VLANs and segmentation: separating guests, employees and equipment

VLANs logically divide a network on shared equipment. They help separate guests, employees, cameras and device management. A separate VLAN number does not create a complete security policy; configure and verify which traffic may cross segments.

Group devices by role

Start with needs: internet access, file access and equipment administration. A camera and an accountant’s laptop have different tasks even on the same switch. Grouping should be understandable to support and reflect actual permissions.

Define addressing, DHCP, DNS and ownership for each segment. Avoid unnecessary groups because each adds maintenance. Describe exceptions such as employee access to a network printer or presentation system.

VLANs and firewalls work together

A VLAN defines a logical boundary; supported router or switch policies control traffic between networks. If routing allows everything, guests may gain unwanted access despite a separate Wi-Fi name. Inspect the actual configuration.

For example, a recorder receives camera streams while employees view footage through an approved service. This does not require exposing every camera to every workstation. Build rules around necessary flows rather than universal internal trust.

Check the complete VLAN path

Traffic traverses ports, switch uplinks, access points and a gateway. One incorrect port profile can break a segment or expose another. Keep diagrams and labels instead of reconstructing configuration from cable colours.

Consider cross-network device discovery separately. A printer or screen may need a specifically approved discovery mechanism. Opening all traffic for one service defeats segmentation; use a controlled exception.

Test both permitted and prohibited access

From each segment, test required services and connections that should be blocked. For guests, also test client-to-client communication according to policy. Access point isolation and inter-VLAN rules may operate at different parts of the network.

After acceptance, hand over the access matrix, diagram and port-change procedure. Assign new devices to a defined role rather than the first network with working internet. Periodic review removes temporary exceptions that are no longer needed.

Sources and further reading

• MikroTik: VLAN concepts and routing
• UniFi: network and client isolation
• UniFi: broadcast traffic and device discovery

• Related subservice: Network management and segmentation
• Explore this service area