My question is about the literal and precise meaning of the term "VLAN". According to IEEE 802.1Q-2014, a LAN is a single segment of a medium. A cable connecting a PC to a switch port is a single LAN. I know that is not how we use the term, but that is how it is defined. What we call "the LAN" is defined as a Bridged Local Area Network. So, in practice, most LAN's when the term is correctly used have only one end station and one switch port on them nowadays. So you would expect a Virtual LAN (or VLAN) to be a virtualisation of this. The IEEE standard does indeed define a "VLAN Bridged Network" as a Virtual Bridged Network, so what we call a "VLAN" e.g. VLAN 20 seems to be more accurately described as a VBN. A VLAN itself is defined as "The closure of a set of Media Access Control (MAC) Service Access Points (MSAPs) such that a data request in one MSAP in the set is expected to result in a data indication in another MSAP in the set." Without a bridge, this would refer to a subset of stations on a LAN (single segment), although in practice we never implement this (that I know of). Would anyone like to confirm or refute this?
A VLAN is a layer 2 construct which separates devices into separate broadcast domains.
A VLAN is a group of devices on one or more LANs that are configured to communicate as if they were attached to the same wire, when in fact they are located on a number of different LAN segments. Because VLANs are based on logical instead of physical connections, they are extremely flexible.
IEEE definition are sometimes a bit historical - a wire connecting a node to a switch port is a layer-1 segment (historically, this could also be a shared coax cable with many nodes connected to it, or a collision domain held together with a repeater hub).
A simple switch connects all ports together to a single layer-2 segment or broadcast domain. These ports can directly talk to each other using MAC-addressed frames.
VLANs on managed switches can split the ports into multiple layer-2 segments or broadcast domains. Only ports associated with the same VLAN can directly talk to each other. In addition, you can tag frames between switches to mark their association with a specific VLAN. VLAN trunks between switches can transport tagged frames from multiple VLANs on a single cable.
That way, you can distribute a specific VLAN over your entire physical network, making any port anywhere part of that VLAN as required - without running extra cables.
You can connect different VLANs by using routers - usually, the router also controls what kind of traffic you permit and what kind you deny.
Specifically answering about whether we implement VLANs without bridging.
Without a bridge, this would refer to a subset of stations on a LAN (single segment), although in practice we never implement this (that I know of).
Actually it's quite common in smaller networks to partition a single, larger switch; I've certainly seen many Layer-3 switches used as the only network device, partitioned into inside-LAN, outside-link, webserver-LAN etc.
Basically, a LAN or VLAN is a layer-2 broadcast domain, bounded by layer-3 devices (routers). To send traffic from one VLAN to another VLAN requires a router. In a bridge (a switch is a bridge), a VLAN logically divides the bridge in separate, unconnected, virtual bridges.
Ethernet was originally run on coax, and later on UTP hubs, where every host was on the same physical cable that constituted both a broadcast and collision domain. The advent of bridges allowed the separation of the broadcast and collision domains, and switches (high-density bridges) allowed each host to be in the same broadcast domain (LAN or VLAN), but separate collision domains.
Configuring VLANs on a switch (bridge) allows the switch to serve as multiple virtual switches.
Thanks for the helpful and informative responses.
My conclusion is that a VLAN is not a virtual instance of a LAN (at least in terms of 802.1Q definitions). Clause 3.258 defines a VLAN as a closed subset of MAC Service Access Points (MSAP's). But we don't have a definition of the full set of MSAP's. That seems to most closely match the definition of a Bridged Network, or at least the access points of a Bridged Network (Clause 3.24).
If that is correct, then a VLAN is a virtual instance of a Bridged Network, and not a virtual instance of a LAN. It is also a logical collection of LAN's. In Clause 7.2, individual LAN's are part of, or members of, a VLAN.