A VLAN (virtual local area network) is a logically separate network created on the same physical switches, so devices on one VLAN can't talk to devices on another unless a router or firewall allows it. Putting meeting room and AV devices on their own VLAN keeps them apart from user laptops and servers, makes it easier to prioritize their traffic, and limits the damage if a device is compromised.
How it works
- The network admin creates a VLAN with an ID (for example, VLAN 40 "AV").
- Switch ports for room devices are set as "access" ports on that VLAN. The device doesn't need to know it's on a VLAN.
- Ports that carry several VLANs, such as uplinks between switches, are "trunk" ports that tag traffic with IEEE 802.1Q.
- A router or firewall controls what the AV VLAN can reach: the internet for cloud meeting services, DHCP, DNS, NTP and management portals.
Why AV devices get their own VLAN
| Reason | What it means in practice |
|---|---|
| Security | Video bars, cameras and panels can't reach file servers or user PCs, and vice versa |
| QoS | Easier to mark and prioritize real-time audio and video. See QoS for video conferencing |
| Multicast control | AV-over-IP and Dante traffic stays in its own broadcast domain |
| Troubleshooting | Easier to spot a misbehaving device or traffic spike |
| Policy | Simple firewall rules for the meeting services' published IP ranges and ports |
Common VLAN layouts for meeting rooms
| VLAN | Devices |
|---|---|
| Room systems | Video bars, room PCs, touch controllers, scheduling panels |
| AV transport | Dante audio, NDI or other AV-over-IP, PoE cameras, ceiling mics |
| Guest Wi-Fi | Visitor laptops (kept away from room systems) |
| Corporate | User laptops and desktops |
Small offices often put room systems and AV transport on one VLAN. Larger sites split them, especially when Dante or NDI is involved. See Dante audio and AV over IP.
Things that can break
- Casting and discovery. Features like AirPlay, Miracast and some casting protocols use multicast discovery (mDNS/Bonjour) that doesn't cross VLANs by default. If laptops on the corporate VLAN can't find a room's wireless display, you may need an mDNS gateway or the vendor's cross-VLAN option.
- Proximity join often uses Bluetooth or ultrasound, which isn't affected by VLANs; but the laptop and room still need cloud connectivity.
- Touch controller pairing. Controllers that pair over the network (like Logitech Tap IP or Neat Pad Generation 2) generally need to be on the same network segment as the bar; check the vendor's network guide.
- 802.1X. If your switches require network authentication, plan certificates or MAC authentication for room devices. See 802.1X for room devices.
What to check before buying
- Does the device support 802.1Q VLAN tagging, or will it sit on an access port? (Access ports are the usual approach.)
- Does it support 802.1X if you use it?
- Does it support DSCP QoS marking?
- For PoE devices, does the switch port provide enough power on that VLAN's switch? See PoE for meeting room devices.
- Does the vendor publish firewall ports and URLs? Microsoft, Zoom and Google all publish theirs. See Teams Rooms network requirements.
Devices that often go on an AV VLAN
Networked cameras such as the AVer PTZ310UV2 (IP and NDI|HX3 with PoE+), networked ceiling mics like the Yealink CM20 (PoE, AES67), PoE touch controllers and scheduling panels, and every appliance video bar.
More: conference room wiring and how to secure meeting room devices.
Planning the network for new rooms? Send us your device list and we'll outline the ports, PoE and VLAN needs.
Related guides
Outfitting several rooms, or reselling? Get a volume quote or apply for wholesale pricing →
