CCNA online course

Configure VLANs on a Cisco Switch

Learn how to create Cisco VLANs, assign access ports, configure 802.1Q trunks, manage VLANs, verify operation, and troubleshoot common CCNA VLAN problems.

A VLAN is a logical Layer 2 network segment identified by a numeric VLAN ID. On a switch, each VLAN forms a separate broadcast domain: a Layer 2 broadcast sent by a device in one VLAN is not forwarded into other VLANs.

VLANs let you separate departments, voice endpoints, guest devices, management traffic, and ordinary user devices without requiring a separate physical switch for every group. This improves broadcast containment, supports security boundaries, and makes network administration more organized.

Switching alone forwards frames within the same VLAN. Devices in different VLANs need inter-VLAN routing through a router, a multilayer switch, a router-on-a-stick design, or switched virtual interfaces (SVIs).

VLAN IDs and VLAN types

A VLAN ID is the number that distinguishes one VLAN from another. Cisco enterprise switches commonly use VLAN IDs from 1 through 4094. VLANs 1 through 1005 are traditionally called the normal range; VLANs 1006 through 4094 are the extended range. Platform, IOS, and database behavior can vary, so confirm supported features for the switch model.

• VLAN 1: the default VLAN. It exists by default and has special default behavior. Avoid using it for ordinary user traffic, management traffic, or the native VLAN in a basic production design.
• Data VLAN: carries ordinary endpoint data, such as workstation traffic.
• Voice VLAN: carries IP phone traffic. A phone-facing access interface can commonly have both a data VLAN for a connected computer and a voice VLAN for the phone.
• Management VLAN: carries management access to a switch through an SVI.
• Native VLAN: the VLAN whose frames are normally sent untagged on an IEEE 802.1Q trunk.
• Unused or parking VLAN: a VLAN used for unassigned ports. It should not be treated as a replacement for authentication or a complete access-control system.

Example VLAN plan

Cisco IOS command modes for VLAN configuration

Cisco IOS uses command modes. Enter privileged EXEC mode with enable, then enter global configuration mode with configure terminal. The vlan command enters VLAN configuration mode, where you create or edit a VLAN and assign its name.

Switch> enable
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# end
Switch#

Defining a VLAN and assigning a port to it are separate tasks. Creating VLAN 10 adds it to the switch's active VLAN information, but no endpoint port automatically becomes a member of VLAN 10. Port membership is configured under the interface.

Creating, naming, and deleting VLANs

Use meaningful names so that command output is easier to interpret and mistakes are less likely.

enable
configure terminal
vlan 10
 name SALES
vlan 20
 name ENGINEERING
vlan 99
 name MANAGEMENT
vlan 999
 name UNUSED
end

Confirm the VLANs before assigning interfaces:

show vlan brief

To delete a VLAN, use no vlan from global configuration mode:

configure terminal
no vlan 20
end

Deleting a VLAN removes its VLAN definition. Ports that were assigned to that VLAN no longer provide normal membership in the deleted VLAN; their resulting state and displayed assignment can vary by platform and IOS release. Reassign affected ports to an appropriate existing VLAN, then verify with show vlan brief and interface-specific commands.

Core IOS VLAN commands

Configuring access ports

An access port carries traffic for one data VLAN and normally connects to an endpoint such as a computer, printer, or server. When an endpoint sends ordinary untagged Ethernet frames, the switch associates those frames with the access VLAN configured on the port.

Configure a single endpoint interface as a static access port:

configure terminal
interface fastethernet 0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
end

switchport mode access prevents the interface from operating as a trunk through normal negotiation. switchport access vlan 10 places untagged endpoint traffic into VLAN 10. spanning-tree portfast is appropriate for an endpoint-facing port, not for a switch-to-switch link.

Assigning a range of ports

Interface ranges make repeated configuration efficient:

configure terminal
interface range fastethernet 0/1 - 4
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
interface range fastethernet 0/5 - 8
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
end

Check that the interface names and range syntax match the switch. A typo or an incorrect range can configure the wrong ports.

Hardening unused ports

Unused interfaces should not be left as convenient entry points in a default VLAN. A basic hardening practice is to place them in an unused parking VLAN and shut them down:

configure terminal
vlan 999
 name UNUSED
interface range fastethernet 0/9 - 24
 switchport mode access
 switchport access vlan 999
 shutdown
end

On endpoint-facing interfaces, explicitly disabling dynamic trunk negotiation where supported is also useful. Hardening should be combined with controls such as port security, authentication, monitoring, and appropriate physical security.

Access ports versus trunk ports

Trunks and IEEE 802.1Q tagging

A trunk is required when several VLANs must cross one physical link, such as an inter-switch uplink or a switch-to-router link. IEEE 802.1Q adds VLAN identification to Ethernet frames so the receiving device can preserve the frame's VLAN across the shared connection.

Most VLAN traffic on a trunk is tagged. Traffic belonging to the native VLAN is normally transmitted without an 802.1Q tag. Both ends must agree about trunk operation, the native VLAN, and the VLANs permitted to cross the link.

Configuring a trunk

configure terminal
interface gigabitethernet 0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999
end

Some older Cisco platforms require explicit encapsulation selection before trunk mode:

interface gigabitethernet 0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk

Use the encapsulation command only when the platform and IOS version support and require it. Many newer switches support only 802.1Q and do not offer that command.

Restricting the allowed VLAN list

The allowed VLAN list limits which VLANs can traverse a trunk. This reduces unnecessary VLAN propagation and makes the intended design easier to audit.

switchport trunk allowed vlan 10,20,99 replaces the existing allowed list with exactly those VLANs. To add VLANs without replacing the current list, use the add keyword:

interface gigabitethernet 0/1
 switchport trunk allowed vlan add 30,40

To remove selected VLANs while retaining the others, use remove where supported. Apply compatible settings at the other end of the trunk. A VLAN must exist and be active on the switches where it is needed.

Native VLAN considerations

Frames for the native VLAN are normally untagged on an 802.1Q trunk. If one end uses native VLAN 999 and the other uses native VLAN 1, each switch interprets untagged frames as belonging to a different VLAN. Cisco devices can report a native VLAN mismatch, and connectivity or spanning-tree behavior may be unexpected.

Use the same native VLAN on both ends, preferably an unused VLAN such as 999 rather than VLAN 1:

interface gigabitethernet 0/1
 switchport trunk native vlan 999

Changing the native VLAN does not by itself provide complete security. The VLAN should be unused for endpoints, restricted in the allowed list where appropriate, and supported by a broader switch hardening policy.

Verifying VLAN and access-port membership

Use show commands before testing with ping. First confirm that the VLAN exists and that the expected access ports appear under it:

show vlan brief

For a detailed interface check, use:

show interfaces fastethernet 0/1 switchport
show interfaces switchport

Inspect the administrative mode, operational mode, access mode, access VLAN, voice VLAN when present, and trunk status. The interface should show access operation and the intended access VLAN.

Save successful changes:

copy running-config startup-config

The running configuration is the active configuration in memory. The startup configuration is the saved configuration used after a reload. If changes are not copied to startup configuration, they can be lost when the switch reloads, depending on the platform and how VLAN information is stored.

Verification commands

Management VLAN and the switch SVI

A Layer 2 switch can receive a management IP address through an SVI, such as interface vlan 99. The SVI is a virtual Layer 3 interface associated with VLAN 99; it is not a physical access port.

configure terminal
interface vlan 99
 ip address 192.0.2.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.0.2.1
end

The default gateway is needed when remote management originates from another IP network. The management VLAN must exist and have an active Layer 2 path: for example, an active access port in VLAN 99 or a reachable trunk carrying VLAN 99. Without such a path, the SVI may be administratively up while its line protocol is down.

The SVI used for management is separate from the physical port assignments. Assigning a workstation port to VLAN 99 does not itself configure the switch's management IP address.

VLAN communication and the routing boundary

A Layer 2 switch forwards frames within a VLAN. It does not route traffic from VLAN 10 to VLAN 20. Inter-VLAN communication requires a Layer 3 gateway, such as:

• a router with separate interfaces or router-on-a-stick subinterfaces;
• a multilayer switch using an SVI for each routed VLAN;
• another Layer 3 device providing gateways and routing policy.

Hosts in different VLANs should normally use different IP subnets and a default gateway appropriate to their VLAN. Inter-VLAN routing is the next configuration dependency after VLAN and trunk operation.

Two-switch trunk example

Suppose Switch A and Switch B each have Sales and Engineering users. One Ethernet uplink connects the switches. Configure the uplink on both switches with matching trunk parameters:

interface gigabitethernet 0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,99,999

Users in VLAN 10 on opposite switches can communicate at Layer 2 when their addressing is correct and VLAN 10 is active and permitted across the trunk. The same applies to VLAN 20. A VLAN 10 host and a VLAN 20 host remain isolated unless an inter-VLAN routing service is configured.

Validation workflow

1. Run show vlan brief and confirm VLAN IDs, names, active status, and access-port membership.
2. Use show interfaces <interface> switchport to confirm endpoint ports are statically operating as access ports in the intended VLAN.
3. Use show interfaces trunk to confirm inter-switch links are trunks with matching native VLANs and the required allowed VLANs.
4. Check link state, endpoint IP addresses, subnet masks, and default gateways.
5. Test same-VLAN connectivity on one switch and then across the trunk.
6. Test different-VLAN connectivity. It should fail when no inter-VLAN routing exists and should succeed only according to the configured Layer 3 gateways and policies.
7. Review the MAC address table if the result is unexpected, then save the verified configuration with copy running-config startup-config.

Common VLAN faults and fixes

Exam-relevant notes

• An access port carries one data VLAN; a trunk carries multiple VLANs.
• 802.1Q tags identify VLAN traffic on trunks, while native-VLAN traffic is normally untagged.
• Both trunk ends must agree on trunk mode, native VLAN, and required allowed VLANs.
• VLANs separate broadcast domains, but routing is required for communication between them.
• VLAN creation does not automatically assign interfaces to that VLAN.
• A management SVI needs an active Layer 2 path before it becomes operational.
• Static access and trunk configuration is more predictable than relying on DTP negotiation for endpoint and infrastructure roles.

For the routing boundary that follows VLAN configuration, continue with configure trunk ports and then study OSPF configuration for a related Layer 3 routing topic. Review the OSI reference model when you need to distinguish Layer 2 switching from Layer 3 routing.