Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Objective 2.4

Quick reference: the short version of this lesson is the VLANs and VPNs cheat sheet, part of Section 2.

Learning objectives

By the end of these notes you should be able to:

Define a LAN in terms of a broadcast domain, and explain why separate switches create separate broadcast domains.
Explain the inefficiency of using one physical switch per network, and how VLANs solve it.
Describe how VLANs assign switch interfaces to logically separate broadcast domains.
Explain why devices on different VLANs need a router to communicate.
Explain what a VPN does, and the role of a VPN concentrator.
Distinguish client-to-site VPNs from site-to-site VPNs, and describe how each is typically implemented.

1. LANs and broadcast domains

1.1 What defines a LAN

A LAN (Local Area Network) is a group of devices connected together into a single broadcast domain. Send a broadcast from one device on that LAN, and every other device on that same LAN sees it.

1.2 Separate switches, separate broadcast domains

A separate switch creates a separate broadcast domain. A broadcast sent on one switch’s network (call it the red network) is not seen by devices connected to a different switch’s network (the blue network) — they’re entirely separate.

From a security and organisational standpoint, this is a good design. Everyone on red connects to the red switch; everyone on blue connects to the blue switch — clean separation.

1.3 The inefficiency problem

Worked example — wasted switch capacity. A 24-port switch has only two devices connected. A second, separate 24-port switch also has only two devices connected.

22 ports sit unused on each switch.
To save money and rack space, you’d want to put all four devices on one physical switch.
But doing that naively would put every device into one shared broadcast domain, losing the separation between red and blue.

2. VLANs

2.1 What a VLAN is

A VLAN (Virtual Local Area Network) solves this: modern switches let you assign different interfaces (ports) on a single physical switch to different VLANs. Each VLAN is still its own separate broadcast domain — logically separated, even though the devices share one piece of hardware.

Worked example — combining two switches into one. Instead of two separate 24-port switches, use one 24-port switch:

Some interfaces are assigned to the red VLAN.
Other interfaces are assigned to the blue VLAN.
A broadcast sent by a device on a blue interface is only seen by other blue-VLAN interfaces.
A broadcast sent on a red interface is only seen by other red-VLAN interfaces.

The result: a single switch, a single power source, taking up the space of one device in the rack — while still fully separating red and blue traffic. Two physical switches become one physical device with logical separation.

2.2 Multiple VLANs on one switch

A switch can support many VLANs, not just two. Worked example — a three-VLAN switch:

VLAN

Name

VLAN 1

Gate room

VLAN 2

Dining room

VLAN 3

Infirmary

Devices on VLAN 1 cannot communicate with devices on VLAN 2 or VLAN 3 — each is a completely separate broadcast domain, exactly as if they were on entirely separate physical switches.

2.3 Letting VLANs talk to each other

Sometimes there’s a legitimate networking reason for devices on different VLANs to communicate. Because VLANs are separate broadcast domains (and separate IP subnets), this requires a router to move traffic between them.

Option

How it works

Routing built into the switch

Some switches include routing functionality, letting them route between their own VLANs directly

External router

A separate router is connected to route traffic between VLANs

3. VPNs

3.1 What a VPN does

A VPN (Virtual Private Network) lets devices communicate across a network while encrypting all of the data sent between them. If someone captured that traffic in a packet-capture tool, the encrypted contents would be unreadable.

3.2 The concentrator

The device that handles this encryption and decryption in real time is called a concentrator.

Feature

Detail

Where it lives

Often built into a firewall, or another purpose-built appliance

What it does

Everyone connects to the central concentrator, which decrypts incoming traffic for use inside the network, and encrypts traffic heading back out to the remote station

Form

Usually hardware, but software-only concentrator solutions exist too, runnable on an existing server

Client side

Many operating systems include built-in VPN client software; third-party VPN software can also be installed

4. Client-to-site VPN

4.1 The “working from home” scenario

If you’ve ever worked from home, you’ve likely used a client-to-site VPN:

The client — you, the remote user at home.
The site — a concentrator at a central point, typically at the edge of the corporate network.

All remote users and devices outside the building connect to that one central concentrator, across the internet. The concentrator is, in turn, connected to the internal corporate network.

4.2 What this achieves

All communication between the remote user and the concentrator is always encrypted — the data is fully protected in transit.
The concentrator decrypts the traffic and sends it on to the appropriate resources inside the corporate network.

4.3 Always-on VPN

A client-to-site VPN can be configured as always-on:

The moment the remote user’s laptop turns on and logs in, the VPN link to the concentrator is created automatically.
No manual VPN software step is needed.
Anytime the device is on and connected to the internet, it has an encrypted channel back to the concentrator — continuously.

5. Site-to-site VPN

5.1 Connecting whole locations

Large organisations often have a central corporate network plus remote sites at other physical locations. One way to connect those sites together is over an existing internet link — but that raises the same concern: anyone able to observe internet traffic could potentially see what’s being sent.

The solution is a site-to-site VPN.

5.2 How it’s implemented

Component

Role

Firewall at the corporate network

Connects to the internal network, the internet, and the VPN

Firewall at the remote site

Connects to that site’s network, the internet, and the VPN

Site-to-site VPN

Configured between the two firewalls

The firewalls act as the VPN concentrators for this connection.

5.3 What’s encrypted, and what isn’t

Traffic

Encryption

Inside either site’s own network

In the clear — no VPN involved

Between the two sites, over the internet

Always encrypted, via the site-to-site VPN

Every time information travels from the remote site back to the corporate network (or vice versa) across the internet, it goes through the encrypted channel automatically — with no individual user action required.

5.4 Client-to-site vs site-to-site

Client-to-site

Site-to-site

Connects

One remote user’s device to the network

Two whole networks (sites) to each other

Endpoint at the user’s end

VPN client software on the user’s device

A firewall at the remote site

Endpoint at the corporate end

A concentrator

A firewall at the corporate network

Typical use

Working from home, travelling staff

Branch offices, remote facilities

6. Security perspective

VLANs are a segmentation tool, not encryption. Traffic within a VLAN is not encrypted by the VLAN itself — VLANs control which devices can see which broadcast traffic and reach each other directly, not confidentiality of the data.
Inter-VLAN routing reintroduces reachability — and risk. Any router connecting VLANs should apply firewall rules or access control lists between them; otherwise, segmenting into VLANs achieves little if every VLAN can freely route to every other.
A misconfigured switch port can put a device on the wrong VLAN, potentially exposing it to traffic (like the infirmary or gate room example) it should never see. Port-level VLAN assignment should be checked, not assumed.
The VPN concentrator is a high-value target. It’s the single point where encrypted traffic becomes readable — compromising it exposes everything passing through, so it needs strong patching, monitoring and access control.
Always-on VPN reduces user error (forgetting to connect) but also means a compromised or lost device retains a live, automatic path into the corporate network — device security and remote-wipe capability matter more as a result.
Site-to-site VPNs protect data between sites, not inside them. Traffic is “in the clear” once it’s inside either network, so internal security controls at both ends still matter.

Summary

A LAN is a single broadcast domain. Separate switches create separate broadcast domains, which is good for security and organisation but wastes switch capacity when few devices use each one.
VLANs let a single physical switch host multiple logically separate broadcast domains, by assigning different interfaces to different VLANs — combining hardware without losing separation.
Devices on different VLANs can’t communicate directly. A router (built into the switch, or external) is needed to route between VLANs when required.
A VPN encrypts data in transit, so captured traffic is unreadable. A concentrator — often built into a firewall, hardware or software — handles the real-time encryption and decryption.
Client-to-site VPN connects an individual remote user to a central concentrator at the network’s edge, encrypting all traffic between them — often configured always-on.
Site-to-site VPN connects two whole networks together over the internet, typically implemented firewall to firewall, with each firewall acting as a concentrator. Traffic between the sites is always encrypted; traffic within each site is not.

Glossary

Term

Definition

LAN

Local Area Network — a single broadcast domain

Broadcast domain

The set of devices that receive a broadcast sent within it

Broadcast

A message sent to every device within a broadcast domain

VLAN

Virtual Local Area Network — a logically separate broadcast domain on shared switch hardware

Interface (port)

A physical connection point on a switch, assignable to a VLAN

Inter-VLAN routing

Routing traffic between different VLANs

VPN

Virtual Private Network — encrypts data sent across a network

Concentrator

A device that encrypts and decrypts VPN traffic in real time

VPN client

Software on a user’s device that connects to a VPN concentrator

Client-to-site VPN

A VPN connecting one remote user’s device to a central network

Site-to-site VPN

A VPN connecting two whole networks (sites) together

Always-on VPN

A VPN that connects automatically as soon as the device is online

Firewall

A device controlling traffic, often also hosting VPN or concentrator functionality

Review questions

What defines a LAN in terms of broadcast traffic?
Why doesn’t a broadcast on one switch’s network reach devices on a completely separate switch?
Describe the inefficiency problem with using one 24-port switch per small group of devices.
How does a VLAN solve that inefficiency without losing the separation between networks?
In the three-VLAN example (gate room, dining room, infirmary), can a device on VLAN 1 communicate directly with a device on VLAN 2? Why or why not?
What’s needed to let devices on different VLANs communicate, and name two ways to provide it?
What does a VPN do to data sent across a network?
What is a VPN concentrator, and where is it often built into?
In a client-to-site VPN, what are the “client” and the “site”?
What does an always-on VPN configuration do for the user?
How is a site-to-site VPN typically implemented?
In a site-to-site VPN, which traffic is encrypted and which isn’t?
Why is a VPN concentrator considered a high-value security target?
Why don’t VLANs alone provide confidentiality for the data crossing them?

Answer key

A LAN is a single broadcast domain — a broadcast sent by any device on it is seen by every other device on it.
Each switch forms its own separate broadcast domain, so broadcasts don’t cross between physically separate switches.
Each switch might only have a couple of devices connected out of 24 ports, wasting most of its capacity, cost and rack space.
A VLAN lets different interfaces on one physical switch belong to different, logically separate broadcast domains, so one switch can do the job of several without merging the networks.
No. Each VLAN is a completely separate broadcast domain, just as if they were on separate physical switches.
A router — either routing functionality built into the switch itself, or a separate external router.
It encrypts the data, so anyone capturing the traffic can’t read its contents.
A device that encrypts and decrypts VPN traffic in real time, often built into a firewall or another purpose-built appliance (hardware or software).
The client is the remote user’s device; the site is the concentrator at the edge of the corporate network.
It automatically creates the VPN connection to the concentrator as soon as the device turns on and logs in, with no manual step needed.
Firewall to firewall — one firewall at the corporate network, one at the remote site, with the VPN configured between them.
Traffic between the two sites, over the internet, is always encrypted. Traffic inside either site’s own network is in the clear.
It’s the single point where encrypted traffic becomes readable, so compromising it would expose everything passing through it.
VLANs control which devices can see broadcasts and reach each other — they’re a segmentation mechanism, not an encryption mechanism. Data within a VLAN isn’t encrypted by the VLAN itself.