Recognition Display Private VLAN Isolation Test for Shared School Networks
Intent: decide — A school lobby recognition kiosk and the guest Wi-Fi access point mounted three feet away may share the same physical switch, the same IP subnet, and the same VLAN number — yet under a correctly configured private VLAN architecture, those two devices cannot exchange a single IP packet directly. Private VLANs (PVLANs) enforce peer isolation at the switch hardware layer, preventing recognition displays from receiving unsolicited traffic from other kiosks, student laptops, visitor devices, or IoT equipment on the same segment, while still allowing each display to reach the upstream router, the content management system, and any authorized management hosts. Testing whether that isolation is actually working requires more than confirming the kiosk can load content — it requires verifying that the peer block is in place, that the promiscuous uplink is the only valid gateway, and that DHCP, DNS, NTP, and CMS connectivity are all preserved through the PVLAN architecture rather than broken by it.
Read More
