VLAN Concepts and Segmentation

Why VLANs exist in campus networks

If every user, printer, AP, camera, and server shared one flat Ethernet segment, broadcasts and unknown unicasts would flood everywhere the switch fabric reached. ARP, DHCP discovery, and chatty protocols would waste bandwidth and expose every host to every other host’s Layer 2 traffic. A VLAN (Virtual Local Area Network) carves that fabric into separate logical broadcast domains without requiring a separate physical switch for every group.

HCIA-Datacom expects you to explain VLANs in three languages at once:

1. Traffic behavior — flooding and MAC learning stay inside one VLAN.
2. Security and design — HR, guests, and servers are isolated at Layer 2.
3. IP mapping — each VLAN almost always maps to one subnet and one gateway (VLANIF).

Broadcast domain vs collision domain (quick review)

Routers (and Layer 3 switches performing routing) separate broadcast domains. Two VLANs on the same switch are already two broadcast domains—even before a router is configured. Until you add inter-VLAN routing, hosts in VLAN 10 and VLAN 20 cannot complete normal IP communication with each other.

VLAN ID space and default VLAN 1

IEEE 802.1Q VLAN IDs are 12 bits, yielding IDs 1–4094 for usable VLANs (0 and 4095 are reserved special cases in the standard). On Huawei switches:

• VLAN 1 exists by default. Access ports often start in VLAN 1 until you reassign them.
• Many deployments leave management in VLAN 1 during early labs; production best practice is often a dedicated management VLAN—but the exam still tests that VLAN 1 is the default.
• Creating VLAN 10 does not by itself put user ports into VLAN 10—you must configure port link type and VLAN membership (next section).

Common campus VLAN plan (example)

Each row is one broadcast domain and usually one IP subnet. Gateways become VLANIF 10, VLANIF 20, and so on.

Benefits of segmentation (exam talking points)

• Smaller flood domains — ARP storms and unknown unicast stay local to the VLAN.
• Security boundaries — guests cannot Layer-2-sniff employee traffic; ACLs at Layer 3 refine policy further.
• Policy and QoS mapping — voice VLANs, different DHCP pools, different rate limits.
• Flexible topology — users in the same VLAN can sit on different access switches connected by trunks; physical location ≠ VLAN membership.
• Cleaner troubleshooting — display mac-address vlan 10 focuses on one user group.

Creating VLANs on Huawei VRP

Single VLAN:

[Huawei] vlan 10
[Huawei-vlan10] description Employee-Data
[Huawei-vlan10] quit

Batch create (exam-favorite efficiency):

[Huawei] vlan batch 10 20 30 100

or ranges where supported by the software style you use in lab:

[Huawei] vlan batch 10 to 20

Verification:

<Huawei> display vlan
<Huawei> display vlan 10

display vlan shows which VLANs exist and which ports belong to them (tagged vs untagged presentation depends on platform output). If a VLAN is created but has no ports, it will not carry user traffic—creation alone is not a complete design.

Naming and documentation

Use description under the VLAN view so operators know VLAN 30 is voice, not “mystery VLAN.” Descriptions do not change forwarding behavior; they prevent operational mistakes.

The golden rule: same VLAN for Layer 2 connectivity

Two hosts need all of the following for pure Layer 2 unicast success:

1. Same VLAN end to end on the path (access PVID and trunk allow-list must pass that VLAN).
2. Correct cabling and up links that are not blocked by STP (later chapter).
3. IP parameters in the same subnet (if you are testing with IP—IP misconfiguration is Layer 3, but the frame still needs L2 delivery for ARP).
4. Learning/flooding working—ports up, not error-disabled.

Classic exam failure scenario: Host A in VLAN 10 with 192.168.10.10/24 and Host B in VLAN 20 with 192.168.10.20/24. The IPs look “related,” but they are different broadcast domains. ARP never completes across VLANs. Fixing IP addresses without aligning VLANs (or without routing) fails. Conversely, two hosts in VLAN 10 with addresses in different subnets also fail for IP reasons even though L2 frames can flood.

VLAN types you may see in broader materials

HCIA focuses on port-based 802.1Q VLANs in campus switching. Awareness items (not deep configuration in this chapter):

• Data VLAN — ordinary user traffic.
• Voice VLAN — often coexists on a hybrid/access design for IP phones (platform features may auto-assign voice).
• Management VLAN — switch management IP (often on VLANIF).
• Native / default PVID concepts — untagged traffic classification on a port (covered with link types).

Protocol-based or MAC-based VLAN assignment exists on some products; for H12-811, prioritize manual port VLAN membership and trunk allow-lists.

Interaction with MAC tables and ARP

• MAC learning is per VLAN. Flooding for unknown unicast stays inside the VLAN.
• ARP broadcasts from a host only reach other ports in that VLAN.
• A Layer 3 interface (VLANIF) in VLAN 10 has a MAC; hosts ARP for the gateway IP and learn the VLANIF MAC as their default gateway’s MAC.

Design pitfalls

• One big VLAN for everything — defeats isolation; large broadcast domain.
• VLANs without IP plan — every VLAN that needs routed services needs a subnet and gateway.
• Orphan VLANs on trunks — VLAN created on access but not allowed on uplink trunk → host isolated from gateway.
• Overusing VLAN 1 — works in lab; production risk and noisy default assumptions.
• Assuming “VLAN = subnet” is automatic — you must configure both the L2 VLAN and the L3 addressing.

Mini design exercise

A floor has 80 employees, 20 guests, and 10 IP phones.

1. Create VLANs 10, 20, 30 with vlan batch 10 20 30.
2. Map each group to a /24 (or appropriate size) subnet.
3. Place access ports into the correct VLAN (access or hybrid for phone+PC).
4. Ensure the uplink trunk allows 10, 20, and 30.
5. Provide gateways with VLANIF interfaces and routing as needed.

That workflow is the campus default and reappears in every inter-VLAN routing lab.

Transition

Knowing what a VLAN is does not finish the job. Ports must be told how to tag or untag traffic: access, trunk, and Huawei’s important hybrid type. The next section is pure VRP CLI muscle memory—and a frequent source of exam traps when allow-pass or PVID is wrong.