BlogInfrastructure & networking
VLANs explained: segmenting an office network
By Vicky Ogola, Senior ICT Consultant 1 min read
VLANs split one physical network into separate logical networks, so a compromised camera or guest laptop cannot reach your servers.
In many small networks, every device — laptops, servers, printers, CCTV cameras, guest phones — sits on the same flat network. If one device is compromised, everything else is reachable. VLANs fix that.
What a VLAN is
A virtual LAN is a separate logical network running over the same switches and cables. Devices in different VLANs cannot talk to each other unless a router or firewall allows it.
A sensible starting design
- **Staff** — laptops and desktops.
- **Servers** — reachable only on the ports staff actually need.
- **Voice** — IP phones, often with traffic prioritised.
- **CCTV and building systems** — cameras, access control, HVAC controllers.
- **Guests** — internet only, no access to anything internal.
- **Management** — switch and access point administration, restricted to IT.
Control traffic between VLANs
The value comes from the rules between segments. Start from "deny" and allow only what is needed: staff to the file server, the recorder to the cameras, nobody from the guest network to anything internal.
Document it
Keep a table of VLAN IDs, address ranges, purpose and allowed traffic. Without it, the next change undoes the design.
Need a network redesign? See our infrastructure and networking services.
About the author
Vicky Ogola
Senior ICT Consultant
Vicky Ogola writes about network design, connectivity, data centres and the infrastructure that business systems depend on.