DEV Community

Mustafa ERBAY
Mustafa ERBAY

Posted on • Originally published at mustafaerbay.com.tr

Why VLAN Segmentation is No Longer as Necessary? (Or Is It?)

#life #network #vlan #segmentation

Introduction: 20 Years of Network Experience and the Place of VLANs

I've been in this field for twenty years. I've both designed and personally managed many aspects, from local area network (LAN) architecture to firewall policies, VPN topologies, and company exits. Throughout this process, one of the most frequently used tools was VLAN (Virtual Local Area Network) segmentation. However, in recent years, especially with new approaches like Zero Trust Network Access (ZTNA) and the widespread adoption of cloud technologies, I've started to think that VLANs are no longer as "essential" as they once were. In this post, I will share, based on my own experiences, why VLAN segmentation is no longer as relevant as it used to be, the practical situations I've encountered, and current alternatives. This is not a "VLANs are bad, don't use them" post; rather, it's more about saying, "VLANs are no longer the solution to every problem."

VLAN Segmentation: Why Did It Emerge and What Did It Promise?

VLANs are used to logically divide a physical network infrastructure into multiple network segments. Their primary goal was to isolate network traffic, reduce broadcast domains, and consequently improve network performance. They also allowed us to keep different departments or device groups (e.g., IP phones, servers, guest networks) on separate networks without incurring the cost of physical cabling. This isolation also provided a significant layer of security; a problem in one VLAN did not directly affect others. In the early years of my career, I extensively used VLANs in large corporate networks to group devices, reduce broadcast load on bandwidth, and apply more granular policies with firewall rules.

For instance, when setting up the ERP system for a manufacturing firm, we created a separate VLAN for the servers in the server room, another for users, and yet another for IP cameras. This way, server traffic was separated from user traffic, broadcast storms were prevented, and clear rules like "allow access to the ERP server only from the server VLAN" could be defined in the firewall. This approach was quite logical and effective for the conditions of that era. However, as technology advanced, the limitations of this logic also became apparent.

ℹ️ Key Benefits of VLANs (Historically)

  • Reducing broadcast domains to improve network performance.
  • Isolating traffic logically to ensure network security.
  • Lowering physical cabling and hardware costs.
  • Creating separate network segments for different departments or device groups.

Limitations of VLANs: Complexity and Security Vulnerabilities

One of the biggest disadvantages of VLANs is the complexity of management. Especially in large networks, when hundreds of VLANs are created and routing between them is required, things can get out of hand. Every time you add a new VLAN, you typically need to configure a new interface on a Layer 3 device (router or Layer 3 switch) and the relevant routing rules. This situation can lead to configuration errors and unexpected network outages. It happened to me too; once, while adding a VLAN for a new department, I accidentally copied the IP range of an existing VLAN. The result? Users in that department couldn't connect to the network, and a debugging process that lasted for hours began.

Furthermore, VLANs alone are not a robust firewall. Attack types like VLAN hopping can allow an attacker to move from one VLAN to another. To prevent such attacks, you also need to configure additional security measures like DHCP snooping, Dynamic ARP Inspection (DAI), and IP Source Guard. This further increases the complexity. In my own experience, during a security audit, I had to notice and correct that these additional measures were not fully configured on the switches. While VLANs offer a "logical separation," ensuring the security of this separation requires extra effort.

⚠️ Challenges of VLAN Management

  • Management complexity as the number of VLANs increases in large networks.
  • Increase in routing (Layer 3) configurations and margin for error.
  • The need for additional security measures against attacks like VLAN hopping.
  • The risk of configuration errors causing network outages.

Zero Trust Network Access (ZTNA): A New Paradigm

The Zero Trust architecture, which has gained popularity in recent years, is based on the principle of "never trust, always verify." In traditional network security models, everything that entered the network was considered trusted. However, with ZTNA, every user's and every device's network access request is evaluated individually based on their identity and authorization. This eliminates the assumption of a "trusted internal network" that VLANs provide. With ZTNA, a user, regardless of their location or network, can only access resources they are authorized for. This approach has become even more important with the widespread adoption of remote work and cloud-based services.

In a client project, we needed to ensure employees could securely access both internal company resources and cloud-based SaaS applications. Instead of traditional VPN and VLAN-based segmentation, we used a ZTNA solution. As a result, users could access applications based solely on their roles and permissions, regardless of where they were working. This not only increased the security level but also significantly reduced the management burden for the IT team. Now, instead of asking, "Which VLAN should this user be in?", the question asked is, "Should this user have access to this resource?"

# Example of verifying a user's access request with ZTNA (concept)
ACCESS_REQUEST {
  user_id: "mustafa.erbay",
  resource_id: "erp.production.service",
  device_id: "laptop-001",
  device_posture: "compliant", # Is it compliant with security policies?
  authentication_method: "MFA",
  authorization_policy: "read_write"
}

if ACCESS_REQUEST.device_posture == "compliant" and ACCESS_REQUEST.authentication_method == "MFA" {
  grant_access(ACCESS_REQUEST.user_id, ACCESS_REQUEST.resource_id);
} else {
  deny_access(ACCESS_REQUEST.user_id, ACCESS_REQUEST.resource_id);
}
Enter fullscreen mode Exit fullscreen mode

Micro-segmentation and Policy-Based Networks

Besides ZTNA, micro-segmentation is another important technology replacing VLANs. Micro-segmentation further refines network security by allowing the definition of individual security policies for each workload (application or server). This is much more granular than traditional VLAN segmentation. In a data center or cloud environment, you can define separate security rules for each virtual machine or container. This way, even if one workload is compromised, the spread of damage is prevented.

While developing an internal platform for a manufacturing firm, we needed to tightly control the communication between different services. Using micro-segmentation, we only allowed services that were dependent on each other to communicate. This prevented a security vulnerability in one service from jeopardizing the entire platform. Such policies are typically implemented through software-defined networking (SDN) solutions or cloud providers' security groups. These approaches are much more dynamic and flexible compared to the static nature of VLANs.

💡 Advantages of Micro-segmentation

  • Defining specific security policies for each workload.
  • Preventing the spread of security breaches (lateral movement).
  • More granular and flexible network security control.
  • Ease of meeting compliance requirements.

The Role of VLANs in Modern Network Architectures

So, have VLANs become entirely unnecessary? No, of course not. Their use is still logical and necessary in many scenarios. Especially in older infrastructures, if the capabilities of physical network devices are limited, or if implementing more advanced solutions like ZTNA is not practical, VLANs can still offer good segmentation. For example, using VLANs to isolate guest Wi-Fi networks from the corporate network is still a common and effective method. Or VLANs can be used to separate specific IoT devices or legacy systems from the main network.

However, the key point here is not to consider VLANs as the sole layer of your security strategy. VLANs are a great tool for logically separating network traffic, but true security is achieved with additional security measures (firewall rules, ZTNA, micro-segmentation, etc.). I still encounter situations where I need to use VLANs in my own projects. For instance, I had to create a separate VLAN for the IP phones of a legacy system in a customer's network because this system did not support modern network protocols. In this case, VLAN was a quick and cost-effective solution.

# Example of creating a VLAN interface on a Linux server (with systemd-networkd)
# /etc/systemd/network/20-vlan0.network
[Match]
Name=eth0

[Network]
VLAN=0

# /etc/systemd/network/30-vlan0-ipv4.network
[Match]
Name=eth0.0

[Network]
Address=192.168.10.5/24
Gateway=192.168.10.1
Enter fullscreen mode Exit fullscreen mode

Trade-offs and Future Outlook

In conclusion, the situation of VLAN segmentation "no longer being necessary" does not mean it has disappeared entirely. Rather, it signifies a shift in priorities and approaches. VLANs, once seen as the cornerstone of network security, have now become just one part of a broader and more holistic security strategy. More modern approaches like ZTNA, micro-segmentation, and policy-based networks offer greater flexibility and security in today's dynamic and distributed network environments.

My personal preference is to use more modern approaches like ZTNA and micro-segmentation wherever possible. However, it's also important not to ignore infrastructure requirements and existing constraints. When choosing a solution, one must always consider the trade-offs. While the simplicity and ubiquity of VLANs may still be valid, it's essential to consider the management complexity and security vulnerabilities they introduce. Striking this balance is one of the biggest tasks for today's network architects.

🔥 Assuming VLANs Alone Are a Security Solution Can Be Dangerous

Remember that VLANs are a logical separation tool. True security is achieved through a layered approach, strong authentication, access control policies, and continuous monitoring. Over-reliance on VLANs can lead to serious vulnerabilities in cybersecurity.

I believe these trends in network security and management will only strengthen in the coming years. We will build smarter, more automated, and more policy-driven networks. And yes, VLANs will still have their place in this journey, but they are no longer the main actors; they have taken on more of a supporting role. I would also be interested to hear your experiences on this topic.

Top comments (0)