How I Plan a VLAN Layout Before Touching the CLI
The paper-first checklist I use for small VLAN designs: inventory, addressing, trunk map, and test cases.
Start with the inventory, not the switch
Every design I do starts as a table: device, role, department, required reachability. If a printer only needs the print server, that constraint belongs in the plan before any configuration exists.
This habit saves the most time. Drawing the table forces me to ask who should talk to whom, which is the entire security model of a segmented network.
Addressing that leaves room to grow
I size each VLAN with headroom — a /24 for user segments even when only thirty hosts exist today, and small, documented /30s or /31s for point-to-point links.
Every subnet gets a one-line justification. Future-me, or anyone reviewing the lab, can see why each block is the size it is.
Test cases before deployment
The last section of my plan is a list of pings and connection attempts that should succeed, and — just as important — ones that should fail.
A segmentation design is only done when the deny cases are verified, not assumed.
Related reading
What Enabling 2FA Everywhere Taught Me
Lessons from auditing my own accounts: recovery codes, authenticator backups, and the accounts I almost missed.
Strict TypeScript Habits That Survived Contact With Real Code
Narrowing over casting, discriminated unions over flag soup, and treating every API response as untrusted.