A Virtual LAN (VLAN) divides a switched Ethernet network into logical Layer 2 broadcast domains. Devices in the same VLAN can exchange Ethernet frames through the switching infrastructure, while communication between different VLANs normally requires a router, firewall, or Layer 3 switch. This separation lets teams share physical equipment without placing every connected device in the same broadcast domain. For example, an enterprise can separate application servers and management interfaces even when both use the same switches.
IEEE 802.1Q identifies VLAN membership by inserting a four-byte tag into an Ethernet frame. The tag contains a 12-bit VLAN identifier; IDs 1 through 4094 are generally usable, although equipment and providers may impose additional restrictions. An access port normally associates untagged endpoint traffic with one VLAN, while a trunk carries multiple VLANs using tags. Some trunk configurations also support an untagged native VLAN. Engineers must align tagging expectations and allowed VLANs at both ends; a link can be physically up while forwarding none of the intended traffic because its VLAN configuration is wrong.
Cloud interconnects commonly use VLANs to distinguish logical connections on a physical Ethernet handoff. With AWS Direct Connect, a virtual interface uses an 802.1Q VLAN, and the customer configures the corresponding router interface or subinterface. For example, separate private and public virtual interfaces can use different VLAN IDs on a dedicated connection. The private interface supports private connectivity to VPC resources, while the public interface supports access to AWS public service endpoints. Each interface also needs appropriate IP addressing, BGP configuration, and routing policy; the VLAN tag alone does not establish cloud reachability.
A cloud VLAN handoff is not automatically an extension of an on-premises Ethernet broadcast domain into a cloud subnet. Standard Amazon VPC networking is not a customer-managed VLAN fabric, and Direct Connect provides routed connectivity rather than transparent Layer 2 extension into VPC subnets. A VLAN ID also has meaning within its configured Layer 2 scope, not as a globally unique network identifier. Reusing VLAN 200 in two disconnected sites does not connect those sites or make their IP networks equivalent.
Physical-layer compatibility must be verified independently of VLAN configuration. The interface speed, optical transceivers, fiber type, wavelength, and provider handoff specifications must match. A link aggregation group, or LAG, combines compatible physical links into a logical interface, commonly using LACP. VLAN traffic can traverse that aggregate, but VLANs do not aggregate bandwidth themselves. Flow hashing generally keeps an individual flow on one member link, so aggregate capacity does not imply that one flow can use every member's bandwidth. A LAG also does not replace geographically diverse connectivity.
MTU planning is another separate requirement. An 802.1Q tag adds Ethernet frame overhead, but it does not inherently require reducing the IP MTU when the equipment supports appropriately sized tagged frames. Jumbo frames require support across the relevant path, including router interfaces and cloud connection components. Do not assume that enabling jumbo frames on a physical interface enables them on every virtual interface or destination path. Test the intended packet sizes and account for encapsulation overhead; MTU mismatches can allow BGP and small packets to work while larger application packets fail.
VLANs reduce broadcast scope and support logical separation, but they do not encrypt traffic or replace firewall policy. Restrict trunk VLAN membership, avoid unintended native VLAN behavior, and apply routing and security controls at boundaries. When troubleshooting an interconnect, check optical status and errors first, then aggregation state, VLAN tagging, IP adjacency, BGP, routes, and MTU. This layered approach distinguishes physical faults from tagging errors and routing failures instead of treating every connectivity problem as a VLAN issue.
AWS Direct Connect