Understanding VLAN architecture, RouterOS/SwOS, VLAN filtering, inter-VLAN routing, MikroTik VLAN & VXLAN: A Professional Guide to Network Segmentation, Routing and Overlay Networking underlay/overlay and evidence-based troubleshooting.
Modern networks are rarely a single flat Layer 2 environment.
Users, servers, management systems, guests and laboratory workloads often need logical separation.
Two technologies become particularly important:
VLAN
and
VXLAN
But they solve different problems.
VLAN: The Foundation of Logical Segmentation
A VLAN allows physical switching infrastructure to represent multiple logical broadcast domains.
For example:
VLAN 10 → Users
VLAN 20 → Servers
VLAN 30 → Management
The physical infrastructure can remain shared while the logical networks remain distinct.
This makes VLANs fundamental to enterprise switching, branch infrastructure, laboratories and network-security architecture. �
WhiteDavid23 Academy
VLANs Are Not the Entire Security Architecture
Segmentation is useful, but a VLAN should not automatically be considered a complete security boundary.
Communication between segments may depend on:
Layer 3 routing
Firewall policies
Identity controls
Endpoint security
Monitoring
The design question should therefore be:
Which communication is actually required?
not simply:
“Which VLAN exists?”
Access Ports and Trunks
An access port generally connects an endpoint to a single logical VLAN.
A trunk carries multiple VLANs between network components.
Tagged traffic preserves VLAN identity across shared links.
Untagged traffic can be mapped into the intended VLAN at an endpoint-facing edge.
Understanding these concepts is essential for troubleshooting.
MikroTik RouterOS and SwOS
MikroTik platforms can serve different networking roles.
RouterOS provides broad networking and routing capabilities.
SwOS is focused on switching.
The correct configuration approach depends on the hardware, software version and intended network role.
This is why professional networking requires version awareness rather than blindly copying configuration examples from another RouterOS release.
VLAN Filtering
VLAN filtering helps define which VLANs are valid on particular ports and how tagged and untagged traffic should behave.
A permissive or inconsistent design can make troubleshooting difficult and weaken the intended segmentation model.
The goal is to make VLAN membership explicit.
Inter-VLAN Routing
Different VLANs are different Layer 2 domains.
When communication between them is required, Layer 3 routing becomes part of the architecture.
This is also a policy-enforcement opportunity.
For example:
Users → Application Servers
may be required.
While:
Guest → Internal Servers
may normally be restricted.
A traffic matrix can make these requirements explicit.
VXLAN: Understanding Overlay Networking
VXLAN addresses a different scaling problem.
It allows logical Layer 2 segments to be carried across a Layer 3 transport network through encapsulation.
WhiteDavid23 Academy
A useful mental model:
Underlay
Provides IP reachability.
Overlay
Represents the desired logical network.
VXLAN
Provides the encapsulation mechanism between the logical and transport layers.
VLAN vs VXLAN
Concept
VLAN
VXLAN
Primary model
Local Layer 2 segmentation
Overlay across Layer 3
Main purpose
Separate broadcast domains
Extend logical networks across routed infrastructure
Transport
Ethernet switching
Encapsulated traffic over IP
Key learning
Ports, tagging, VLAN membership
Overlay, endpoints, underlay, encapsulation
The Underlay Comes First
One of the most important VXLAN troubleshooting principles is:
Validate the underlay before the overlay.
If the VXLAN endpoints cannot reach one another through the underlying IP network, the overlay cannot solve that problem.
A staged build sequence is:
Requirements
↓
Physical Topology
↓
VLAN Segmentation
↓
Layer 3 Routing
↓
VXLAN Overlay
↓
Validation
Network Design Methodology
Before opening RouterOS and creating VLANs, define what the network needs to accomplish.
Step 1 — Identify Logical Groups
Users, servers, management, guests, labs or other functional zones.
Step 2 — Define Communication Requirements
What does each group actually need to reach?
Step 3 — Map the Physical Topology
Document switches, routers, endpoints and links.
Step 4 — Decide Where Layer 3 Lives
Define where inter-VLAN routing occurs.
Step 5 — Validate the Underlay
If VXLAN is required, confirm IP reachability first.
Step 6 — Test One Segment at a Time
Start simple.
One VLAN.
Then routing.
Then overlay.
This creates a reliable troubleshooting baseline.
The most valuable skill is understanding why each layer exists and how to troubleshoot it when the expected behavior doesn't occur.
📖 Read the complete CMVVS guide:
https://blog.whitedavid23.org/2026/08/certified-mikrotik-vlan-vxlan.html
Design the Network. Segment with Purpose. Validate Every Layer.
Top comments (0)