Separating servers, staff, guests, cameras, IoT devices and other systems is one of the most useful functions of a managed network. VLANs provide the logical separation, while routing and access policies determine what can communicate.
Practical example: segmenting a 45-user office
Gateway policy controls which VLANs may communicate. Guest access can be restricted to the Internet.
Scenario: One managed switching environment carries servers, staff devices, VoIP, CCTV and guest WiFi.
| Example VLAN | Purpose | Example policy |
|---|---|---|
| 10 | Servers | Accessible only from authorised business networks |
| 20 | Staff | Access to approved internal services and Internet |
| 30 | Voice | Restricted to required voice and management services |
| 40 | CCTV | Camera traffic restricted to required recording and management systems |
| 50 | Guest WiFi | Internet access, blocked from internal business networks |
Decision: VLANs provide the logical separation. The router, firewall or Layer 3 policy determines which networks may communicate.
Common mistakes and selection checklist
Common mistakes
- Creating VLANs but allowing unrestricted routing between them.
- Using VLAN IDs without documenting IP subnets, DHCP, gateways and access policy.
- Configuring trunk and access ports inconsistently across switches and access points.
What happens if you get it wrong?
The network can look segmented while providing little security benefit, or devices can lose connectivity because tagged and untagged traffic is handled differently at each hop.
Selection checklist
- Define the purpose and subnet of every VLAN.
- Document which VLANs may communicate and on which services.
- Configure gateway or Layer 3 firewall policy explicitly.
- Verify access ports, trunks and native or untagged VLAN behaviour end to end.
- Test DHCP, DNS, Internet access and blocked inter-VLAN paths after deployment.
Example business segmentation
| Network | Example purpose |
|---|---|
| VLAN 10 | Servers and infrastructure |
| VLAN 20 | Staff workstations |
| VLAN 30 | Voice |
| VLAN 40 | CCTV and security devices |
| VLAN 50 | Guest WiFi |
The exact VLAN numbers are arbitrary. What matters is that the network has a documented structure and that traffic between the networks is controlled deliberately.
VLANs do not automatically provide security
Creating separate VLANs creates separate broadcast domains, but it does not by itself define which traffic is allowed between them. Inter-VLAN traffic must be handled by a router or Layer 3 switch and controlled using appropriate firewall or ACL policy.
Switch ACLs vs firewall rules
Ubiquiti describes firewall rules as the standard method for controlling traffic between VLANs or between the LAN and the internet. Switch ACLs can be used for device isolation within the same VLAN and, on supported switches, for performance-oriented Layer 3 restrictions.
802.1X and device authentication
UniFi also supports RADIUS-based 802.1X control. This can be used to authenticate wired clients and, in appropriate configurations, assign devices to VLANs based on authentication information.
Keep the design simple
Segmentation should solve a real problem. A small office does not need dozens of VLANs merely because a managed switch can create them. A practical design might separate staff, guest access, servers and security devices while keeping the rules easy to document and troubleshoot.
Technical information in this article is based on current manufacturer documentation available at the time of writing. Product availability and specifications can change.
Confirm the exact product specification, supported configuration and compatibility before ordering. Platform generation, firmware, licences and optional components can change what a product supports.