Layer 2 switches forward Ethernet frames within a LAN using MAC addresses. VLANs (Virtual Local Area Networks) partition that Layer 2 fabric into separate broadcast domains on the same physical wiring — a building block of defence-in-depth, but not a firewall by itself.
Related: OSI Model | TCP/IP Fundamentals | Network Topologies | Network Segmentation | Network Security Devices | FR 5 Restricted Data Flow
Unlike a hub (which floods every frame), a switch learns which MAC addresses live on which ports and forwards frames only where needed. Switches operate at the physical and data-link layers within a LAN.
| Type | Behaviour |
|---|---|
| Unmanaged | Not configurable; plug-and-play. Lower cost and complexity; no port security or VLAN tuning. |
| Managed | Configurable locally or remotely: VLANs, port limits, storm control, monitoring and other security-relevant settings. Most industrial Ethernet switches today are managed. |
A VLAN groups hosts with common requirements into a distinct Layer 2 segment regardless of physical location. Multiple VLANs can share the same switches and cable plant; a trunk between switches carries tagged traffic for more than one VLAN.
Teaching example: Boiler 1 HMIs and engineering workstation on VLAN 10; Boiler 2 equipment on VLAN 20 — same wire plant, separate broadcast domains so VLAN 10 stations do not see VLAN 20 traffic by default.
Security note: A VLAN alone is not strong security. It is logical separation and part of defence in depth. Crossing VLANs still needs routers, ACLs or firewalls aligned with zones and conduits (network segmentation, FR 5).