Quiz Entry - updated: 2026.10.16
On which network layers is a perimeter built in practice, and what is the difference between separating on Layer 2 physically and virtually?
In principle a perimeter is possible on every OSI layer, but in practice it is almost always isolation on Layer 2 plus restriction on Layer 3. Physical L2 separation uses different switches and can only be broken physically; virtual separation (VLANs) can be broken by configuration.
| Physical L2 separation | Virtual L2 separation (VLAN) | |
|---|---|---|
| How | Each broadcast domain is served by its own switches | One switch is split into virtual Layer 2 networks (supported from the lower mid-range up) |
| How the perimeter can break | Only physically: someone plugs in a cable that bridges the two | Through configuration: an accidental misconfiguration, or a successful attack on the switch's management interface |
The trade-off is the same as with isolation in general: the virtual variant is cheaper and more flexible, but the boundary is now a setting rather than a missing cable, so anyone who can change the setting can remove the boundary.