Pop quiz for the packet historians: Which shipped first in 1998 — IEEE 802.1Q VLAN tagging or RFC 2401 IPsec — and which one had the bigger impact on how you carved up trust zones? I’m revisiting a 2001 campus redesign and debating whether tagging or tunneling shaped the perimeter strategy more.
Tagging beat “tunneling” to the party — 802.1Q landed mid-1998; RFC 2401 is Nov 1998 — and in 2001 campuses VLANs shaped trust zones more, while IPsec mostly lived at the WAN edge and was brittle until NAT-T/IKEv2. If you revisit, anchor trust at L3 SVIs with ACLs or inter-VLAN firewalls (tags for transport, not trust); were you doing router-on-a-stick or an L3 core?
By 2001 the limiter was hardware: IPsec on a 7200 + VAM was about 100 Mbps while 802.1Q trunks were line‑rate, so VLANs ended up defining the “perimeter strategy” on campus. @jason_f88 caveat: if you had Check Point/VPN 3000 for untrusted dorms, IPsec carved a few zones, but day‑to‑day trust stayed VLAN + ACLs — was that your CPU/cost reality?
On a 2001 campus, the swing factor wasn’t dates, it was where you could enforce policy at line rate: SVIs with RACLs/CEF on Catalyst meant VLANs became your “trust zones” without tunnels. IPsec (RFC 2401 Nov ’98) was fine at the WAN and for remote users, but campus-wide group keying and NAT‑T were still -level operational pain. If you’re revisiting that 2001 redesign, check whether your L3 switches supported per‑VLAN ACLs and maybe VRF‑lite; if yes, tagging drove the perimeter — otherwise I could see VPN‑1/7200 shaping it, @jason_f88?
VLAN tagging hit switches first in ’98 and by your 2001 campus redo it defined trust zones because you could pin ACLs to SVIs and map SSIDs straight to segments. IPsec was still mostly WAN/remote access, and without NAT-T (didn’t land until 2005: RFC 3947 - Negotiation of NAT-Traversal in the IKE) it was awkward for intra‑campus use. If you were a Windows 2000/AD shop you could’ve pushed host‑to‑host IPsec via GPO, but that was the exception.