. This makes reading IP addresses simple: any technician glancing at 192.168.10.25 instantly knows the device sits in the Sales department.

Assigning a distinct subnet to each VLAN also matches how operating systems make routing decisions. Because Sales and Engineering have different network prefixes, computers know they cannot speak directly at Layer 2 and must look for a router to cross departmental boundaries.

Field Story: The Accidental Port Swap

One of the most frequent support tickets in offices happens when facilities staff reorganize desks over the weekend. A cleaner or employee unplugs cables from wall jacks and plugs an engineering laptop into an access port configured for VLAN 10.

The engineer boots their computer, but suddenly cannot open code repositories or private build servers. Why? Because the switch sees their traffic entering a Sales port and blocks access to the Engineering network. Understanding how access ports work makes it easy to check the switch port configuration and reassign it to the right department.

Moving Beyond a Single Switch

Segregating teams on a single switch works smoothly when everyone sits in the same room. But what happens as the company grows across multiple floors or into a neighboring building? Running dozens of cables between switches—one cable for every single department—quickly becomes untidy and impractical.

In our next chapter, we will see how an 802.1Q Trunk Port allows multiple departments to travel safely across a single shared physical cable. You will see how switches add temporary 4-byte tags to Ethernet frames so traffic never gets mixed up across building floors.