VLANs: Why Your Office Network Needs Segmentation

In many small offices, every device — laptops, printers, CCTV cameras, the billing terminal and visitors' phones — sits on one flat network. That is convenient until something goes wrong. A single infected device can then reach everything else.

What a VLAN is

A VLAN (virtual local area network) divides one physical network into several logical networks. Devices on different VLANs cannot talk to each other unless the router or firewall explicitly allows it, even though they share the same switches and cabling.

A typical office layout

• Staff VLAN: company laptops and desktops.
• Guest VLAN: visitors' devices with internet-only access.
• CCTV VLAN: cameras and video recorders.
• Payments VLAN: POS terminals and card machines.
• IoT VLAN: printers, smart TVs and building systems.
• Management VLAN: network equipment itself.

Security benefits

If a guest's phone is infected or a camera is compromised, segmentation stops the problem spreading to finance systems or file servers. It also limits what an attacker can see after gaining a foothold.

Performance benefits

Broadcast traffic stays within each VLAN, and quality-of-service rules can prioritise critical VLANs such as voice or payments.

Compliance

Payment card standards and many security frameworks expect payment systems to be separated from general networks. VLANs are a practical way to achieve that.

Wi-Fi integration

Each VLAN can have its own Wi-Fi network name, so staff, guests and devices connect to the right segment automatically.

Keep it documented

Record which VLANs exist, what belongs on each and which traffic is allowed between them.

The bottom line

VLANs are one of the most cost-effective security upgrades for any office. A managed router and switch setup makes segmentation simple to deploy and maintain.

Learn more about Managed Router & SD-WAN from UbiFi, or talk to our team.