A district can have a hundred VLANs and no security segmentation at all. The VLANs keep broadcasts apart, which is a real operational benefit, and they do nothing to stop a student laptop from reaching a staff file server, because nothing in the path is enforcing a decision.
The distinction is the subject of this article: a VLAN is a boundary you can see, and a trust boundary is a place where traffic is actually inspected.
What a VLAN does
A VLAN is a layer 2 broadcast domain. Frames stay inside it; the switch keeps a separate MAC table per VLAN; a trunk carries several across one cable.
That gives you:
- Smaller broadcast domains, so a storm affects fewer devices.
- A natural unit for a subnet, a DHCP scope, and a policy.
- Reduced blast radius for layer 2 attacks like ARP spoofing.
It does not give you a security boundary, because the moment two VLANs need to talk — and they always do — something must route between them, and that router decides whether they can. If the router permits everything, the VLAN boundary is a label.
Where trust is actually enforced
| Layer | Enforces | Fails when |
|---|---|---|
| VLAN | Broadcast separation | Routing permits everything |
| Firewall zone | Policy between groups of networks | Zones are too broad |
| Host firewall | Policy on the endpoint | Disabled or unmanaged |
| Identity | Who may authenticate | Shared credentials |
| Application | Who may do what | Trusts the network |
Real segmentation stacks several of these. A student device should be in a student zone, unable to reach staff subnets, unable to reach the camera network, and able to reach only the services it needs — with the policy enforced at a device that inspects the traffic.
The flat-network failure
The district's current design is the clearest possible example: 98 networks in one Internal zone, with a predefined allow-all between them and 104 billion hits on that rule.
Every VLAN in that zone is separated at layer 2 and fully reachable at layer 3. A compromised camera can reach a domain controller. A student device can reach a printer's management interface. A guest laptop can reach the HVAC controller. None of that requires an exploit; it requires an address.
The fix is not more VLANs. It is fewer, broader zones with policy between them, and then moving networks into those zones.
What segmentation actually buys
- Blast radius. A compromised device reaches its own zone and the services it needs, not the domain controller.
- A place to put policy. You cannot write "students may not reach servers" until students and servers are separable.
- Compliance evidence. Filters and auditors ask for boundaries, not VLAN IDs.
- Troubleshooting. "It only fails from the student VLAN" is a much shorter path than "it fails sometimes."
What segmentation does not buy
- Protection from phishing. A user who types credentials into a fake login page is compromised inside their own zone.
- Endpoint security. Segmentation limits lateral movement; it does not stop malware on the host.
- Anything at all if the policy is allow-any. A zone with a permit-all rule is a VLAN with extra paperwork.
The most dangerous sentence in a district
"We have VLANs, so we're segmented." It is true at layer 2 and false at layer 3, and the gap between those two statements is where incidents live.
Worked example: one building, four boundaries
A high school with student, staff, guest, IoT, and building-control devices:
| Group | Networks | May reach | Must not reach |
|---|---|---|---|
| Student | 10 student VLANs | Internet, DNS, printers | Staff, servers, cameras |
| Staff | 4 staff VLANs | Servers, printers, internet, cameras (client) | Student, guest |
| Guest | 1 guest VLAN | Internet, DNS | Everything internal |
| IoT / building | 6 VLANs | Vendor cloud, NTP, DNS | User networks, servers |
That is four policy decisions, not a hundred rules. The VLANs provide the address plan; the zones provide the enforcement; the rules describe the exceptions.
What breaks in production
- A shared service nobody documented. Printing, HVAC, or camera viewing crosses zones, and the move breaks it because the dependency was never written down.
- Zones so broad they repeat the problem. "Internal" containing 98 networks is not a zone; it is a filing cabinet.
- Policy written but never applied because the networks were never moved.
- Guest on the same L2 as staff through a misconfigured trunk, which defeats both.
Checklist
- You can state, in one sentence, what each zone is for.
- Every zone pair has an explicit policy, including a deny.
- Shared services are listed with their consumers before any move.
- A test device in each zone has been used to prove what it can and cannot reach.
- Nobody describes the network as segmented because it has VLANs.
Next
The theory is simple; the migration is not. Continue with From Flat to Segmented: Migrating a Live Network for the order, the pre-checks, and the rollback.