Virtual local area networks (VLANs) are widely used in many enterprises, campuses, and data-centre networks. Although VLANs can restrict broadcast domains and contain hosts in one network or separate networks, the management of VLANs is an ad hoc and error-prone work. In this paper, we design and implement a centralized and semi-automatic system for VLAN management (CSS-VM). Based on the physical network topology and user group (examples are engineering, student cluster, and faculty cluster) information, CSS-VM can decide the number of VLANs that each user group would be partitioned into. In addition, CSS-VM can not only monitor the status of devices and links but can also calculate an optimal spanning tree for each affected VLAN after a link or device failure is detected, so that it does not need to enable the Spanning Tree Protocol on devices but still has the ability of converging from device or link failures and avoiding bridging loops. We have evaluated CSS-VM on the topology and VLAN partition data of an operational enterprise network. Our results show that CSS-VM can obviously keep the broadcast traffic cost reasonable, efficiently partition and configure VLANs, quickly converge from link and device failures, and intelligently make a balanced use of links.Virtual local area networks (VLANs) play an important role in enterprises and campus networks. Enterprise or campus network operators often group the users based on the roles they are playing. Users in a user group are in the same broadcast domain and have the same access permission, which will simplify the administration and security tasks. Theoretically, we can create one VLAN for a whole user group. However, if one user group has too many users, the broadcast domain of this VLAN will be relatively large. In this case, a mass of broadcast packets will occupy the bandwidth and then degrade network performance. In order to control the broadcast domain in a reasonable scope, further partition of such a user group is needed. Obviously, the more VLANs into which a user group is partitioned, the smaller the average broadcast domain of the VLANs is. However, limited by the hardware capacity, the total number of VLANs has an upper bound. Thus, it is important for the operators to make a trade-off between the hardware capacity and network performance.Currently, both the ad hoc fashion in VLAN design and the complicated configuration in VLAN implementation may cause poor network performance. In the design phase, operators choose strategies to partition VLANs in an ad hoc fashion. Without a holistic viewpoint, the division plan may lead to much broadcast traffic, underutilization of some high-performance links, and overload of other links, which often deviates from the optimal design. In the implementation phase, operators enable the parameters by manually inputting many commands. For a network that may contain many :52-73 TOWARDS CENTRALIZED AND SEMI-AUTOMATIC VLAN MANAGEMENT 53 devices produced by different manufacturers, operators must configure the trunk links...