VLAN Planning for AV Systems

Why segment an AV network at all?

A VLAN (virtual LAN) carves one physical switch, or a whole stack of them, into multiple isolated networks. Devices in the same VLAN talk as if they share a private switch; devices in different VLANs can't reach each other unless a router deliberately connects them. On paper that's an IT concept. On a show network it buys three specific protections:

• Traffic isolation. Real-time media wants a quiet, predictable network. Dante audio and NDI video shouldn't compete for the wire with a presenter's laptop syncing cloud backups or the venue printer announcing itself to the world.
• Multicast containment. Dante and NDI both use multicast for discovery, and both can carry media as multicast. Unmanaged multicast is flooded to every port in the broadcast domain whether it asked or not, a VLAN is the fence that decides how far that flood can spread.
• Blast-radius control. A cable loop, a rogue DHCP server on a guest machine, or one misbehaving NIC takes down its own VLAN, not the console-to-stage link. Segmentation is also baseline security: the guest network has no business seeing your switcher's web interface.

A practical five-VLAN starting model

There is no gospel VLAN layout. What follows is a common starting point for mid-size shows and installs, one VLAN per traffic class, IDs numbered with room to grow, subnets that encode the VLAN ID. Prune it for small rigs, extend it for big ones, and treat the final map as a project document, not a template you obey.

Two habits make the map self-documenting. First, match the subnet's third octet to the VLAN ID, an address like 10.10.30.42 instantly reads as "VLAN 30, video." Second, leave gaps in the numbering (10/20/30, not 1/2/3) so the inevitable sixth network slots in without renumbering anything.

Devices get one entry per network interface, not per box. Many LED processors and media servers, for example, expose a dedicated management port alongside their media ports, the management port belongs in MGMT, the media ports in the media VLAN. The IP schedule is where every one of those interfaces gets its address inside these subnets.

Trunk vs. access ports, translated for AV people

VLAN membership is configured on switch ports, and every port runs in one of two modes. An access port belongs to exactly one VLAN: the device plugged into it never sees a VLAN tag and doesn't need to know VLANs exist, it just finds itself on a smaller, quieter network. A trunk port carries multiple VLANs at once, with each frame tagged (the mechanism is IEEE 802.1Q) so the switch at the far end can sort the traffic back out.

The AV translation: an access port is a single labeled line; a trunk is the multicore. One cable between the FOH switch and the stage switch can carry AUDIO, VIDEO, CONTROL, and MGMT simultaneously, as long as both ends agree the link is a trunk and agree on which VLANs it carries.

• Endpoint devices, cameras, consoles, processors, touch panels, plug into access ports. Almost no AV endpoint tags its own traffic, and most expect plain untagged frames.
• Switch-to-switch links are trunks. So are links to the few devices that genuinely speak multiple VLANs, a router, or wireless access points that map one SSID to each VLAN.
• When in doubt, it's an access port. A device on a trunk it doesn't understand either lands on the wrong network or on none at all, and the link light stays green either way.

Where AV breaks IT assumptions: multicast and IGMP

Most office traffic is unicast, one sender, one receiver, and switches forward it correctly with zero help. AV-over-IP leans on multicast: one sender, many possible subscribers. Dante uses multicast for discovery and clocking and can carry audio as multicast flows; NDI's default discovery is multicast-based, and it can optionally transport video as multicast too. This is exactly where AV traffic collides with switch defaults.

A switch with no multicast management floods multicast to every port in the VLAN. With a handful of Dante flows that's waste; with multicast NDI video it can saturate links that had nothing to do with the stream. The fix is IGMP snooping, the switch learns which devices subscribed to which multicast group and forwards each stream only where it was requested, plus a working IGMP querier on each media VLAN, one device that periodically asks "who still wants what?" so subscriptions stay alive (switches elect a single querier if several offer). Media VLAN + snooping + querier is the standard recipe, and it's one more argument for separating media traffic: these settings are tuned per VLAN, so a dedicated media VLAN keeps the tuning surface small.

The honest counterpoint: when one flat network is fine

VLANs cost something: managed switches, configuration time, and a person who understands the map. A system that doesn't need them shouldn't pay for them. Physical separation is the original segmentation, a console and a stage box on one dedicated switch that carries nothing else is already isolated better than any VLAN could manage.

• The switch carries one system for one trade, say, a Dante network that is only consoles, stage boxes, and amps, with nothing else plugged in.
• Nothing on it touches the internet, house IT, or a guest device. Ever.
• One operator owns every port, and the gear count fits in one head.
• The network is struck and rebuilt each show, so nothing accumulates behind your back.

Segmentation earns its complexity the moment infrastructure is shared: multiple trades on the same switches, a permanent install the client's IT department touches, guest access anywhere near show gear, or any network you'll hand to someone else to run. The dividing line isn't device count, it's sharing.

Document the plan where the crew can find it

A VLAN plan that lives in one engineer's head fails the bus test; one that lives only in a switch config fails slower but just as hard. The written plan is three artifacts: the VLAN map (the table above), the IP plan that assigns addresses inside each subnet, and a switch-port map that records which physical port carries which VLAN in which mode.

In WireFlow those live on the same drawing as the signal flow: devices carry their VLAN and IP assignments, switch ports are documented port by port, and PoE loads sit alongside, one source of truth instead of a diagram, a spreadsheet, and a wiki page drifting apart. Pair the map with a PoE budget for the same switches and a duplicate-IP prevention habit for the addresses inside each VLAN; the rest of the AV networking guides build on this map.

Frequently asked questions

Do I need managed switches to use VLANs?

Yes. VLAN tagging and IGMP snooping are managed-switch features; an unmanaged switch forwards everything to everyone and ignores tags. Most switches sold as "managed" or "smart managed" support 802.1Q VLANs, but feature depth varies, confirm IGMP snooping and querier support before trusting one with a media VLAN.

Can Dante and NDI share one media VLAN?

They can, and small systems sometimes run that way, but common practice is to separate them. NDI video flows are far larger than Dante audio flows, and keeping them apart means congestion or multicast misbehavior on the video side can't touch the audio clock. If you do combine them, treat the shared VLAN with full media-network care: IGMP snooping, a querier, and the vendors' recommended QoS.

How many VLANs does a show network actually need?

As many as you have traffic classes that must not interfere, and no more. The five-VLAN model (management, audio, video, control, guest) covers most mid-size systems; a small corporate gig might collapse to media, control, and guest; a broadcast plant might add several more. Empty VLANs created "just in case" are configuration debt, not planning.

Does VLAN tagging add latency to Dante or NDI?

Not meaningfully. Tagging is a routine switching operation; the latency AV actually fights comes from congestion, oversubscribed links, and misbehaving multicast, the exact problems VLANs help contain. In practice the well-segmented network is usually the lower-latency one.

Document your AV network in WireFlow

VLANs, IPs, PoE, and switch ports live on the same diagram as your signal flow, one source of truth for the whole system.

Start a free network plan · See the sample project