Our network works. What is the problem?
Working internet access and appropriate internal access are different questions. A virtual local area network (VLAN) creates a logical network segment on shared physical equipment. Traffic between VLANs requires routing. The design should use appropriate firewall or access-control rules to permit necessary connections and restrict the rest. [3]
Think of separate rooms sharing one building. Creating rooms helps organize access, but the doors still need the right controls. The number of rooms does not tell you whether the building is secure.
What would we actually separate?
Consider a hypothetical office with employee computers, visitor Wi-Fi, cameras, and a printer. A sensible design might give visitors internet access without access to staff devices, allow authorized employees to reach the printer, and limit cameras to their required services. That is an illustrative design, not a claim about a particular customer or a universal template.
Joint government guidance recommends identifying and isolating critical systems with appropriate controls to limit the impact of a compromise. The benefit comes from reducing unnecessary connections, not merely assigning VLAN numbers. [2]
Does a VLAN make us secure?
No. Devices within the same VLAN may still communicate, and permissive routing between VLANs can defeat the intended separation. Ask for tests showing both that prohibited connections fail and that required work succeeds. Port membership and the path between networks matter. [3]
Do not treat a device as trustworthy just because it is on the staff network. NIST's zero-trust guidance explicitly separates authentication and authorization from physical or network location. Account controls, device protection, and secure application access still need attention. [5]
When is the proposal more complicated than we need?
Ask for the simplest design that addresses your actual devices and risks. A small headcount is not a design by itself; neither is a plan to create a VLAN for every department. Ask what an additional boundary accomplishes and whether existing equipment can support it.
Before approving changes, request a plain-language network diagram, allowed connections, migration window, rollback plan, and tests for printing, phones, and business applications. Clarify the setup cost and ongoing maintenance. If the justification is "compliance," ask which applicable requirement is being addressed.
The buying question is not "How many VLANs will you give us?" It is "Which unnecessary access will you remove without breaking our work?" Ask Blue Tree Technology® to explain that outcome for your environment before agreeing to a network redesign.
Verification sources
[2] Joint cybersecurity advisory: Protecting MSPs and their customers
[3] Cisco: VLAN management - business-switch administration guide