## 3 The Virtual LAN Segmentation in Static and Dynamic Networks  
As earlier mentioned, with VPN a \"tunnel\" between two communicating devices, supporting secure communication and secure Internet browsing, can be created. In such a configuration, the original packet (including data and their headers, which may contain information such as the addresses of the source and destination, the type of information provided, the length and the packet sequence number) is encrypted. Then, it is encapsulated in another packet containing only the IP addresses of the two communicating devices (i.e., routers). This configuration protects the traffic and its contents from unauthorized access and allows access to the VPN only to devices with the correct \"key\". Network devices between the client and the server will not be able to access or view data. The main difference between HTTPS (SSL/TLS) and VPN is that HTTPS encrypts only the actual data of a packet, while with VPN the entire packet can be encrypted and encapsulated to create a protected \"tunnel\". So, VPN provides a secure method for connecting to a private network through an unsecured public network such as the Internet. A valid alternative to VPN is Virtual LAN (VLAN) technology. It allows networks to be grouped logically rather than by physical location, and it enables the segmentation of a network into virtual networks or virtual groups (a feature that is supported by most network switches). Only users in a specific group are able to exchange data or access certain resources on the network. The primary protocol used when configuring VLANs is IEEE 802.1Q, which tags each frame or packet with extra bytes to indicate the virtual network to which the packet belongs. In Figure 2, VLANs are set to different switches. First, each of the two different LANs are segmented into VLAN 20 and VLAN 30. The links between the switches carry data from different VLANs. Only members of the same VLAN can exchange data, either within the same network and on different networks (the example shows the separation of a video network from a corporate network). VLANs can be configured in different ways, and depending on the type, different technology is applied. In practice, we can find two types of applications: port-based VLANs and tagged VLANs. 1. Port-based VLAN (or Trunked VLAN): inside a switch, each network participant is directed to a port. Ports are also used to connect the switches together. If two VLANs should be obtained from a single physical network, the related ports are assigned to the desired virtual network. The configuration through different switches is also  
Figure 2: An example of VLAN segmentation. possible when the port-based VLAN installation is implemented on small networks and is carried out within a single switch. Thus, for example, ports one to three on the first switch and port one on the second switch can be connected together to a single VLAN. To do this, the two switches must be connected to each other with two cables, providing a connection for each VLAN. Network administrators set up and assign ports to their respective VLANs. In this case, the VLAN is defined as static. If VLANs need to be configured differently, the ports need to be redistributed when configuring the switch. Furthermore, each port (and therefore, each device connected to it) belongs only to a single VLAN. This type of connection is called \"trunking\", and switches have one or more ports designed for this purpose. It is independent from the PHY layer; it does not matter whether copper or fiber optic cables or a wireless connection are used; (2) Frame-based VLAN (or Tagged VLAN): in this case, the assignment to the VLAN is more dynamic, in the sense that it is guaranteed by a tag in the packet frame, which replaces the permanent setting in the switch. The tag contains the information that indicates which VLAN the frame belongs to. Each switch recognizes in which segment the communication takes place, and on the basis of this, forwards the message. Each VLAN has its own number.