# Is a VLAN a security boundary?

Only when traffic between VLANs passes through a firewall or access rules that enforce something. A VLAN by itself separates broadcast domains on a switch; if the router between VLANs allows everything, the separation is cosmetic, and that is a common finding in small networks. Misconfigured switch ports can also let an attacker hop between VLANs, for example trunk ports left open to user devices, or the default VLAN used for everything. To make VLANs count: route between them through a firewall with an allow list, set user ports to a single access VLAN, disable unused ports, and keep management interfaces in their own VLAN. Then check that the rules hold with real traffic. NetSenX shows host-to-host connections on monitored segments and flags scanning and lateral movement on every plan, so a host that reaches across VLANs where it should not becomes visible, as long as that traffic crosses a mirrored link.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/is-a-vlan-a-security-boundary

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [How do I check that guest Wi-Fi cannot reach our internal network?](https://netsenx.com/en/faq/how-to-check-guest-wifi-cannot-reach-the-internal-network)
- [Is a separate guest Wi-Fi enough for security?](https://netsenx.com/en/faq/is-a-separate-guest-wifi-enough)
- [Can someone plug a device into a free network socket in our office?](https://netsenx.com/en/faq/can-someone-plug-a-device-into-a-free-network-socket)
- [What is 802.1X, and does a small office need it?](https://netsenx.com/en/faq/what-is-802-1x-and-does-a-small-office-need-it)
- [Is multi-factor authentication enough to stop account takeover?](https://netsenx.com/en/faq/is-mfa-enough-to-stop-account-takeover)