Can anyone explain to me what is the difference between a VLAN and a ACL list? coz i cant get my head around it?


IT geek

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 17:05

VLAN and acl are totally diffrent things The VLAN in simple words is logical partation of the switch which seperate the hosts connected to the same switch in the network on the layer 2 level,so hosts in diffrent VLANs and connected to the same switch (or connected switches) can't communicate together without layer 3 device like a router. Access list as its name describe is mechanism to control the traffic on the network device exist of entries with match criteria and action like permit and deny


Considering and referring to OSI Model, VLan is based at Layer 2 and ACL mostly resides at layer 3 for IP.

Vlan is isolation between two separate networks. For instance, Vlan 200 has a network of and vlan 250 has a network of at layer 2.

ACL, Access Control List consist of Access Control Entries which defines which single source IP will be connecting to which single destination IP on specific EtherType protocol or destination port. It normally handled at layer 3.


The two are entirely separate concepts and both far to broad to cover in any detail here; entire books have been written on both subjects. Keep in mind that anything further is an extremely simplistic explanation, but hopefully it will be enough for you to understand the difference.

VLANs are a means of dividing a physical switch into multiple virtual switches. They are used for creating separate L2 spaces. These separate L2 domains can only communicate with each other through the use of a L3 device as a gateway (i.e. a router)

ACLs on the other hand come in a number of different types and are used in many different ways. In general, they define a list of "things" that are either allowed or denied. Those "things" may include IP addresses/networks, types of traffic, time, or other information. Once the list is defined, it is applied in some fashion to restrict or allow access, as examples: to traffic on a L2 or L3 interface, to limit debug output, to restrict access to VTYs (telnet/SSH), to limit access to a service (such as SNMP), defining traffic for QoS/NAT, and a number of other ways.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.