VLAN Virtual Local Area Network
A logical grouping of network devices that acts as its own independent broadcast domain, regardless of where the devices are physically plugged in. VLANs allow network engineers to slice a single massive 48-port physical switch into dozens of smaller, isolated, and secure "virtual" switches.
The Broadcast Domain Boundary
By default, if a computer sends an ARP broadcast out of a switch port, the switch floods that frame out of every other active port. In an enterprise with thousands of computers, this ambient broadcast traffic will quickly choke the network bandwidth.
Historically, the only way to separate the HR department's traffic from the IT department's traffic was to buy two entirely separate physical switches and run distinct cables.
With VLANs, you can assign Ports 1-10 to VLAN 10 (HR) and Ports 11-20 to VLAN 20 (IT). If a PC on Port 1 sends a broadcast, the switch only floods it out to Ports 2-10. Port 11 is completely deaf to it.
CCNA Exam Gotchas
The Inter-VLAN Routing Barrier
VLANs provide absolute Layer 2 isolation. If a PC in VLAN 10 needs to send an email to a server in VLAN 20, they cannot communicate directly through the switch, even if they are plugged in right next to each other. To cross a VLAN boundary, the traffic must be sent up to a Layer 3 Router (or a Multilayer Switch SVI) to be routed between the distinct subnets. (1 VLAN = 1 Broadcast Domain = 1 Subnet).
VLAN 1 Default Hazards
Out of the box, every single port on a Cisco switch belongs to VLAN 1. Furthermore, Cisco's internal control protocols (CDP, VTP, PAgP) strictly transmit over VLAN 1. Security best practices heavily dictate moving all user access ports into a different VLAN (e.g., VLAN 10) to segregate user data from network control traffic.