You've inherited one big /24 where the CCTV, the till, the office PCs and the guest Wi-Fi all share a broadcast domain, and you need VLANs. The catch: people are working on it right now, and you can't take it down to rebuild it. This is the cutover that adds segmentation to a live network — additive, reversible, bottom-up, with enforcement turned on last and a rollback at every step. The patient stays awake.
A flat network is one where every device shares a single broadcast domain and can reach every other device at layer 2. It works, until it doesn't: a broadcast storm takes down everything at once, ransomware on one PC walks straight to the NAS and the cameras, and the guest on the Wi-Fi is one subnet away from the accounts server. Segmentation — VLANs with a firewall between them — is the fix. The hard part isn't the VLAN design; it's getting there without an outage, on a network that's carrying real work while you operate.
The method is the same as any surgery on something that can't stop: work additively, keep every step reversible, and turn on enforcement last. You build the new structure alongside the old one, move hosts into it a group at a time, watch what breaks in log-only mode, and only flip to default-deny once the logs are clean. At no point is there a moment where a typo takes the whole site down — and if a step misbehaves, you roll back that one step, not the project.
01
One broadcast domain where everything reaches everything, becoming lanes where broadcasts and lateral movement stop at the edge and a firewall decides what crosses.
The destination is uncontroversial: a VLAN per trust level, a firewall enforcing a default-deny policy between them, the internet reachable from the ones that need it. The question this post answers is the order of operations that gets a live network from the first picture to the second without a single user noticing — and lets you abort cleanly at any point if something you didn't know about turns out to depend on the flat design.
02
Every decision in the cutover follows from these. Break one and you're doing a big-bang migration with an outage, not surgery.
Build the new structure alongside the old. Create the VLAN interfaces, subnets and DHCP pools while the flat network keeps running untouched. Add the tagged VLANs to the trunks in addition to the existing untagged traffic. Nothing is removed or blocked until the very end — so until then, nothing can break.
Each step has a one-line undo, and you know it before you run the step. Moved an access port to the wrong VLAN? Move it back. The new DHCP scope misbehaves? Disable it; the host falls back to the flat one. This is what lets you work on a production network at 10am instead of only at 2am.
The firewall rules that deny traffic between VLANs go in dead last — and even then, in log-only mode first. You watch the logs for a few days to discover the undocumented dependency (the label printer that talks to the accounts PC, the camera NVR the manager views from their desk), add the explicit allow for it, and only then flip the final rule to drop.
03
Seven steps. The first five are invisible to users; only step 6 touches them, one group at a time; step 7 is the only irreversible-feeling moment, and it's log-tested before you commit.
| Step | Do | Rollback |
|---|---|---|
| 1 · Plan | Decide VLAN IDs and parallel subnets (e.g. V10 10.20.10.0/24, V20 10.20.20.0/24) that don't overlap the flat 10.0.0.0/24. Inventory what's on the wire first. | None needed — paper only. |
| 2 · Gateways | Create the VLAN interfaces, addresses and DHCP scopes on the router. No client uses them yet. | Delete the unused interfaces. |
| 3 · Trunks | Add the new VLANs tagged to the switch-to-switch and switch-to-router trunks, keeping the flat VLAN as the untagged/native one. | Remove the tagged VLANs from the trunk. |
| 4 · Wi-Fi SSIDs | Stand up the new SSIDs mapped to their VLANs alongside the existing one. Old SSID still works. | Delete the new SSIDs. |
| 5 · Permit + log | Add inter-VLAN firewall rules in accept + log mode. Nothing is blocked; you're only watching who talks to whom. | Remove the rules. |
| 6 · Migrate hosts | Move access ports / devices into their VLANs a group at a time, in a window. Each host re-leases into the new subnet. | Move the port back to the flat VLAN. |
| 7 · Enforce | Once logs are clean and dependencies are explicit allows, flip the final rule from accept-log to drop. | Flip it back to accept-log. |
# step 2: new VLAN gateways + DHCP, alongside the untouched flat network /interface vlan add name=v10-staff interface=bridge vlan-id=10 /interface vlan add name=v20-guest interface=bridge vlan-id=20 /ip address add address=10.20.10.1/24 interface=v10-staff /ip address add address=10.20.20.1/24 interface=v20-guest /ip pool add name=p-staff ranges=10.20.10.50-10.20.10.254 /ip dhcp-server add name=d-staff interface=v10-staff address-pool=p-staff disabled=no # step 3: add the tags to the trunk — flat VLAN stays untagged (still working) /interface bridge vlan add bridge=bridge vlan-ids=10,20 tagged=bridge,sfp-sfpplus1,ether24 # NOTE: vlan-filtering stays OFF until the very end (see the gotcha)
# accept but LOG every inter-VLAN flow: this blocks nothing yet /ip firewall filter add chain=forward action=accept in-interface=v20-guest out-interface=v10-staff \ log=yes log-prefix=XVLAN-G2S add chain=forward action=accept in-interface=v10-staff out-interface=v30-cctv \ log=yes log-prefix=XVLAN-S2C # watch /log print for a few days: every real cross-VLAN need shows up here # then add explicit allows for the legitimate ones, e.g. staff -> NVR
The Cisco shape is the same idea: create the SVIs and ip helper-address scopes, add the VLANs to the trunk allowed list, move access ports group by group, and put the inter-VLAN ACL in with log on permits first, swapping to an explicit deny last. The principle — additive, reversible, enforce last — is vendor-independent.
04
A migration without a rollback is a gamble. Here every step's undo is known in advance, and the flat network stays reachable until the last moment.
Keep the flat subnet and its gateway alive for the whole migration. A host that hasn't been moved yet still works on the flat network; a host you just moved can be moved back in one command if something about it breaks. The only step that feels one-way is step 7 (enforcement), and it isn't: flipping the final rule from drop back to accept log restores reachability instantly while you investigate. Schedule step 6 (the host moves) in a maintenance window per group, not all at once — moving the accounts office is a different blast radius than moving the guest Wi-Fi, and you want to move the low-risk groups first to validate the process.
On RouterOS, the instinct is to set vlan-filtering=yes on the bridge early "to make it real." Do that before the trunks and your own management access are correctly tagged, and the bridge starts dropping every frame that doesn't match the VLAN table — including the one carrying your Winbox session. Enforcement goes on last, from a management VLAN you've already proven, in Ctrl+X Safe Mode so a mistake auto-reverts when your session drops. Same lesson on the firewall: the default-deny rule is the last thing you add, after the permit-log phase has shown you everything that legitimately crosses.
Flat networks are full of devices someone statically addressed years ago: a printer, a camera NVR, a door controller, a PLC. When its neighbours move to a new subnet, it's stranded on the old one and stops working — and nobody remembers it's static until it breaks. Before step 6, find the statics (scan for hosts not in any DHCP lease), and either re-address them deliberately as part of their group's move or give their VLAN a gateway in the old range during transition. This is the single most common cause of "the migration broke the one thing nobody mentioned."
05
Before you touch a production network, and before each host-moving window.
| Before you start | Why |
|---|---|
| Full config export + out-of-band access | The one-command whole-project rollback, and a way in if you lose the management path. See OOB. |
| Inventory of statics and cross-talk | So the hardcoded printer and the NVR-to-desk flow don't surprise you at step 6/7. |
| Short DHCP lease during migration | Moved hosts re-lease into the new subnet in minutes, not hours. Set it back after. |
| Move low-risk groups first | Guest Wi-Fi before the accounts office — validate the process where a mistake is cheap. |
| A named rollback per step | You should be able to say the undo out loud before you run the step. |
Takeaways
vlan-filtering or default-deny too early locks you out — do it last, from a proven management VLAN, in Safe Mode.I migrate flat networks to proper VLAN segmentation on live sites — additively, with a rollback at every step and enforcement proven in log-only mode first — so the cameras, the till and the office end up on their own lanes without an outage anyone notices.
Book a Discovery Call →