Network Segmentation with VLANs: A 2026 Refresher
R
RAMOJ Security Team
Why Segment?
One compromised endpoint on a flat /23 can pivot to every printer, CCTV, HVAC controller, and staff laptop in the building. VLANs + inter-VLAN ACLs limit blast radius.
Standard VLAN Layout (Mid-Size Office)
| VLAN ID | Name | Subnet | DHCP Scope |
|---|---|---|---|
| 10 | Management | 10.10.10.0/24 | static only |
| 20 | Staff Wired | 10.10.20.0/23 | 500 hosts |
| 30 | Staff Wi-Fi | 10.10.30.0/23 | 500 hosts |
| 40 | Guest Wi-Fi | 10.10.40.0/24 | 200 hosts, internet-only |
| 50 | VoIP | 10.10.50.0/24 | QoS-tagged |
| 60 | CCTV/IoT | 10.10.60.0/24 | isolated, no internet |
| 70 | Printers | 10.10.70.0/24 | reachable from VLAN 20/30 only |
| 99 | Native (disabled) | — | no devices |
Inter-VLAN Rules
- Management (10) reachable only from admin workstations
- Guest (40) has zero access to any internal VLAN
- IoT/CCTV (60) isolated from everything except NVR server and NTP
- Printers (70) reachable from Staff VLANs only, outbound denied
Native VLAN Hardening
Always change the native VLAN from the default (1) to an unused, shutdown VLAN (e.g., 999). Prevents VLAN hopping attacks. Enable bpduguard, stormcontrol, and dhcp snooping on all access ports.
Looking for the right hardware?
Browse our full range of enterprise IT hardware with expert pre-sales support.
Need a custom quote?
Our certified engineers respond within 2 business hours.