In many offices the guest Wi-Fi password is printed on a card at reception, and the guest network is, in practice, the same network as everything else. A visitor's laptop gets an address in the same range as the accounting workstations, the file server, the CCTV recorder and a dozen IP cameras — some still using their default passwords. Nothing bad has happened yet. That is not the same as being safe.
A flat network means that any compromised device can see every other device and try to reach it. Network segmentation with VLANs is one of the most effective ways to limit that — provided it is designed with clear rules, not just as a set of numbers on a switch.
What a VLAN does — and what it does not
A VLAN (virtual local area network) splits one physical network into several logical networks. Devices in different VLANs can share the same switches and cabling, but they cannot talk to each other directly: traffic between VLANs has to pass through a router or firewall. On links between switches, frames are tagged (the IEEE 802.1Q standard) so that each switch knows which VLAN they belong to.
The key point: the VLAN creates the boundary, but the rules at that boundary provide the security. If the core switch routes freely between all VLANs, the network looks tidier, but an infected laptop can still reach the accounting server.
A practical segment map for an office
There is no single correct design, but most offices end up with a similar set of segments:
- Staff: employees' workstations and laptops.
- Servers: file, application and database servers.
- Finance: accounting and payment workstations, where the risk justifies it.
- Guests: internet access only, with client isolation on Wi-Fi.
- Security: IP cameras, the CCTV recorder, access control controllers and intercoms.
- Voice: IP phones, which also benefit from quality-of-service (QoS) settings.
- Printers and IoT: printers, displays, meeting room equipment, sensors.
- Building systems: HVAC controllers, lighting and other automation.
- Management: management interfaces of switches, access points, UPS units and the firewall, reachable only from admin workstations.
The rules between segments matter more than the segments
Start from 'deny by default' between segments and allow only the flows that are actually needed. For example:
- Staff → printers: allowed, on printing ports only.
- Staff → servers: allowed to the applications they use; administrative access only from the management segment.
- Cameras → CCTV recorder: allowed; cameras → internet and everything else: blocked.
- Viewing recordings: only from designated security workstations.
- Guests → internet: allowed; guests → anything internal: blocked.
- Building systems → only their own controller or cloud service, as documented by the vendor.
Why cameras and building systems need their own segment
IP cameras, recorders, access control panels and building automation controllers often run firmware that is rarely updated, use default or shared credentials, and are installed by different contractors. They are exactly the devices an attacker looks for. Placing video surveillance and access control and building automation in their own segments means a weakness in one camera does not expose the finance department, and a problem on the office network does not stop the recording.
Imagine a hypothetical office of 40 people where a visitor connects an infected laptop to the guest Wi-Fi. On a flat network, the malware can scan the whole address range and find the CCTV recorder still on its default password and the file server with an open share. On a segmented network, the same laptop sees only the internet gateway: the scan finds nothing, and the incident remains the visitor's problem rather than the company's.
Common mistakes
- Too many VLANs without a clear purpose — complexity nobody can maintain.
- Inter-VLAN routing on the core switch with no filtering at all.
- Wi-Fi SSIDs not mapped to the right VLANs, so the guest network lands in the staff segment.
- Trunk ports carrying every VLAN everywhere, including to desks and meeting rooms.
- Discovery protocols (for printers and screen sharing) breaking across segments, followed by 'temporary' allow-all rules.
- No documentation: VLAN numbers, address ranges and rules known only to one person.
How to segment an existing flat network without a big bang
- Inventory every device and what it needs to talk to.
- Define the segments and an addressing plan with room for growth.
- Write the rules between segments before touching the switches.
- Prepare switches, firewall and Wi-Fi: VLANs, trunks, SSID mappings, DHCP.
- Move one segment at a time, starting with the easiest — usually guests, then cameras.
- Test both the allowed and the blocked flows after each step.
- Document the result and keep it current.
Segmentation is usually done as part of a broader network infrastructure project or refresh, when switches and firewalls are being replaced anyway — which makes that a good moment to plan it.
Want to know how flat your network really is? Get in touch — we can help map the current state and plan a segmentation that fits your office.