Building Resilient Networks: Why Flat Designs and Basic VLANs Fall Short

Whether you’re just getting familiar with VLANs or looking to strengthen your segmentation strategy, this is where the journey begins. Let’s start by exploring a common but often overlooked network design: the flat network. We’ll define what it is, explain why this design can be problematic, and set the stage for a more detailed understanding of VLANs.

Defining a Flat Network

A flat network is a network where all the devices are in one Virtual Local Area Network (VLAN)—often VLAN 1. VLANs are a combination of infrastructure and IP address assignments.

VLAN: Infrastructure’s Role

Infrastructure refers to the devices that move traffic throughout the network, such as switches and routers. In the case of VLANs, the focus will be on switches.

Scenario 1:

• Two separate production lines.
• Each line has its own IP address range
• Line #1: 6 devices
• Line #2: 8 devices
• Line #1 should not communicate with Line #2

One way we can do this is with two separate switches, one per line:

This works.

However, we can accomplish all the goals above by using VLANs. VLANs “split” a switch into multiple logical switches.

If a device is in VLAN 1 and another is in VLAN 2, these devices will not communicate unless routing between the VLANs is allowed. Most importantly, broadcasts do not cross VLANs by default.

These 2 points sum up the infrastructure’s role in VLANs:

1. VLANs are a group of ports on a network that can communicate.
2. The devices in the same group of ports do not need a router/default gateway to communicate with unicast, multicast, or broadcast traffic.

VLAN: IP Address Role

Devices on a network use IP addresses to organize themselves into groups called subnets. Typically, devices in the same subnet are also part of the same VLAN. One key concept here is the broadcast IP address—it tells the switch to send a message to every device in that VLAN. When a device wants to talk to all others at once, it sends a broadcast. The switch doesn’t care which subnet the devices are in; it just sends the message to every port in the VLAN. If two subnets share the same VLAN, a broadcast from one can affect devices in the other. That’s why configuring VLANs properly is so important: it controls how traffic flows and who hears what.

Scenario 2:

• Two separate production lines.
• Each line has its own IP address range
• Line #1: 2 devices
• Line #2: 2 devices
• Line #1 should not communicate with Line #2

We deploy the network below:

The red and blue outlines in the diagram show two separate IP address groups. Because all the ports are still part of VLAN 1, the devices are treated as one big group by the switch. That means a broadcast from the red group can reach the blue group—even though they’re supposed to stay separate. This setup breaks the rule that the two lines shouldn’t communicate. In real-world terms, an accidental broadcast storm from one group could disrupt the other. Worse, a deliberate broadcast could take down both. That’s why proper VLAN configuration is critical for both operational reliability and network security.

The solution above accomplishes the goals established. By changing the port groups on the switch so each VLAN matches a single IP subnet. When implementing VLANs, stick to this rule: one IP subnet per VLAN.

Communication Type 1: Unicast – One to One Communication

Communication Type 2: Multicast – One to Many Communication

Communication Type 3: Broadcast – One to All Communication

Flat networks may seem simple, but simplicity can come at a cost. Placing all devices in a single VLAN can lead to unintended communication and security risks. Through real-world scenarios, we’ve laid the foundation for understanding VLANs and why proper segmentation matters. It’s the first step toward building smarter, more secure networks.

Strengthen your organization’s security and reliability with network segmentation. Connect with Kendall Electric’s Network Specialists for expert guidance and practical solutions tailored to your needs.