Dipak D. Kuthe · Originally published May 30, 2026
Start with a list of who needs to reach what. A VLAN separates Ethernet broadcast domains. The gateway and the policy at the actual routing boundary determine which routed connections can cross between VLANs. Write those decisions down before moving switch ports or Wi-Fi clients.
Plan the VLANs, subnets, and gateways
Group devices by access needs. Give each routed VLAN its own subnet and record its gateway, DHCP scope or relay, and approved DNS resolvers. Identify where packets cross between VLANs. If a Layer 3 switch routes between them, an internet-edge firewall only sees traffic that is routed through it. Enforce policy at the actual routing boundary. Review IPv6 alongside IPv4. Cisco inter-VLAN routing guide · NIST firewall guidance
Example topology for a small office
Fictional design. CoreSecTech did not configure or test this network. The VLAN IDs, private subnets, and hostnames are example values. Choose addresses that do not overlap your existing networks or VPNs.
Staff PC ── access VLAN 10 ──┐
Printer ─── access VLAN 30 ──┼── Managed switch ── 802.1Q trunk ── Firewall/router ── Internet
Admin PC ── access VLAN 40 ──┤ VLANs 10, 20, 30, 40
Wi-Fi AP ── VLAN 20 / 40 ────┘
Guest SSID / AP management| VLAN | Purpose | Example subnet and gateway | First access decision |
|---|---|---|---|
| 10 | Staff | 10.20.10.0/24, 10.20.10.1 | Allow required business services and the designated printer service. |
| 20 | Guest | 10.20.20.0/24, 10.20.20.1 | Allow approved DNS and internet access. Deny access to office services and management interfaces. |
| 30 | Printers | 10.20.30.0/24, 10.20.30.1 | Allow printing from approved staff devices or the print server. Restrict printer administration separately. |
| 40 | Management | 10.20.40.0/24, 10.20.40.1 | Allow designated admin devices to reach approved management services. |
The VLAN ID identifies the Layer 2 network. The subnet is its IP address range. The gateway in this design is the firewall/router address clients use to reach another IP network. The firewall/router owns the four gateway interfaces, so routed traffic between these VLANs crosses its policy. An example rule allows Staff to reach the single test printer service at 10.20.30.25 on TCP 631. A separate rule denies Guest access to that service and other office resources. Review the rule order so a broader permit does not override the intended restriction. Traffic between devices in the same VLAN may never reach this firewall. Use host or switch controls where same-VLAN isolation matters. Cisco routing example · NIST firewall guidance
Map ports and trunks before moving devices
An access port typically places untagged endpoint traffic into one VLAN. In the example, the staff PC uses VLAN 10 and the printer uses VLAN 30. An 802.1Q trunk carries multiple VLANs between devices configured to handle the tags. Verify the switch and firewall allow the same required VLANs. If a native or untagged VLAN is used, agree on its ID and tagging behavior at both ends.
Map the Guest SSID to VLAN 20. In this design the AP uses a separate management VLAN, so its uplink carries VLANs 20 and 40 as required by that AP’s tagging configuration. Review unused access ports separately. A voice VLAN can help classify traffic, but QoS and call quality still depend on traffic policy and available capacity.
These principles are vendor-neutral. Switch interface syntax, native VLAN defaults, trunk verification commands, and AP behavior depend on the product and software version. Use the applicable device manual before entering configuration commands. Cisco VLAN trunk configuration example
Pilot one floor before moving the rest
Move one authorized staff test device and one guest test device. Verify each client’s address, gateway, and DNS settings first. If a client fails to obtain DHCP after a move, inspect the access-port or SSID mapping, trunk allowance, and DHCP scope or relay before changing firewall policy.
For the printer pilot, use a controlled IPP test service on TCP 631. Replace the documentation-only hostname with your authorized test endpoint. Run the same check on the staff and guest Windows devices.
Test-NetConnection -ComputerName print-test.office.example -Port 631| Check | Expected result |
|---|---|
| Staff addressing and resolution | The staff test device has a VLAN 10 address, uses its intended gateway and DNS, and resolves the test name to the intended service. |
| Staff to test printer | TcpTestSucceeded: True when the service is healthy and the path is approved. A harmless test page also prints successfully. |
| Guest to the same printer service | TCP fails and the attempted connection is visible in the matching deny log or rule counter. If guest DNS deliberately does not resolve the internal name, record that separately. Use the known test IP for the authorized firewall check so that a DNS failure does not substitute for an observed deny. |
| Guest to approved internet destination | DNS and the intended internet test succeed. This confirms the guest VLAN has working connectivity while office access is restricted. |
| Management | The designated admin path works. Test that unapproved sources cannot reach the management interface. |
| IPv6, if enabled | Repeat the applicable allowed and denied checks using IPv6. Compare the address selected by the client with the address family you intended to test. |
A failed TCP check can also mean the service is stopped, the destination is wrong, or the network is unavailable. Establish the permitted path first and correlate the denied attempt with rule evidence. A successful TCP connection proves reachability on that port. The test page checks the printing workflow itself. Microsoft Test-NetConnection reference · Office network security verification guide
Roll back the pilot if a required path fails
Save the approved switch, AP, and gateway configurations before the change. Keep a management path independent of the ports and rules being changed. Record which pilot port, SSID mapping, or gateway rule you will restore if a required service fails or management is lost. Restore the previous approved setting for the affected pilot scope. Recheck DHCP, DNS, management access, the approved printing path, and the expected guest restriction before expanding the rollout.
Segmentation limits where traffic can go. Continue to authenticate and authorize users at sensitive applications. NIST Zero Trust Architecture