First let’s take Carl back to the days before VLANS. In an office, lets say you wanted to separate the accounting department's network traffic from the creative department's network traffic. You’d have to buy and install a separate switch for each department because this was the only way to make sure someone in the opposite department couldn't see the others network traffic. Also, if you wanted to move one person from accounting to another building, there's no way to keep this separation of traffic from different physical locations.   The solution came in the form of VLANS. Technically speaking all a VLAN is, is a Tag added to each ethernet frame as it enters a port on a VLAN enabled switch. This Tag is removed at the egress port. The two standards for these Tags are 802.q and ISL although ISL has really fallen out of use because it's cisco proprietary.    Having each piece of traffic marked allows a switch to direct where traffic is allowed to go and not allowed to go. So if we now want to make sure that accounting traffic stays separate from the creative department's traffic we can apply a VLAN tag to each departments traffic and tell the switch where everything is allowed to go. We can even expand this control beyond 1 physical location so if a single member of the accounting team moves to a new building all I have to do is find the port that person is connecting to and apply the accounting department's VLAN to it. That employee is now part of the accounting department's network without much effort or added cost of rewiring the network. ... View more