Wireless and virtual LANs decide which devices share a network and which can talk to each other. Both are security boundaries when configured deliberately.
VLANs and trunks
A VLAN is a logical broadcast domain. An access port belongs to one VLAN; a trunk carries multiple VLANs using 802.1Q tags.
- Keep management VLANs separate from user traffic.
- Do not use VLAN 1 for everything.
- Restrict which VLANs are allowed on a trunk.
- Remember that routing between VLANs may allow everything unless ACLs or a firewall enforce policy.
Wi-Fi security
- WEP is broken.
- WPA2-Personal derives keys from a passphrase; use a long, unique one.
- WPA3 uses SAE, which resists offline guessing of captured handshakes.
- WPA2/WPA3 mixed mode is a compatibility compromise.
- WPS has known weaknesses; disable it.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.