VLANs and network segmentation for SMEs: a practical guide

Why a flat network is a risk

In many small and medium-sized companies, all devices share a single network: PCs, servers, printers, phones, cameras and sometimes even the guest Wi-Fi. That is quick to set up, but it means every device can reach every other device. If a laptop is infected or a camera is taken over, an attacker can scan the entire network from there and pick the next target.

Network segmentation divides this network into separate zones with controlled transitions. For most SMEs, this means separate VLANs for clients, servers, guests, cameras and management, plus firewall rules that allow only the necessary traffic between them. This does not prevent every attack, but it limits how far an attacker or malware can spread. The network also becomes easier to understand and quicker to troubleshoot.

What is a VLAN?

A VLAN (virtual local area network) divides one physical network into several logical networks. It is based on the IEEE 802.1Q standard: switches add a tag with the VLAN ID to Ethernet frames, so a single cable can carry several separate networks. In practice, each VLAN gets its own IP subnet.

• Access port: connects an end device such as a PC or camera and belongs to exactly one VLAN. The device itself is unaware of the VLAN.
• Trunk port: carries several tagged VLANs, typically between switches, to the firewall or to Wi-Fi access points.
• Separation: devices in different VLANs cannot communicate directly. Traffic between them has to pass through a router or, better, a firewall.

On Wi-Fi, separate wireless networks (SSIDs) are mapped to VLANs. The guest Wi-Fi then ends up in the guest VLAN and the company Wi-Fi in the client VLAN.

Typical network segments for SMEs

How many segments make sense depends on size and devices. The following layout is a good starting point for many offices, practices and shops and can be scaled down or extended.

Backups deserve particular attention. Ideally, the backup system sits in its own segment or is at least protected so that a compromised client can neither reach nor delete backups.

Inter-VLAN routing: the firewall decides

Traffic between VLANs can be routed by a layer 3 switch or by the firewall. A layer 3 switch is fast, but its access lists are usually stateless and rarely logged in detail. For transitions between zones with different protection needs, routing through the firewall is therefore generally the better choice: it inspects connections statefully, logs them and can apply additional protection features. Our article on next-generation firewalls explains more.

The basic rule is to block everything that is not explicitly allowed. Each rule names the source, destination and service. For example, clients may reach the file server via SMB, but not the cameras. Cameras may only send their video streams to the recorder and may not reach the internet. Detailed guidance is in our article on securing IP cameras.

802.1X and NAC: who is allowed on the network?

VLANs separate the network but do not decide who may connect in the first place. Anyone who plugs a laptop into a free network socket lands in whichever VLAN that port is set to. This is where 802.1X comes in: before the switch or access point grants access, the device has to authenticate.

• How it works: the device (supplicant) authenticates with the switch or access point (authenticator), which forwards the request to a RADIUS server. This server is often linked to the user directory.
• Methods: certificate-based authentication (EAP-TLS) is considered particularly robust. Methods using a username and password (for example PEAP) are easier to introduce, but the devices must validate the RADIUS server's certificate.
• Dynamic VLANs: the RADIUS server can assign the appropriate VLAN, so a company laptop lands in the client VLAN and an unknown device in a restricted network.
• Devices without 802.1X: printers and cameras often do not support it and are usually admitted by their MAC address (MAB). Because MAC addresses can be spoofed, these devices belong in tightly restricted segments.

Network access control (NAC) goes a step further and can also check the state of a device, such as whether security updates are installed. For many SMEs, 802.1X on Wi-Fi and in exposed areas such as meeting rooms is a sensible first step. Segmentation and 802.1X are also core building blocks of a zero trust approach.

Introducing segmentation step by step

1. Take stock: list all devices with their purpose, location and the systems they need to communicate with.
2. Define zones and an IP plan: decide on segments, VLAN IDs and subnets and record them in a clear table.
3. Check the hardware: the switches must support VLANs (managed switches). The firewall needs VLAN interfaces and enough throughput for the internal traffic that will pass through it.
4. Start with the simple segments: move guests, cameras and IoT first, because their communication needs are clear and limited.
5. Log before you restrict: for clients and servers, first record which connections actually occur, then replace broad rules with specific ones.
6. Secure management: move admin interfaces to the management VLAN and allow access only from defined admin devices.
7. Document and review: keep the network plan and rule set up to date and review both at least once a year.

Prepare a change like this with a fallback plan and carry it out outside business hours, because VLAN or DHCP mistakes can interrupt operations.

Common mistakes and how to avoid them

• Everything stays in VLAN 1: on delivery, all ports usually belong to the default VLAN. Use dedicated VLANs for business traffic and assign unused ports to an empty VLAN or disable them.
• Any-any rules between VLANs: a rule that allows all traffic between segments cancels out the separation. Every rule needs a clear purpose.
• Admin interfaces reachable from everywhere: the login pages of switches, firewall and access points must not be reachable from the client or guest network.
• Forgetting device discovery: printers and media devices often use discovery protocols such as mDNS that do not cross VLAN boundaries. Plan fixed addresses or a controlled mDNS gateway in advance.
• No documentation: without an up-to-date network plan, the next change quickly leads to exceptions nobody can follow.

Conclusion: separate first, then allow deliberately

Network segmentation is an effective measure against the spread of attacks and is well within reach for SMEs with managed switches and a suitable firewall. The keys are a clear zone plan, restrictive firewall rules and a step-by-step introduction. If you would like support with planning or implementation, Q-entra helps with network infrastructure and cyber security, from the IP plan to a documented rule set.