VLANs and network segmentation

A VLAN (virtual local area network) splits one physical set of switches and cables into several separate networks. Segmentation is the practice of using VLANs, subnets and firewall rules to keep groups of devices apart, so a guest laptop, a security camera and a building automation controller can share the same cabling without being able to reach each other.

Why segment a building network

A flat network, where every device sits in one big segment, is easy to set up and hard to live with. Any device can talk to any other device. A compromised laptop can scan for cameras and controllers. A misbehaving device can flood the whole network with broadcast traffic. When something goes wrong, there is no clear boundary to look at.

Segmenting the network gives you:

• Containment. A problem in one segment, whether malware, a faulty device or a configuration error, stays in that segment.
• Control. Traffic between segments has to pass a router or firewall, where rules decide what is allowed.
• Clarity. Each segment has a purpose, an owner and an address range, which makes troubleshooting and audits faster.
• Separation of responsibility. Building systems contractors can be given access to their own segment without access to corporate data.

How VLANs work

A switch port is assigned to a VLAN. Devices on ports in the same VLAN can talk to each other directly, as if they shared their own switch. Devices in different VLANs cannot, even when they are plugged into the same switch, unless traffic is routed between them.

There are two kinds of port:

• Access ports belong to one VLAN and connect end devices such as computers, cameras and controllers. The device does not know a VLAN exists.
• Trunk ports carry several VLANs at once, usually between switches or from a switch to a router or firewall. Each frame is tagged with its VLAN number so the far end knows which segment it belongs to.

Each VLAN normally has its own IP subnet. Routing between subnets happens at a layer 3 switch or a firewall, and that is where the policy lives.

The tag itself is small. On a trunk, the switch inserts a short field defined by the IEEE 802.1Q standard into each Ethernet frame, and that field carries the VLAN number. The switch at the other end reads the tag, removes it and delivers the frame to the right ports.

Typical segments in a building

Voice often gets its own VLAN as well, so phones can be given priority. Our guide on QoS for voice and video explains how that works.

Writing the policy between segments

VLANs separate traffic; the firewall or layer 3 switch decides what can cross. The safest starting point is to deny everything between segments and then allow only the specific flows each system needs, written down with a reason.

Planning segmentation, step by step

1. List every kind of device. Include building systems, security, AV, signage and anything a tenant or contractor brings. Record who owns and supports each one.
2. Group by trust and function. Devices that need the same access and share an owner can share a segment. Do not create a VLAN per device type unless there is a reason.
3. Assign VLAN numbers and subnets. Use a consistent scheme across the building or portfolio, and leave room for growth.
4. Write the flows. For each segment, list what it must reach, on which ports, and why. That list becomes the firewall policy.
5. Configure and test. After the build, test from a device in each segment that allowed flows work and denied flows fail. Record the results.
6. Keep it current. Review the policy when systems are added or contractors change.

A worked example

Consider a typical case: a four-storey medical office building where the landlord runs the base building systems and each floor is leased to a different clinic. Today everything sits on one flat network installed years ago. The landlord wants to add cameras and card access and has been told the controls contractor needs remote access.

The segmentation plan for a building like this usually looks something like this:

• Landlord segments: building automation, access control, video surveillance and a small management segment for the switches. Each has its own VLAN and subnet, and only the landlord's systems integrator manages them.
• Tenant segments: each clinic gets its own VLAN, or its own separate network handed off at a demarcation point, with no route to any other tenant or to the landlord's systems.
• Guest segment: waiting room WiFi, internet only.
• Remote access: the controls contractor connects through a VPN or secure remote access service that lands only on the building automation segment, with individual accounts and logging, rather than a port forward on the internet router.

The result is that a problem on one clinic's computers cannot reach another clinic or the building systems, the contractor can do their job without seeing anything else, and the landlord can show tenants and insurers how the separation works.

Common mistakes

• VLANs without a firewall policy. If the core routes freely between every VLAN, the segments are only labels.
• Leaving defaults in place. Using the switch's default VLAN for user devices, or leaving unused ports active in a live VLAN, invites trouble. Unused ports are best disabled or placed in an unused VLAN.
• Management on the user network. Switch and access point management interfaces should be on their own segment.
• Contractor shortcuts. A vendor who needs remote access to one controller should not be given a path to the whole building network.
• No documentation. An undocumented VLAN is one nobody dares remove.

How ehZee can help

Our network design service includes a segmentation plan: the list of segments, the VLAN and IP address plan, and the written flows between segments, reviewed with your IT team and the building systems contractors. After the build we test that the policy works as written. See also converged networks for building systems.

Common questions