It divides one physical switch into several independent logical switches, each with its own broadcast domain.

Devices in different VLANs cannot reach each other through the switch at all, even plugged into adjacent ports. Traffic between them has to go via a router or firewall, which is precisely the point: that is where policy gets applied.

Ports are configured either as access ports, belonging to one VLAN and carrying untagged traffic to an ordinary device, or as trunk ports carrying several VLANs with 802.1Q tags to another switch.

The practical effects are worth being concrete about. Broadcast traffic stays within its VLAN, so a chatty device does not affect everyone. A compromised camera cannot see the finance system. And the cabling system carries multiple networks without multiplying the cabling.

The planning that matters is the numbering scheme and which VLANs exist where - inconsistent VLAN numbering between switches is one of the most common causes of confusing faults.

By finding the loops in a topology and blocking one path in each, then reopening it only if the active path fails.

Ethernet cannot survive a loop, and a resilient network needs redundant paths - those two facts are in direct conflict. Spanning tree resolves it. Switches exchange messages, agree a root, calculate the best path from every switch to it, and put every remaining path into a blocking state.

When an active link fails, the blocked path is brought into service. Rapid spanning tree does this in a second or two; the original protocol took the best part of a minute.

Multiple spanning tree extends the idea so different VLANs can use different paths, which stops half the links sitting idle.

The design decision that matters is where the root is. Left to default the root ends up somewhere arbitrary - often a small edge switch - and traffic takes strange paths. Set the root priority explicitly on the core switches.

A port carrying several VLANs at once, tagged so the switch at the other end knows which is which - needed on every link between switches that share VLANs.

An access port belongs to a single VLAN and passes ordinary untagged frames to a computer or phone. A trunk port adds an 802.1Q tag to each frame identifying its VLAN, so one cable carries many networks.

The standard requirement is the uplink from an edge switch to the aggregation switch. It also applies to links to firewalls, virtualisation hosts, and wireless access points that serve several networks.

Two things cause most trunk problems. First, the VLAN list must match at both ends - a VLAN allowed on one side and not the other simply disappears, silently. Second, the native or untagged VLAN must match, and mismatched native VLANs produce traffic leaking between networks, which is a security problem rather than an inconvenience.

Allow only the VLANs actually needed on each trunk rather than all of them.

Port-based authentication: the switch refuses to pass traffic until the device or user proves who they are against a central server. It is worth it where physical access to outlets cannot be controlled.

When a device connects, the switch challenges it, relays the credentials to a RADIUS server, and only then opens the port - often placing it into a VLAN chosen by the server according to who authenticated.

That gives two things: unknown devices cannot simply plug in, and known devices land on the right network automatically wherever they connect.

The deployment cost is real. It needs a RADIUS infrastructure, certificates or credentials on the devices, and a considered plan for everything that cannot authenticate - printers, cameras, building controls - which usually means MAC-based bypass with its own register.

Start in monitor mode, which logs what would have been rejected without rejecting it. Turning 802.1X on abruptly across a live site is a reliable way to disconnect the estate.

Several physical links are bonded into one logical link, sharing traffic across them and surviving the loss of any one.

The switches at both ends agree the bundle, usually with LACP, and thereafter treat it as a single interface. Spanning tree sees one link, so no path is blocked and all the bandwidth is available.

The important caveat is how traffic is distributed. Frames are assigned to a member link by hashing addresses or ports, so a single conversation stays on one link. Two bonded gigabit links give a single transfer one gigabit, not two - the benefit is aggregate capacity and resilience, not a faster single flow.

Both ends must be configured, and a bundle configured on one side only is a classic cause of an intermittent loop.

Where the switches support stacking or multi-chassis aggregation, the bundle can be split across two physical switches, so a whole switch can fail without dropping the link. That is usually the real reason for aggregating at the uplink.

BPDU guard, root guard, storm control, port security and DHCP snooping - all cheap, all aimed at the same thing: users plugging in things they should not.

BPDU guard shuts a port that receives spanning tree messages, so a switch plugged into a desk outlet is disabled rather than allowed to influence the topology.

Root guard prevents a downstream device becoming the spanning tree root and dragging traffic through the wrong path.

Storm control caps broadcast, multicast and unknown unicast rates so a faulty device or a loop beyond the switch cannot saturate it.

Port security limits how many MAC addresses a port may learn, which detects small unmanaged switches added under desks.

DHCP snooping blocks DHCP responses from ports where no server should be, which stops a home router plugged in backwards from handing out addresses to the floor - one of the most common and most disruptive accidental faults.

Through SNMP for counters, syslog for events, and LLDP for topology - configured at installation rather than after the first fault.

SNMP polling gives per-port traffic rates, error counters, PoE consumption and uptime. Trends matter more than instant values: a port whose error count climbs steadily is a cable or transceiver failing before anyone notices slowness.

Syslog to a central collector captures link state changes, spanning tree events, authentication failures and configuration changes. A port flapping every few minutes is obvious in the log and invisible otherwise.

LLDP lets switches advertise themselves to their neighbours, which builds an accurate topology map and identifies what is plugged into which port - extraordinarily useful when the documentation is out of date, which it is.

Set meaningful port descriptions at installation. A network where every port is labelled with what it serves is diagnosable by anybody; one where they are not is diagnosable only by whoever built it.