Network & IP Reference

VLAN Planning Reference Chart

Quick reference for VLAN ID ranges, common VLAN assignments, 802.1Q trunking rules, inter-VLAN routing guidance, and planning mistakes to avoid. Use for fast orientation, then use the VLAN Planner for a structured export.

Use VLAN planner Back to charts

Terms

VLANVirtual Local Area Network: A way to split one physical network into several separate, isolated virtual networks using the same cables and switches — like having several private lanes on one road instead of building separate roads.

VLAN ID ranges

IEEE 802.1Q defines VLAN IDs from 1 to 4 094. Range handling varies slightly by vendor and VTP mode.

VLAN ID range	Label	Notes
1	Default VLAN	All ports start here. Leave devices on VLAN 1 only by explicit intent. VLAN 1 carries untagged control traffic on most switches.
2 – 1 001	Normal range	Standard VLANs for most deployments. Stored in VLAN database (vlan.dat on Cisco). Supported by all 802.1Q switches.
1 002 – 1 005	Cisco legacy	Reserved for legacy FDDI and Token Ring. Cannot be deleted or reassigned on Cisco IOS. Not used in modern designs.
1 006 – 4 094	Extended range	Requires VTP transparent mode or VTP v3 on Cisco. Supported on most modern switches. Used in large or multi-tenant designs.
4 095	Reserved	Reserved by IEEE 802.1Q. Not usable.

Common VLAN assignments

These are recommended starting points. Adapt VLAN IDs and subnets to your site numbering scheme. A consistent pattern (VLAN ID = third octet of subnet) makes the design readable at a glance.

VLAN ID	Name	Purpose	Example subnet	Planning note
1	Default	Untagged / unassigned	`Varies`	Avoid placing infrastructure here. Separate management traffic.
10	Management	Switch, AP, router management interfaces	`10.x.10.0/24`	Access only from authorised management stations.
20	Data / Users	Workstations, laptops, wired users	`10.x.20.0/24`	Largest VLAN by device count in most deployments.
30	Voice	VoIP phones, softphones	`10.x.30.0/24`	QoS marking critical. Separate from Data for call quality.
40	Servers	Internal application and file servers	`10.x.40.0/24`	Restrict inter-VLAN access with ACLs or firewall rules.
50	IoT / OT	IP cameras, printers, sensors, BMS	`10.x.50.0/24`	Isolate from Data and Servers. Block lateral movement.
60	Guest Wi-Fi	Unmanaged visitor devices	`10.x.60.0/24`	Internet-only. Block all access to internal VLANs.
99	Native / Trunk	Untagged trunk traffic	`None`	Use an unused VLAN as native VLAN. Never carry user traffic.
100+	Storage / Backup	iSCSI, NFS, backup target traffic	`10.x.100.0/24`	High bandwidth. Dedicated ports or link aggregation recommended.

Pattern tip:Aligning VLAN ID with the third octet of the subnet (VLAN 10 → 10.x.10.0/24, VLAN 20 → 10.x.20.0/24) makes the plan self-documenting and reduces misconfiguration risk when entering ACL rules manually.

802.1Q trunking rules

A trunk port carries multiple VLANs tagged with 802.1Q headers.
Each trunk has a native VLAN — traffic on this VLAN is sent untagged.
Always set native VLAN to an unused VLAN (e.g. 99) on trunk ports between switches.
Access ports carry a single VLAN and strip the tag before delivery to the host.
Voice ports use a hybrid mode: one VLAN tagged for voice, one untagged for data.
Unused ports should be disabled and assigned to an unused VLAN to prevent unauthorised access.

Trunk = multiple tagged VLANs · Access = one untagged VLAN · Native = untagged on trunk

VLAN planning workflow

Define security boundaries first — which device groups must never communicate directly.
Assign VLAN IDs using a consistent numbering convention (match to third octet of the subnet).
Plan one subnet per VLAN — keep the subnet smaller than the VLAN needs to hold today.
Define inter-VLAN routing rules: which VLANs may talk to which, and what is blocked.
Configure trunk ports between switches with explicit allowed VLAN lists.
Set native VLAN to an unused ID on all trunks.
Disable and quarantine unused switch ports.
Document VLAN ID, name, subnet, gateway, purpose, and allowed communication for each VLAN.

Common mistakes

Leaving all devices on VLAN 1 — exposes management traffic to all users.
Not documenting VLAN assignments — causes conflicts when expanding the network.
Using the same VLAN across different security zones (e.g. IoT and servers on the same VLAN).
Allowing all VLANs on trunks by default instead of specifying an allowed list.
Setting native VLAN to VLAN 1 on trunk ports — creates VLAN hopping attack surface.
Assigning overlapping subnets to different VLANs, causing routing table conflicts.

FAQ

Do VLANs replace firewall rules?

No. VLANs provide Layer 2 segmentation. Inter-VLAN routing happens at Layer 3 (router or Layer 3 switch). Without explicit ACLs or firewall rules, a Layer 3 switch will route freely between all VLANs. Always enforce inter-VLAN policy at the routing layer.

What is VLAN hopping and how do I prevent it?

VLAN hopping exploits the native VLAN or DTP auto-negotiation to gain access to other VLANs. Prevent it by: setting native VLAN to an unused ID, disabling DTP on all non-trunk ports, and explicitly specifying allowed VLANs on every trunk.

Can I put VoIP and data on the same VLAN?

Technically yes, but not recommended. Separate voice VLANs allow QoS marking to prioritise call traffic without relying on the host endpoint to mark correctly. Most IP phones support a voice VLAN (tagged) alongside a data VLAN (untagged) on the same port.

How many VLANs should a site have?

Start with the minimum that reflects your security boundaries — typically 4 to 8 VLANs for a medium-sized office (management, data, voice, IoT, guest, servers). More VLANs add operational complexity. Add new VLANs when a security boundary genuinely requires it, not for tidiness alone.

Next step

Need a structured VLAN plan?

Use the VLAN Planner to define all VLANs with IDs, names, subnets, gateway, DHCP range, and purpose — then export the full plan as an Excel workbook for documentation and handover.

Open VLAN planner →

Disclaimer

This reference chart provides planning guidance only. VLAN behaviour, ID ranges, and trunking rules vary by switch vendor, firmware version, and VTP mode. Always verify VLAN configuration against your switch vendor's documentation and test in a non-production environment before deploying to critical infrastructure.