Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm learning about vlans. The literature says that they provide improved performance and security by segrating the physical network into separate "virtual" networks.

I understand the performance bit . . . reducing traffic mostly. But the security part I don't get. I'm having troulbe envisioning what kind of threats exist at layer 2. What kind of data access is barred by a vlan?

share|improve this question

closed as off topic by EEAA, Tom O'Connor, Dave M, Khaled, mgorven Mar 20 '13 at 16:34

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

I probably can't answer this question completely, so I'll just put in a quick comment. 1 advantage of a vlan is that unless you've specifically configured and allowed them to, members on 1 vlan wouldn't be able to talk to another. So that's a huge security protection. – David W Mar 19 '13 at 22:04
IP subnetting would also prevent them from "talking", if by talking we mean stuff like ssh access. – chad Mar 20 '13 at 14:48
This question is clearly about "Network routing, switches, and firewalls", which is a valid topic as defined in FAQ. How is this question open to being closed? I asked for specific technical info about vlan security benefits. – chad Mar 20 '13 at 17:43
Suggested improvements? – chad Mar 20 '13 at 17:44

VLANs essentially can split your network into several seperate isolated networks. The security comes in by forcing certain ports to be part of a specific vlan.

One example would be a seperate vlan for guests in conference rooms. They can have internet access but not see the company's computers and servers.

Another would be in a datacenter with multiple people's servers. You want them to see their own servers but not each others. And those servers are probably spread out through several racks making it harder to give them their own router and switch and directly wire them to that switch. vLANs to the rescue - you can have a switch at each rack and each clients servers connected at layer 2 without being able to affect other clients. Without vlans in such a setup malicious servers could try to steal ip addresses from another users server.

If gives you almost all the security of running several isolated networks without the pain and expense of managing them seperately.

share|improve this answer
I appreciate this answer, but it's what I already knew. The part that I'm interested in is when you say that the separate vlans can't "see" each other. My question is what is the nature of this seeing? It's layer two right? So what sort of access does a "hacker" have to exactly what data? – chad Mar 20 '13 at 14:47
It works as though you had two seperate switches that are not connected together. They don't see each other at all unless you setup a router to route between the two vlans. – Grant Mar 20 '13 at 15:11
Again, Grant, I was looking for more specific things. I found some info myself and will edit your answer with some references. – chad Mar 20 '13 at 15:59

any communication between the vlans that you do not wish to occur.

say you accept credit card information into your switch on port 1, and port 2 is your receptionist's pc (a very contrived example). If they are on different vlans, the reception PC won't be able to see any traffic on the other vlan.

share|improve this answer
I want to know what "seeing" traffic could be, in terms of a concrete threat. – chad Mar 20 '13 at 14:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.