Summary
Highlights
A Local Area Network (LAN) is a group of devices connected into a single broadcast domain. All devices within a LAN can see broadcasts sent on that network. Separating networks with different switches creates separate broadcast domains, enhancing security and organization. While effective, this can be inefficient by underutilizing switch interfaces.
Virtual Local Area Networks (VLANs) allow a single physical switch to host multiple logical networks. Different interfaces on the same switch can be assigned to different VLANs, effectively creating separate broadcast domains on a single device. This optimization saves space and power while maintaining logical separation and security.
A single switch can support many VLANs, segmenting devices into distinct logical groups (e.g., VLAN 1 for a gate room, VLAN 2 for a dining room). Devices on one VLAN cannot communicate with devices on another without a router. Routers, or switches with routing capabilities, enable communication between different VLANs.
A Virtual Private Network (VPN) encrypts data between devices across a network, ensuring privacy and security. A specialized device called a concentrator (often part of a firewall) encrypts and decrypts this data in real time. VPN client software is commonly built into operating systems or can be installed separately.
Client-to-site VPNs are used by remote users (the client) to securely connect to a central concentrator (the site), typically at the edge of a corporate network. All communication from the remote user to the concentrator is encrypted. Some configurations offer an 'always-on' VPN, automatically establishing a secure connection upon device login.
Site-to-site VPNs connect geographically separate corporate networks over the internet. This is commonly implemented using firewalls at each site, which act as VPN concentrators, creating an encrypted channel between the locations. This ensures that all data transmitted between the sites remains secure while traversing the public internet.