The invisible walls that saved our network

How a week in a Cisco lab taught me that the most powerful security tool isn’t a firewall, it’s a VLAN.

It was a Monday morning in the Ankrah lab. I sat down in front of Rack 4 with a router, a switch, a tangle of CAT6 cables, and realised I had no idea where to begin. By Friday, I would understand something that no lecture had quite managed to make visceral: that segmenting a network isn’t just an administrative convenience. It is the difference between a building with open corridors and one with locked doors on every floor.

This is the story of that week, and of the surprisingly elegant concept at the heart of it.

First, the chaos of a flat network

Before I touched a VLAN command, I had to understand what a network looks like without them. Imagine everyone in a university, students, lecturers, IT administrators, guests on the Wi-Fi, all sharing a single network segment. Every device hears every broadcast. A student’s laptop shouts “who has this IP address?” and every other device on the floor listens, processes it, and discards it. Multiply that by hundreds of devices and the noise becomes staggering.

But noise is the minor problem. The major problem is that in a flat network, there is nothing stopping a curious student from poking at an administrator’s management interface. There is no logical wall between the person streaming a movie in VLAN 191 and the person maintaining the switch in VLAN 140. They are, from the network’s perspective, neighbours.

“A flat network isn’t just inefficient, it’s an open invitation. VLANs are how you revoke that invitation without pulling a single cable.”

What a VLAN actually is

A Virtual Local Area Network is a logical boundary drawn inside a physical switch. Without VLANs, every port on a switch is part of the same conversation. With VLANs, you can tell the switch: ports 1 through 10 belong to the Students group; ports 11 through 16 belong to Staff; port 21 is reserved for management. Each group forms its own isolated broadcast domain, even though all the cables plug into the same physical box.

The switch enforces these boundaries in hardware, at line rate. It costs nothing in performance. It requires no extra hardware. And it means that a broadcast from a student device never even reaches a staff device, let alone an administrator’s workstation.

NETWORK SEGMENTATION

Flat network

VLAN segmented

The nine VLANs of Rack 4

During the workshop, our Rack 4 configuration used nine VLANs to serve a multi-group campus environment. Three groups shared the physical infrastructure but were kept completely isolated from each other at the switch level.

VLANs for RACK 4

Notice the management VLAN, 140. This is the most security-critical VLAN on the entire rack. It is the only segment from which an administrator can SSH into the switch and change its configuration. By isolating it onto its own subnet completely unreachable from student or staff VLANs without an explicit routing decision , we ensure that no student, regardless of technical skill, can accidentally or deliberately reach the device management plane.

Why this matters in practice: In 2023, a significant proportion of documented campus network breaches involved lateral movement from student-accessible segments to administrative infrastructure. VLAN isolation is the architectural control that makes such movement require deliberate, detectable routing policy, not just a port scan.

The moment it clicked, a failed ping

In the workshop, after we had configured the VLANs but before we had set up Router-on-a-Stick inter-VLAN routing, I tried to ping a device in VLAN 192 from a workstation in VLAN 191. The ping failed. Completely. Not a single reply.

My first instinct was that something was broken. I spent twenty minutes checking cables and rechecking configurations. An instructor walked over, watched me work, and quietly said: “It’s not broken. That’s the point.”

The VLANs were working exactly as designed. Without a Layer 3 routing decision explicitly allowing traffic between those two subnets, they are as isolated as if they were on opposite sides of a physical wall. The network was doing precisely what I had configured it to do; I just hadn’t yet appreciated what that meant.

“Security isn’t always loud. Sometimes it’s a ping that goes nowhere, and the silence is exactly right.”

Inter-VLAN routing, opening the right doors

Of course, complete isolation is not the goal. Students still need to reach the internet. Staff need to access shared servers. The point of VLANs is not to prevent all communication — it is to make communication a deliberate, controlled, auditable decision rather than a default.

We implemented Router-on-a-Stick on the router, dividing interface Fa0/1 into logical subinterfaces, one per VLAN, each acting as the default gateway for its respective segment. Traffic between VLANs now had to traverse the router, where it could be inspected, logged, and filtered. The router became the gatekeeper: it decided what was allowed to cross the walls, and what was not.

This is the architecture that underlies every serious campus and enterprise network in the world. VLANs build the walls. Routing policies open the right doors. Together, they turn a flat, undifferentiated network into something that can meaningfully enforce an organisation’s security policy.

What the lab taught me that textbooks couldn’t

I had read about VLANs before this workshop. I could define them, recite their benefits, draw a diagram of 802.1Q tagging on an exam. But sitting in front of a real switch with a console cable, watching a ping fail because the VLAN boundary held, taught me something that the textbook never quite conveyed: VLANs are not an abstraction. They are a physical enforcement mechanism implemented in silicon.

The switch does not ask permission. It does not consult a policy document. When a frame arrives on a port assigned to VLAN 191, the switch tags it, forwards it only to other VLAN 191 ports, and discards it at every other boundary. That enforcement is happening millions of times per second, invisibly, at every port. It is one of the most elegant and dependable security mechanisms in all of networking.

By the end of Friday, after verifying DHCP bindings, watching OSPF converge, and streaming a live video across the network from another rack using VLC, I had a very different relationship with the humble VLAN than I had walking in on Monday morning. It is not a feature. It is the foundation.

Thank you!