Abstract: In view of the potential security problems such as abnormal packets interference and business cross interference existing in the substation control layer network, a security enhanced isolation method based on Virtual Local Area Network (VLAN) technology is proposed. In combination with the communication characteristics of station control layer Manufacturing Message Specification (MMS) and bay layer Generic Object Oriented Substation Event (GOOSE), two VLAN configuration modes and three types of GOOSE isolation strategies are designed to establish a quantitative model of isolation effectiveness and communication delay. Engineering and field verification show that this method can effectively block abnormal messages, achieve mutual isolation between business data streams, and ensure that the transmission delay of GOOSE messages is less than 2ms. It is compatible with IEC 61850 standard and is suitable for network security upgrade of new and old substations.