VLAN design is the one hotel IT decision that gets made twice: once badly, in an afternoon, by whoever installed the switches, and once properly, years later, by whoever has to pass a penetration test. The question that decides which version you end up with is disarmingly simple. How many networks does this hotel actually need? Not how many are technically possible, not how many the brand standard mentions, not how many the lock vendor insists on — how many separate broadcast domains does this specific property genuinely require to run safely and be supportable in ten years’ time?
Most UK hotels answer that question by accident. A guest VLAN appears because guest WiFi obviously cannot sit on the office network. A payments VLAN appears because an acquirer asked. A camera VLAN appears because the CCTV integrator turned up with a laptop. Nothing gets removed, nothing gets documented, and five years later there are nineteen VLANs, four of which nobody can explain and two of which route to everything because a rule was added at 2am during a go-live.
This article is a counting discipline rather than a blueprint. If you want the whole estate on one page, our hotel network design guide covers cabling, switching, wireless and circuits, and our guide to VLAN segmentation for guest WiFi covers the security controls that make separation hold. What follows is the layer before both of them: the VLAN design arithmetic that tells you the number, the five tests that justify each split, and the honest running cost of every segment you add. Our network design practice runs this exercise before anything is cabled.
The short answer, if you only read one paragraph: a small guesthouse needs four networks, a limited-service hotel needs seven, a full-service property needs about eleven, and a resort with conference and leisure operations needs around sixteen. The long answer is why those numbers land where they do, what happens when you double them, and how to size, number, route, test and document the set you choose. Every figure below is arithmetic on one modelled 148-bedroom property, so you can substitute your own counts and get your own number.
Table of contents
- Why VLAN Design Starts With a Number, Not a Diagram
- The Five Tests That Force a New VLAN
- How Many Networks a Hotel Actually Needs
- VLAN Design by Property Type: Four Worked Counts
- The Eleven-VLAN Reference Design for a Full-Service Hotel
- What Every Extra VLAN Actually Costs You
- Over-Segmentation: VLAN Design That Collapses Under Itself
- Under-Segmentation: The Four Merges That Always Hurt
- Sizing Each Segment: Broadcast Domains and Address Plans
- VLAN Numbering Schemes You Can Still Read in 2036
- SSIDs Are Not VLANs: The Wireless Limit on VLAN Design
- Dynamic VLAN Assignment: One SSID, Many Networks
- Private VLANs: When 4,094 Networks Are Not Enough
- The Inter-VLAN Rule Matrix Grows Faster Than Your VLAN Design
- Compliance Boundaries That Decide Your VLAN Design
- What a VLAN Design Programme Costs: A 148-Bedroom Model
- Migrating to a New VLAN Design Without Closing the Hotel
- Testing and Documenting Your VLAN Design
- VLAN Design Mistakes We See Most Often
- Hotel VLAN Design FAQ
- References and Further Reading
Why VLAN Design Starts With a Number, Not a Diagram
Almost every hotel VLAN design conversation starts with a drawing. Someone opens a diagramming tool, draws boxes, and the boxes multiply until the page is full. That is the wrong order. The number of segments is a decision about trust, ownership and consequence; the diagram is just how you communicate it afterwards.
The diagram hides the VLAN design decision
A drawing makes eleven VLANs and twenty-two VLANs look equally tidy. On paper they cost the same. In operation they do not: the second one carries roughly four times the inter-segment rules, twice the documentation, twice the monitoring surface and twice the number of vendor conversations that begin “our system needs to see everything”. Counting first forces the trade-off into the open while it is still cheap.
A VLAN design is permanent in a way switches are not
A switch has a seven-year life and gets replaced without ceremony. A VLAN design outlives three generations of hardware, because every address, every firewall rule, every static route, every device configuration and every vendor’s site notes are written against it. Renumbering a hotel is a project. Choosing well the first time is a morning.
Hotels have no natural boundary to copy
An office has a boundary that VLAN design can borrow: staff inside, guests outside. A hotel has no such line. Several hundred anonymous devices arrive every night, a payment estate sits in public rooms, a life-safety estate runs on the same cable trays, and a building management system predates the IT department. Nothing in the building tells you where the edges are, so you have to derive them.
The NCSC frames it as grouping, not slicing
NCSC guidance on preventing lateral movement puts it plainly: “Segregate networks as sets: identify, group and isolate critical business systems and apply appropriate network security controls to them.” That is a grouping instruction, not a slicing one. Good VLAN design starts from a list of systems and groups them until the groups stop having anything meaningfully in common — it does not start from a target number of VLANs and fill them.
Getting the VLAN design number wrong is expensive in both directions
Too few segments and the cardholder data environment swallows the building, the penetration test finds paths nobody drew, and a compromised television can reach a folio. Too many and the rule matrix becomes unmaintainable, changes take a fortnight, and the team quietly adds permit-any rules to make things work. Both failures are common, and both are decided at the counting stage.
The Five Tests That Force a New VLAN
Every segment in a defensible VLAN design exists because it passes at least one of five tests. If a proposed VLAN passes none of them, it is a subnet-sizing question or a documentation question wearing a costume.
Test one: is there a compliance boundary?
If a defined scope runs across the boundary, split it. Payment card processing is the obvious case — segmentation is not mandatory under PCI DSS, but it is the recognised way to reduce what is in scope, and everything sharing a segment with a card-handling device is in scope with it. The same logic applies to any estate with its own legal regime: surveillance footage, guest identity records, and life-safety systems all carry obligations that the rest of the network does not.
Test two: who administers the devices?
If a third party configures, patches or remotely supports a group of devices, that group belongs on its own segment. The lock vendor, the BMS integrator, the lift contractor and the CCTV installer will each ask for access, and each will ask for more than they need. Giving each an addressable boundary means the conversation is about one segment rather than about your whole VLAN design.
Test three: can you authenticate and patch the device?
Devices you cannot enrol, patch or authenticate are a different class of risk from devices you can. A staff laptop with an agent on it and a fifteen-year-old door controller with a hard-coded password do not belong together at any price. This test is what separates the staff segment from the IoT segment even when both are “internal”.
Test four: what is the replacement cycle?
Lifecycle mismatch is the test people skip, and it is the one that causes renumbering projects. Access points last around seven years, staff endpoints five, door locks fifteen, lift controllers twenty-five, and BMS field devices longer still. Mixing a five-year estate with a twenty-five-year estate means every refresh of the fast-moving group disturbs the slow-moving one.
Test five: what happens when this segment fails?
Group by consequence as well as by kind. A guest wireless outage is an unhappy review. A payments outage stops trade. A door lock outage is a life-safety and liability event. A CCTV outage may breach a licence condition. Things with materially different failure consequences should be separately failable, which means separately addressable.
The four reasons that never justify a VLAN design split
| Test | Question to ask | Split if | Hotel example |
|---|---|---|---|
| 1. Compliance boundary | Does a defined scope cross this line? | Yes — always | Card terminals, PDQs, till payment modules |
| 2. Administrative owner | Who logs in to configure these? | A third party does | Door locks, BMS, lift comms, CCTV |
| 3. Manageability | Can you patch and authenticate it? | No, and you never will | In-room televisions, guest devices, sensors |
| 4. Lifecycle | How often is it replaced? | On a different cycle entirely | 15-year locks beside 5-year laptops |
| 5. Failure consequence | What breaks when this dies? | Something materially different | Trade stops vs a bad review |
| ✗ Different vendor | Same owner, trust and cycle? | Do not split | Two brands of staff printer |
| ✗ Different floor | Is this about topology? | Do not split — that is routing | Third-floor staff PCs |
| ✗ Needs its own SSID | Is this a wireless-naming need? | Do not split — map SSIDs to VLANs | A conference SSID |
| ✗ Too many devices | Is this about address space? | Do not split — resize the subnet | 500 guest devices in a /24 |
How Many Networks a Hotel Actually Needs
Run the five tests across a real hotel estate and the segments fall out on their own. The list is remarkably consistent across UK properties, and it grows in a predictable order as the property gets larger and adds services.
The four segments every VLAN design needs
Even a twenty-room guesthouse passes the tests four times. Guests are unmanageable and untrusted. Staff systems are managed and trusted. Card handling is a compliance boundary. Network infrastructure has a different administrative owner from everything it carries — you. Four segments, and every one of them is justified by a test rather than by preference.
The three that arrive with scale
Once a property has in-room entertainment, cameras and a building management system, three more segments earn their place: unmanageable in-room devices, the surveillance estate with its own legal regime and bandwidth profile, and building services with a third-party owner and a twenty-year lifecycle. That is seven, which is where most limited-service UK hotels should land.
The four that come with full service
A full-service hotel adds voice, staff wireless and handhelds, door locks and gateways, and guest wired bedroom ports. Locks in particular deserve their own segment on tests two, three, four and five simultaneously — third-party managed, unpatchable, fifteen-year lifecycle and a life-safety consequence. That takes the VLAN design count to eleven.
The five that only resorts need
Conference and events networks, leisure and spa systems, retail concessions, EV charging, and a separate back-of-house wireless segment appear only when the property genuinely operates those businesses. Each passes a test — a concession has its own administrative owner, EV chargers have their own vendor cloud and lifecycle — so on a large resort the honest number is around sixteen.
The VLAN design count as a chart
Why VLAN design is never “one segment per system”
There are perhaps forty distinct systems in a full-service hotel. Nobody needs forty VLANs. Systems that share an owner, a trust level, a lifecycle and a failure consequence belong together, however different their function looks on an asset register. Two brands of back-office printer are one segment. A property management terminal and a housekeeping handheld are usually one segment. The tests collapse the forty into eleven, and that collapse is the actual VLAN design work.
VLAN Design by Property Type: Four Worked Counts
The four tiers are not arbitrary bands. Each one adds segments because the property has added a business, an obligation or a class of device that fails one of the tests. Here is the full VLAN design ladder, tier by tier.
Tier one: the four-segment guesthouse VLAN design
Guest, staff, payments, management. Card handling stays on its own segment even in a twenty-room property, because the cost of a fourth VLAN is a few hours and the cost of an in-scope office network is an annual assessment across every device in the building. This is the smallest defensible VLAN design in hospitality.
Tier two: the seven-segment limited-service VLAN design
Add in-room entertainment, surveillance and building services. A limited-service property with 60 bedrooms, televisions in every room, forty cameras and a heating controller has genuinely crossed three more test boundaries, and seven segments is the honest count. Anything above seven here is usually somebody’s preference rather than a test result.
Tier three: the eleven-segment full-service VLAN design
Add voice, staff wireless, door locks and guest wired ports. This is the VLAN design most UK four-star properties should be running, and it is the one modelled in detail throughout the rest of this article.
Tier four: the sixteen-segment resort VLAN design
Add conference and events, leisure, retail concessions, EV charging and back-of-house wireless. Only add these when the business exists — a “future conference VLAN” with no conference centre is documentation debt.
The VLAN design ladder in one table
| Segment | Guesthouse (4) | Limited service (7) | Full service (11) | Resort (16) | Tests passed |
|---|---|---|---|---|---|
| Guest wireless | Yes | Yes | Yes | Yes | 3, 5 |
| Staff and back office | Yes | Yes | Yes | Yes | 2, 3 |
| Payments | Yes | Yes | Yes | Yes | 1, 5 |
| Network management | Yes | Yes | Yes | Yes | 2, 5 |
| In-room entertainment | No | Yes | Yes | Yes | 3, 4 |
| CCTV and recording | No | Yes | Yes | Yes | 1, 2, 5 |
| Building services and plant | No | Yes | Yes | Yes | 2, 3, 4 |
| Voice | No | No | Yes | Yes | 4, 5 |
| Staff wireless and handhelds | No | No | Yes | Yes | 3, 4 |
| Door locks and gateways | No | No | Yes | Yes | 2, 3, 4, 5 |
| Guest wired bedroom ports | No | No | Yes | Yes | 3, 5 |
| Conference and events | No | No | No | Yes | 2, 3, 5 |
| Leisure, spa and pool plant | No | No | No | Yes | 2, 4 |
| Retail concessions | No | No | No | Yes | 1, 2 |
| EV charging | No | No | No | Yes | 2, 4 |
| Back-of-house wireless | No | No | No | Yes | 3, 5 |
Where VLAN design genuinely differs between properties
Two hotels of identical size can justify different counts. A property with no restaurant has fewer payment endpoints but may still need the segment. A listed building with no room for cabling may run more wireless and fewer wired segments. A franchise with a brand-mandated loyalty kiosk fleet inherits a segment it did not choose. Use the tiers as a starting position and let the tests adjudicate the differences.
The Eleven-VLAN Reference Design for a Full-Service Hotel
The modelled property is a 148-bedroom four-star UK hotel with two restaurants, a bar, a small meeting suite and a leisure room. Counted honestly, it carries 753 addressable endpoints before a single guest phone joins the wireless. That inventory is what makes the VLAN design arguable rather than aesthetic.
Count the estate before the VLAN design starts
The 753 endpoints break down as 148 guest wired bedroom ports, 148 in-room televisions, 155 door locks and gateways, 69 management-plane devices (54 access points plus 15 switches, firewalls and controllers), 65 surveillance devices (63 cameras and 2 recorders), 53 building services and life-safety comms devices, 37 staff PCs and printers, 31 voice handsets, 22 staff handhelds, 17 payment endpoints and 8 kiosk and signage devices.
The eleven-segment VLAN design and its subnet sizes
| VLAN | Name | Subnet | Usable | Endpoints | Addressing |
|---|---|---|---|---|---|
| 10 | guest-wired | 10.48.10.0/24 | 254 | 148 | DHCP, 8-hour lease |
| 12 | guest-wireless | 10.48.12.0/22 | 1,022 | Transient | DHCP, 4-hour lease |
| 20 | inroom-entertainment | 10.48.20.0/24 | 254 | 148 | DHCP reservation per room |
| 30 | staff-wired | 10.48.30.0/24 | 254 | 37 | DHCP, 12-hour lease |
| 32 | staff-wireless | 10.48.32.0/24 | 254 | 22 | DHCP, 802.1X assigned |
| 40 | payments | 10.48.40.0/27 | 30 | 17 | Static, deliberately tight |
| 50 | voice | 10.48.50.0/24 | 254 | 31 | DHCP with option 66 |
| 60 | cctv | 10.48.60.0/24 | 254 | 65 | Static or reserved |
| 70 | locks | 10.48.70.0/24 | 254 | 155 | Static, vendor-managed |
| 80 | building-services | 10.48.80.0/24 | 254 | 53 | Static |
| 90 | kiosk-signage | 10.48.90.0/28 | 14 | 8 | Static |
| 99 | management | 10.48.99.0/24 | 254 | 69 | Static, out-of-band where possible |
Why the counts sum the way they do
The eleven populated segments account for every one of the 753 endpoints: 148 plus 148 plus 37 plus 22 plus 17 plus 31 plus 65 plus 155 plus 53 plus 8 plus 69. Guest wireless is the twelfth entry and holds no permanent endpoints at all, which is exactly why it gets the largest subnet and the shortest lease.
The VLAN design distribution is lopsided, and that matters
The three biggest segments are the three you trust least
Locks, guest ports and televisions are 451 of the 753 endpoints — 59.9% of the estate — and not one of them is patchable, enrollable or authenticated by you. That single fact is the strongest argument in hospitality for spending design effort on separation rather than on endpoint agents, because there is no agent to install on nearly six endpoints in ten.
Payments is deliberately the smallest subnet in the VLAN design
Seventeen payment endpoints get a /27 with 30 usable addresses, not a /24. A tight subnet makes growth a conversation: adding an eighteenth terminal is trivial, adding a thirty-first requires someone to think. That friction is a feature, because uncontrolled growth in the cardholder data environment is how scope creeps back after a successful reduction.
What Every Extra VLAN Actually Costs You
Segments are not free, and the cost is not the ten minutes it takes to type the VLAN into a switch. It is the recurring work that segment generates for as long as it exists, which on a hotel network is measured in decades.
The rule matrix grows quadratically with your VLAN design
Every new segment has to have a documented relationship with every existing one. The number of segment pairs in a VLAN design of n segments is n(n−1)/2: four segments produce 6 pairs, seven produce 21, eleven produce 55, and sixteen produce 120. Doubling eleven to twenty-two takes you to 231 pairs — a 4.2-fold increase in relationships for a 2-fold increase in segments.
Each segment adds an address plan entry to the VLAN design
A subnet, a gateway, a DHCP scope or a static range, a DNS suffix decision, a reverse zone, an NTP source and a monitoring template. None of it is difficult and all of it is work that must be repeated identically for every segment, then kept current through every change for the life of the building.
Each segment adds a monitoring surface
Somebody has to know when a segment’s utilisation, error rate or reachability changes. At a modest £14 per segment per month for polling, dashboards and alert routing, eleven segments cost £1,848 a year and twenty-two cost £3,696. That is not a large number, but it is a permanent one and it scales linearly with the VLAN design count.
Each segment adds a testing obligation
Where segmentation is used to reduce scope, the controls have to be penetration tested at least every twelve months and after any change to them — and a configuration review does not satisfy that requirement. Every additional boundary that touches the cardholder data environment is another path a tester has to try to traverse, and another line on the invoice.
Each segment adds a vendor conversation
Every third party in your vendor management register will eventually ask for a route into a segment they were not given. More segments means more of those conversations, more exceptions, and more opportunities for an exception to outlive the reason it was granted. The exceptions are what quietly undo the whole exercise.
The marginal annual VLAN design cost of one segment
| Recurring item | Basis | Annual cost per segment |
|---|---|---|
| Monitoring and alerting | £14 per month | £168.00 |
| Annual rule-matrix review | 0.5 day at £680 | £340.00 |
| Address plan and diagram upkeep | 0.25 day at £520 | £130.00 |
| Total marginal cost | Per segment, per year | £638.00 |
What that means for an over-grown VLAN design
Eleven unnecessary extra segments cost 11 × £638 = £7,018 a year in nothing but upkeep, before a single security benefit is counted, and they arrive alongside 176 extra segment pairs nobody has time to review. That is the real price of a VLAN design nobody counted.
Over-Segmentation: VLAN Design That Collapses Under Itself
Under-segmentation gets all the attention because it fails visibly, in penetration test reports. Over-segmentation fails quietly, and in our experience it is the more common condition in hotels that have had three or four IT providers in a decade.
The first VLAN design symptom is permit-any rules
An over-segmented VLAN design does not stay strict; it degrades. When a change takes a fortnight because it touches eleven segment pairs, somebody eventually adds a broad allow rule “temporarily” to make a go-live happen. Six months later there are four of them, and the twenty-two-segment design provides less isolation than a well-built eleven-segment one.
The second symptom is undocumented segments
Every audit we run on a large hotel estate finds at least one VLAN nobody can account for. It has an address range, it appears on trunks, and no living person knows what is on it. Those segments are never quite empty and never monitored, which makes them the ideal place for something to sit unnoticed for a very long time.
The third symptom is address sprawl
Twenty-two segments consume twenty-two subnets, twenty-two gateways and twenty-two entries in every firewall, routing table and monitoring system. RFC 1918 gives you plenty of private space, so the constraint is not addresses — it is human legibility. Nobody can hold twenty-two ranges in their head at 2am with a queue at reception.
The fourth symptom is per-room ambition
Every few years someone proposes a VLAN per bedroom for guest isolation. On our 148-bedroom model that is 148 segments, and the 4,094-segment ceiling of the 12-bit VLAN identifier stops being theoretical on a large estate. RFC 5517 makes the point directly: because “each VLAN requires a separate subnet, there can be potential wastage of IP addresses in each subnet.” Client isolation and private VLANs solve guest separation without spending a segment per room.
How to audit your own VLAN design honestly
Walk your segment list and try to name, for each one, the test it passes and the person who owns it. Any segment where you cannot name both is a candidate for merging. In practice this exercise removes three to six segments from a typical over-grown hotel VLAN design without weakening a single control anybody relies on.
Under-Segmentation: The Four Merges That Always Hurt
The opposite failure is rarer in mature estates and near-universal in new ones. Four specific merges cause almost all of the damage we see in hospitality, and all four are made for convenience rather than conviction.
Merge one: payments on the staff network
The most expensive merge available. It puts every staff PC, printer and back-office laptop into the cardholder data environment, which means every one of them inherits the patching, logging, access control and testing obligations of a payment device. On our model that turns a 17-endpoint scope into a 54-endpoint scope overnight.
Merge two: in-room televisions on the guest network
Tempting because both are “guest facing”, wrong because they are opposite cases. Televisions are permanent, addressable, unpatchable and yours; guest devices are transient, anonymous and theirs. Putting them together means a compromised guest laptop shares a broadcast domain with 148 installed devices you cannot fix.
Merge three: door locks on the building services network
Both are third-party managed, so the merge looks defensible on test two. It fails on test five: a plant outage is a comfort problem and a lock outage is a life-safety and liability event. They also fail differently under load, and lock gateways generally cannot tolerate the broadcast noise of a large plant estate.
Merge four: the management plane on the staff network
The one that turns a small compromise into a large one. If switch, firewall, controller and access point management interfaces are reachable from the same segment as a phishable staff laptop, then an initial foothold reaches the control plane of the whole VLAN design in one hop. Separating them is the cheapest control in this article.
The four VLAN design merges compared
| Merge | Why it happens | Test it fails | Cost on the 148-bedroom model |
|---|---|---|---|
| Payments on staff | One spare switch port in the office | 1 and 5 | Scope grows from 17 to 54 endpoints |
| Televisions on guest | Both are “guest facing” | 3 and 4 | 148 unpatchable devices exposed to guests |
| Locks on building services | Both vendor-managed | 5 | 155 lock devices share a plant broadcast domain |
| Management on staff | Convenience for the IT team | 2 and 5 | 69 control-plane devices one hop from a laptop |
The one VLAN design merge that is usually fine
Staff wired and staff wireless can share a segment in a small property. Both are managed, both are patched, both are authenticated, and the lifecycle is similar. Splitting them in a 60-room hotel is over-segmentation; splitting them in a 250-room hotel with 22 handhelds on a different refresh cycle is not.
Sizing Each Segment: Broadcast Domains and Address Plans
Once the VLAN design count is settled, sizing is arithmetic. Two constraints matter: how many usable addresses a prefix gives you, and how large a broadcast domain you are willing to operate in a building full of chatty devices.
The prefix arithmetic every VLAN design uses
A /28 gives 14 usable addresses, a /27 gives 30, a /26 gives 62, a /24 gives 254, a /23 gives 510, a /22 gives 1,022 and a /21 gives 2,046. Almost every hotel segment fits a /24 with room to spare. Guest wireless is the exception, because transient devices at two or three per occupied room can exceed a /24 on a full Saturday night.
Size for the peak, not the average
Our 148-bedroom model at 92% occupancy has 136 occupied rooms, and at 2.6 connected devices per room that is 354 concurrent guest devices — comfortably inside a /24 on paper. Add day guests, function attendees and staff-owned phones and a /22 with 1,022 addresses removes the argument permanently. Guest address exhaustion on a Friday evening is a visible and entirely avoidable failure.
Keep broadcast domains modest by choice
A single flat /21 with 2,046 hosts is legal and unwise. Broadcast and multicast traffic is repeated to every port in the domain, and the noisiest devices in a hotel — televisions doing service discovery, printers advertising themselves, lock gateways polling — are exactly the ones you least want amplified. Keeping domains at a few hundred hosts is a resilience decision, not a purity one.
Short leases on transient segments, static on permanent ones
Guest wireless wants a four-hour lease so addresses recycle after checkout. Guest wired ports can take eight hours. Staff endpoints take twelve. Cameras, locks, payment devices and plant controllers should be static or reserved so that an address in a log always means the same physical thing three months later.
Reserve the pattern, not just the range, in the VLAN design
Use the third octet as the segment identifier and keep it aligned to the VLAN number where you can: VLAN 60 on 10.48.60.0/24 is self-documenting, VLAN 60 on 10.48.7.0/24 is a lookup every single time. That one convention removes a surprising amount of 2am confusion, and it costs nothing whatsoever at VLAN design time.
Leave gaps in the VLAN design deliberately
Number segments in tens so there is room to insert one without renumbering. Our model uses 10, 12, 20, 30, 32, 40, 50, 60, 70, 80, 90 and 99, which leaves obvious slots for a conference segment at 92 or a second payments segment at 42 without disturbing anything that already exists.
VLAN Numbering Schemes You Can Still Read in 2036
Numbering is the cheapest thing in this article to get right and one of the most expensive to change later, because the number appears in every switch configuration, every firewall rule, every vendor’s site notes and every diagram of the property.
Keep the VLAN design inside the ranges your kit supports
The 802.1Q VLAN identifier is a 12-bit field, giving usable identifiers from 1 to 4094. Many switch platforms also reserve a block around 1002–1005 for legacy media types, and treat the extended range above 1005 differently from the standard range. Staying with two-digit and three-digit numbers below 1000 avoids every one of those platform quirks.
Never use VLAN 1 for anything
VLAN 1 is the default on most switch platforms, which means it is the one an unconfigured port lands in, the one a mistyped trunk carries, and the one every attacker assumes is populated. Leave it unused and unrouted, and make sure no trunk anywhere uses it as its native VLAN.
Encode meaning in the number
| Range | Reserved for | Example | Why |
|---|---|---|---|
| 1 | Nothing, ever | Unused, unrouted | Platform default and attacker assumption |
| 2–9 | Native and blackhole VLANs | VLAN 2 as an unused native | Keeps trunk natives away from data |
| 10–19 | Guest-facing | 10 wired, 12 wireless | Untrusted, transient, largest subnets |
| 20–29 | In-room devices | 20 televisions | Yours, permanent, unpatchable |
| 30–39 | Staff and back office | 30 wired, 32 wireless | Managed and authenticated |
| 40–49 | Payments and compliance scope | 40 payments | One obvious range for in-scope segments |
| 50–59 | Voice and real-time | 50 SIP handsets | Distinct quality-of-service treatment |
| 60–89 | Operational technology | 60 CCTV, 70 locks, 80 plant | Third-party owned, long lifecycle |
| 90–98 | Commercial extras | 90 kiosks, 92 conference | Grows with the business |
| 99 | Management plane | 99 infrastructure | Memorable, always last, never routed to guests |
Name each segment in the VLAN design as well as numbering it
Every switch platform lets you attach a name to a VLAN. Use it, use lower case, use hyphens, and use the same string in the firewall object, the monitoring system and the diagram. When four systems call the same segment “payments”, correlation during an incident is trivial. When they call it “PAYMENTS”, “VLAN40” and “PCI-Zone”, it is not.
Keep the VLAN design scheme identical across properties
A group with six hotels should use the same numbering in all six, with only the address space differing. An engineer who fixed VLAN 70 in Chester on Monday should not have to look up which number is the lock segment in Cardiff on Tuesday. This is the single largest operational saving available to a multi-property estate.
Write the VLAN design scheme down before the first switch is configured
The scheme is a one-page document. Produce it at VLAN design time, get it agreed, and hand it to every installer and vendor who touches the property. Retrofitting a numbering convention onto a live hotel is a renumbering project with an outage attached to it.
SSIDs Are Not VLANs: The Wireless Limit on VLAN Design
The most common way a sound VLAN design gets wrecked is wireless. Somebody assumes each segment needs its own network name, the access points end up broadcasting eight of them, and performance drops for every guest in the building.
Each SSID costs airtime whether anyone uses it or not
Vendor guidance is blunt about the mechanism. Each virtual access point “must send a beacon every 100ms at the lowest supported data rate so all clients can receive it”, and every probe request draws a response from each one. Meraki’s documentation states plainly that “no more than 3 SSIDs should be enabled on any single access point”, and the illustration is stark: two access points with four SSIDs each means eight beacon streams and eight probe responses instead of two.
Three network names is enough for an eleven-segment VLAN design
A well-built full-service hotel needs a guest SSID, a staff SSID and — sometimes — an events or device SSID. That is three broadcast networks carrying traffic for as many segments as you like, because segment membership is decided after association, not by the network name a client picked from a list.
Map many segments onto few network names
The guest SSID maps to the guest wireless segment. The staff SSID maps to staff wireless, handhelds, kiosks and back-of-house devices depending on who authenticates. The device SSID, where one exists, maps to televisions, sensors or lock gateways using pre-shared keys per device class. Eleven segments, three names on the air.
Do not put operational technology on a broadcast network name
Cameras, plant controllers and lock gateways should be wired wherever the cable exists. Where wireless is unavoidable, use a hidden or restricted network with per-device credentials rather than adding another name to the general broadcast set. The airtime cost of an SSID that serves fifty static devices is paid by several hundred guests.
Client isolation is a wireless control, not a VLAN design decision
Putting every guest in one segment does not stop them seeing each other; client isolation at the access point does. This is the clearest example of a control that people mistakenly try to solve by adding segments. One guest segment plus isolation beats twenty guest segments without it, and it costs a checkbox rather than a project.
Dynamic VLAN Assignment: One SSID, Many Networks
Dynamic assignment is what lets a small number of network names serve a larger number of segments, and it is the mechanism that makes a clean count practical rather than theoretical.
How the assignment actually works
An 802.1X-authenticated client is placed into a segment by the authentication server, not by the port or the network name. RFC 3580 sets out the exact attributes: “Tunnel-Type=VLAN (13) Tunnel-Medium-Type=802 Tunnel-Private-Group-ID=VLANID”. The identifier travels as a string, so the same staff network name can put a receptionist’s laptop in one segment and a housekeeping handheld in another.
What dynamic assignment changes about your VLAN design
Once assignment is dynamic, the number of segments stops being limited by the number of network names or the number of physical ports. You can run eleven segments over three network names and one uniform switch port configuration, which is precisely why a well-counted design is easier to operate than a badly counted one, not harder.
Wired ports benefit just as much
The same mechanism works on wired access ports. A meeting room port that assigns a guest segment to unauthenticated devices and a staff segment to authenticated ones removes an entire class of patching mistake, because the port no longer needs to know what will be plugged into it.
Give the VLAN design a deliberate failure segment
Decide in advance where an unauthenticated or failed device lands, and make it a real segment with internet-only access and no route anywhere else. The default on many platforms is to fail into whatever the port’s configured VLAN is, which on an old switch is often VLAN 1.
Do not let the authentication server become the single point of failure
If every port and every association depends on one server, then that server is now a life-safety dependency in a building with electronic locks. Run two, put them on the management segment, and test what happens to the property when both are unreachable before you find out during a power event.
Private VLANs: When 4,094 Networks Are Not Enough
Hotels are the textbook case for private VLANs, and RFC 5517 says so explicitly. It exists because multi-client environments — service providers, and by extension hotels — want per-client isolation without spending a segment and a subnet on every client.
The scarcity the RFC describes
The document is direct about the ceiling: “the IEEE 802.1Q standard specifies that the VLAN ID field in an Ethernet frame is 12 bits wide”, which “equates to a maximum of 4094 users that can be supported.” For a hotel group trying to isolate every room in every property from one controller, that ceiling arrives faster than anyone expects.
The three port types
A private VLAN domain has promiscuous ports, which reach everything and carry the router and DHCP server; isolated ports, where an endpoint “will only possess the ability to communicate with those endpoints connected to promiscuous ports”; and community ports, where a defined group can talk to each other and to the promiscuous ports but to nobody else.
Why that maps onto a hotel so neatly
Isolated ports are bedrooms: each guest reaches the gateway and the internet and nothing else, with no ability to see the room next door. Community ports are a family suite, a conference room or a serviced apartment where several devices legitimately need to see each other. One primary segment, one subnet, hundreds of isolated endpoints.
The address-space dividend
Because “all members can share a common address space that is part of a single subnet associated to the primary VLAN”, a 148-room property gets per-room isolation on one /22 rather than on 148 subnets. That is the difference between a VLAN design that fits on a page and one that fills a spreadsheet.
Check your hardware before the VLAN design depends on it
Private VLAN support is uneven across switch platforms, and the feature names differ. Confirm it works on the exact model and firmware in your comms room before it becomes load-bearing in a VLAN design, and confirm it survives a stack failover, which is where implementations most often disappoint.
The Inter-VLAN Rule Matrix Grows Faster Than Your VLAN Design
Segments are only worth what the rules between them enforce. This is where the VLAN design count you chose earlier turns into ongoing work, and where the quadratic arithmetic starts to bite.
The pair count by VLAN design size
Default deny, then justify each exception
Start from the position that no segment reaches any other, then add the flows the business genuinely needs. In a hotel there are only ever a handful: point of sale to the property management interface for folio posting, the lock server to the door gateways, a staff viewing client to the video recorder, and the management segment outward to the devices it administers.
Write direction into every rule
“Allow point of sale to property management” and “allow property management to point of sale” are different statements with different consequences. Write every rule with a direction and let the firewall handle return traffic statefully. A bidirectional rule between two segments is usually two segments pretending to be one, which means your real count is lower than your documented count.
The flows people forget until go-live
Backup traffic, monitoring polls, certificate renewal, time synchronisation, vendor remote support and firmware update paths are all real flows that get discovered on commissioning night because nobody drew them. Add a row for each during design and the go-live week is considerably calmer for everyone involved.
The matrix for the eleven-segment VLAN design
| From ↓ / To → | Guest | In-room | Staff | Payments | CCTV | Locks | Plant | Internet |
|---|---|---|---|---|---|---|---|---|
| Guest | Isolation on | Casting proxy only | Deny | Deny | Deny | Deny | Deny | Allow, filtered |
| In-room | Deny | Isolation on | Deny | Deny | Deny | Deny | Deny | Named update hosts |
| Staff | Deny | Deny | Allow within | Deny | Viewer to recorder | Lock server only | Engineering host only | Allow, logged |
| Payments | Deny | Deny | One host, one port | Allow within | Deny | Deny | Deny | Named acquirer hosts |
| CCTV | Deny | Deny | Reply traffic only | Deny | Allow within | Deny | Deny | Update hosts only |
| Locks | Deny | Deny | Reply traffic only | Deny | Deny | Allow within | Deny | Vendor cloud only |
| Plant | Deny | Deny | Deny | Deny | Deny | Deny | Allow within | Deny by default |
| Management | Manage APs | Manage switches | Manage switches | Manage switches | Manage switches | Manage switches | Manage switches | Vendor cloud only |
Review the matrix on a schedule, not on an incident
Rules accumulate. Once a year, print the matrix, walk it with the people who own each segment, and delete anything nobody can explain. This is also the first artefact an assessor or a cybersecurity consultant will ask to see, so keeping it current pays a compliance dividend as well as a security one.
The matrix is the honest measure of your VLAN design
If you cannot produce a filled-in grid for your current segment list, then you do not have a VLAN design — you have a VLAN inventory. The grid is what turns a count into enforcement, and producing it for the first time usually reveals two or three segments that were never really separate at all.
Compliance Boundaries That Decide Your VLAN Design
Three UK obligations put hard edges on the VLAN design count, and each one is easier to satisfy with a deliberate segment than with an exception.
PCI DSS: segmentation is optional, scope is not
Segmentation is not a PCI DSS requirement, but it is the recognised method of reducing what falls inside the cardholder data environment. Where you rely on it, the controls have to be penetration tested at least every twelve months and after any change to them, and a configuration review alone does not discharge that obligation. Service providers face the same test every six months.
Cyber Essentials: scope is what you declare
Cyber Essentials assesses the whole organisation unless you scope it deliberately, and a segregated sub-scope has to be genuinely segregated. A hotel that certifies a “corporate” scope while payments, locks and cameras share a broadcast domain with staff laptops has not scoped anything — it has drawn a line on a diagram that the network does not honour.
UK GDPR: appropriate technical measures
Article 32 requires data protection measures appropriate to the risk, and the Information Commissioner’s Office treats network separation as a standard expectation rather than an advanced control. Guest identity records, surveillance footage and booking data each carry their own retention and access obligations, and a segment is the cheapest way to make “who can reach this” an answerable question.
Life safety changes the calculation
Fire panels, lift comms, door locks and alarm circuits are not ordinary IT. They have their own regulatory owners, their own inspection regimes and their own consequences. Where they are networked, they belong on segments whose availability is treated as a safety matter and whose rules are reviewed with the responsible person, not with the IT team alone.
Insurance and contractual boundaries
Cyber insurance questionnaires increasingly ask directly whether payment and operational technology systems are segmented from corporate systems. So do brand standards and management agreements. A defensible count with a documented matrix answers all of them from one artefact, which is a genuine cybersecurity and commercial saving rather than a paperwork exercise.
Write the boundary into the VLAN design, not the exception log
Every one of these obligations is easier to satisfy if the boundary was a segment from day one. Retrofitting a compliance edge onto a flat network means either a renumbering project or a growing list of documented exceptions, and assessors read exception lists with more interest than diagrams.
What a VLAN Design Programme Costs: A 148-Bedroom Model
The following is a re-segmentation programme for the modelled property: 148 bedrooms, 753 endpoints, eleven segments, on existing hardware capable of supporting them. Nothing here is new switching — it is the VLAN design, configuration, coordination and validation work.
The one-off VLAN design cost
| Workstream | Basis | Cost |
|---|---|---|
| Discovery and endpoint inventory (753 devices) | 6 days at £680 | £4,080.00 |
| Segment plan, address plan and rule matrix | 5 days at £680 | £3,400.00 |
| Firewall and inter-segment policy build | 4 days at £680 | £2,720.00 |
| Switch reconfiguration across 15 devices | 5 days at £595 | £2,975.00 |
| Wireless mapping and 802.1X assignment | 4 days at £680 | £2,720.00 |
| Vendor coordination (locks, plant, lift, CCTV, POS) | 5 days at £520 | £2,600.00 |
| Out-of-hours cutover windows | 6 nights at £980 | £5,880.00 |
| Segmentation penetration test | Fixed price | £4,450.00 |
| As-built documentation pack | 3 days at £520 | £1,560.00 |
| Subtotal | Before contingency | £30,385.00 |
| Contingency | 10% | £3,038.50 |
| Total one-off | £225.83 per bedroom | £33,423.50 |
Per bedroom and per endpoint
£33,423.50 across 148 bedrooms is £225.83 a bedroom, and across 753 endpoints it is £44.39 an endpoint. Both numbers are worth quoting to a board, because the per-endpoint figure is what makes the case for not putting an eleventh segment’s worth of devices into a tenth segment for convenience.
The annual VLAN design running cost
Eleven segments cost £8,178 a year to operate properly: the £4,450 annual segmentation penetration test, £1,360 for two days of rule-matrix review, £520 for documentation upkeep, and £1,848 of monitoring at £14 per segment per month. That is £55.26 per bedroom per year, or roughly the price of one room night per bedroom.
The five-year VLAN design total
One-off £33,423.50 plus five years at £8,178 gives a five-year total of £74,313.50, which is £502.12 per bedroom over five years. The one-off share is 44.98% of the total, so more than half of what a VLAN design costs is the running of it — which is exactly why the VLAN design count matters more than the build.
What the over-segmented VLAN design alternative costs
The same property re-segmented into twenty-two VLANs adds 11 × £638 = £7,018 a year in marginal upkeep, taking the annual figure from £8,178 to £15,196 — an 85.8% increase — and takes the pair count from 55 to 231. Over five years that is £35,090 of extra cost for isolation nobody asked for and nobody can review.
Where the money is actually saved
The saving is not in the build; it is in every subsequent change. A hotel with eleven documented segments and a filled-in matrix can answer a vendor’s access request in an hour. A hotel with twenty-two undocumented segments takes a fortnight and gets it wrong, which is why our clients’ second-year support hours fall after this exercise rather than rise.
Migrating to a New VLAN Design Without Closing the Hotel
Hotels trade every day of the year, so a re-segmentation is done in service. The sequence below moves 753 endpoints over eighteen weeks with no daytime disruption and no single irreversible night.
Build the new VLAN design before moving anything
Create every segment, subnet, gateway, scope and rule while the old design is still carrying traffic. Nothing moves in the first seven weeks. This means the cutover nights are port-configuration changes rather than VLAN design work, which is the difference between a twenty-minute window and a four-hour one.
Move the management plane first
The management segment is the safest thing to move because you control every device on it and can revert from the console. It is also the segment everything else depends on, so proving it early removes the biggest risk from every later window.
Move operational technology before people
Cameras, plant and lock gateways are static, addressed by you, and unaffected by a change of segment as long as their server can still reach them. They are also the segments where vendor coordination takes longest, so start those conversations in week one and move the devices in week eight.
Move payments last but one, with notice
The payments segment moves after staff and voice and before guest, and only with the acquirer and the point-of-sale vendor informed. Any change to segmentation controls re-triggers the penetration test obligation, so schedule the test after the payments move, not before.
The phased VLAN design migration plan
| Phase | Weeks | What moves | Endpoints | Cumulative |
|---|---|---|---|---|
| 1. Discovery | 1–3 | Nothing — inventory only | 0 | 0 |
| 2. Design and sign-off | 4–5 | Nothing — plan agreed | 0 | 0 |
| 3. Parallel build | 6–7 | Segments created, no ports moved | 0 | 0 |
| 4. Infrastructure and OT | 8–11 | Management 69, CCTV 65, plant 53 | 187 | 187 (24.8%) |
| 5. People and voice | 12–13 | Staff 37, handhelds 22, voice 31, kiosks 8 | 98 | 285 (37.8%) |
| 6. Payments and locks | 14–15 | Payments 17, locks and gateways 155 | 172 | 457 (60.7%) |
| 7. Guest-facing | 16 | Guest wired 148, televisions 148 | 296 | 753 (100%) |
| 8. Test and decommission | 17–18 | Penetration test, docs, old VLANs removed | 0 | 753 (100%) |
The migration curve
Keep a documented rollback for every window
Every cutover night needs a written revert: which ports, which configuration, which order, and who decides. Six windows with tested rollbacks is a controlled programme. Six windows without them is six chances to be explaining an outage at breakfast service.
Remove the old VLAN design deliberately
The final phase is the one everyone skips. Old VLANs left configured on trunks are how the previous design comes back — a mis-patched port lands in a range that still routes somewhere it should not. Delete them, remove them from trunk allow-lists, and record the date.
Testing and Documenting Your VLAN Design
An untested segment boundary is an assumption. A documented one that nobody has tried to cross is an assumption with a diagram attached.
Test from the untrusted side, not the trusted one
Sit on the guest segment with a laptop and try to reach the payment range, the recorder, the lock gateways and the switch management addresses. Then repeat from the in-room entertainment segment, which is the one people forget because it feels like part of the furniture. What matters is what an attacker on the worst segment can actually reach.
A configuration review is not a test
This bears repeating because it is the most common finding: reading the firewall rules and confirming they look right does not satisfy the segmentation testing requirement, and it does not find the exception somebody added in 2023. Somebody has to try to traverse the boundary and fail.
Re-test after any change to the controls
The obligation is triggered by change, not only by the calendar. A new rule, a new segment, a firmware upgrade on the firewall, a new vendor route — each one is a reason to re-validate the boundaries that change touched, not to wait eleven months.
Document four VLAN design artefacts and keep them together
A segment register naming each VLAN, its subnet, its owner and the test it passes. An address plan. A filled-in rule matrix. A one-page diagram. Four documents, one folder, updated as part of change management. The best VLAN design in the country is worthless at 2am if nobody can tell which segment feeds the third floor.
Monitor per segment, not just per switch
Utilisation, error rates, address-scope exhaustion and reachability should all be visible per segment in whatever monitoring platform you run. Guest scope exhaustion, in particular, is a business-visible failure that a monitoring threshold catches days in advance and a complaint at reception catches too late.
Make the VLAN design part of change control
Every request to add a segment should have to name the test it passes and the owner who will maintain it. Every request to add a rule should have to name the flow and the expiry. That single piece of process is what stops an eleven-segment design becoming a twenty-two-segment one over five years.
VLAN Design Mistakes We See Most Often
These are the recurring findings from real UK hotel estates, in rough order of frequency.
Counting VLAN design segments instead of counting reasons
The most common mistake is arriving at a number without a test behind each entry. A design where every segment can name the test it passes and the person who owns it is defensible at any count. One that cannot is fragile at every count.
Leaving trunks carrying everything
An access switch in a bedroom riser does not need to carry the payments segment, but the default trunk configuration gives it to every switch in the building. Prune trunk allow-lists to the segments each switch genuinely serves. This is the single highest-value hour in a re-segmentation.
Using VLAN 1 as the native VLAN
Leaving trunks with VLAN 1 as their native, and dynamic trunk negotiation enabled on access ports, undoes a great deal of good work. Set every trunk’s native to an unused, unrouted identifier, disable dynamic negotiation, and configure access ports as access ports explicitly.
Treating guest isolation as a segment problem
Adding segments does not isolate guests from each other; client isolation and private VLANs do. Properties that try to solve it with more VLANs end up with both a large count and unisolated guests.
Forgetting the printers
Multi-function devices scan to email, hold address books, cache documents and frequently run firmware from a decade ago. They end up on the staff segment by default and are one of the more common footholds we find. On a full-service property they are worth a hard look during the counting exercise.
No owner named per segment
A segment with no named owner gets no reviews, no patching decisions and no vendor accountability. Write a person’s role beside every entry in the VLAN design register. It takes ten minutes and changes how the VLAN design ages.
Never revisiting the VLAN design count
The right number in 2026 is not the right number after a conference suite is added, an EV charger array is installed or a concession moves in. Review the VLAN design count annually alongside the rule matrix. It is a one-hour conversation that prevents a renumbering project.
Hotel VLAN Design FAQ
How many VLANs does a small hotel need?
Four, as a minimum that is genuinely defensible: guest, staff, payments and management. A 60-room property with televisions, cameras and a building management system needs seven. Below four you are almost certainly putting card handling on the office network.
Is more segmentation always safer?
No. Beyond the point where each segment can name a test and an owner, additional segments add rule pairs, documentation and monitoring without adding isolation — and they tend to degrade into broad allow rules. A well-reviewed eleven-segment design beats an unreviewed twenty-two-segment one.
Do I need a separate VLAN per SSID?
No, and the relationship often runs the other way. Segment membership can be assigned dynamically at authentication, so three network names can serve eleven segments. Adding network names costs airtime for every guest, so keep them to three or fewer per access point.
Does PCI DSS require VLANs?
No. Segmentation is not a requirement, but it is the recognised way to reduce what is in scope, and where you rely on it the controls must be penetration tested at least annually and after any change. Without segmentation, everything on the flat network is in scope.
What is the maximum number of VLANs I could have?
The 802.1Q identifier is 12 bits, so 1 to 4094, with platform-specific reservations inside that range. The practical limit in a hotel arrives far earlier — at the point where nobody can review the rule matrix.
Should each floor have its own VLAN?
Generally no. A floor is a topology fact, not a trust boundary, and per-floor segments multiply the VLAN design count without changing who can reach what. Use routing and per-switch trunk pruning for locality, and reserve segments for differences in trust, ownership, lifecycle and consequence.
How do I isolate guests from each other without hundreds of VLANs?
Client isolation at the access point for wireless, and private VLANs for wired bedroom ports. Isolated ports let every room reach the gateway and nothing else while sharing one subnet, which is precisely the multi-client problem private VLANs were designed for.
How long does a re-segmentation take?
On the modelled 148-bedroom property, eighteen weeks: three weeks of discovery, two of design, two of parallel build, nine of phased migration and two of testing and decommissioning. No daytime disruption, six out-of-hours windows, each with a written rollback.
What does it cost?
£33,423.50 one-off for the modelled property — £225.83 per bedroom, or £44.39 per endpoint — plus £8,178 a year to operate, which is £55.26 per bedroom. Over five years that is £74,313.50, of which 44.98% is the one-off.
Where should I start if my network is flat today?
Inventory first, then split payments and the management plane out. Those two moves take you from one segment to three, remove the two failures with the largest consequences, and cost a fraction of a full programme. Everything else can follow on a planned schedule.
References and Further Reading
RFC 5517 — Cisco Systems’ Private VLANs: Scalable Security in a Multi-Client Environment
RFC 3580 — IEEE 802.1X RADIUS Usage Guidelines
RFC 1918 — Address Allocation for Private Internets
RFC 2131 — Dynamic Host Configuration Protocol
RFC 4541 — Considerations for IGMP and MLD Snooping Switches
RFC 3069 — VLAN Aggregation for Efficient IP Address Allocation
IEEE 802.1Q — Bridges and Bridged Networks
IEEE Standards Association — 802.1Q Standard Record
IEEE Standards Association — 802.1X Port-Based Network Access Control
Cisco Meraki — Multi-SSID Deployment Considerations
NCSC — Preventing Lateral Movement
NCSC — Network Security Fundamentals
NCSC 10 Steps to Cyber Security — Architecture and Configuration
NCSC Device Security Guidance — Infrastructure
NCSC Device Security Guidance — Bring Your Own Device
NCSC — Cyber Essentials Overview
PCI Security Standards Council — PCI DSS
PCI Security Standards Council — Document Library
NIST SP 800-215 — Guide to a Secure Enterprise Network Landscape
NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy
NIST SP 800-82 Rev. 3 — Guide to Operational Technology Security
NIST SP 800-153 — Guidelines for Securing Wireless Local Area Networks
NIST SP 800-207 — Zero Trust Architecture
ICO — A Guide to Data Security
UK GDPR Article 32 — Security of Processing
Cyber Security Breaches Survey 2025/2026
