To facilitate management and configuration of VLAN memberships associated with applications or network protocols, a network device receives a packet from a wireless station which is a member of a virtual local area network (VLAN). The network device determines whether the packet is associated with a predefined application or network protocol. If so, the network device delivers the received packet to a dedicated VLAN which is accessible only to network devices associated with the predefined application or network protocol, regardless of destination address specified within the packet. If not, the network device delivers the received packet to an address or a group of addresses specified in a header of the received packet. In some embodiments, the VLAN is divided from a VLAN pool, and the dedicated VLAN corresponds to an address space that is outside the address space of the VLAN pool.