CCNA online course

VLANs Explained: Broadcast Domains, Benefits, and Basic Switch Configuration

Learn how VLANs segment Layer 2 networks, contain broadcasts, use access and trunk ports, extend across switches, and support inter-VLAN routing.

A VLAN, or Virtual LAN, is a logical Layer 2 network segment created on one or more switches. VLANs divide a switched network into separate logical networks without requiring each logical network to use a separate physical switch.

This lesson explains broadcast domains, VLAN membership, access and trunk ports, VLAN configuration on Cisco IOS, and the Layer 3 requirements for communication between VLANs.

What Is a VLAN?

A VLAN is a logical Layer 2 segment implemented by a switch or group of switches. A switch associates each active port with a VLAN. Frames received on that port are handled within the assigned VLAN unless they are sent through a Layer 3 device for routing.

VLAN membership is based on logical configuration rather than physical location. For example, a Sales computer connected to port GigabitEthernet 0/1 on one switch and another Sales computer connected to port GigabitEthernet 0/10 on a different switch can belong to the same VLAN.

VLANs should be distinguished from several related concepts:

• Physical switch: A hardware device that forwards Ethernet frames. One physical switch can contain multiple VLANs.
• LAN cable segment: A physical connection between devices. Changing a cable does not automatically change the VLAN assigned to a switch port.
• IP subnet: A Layer 3 range of IP addresses. A subnet is not the same thing as a VLAN, although network designs commonly associate one subnet with each VLAN.
• VLAN: A logical Layer 2 segmentation boundary that determines which switch ports share a broadcast domain.

A common design uses a one-to-one relationship: one VLAN, one IP subnet, and one default gateway interface. This relationship is a practical design convention, not a definition of a VLAN itself.

VLANs and Broadcast Domains

A broadcast domain is the set of devices that receive a Layer 2 broadcast. A broadcast frame is addressed to every device in its local Layer 2 domain.

Each VLAN is a separate Layer 2 broadcast domain. When a switch receives a broadcast frame, it forwards the frame out applicable ports in the same VLAN, but not out ports assigned to other VLANs.

The same VLAN boundary also affects flooding behavior. A switch may flood an unknown unicast or another applicable flooded frame when it does not yet know the destination location. That flooding remains within the originating VLAN. A host in VLAN 20 does not receive a VLAN 10 broadcast merely because both hosts connect to the same physical switch.

Flat network example

Imagine two switches connected by an inter-switch link. Six endpoints are attached, and every port is still assigned to VLAN 1. A broadcast from one endpoint is forwarded to the relevant ports on the local switch, crosses the inter-switch link if the link carries VLAN 1, and reaches the other VLAN 1 endpoints. The entire topology is one broadcast domain.

This arrangement is simple, but unrelated devices all share the same broadcast exposure. As the number of devices grows, broadcasts and other flooded traffic affect more ports.

Segmented network example

Now assign Sales devices to VLAN 10 and Finance devices to VLAN 20. A broadcast from a Sales endpoint is forwarded only to ports in VLAN 10. Finance endpoints do not receive that Layer 2 broadcast, even when Sales and Finance devices are connected to the same physical switches.

Why Network Administrators Use VLANs

VLANs create more broadcast domains while reducing the number of devices in each domain. Smaller broadcast domains generally improve traffic management, although VLANs do not eliminate all network congestion or replace proper capacity planning.

VLANs also provide segmentation, but segmentation is not the same as a complete security policy. If users in two VLANs must communicate, a router or multilayer switch can route the traffic, and access control lists or other security controls can permit or deny specific flows.

Default VLAN and VLAN Membership

VLAN 1 is commonly present as the default VLAN on switches. On many switches, access ports begin in VLAN 1 unless an administrator reconfigures them.

Assigning an interface to a VLAN determines the VLAN of the endpoint attached to that interface. For example, if a workstation is connected to an access port assigned to VLAN 10, the workstation's Ethernet traffic enters VLAN 10.

Do not assume that a port's physical location determines its logical network. The switch configuration is what determines access-port membership. When a user moves to another wall jack or switch port, the new port must be assigned to the appropriate VLAN.

VLAN Operation on One Switch

Consider a single switch with four endpoint-facing ports:

• Ports GigabitEthernet 0/1 and 0/2 are assigned to VLAN 10 for Sales.
• Ports GigabitEthernet 0/3 and 0/4 are assigned to VLAN 20 for Finance.

Sales endpoints on ports 0/1 and 0/2 can exchange Ethernet frames through Layer 2 switching when their MAC addresses and IP configurations are appropriate. Finance endpoints on ports 0/3 and 0/4 can communicate in the same way.

A Sales endpoint cannot directly deliver an Ethernet frame to a Finance endpoint through ordinary Layer 2 switching. Because the endpoints are in different VLANs, communication requires Layer 3 forwarding.

Extending VLANs Across Switches

The same VLAN can exist on multiple switches. This allows devices in the same logical network to remain together even when they are physically connected to different switches.

A link between network devices that carries traffic for multiple VLANs is a trunk. A trunk transports VLAN information across the inter-switch path so that VLAN 10 traffic remains distinguishable from VLAN 20 traffic.

For same-VLAN communication across switches to work, all of the following must be true:

• The VLAN must exist and be active on both switches.
• The inter-switch link must operate as a trunk or otherwise be configured to carry the required VLAN.
• The required VLAN must be allowed across the trunk.
• The trunk settings must be compatible at both ends.
• The endpoint ports must be assigned to the intended VLAN.

If VLAN 10 is present on only one switch, or if VLAN 10 is excluded from the trunk's allowed list, VLAN 10 devices on separate switches cannot communicate through that path.

Access Ports and Trunk Ports

An access port normally carries endpoint traffic for one VLAN. A workstation, printer, or other single-VLAN endpoint commonly connects to an access port.

A trunk port carries traffic for multiple VLANs. Trunks are commonly used between switches and between a switch and a router or multilayer switch.

Trunk traffic commonly uses IEEE 802.1Q tagging. The tag identifies the VLAN associated with a frame while the frame crosses the trunk. The receiving network device uses that information to keep VLAN traffic separated. An endpoint access port normally presents untagged traffic to a typical endpoint, while the switch associates that traffic with the port's configured access VLAN.

The port configuration must match the connected device and link role. Configuring an endpoint-facing port as a trunk, or configuring an inter-switch link as a single-VLAN access port, can cause connectivity problems.

For a detailed trunk configuration lesson, see Configure Trunk Ports.

Example VLAN and Subnet Plan

In this common design, every VLAN has its own IP subnet. A host in VLAN 10 might use an address such as 192.168.10.25 with a /24 mask and a default gateway of 192.168.10.1. A host in VLAN 20 uses an address from 192.168.20.0/24 and a gateway of 192.168.20.1.

A host's default gateway must be in the same IP subnet as the host. The gateway is the Layer 3 interface that receives traffic destined for a remote subnet. VLAN separation is a Layer 2 boundary, while the separate IP subnets represent a Layer 3 boundary. Routing is required to cross both boundaries.

Basic Cisco IOS VLAN Configuration

The following example creates VLANs 10 and 20 and assigns endpoint-facing interfaces to them. Interface numbers vary by switch model, so verify the platform's available interfaces before applying commands.

configure terminal
vlan 10
 name SALES
vlan 20
 name FINANCE
interface range gigabitEthernet 0/1 - 2
 switchport mode access
 switchport access vlan 10
interface range gigabitEthernet 0/3 - 4
 switchport mode access
 switchport access vlan 20

The first two interfaces become access ports in VLAN 10. The next two become access ports in VLAN 20. The endpoint's logical network changes when its connected switch port is assigned to a different VLAN.

Configure an inter-switch trunk

If GigabitEthernet 0/24 connects two switches, configure the link as a trunk and allow the VLANs required by the design:

interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Apply compatible trunk configuration at the other end. Some platforms or software versions may use additional commands or negotiation behavior, so confirm the syntax and operational state on the actual device.

Verify the configuration

show vlan brief
show interfaces trunk
show interfaces gigabitEthernet 0/1 switchport
show mac address-table vlan 10

• show vlan brief displays VLANs and commonly shows access-port membership.
• show interfaces trunk shows trunk status and VLANs carried by trunk interfaces.
• show interfaces gigabitEthernet 0/1 switchport displays the port's administrative and operational switchport settings.
• show mac address-table vlan 10 shows MAC addresses learned in VLAN 10.

Inter-VLAN Communication

Layer 2 switches do not route traffic between VLANs. A host in VLAN 10 cannot use ordinary Layer 2 switching to reach a host in VLAN 20.

Inter-VLAN routing is Layer 3 forwarding between separate VLANs. It requires a router or multilayer switch. The routing device provides a gateway interface for each VLAN's IP subnet.

When a host in VLAN 10 sends traffic to a destination in VLAN 20, the source host recognizes that the destination is outside its local subnet. It sends the frame to its default gateway, such as 192.168.10.1. The router or multilayer switch then routes the packet toward VLAN 20, whose gateway might be 192.168.20.1.

Two common approaches are:

• Router-on-a-stick: One physical router interface connects to a switch trunk. Router subinterfaces provide gateways for multiple VLANs.
• Multilayer-switch switched virtual interfaces: A multilayer switch creates a Layer 3 virtual interface for each VLAN and routes between those interfaces.

For a focused router-on-a-stick example, see Configure Router on a Stick. For broader background on network layers, see the OSI Reference Model.

Introductory router subinterface example

The following illustrates the gateway interfaces for VLAN 10 and VLAN 20. It is not a complete routing configuration:

interface gigabitEthernet 0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitEthernet 0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Each subinterface is associated with one VLAN ID and one IP subnet. Hosts must use the gateway address belonging to their own subnet.

Troubleshooting VLAN Connectivity

Devices in the same VLAN cannot communicate

• One or more access ports may be assigned to the wrong VLAN.
• The VLAN may not exist or may be inactive on a switch.
• The VLAN may not be allowed across the inter-switch trunk.
• The endpoints may have incompatible IP addresses, subnet masks, or other configuration.

Check membership with show vlan brief, inspect the individual port with show interfaces gigabitEthernet 0/1 switchport, verify trunk status with show interfaces trunk, and validate each endpoint's IP address, mask, and gateway.

Traffic reaches devices that should be separated

• Ports may still be in VLAN 1, the default VLAN.
• The intended port-to-VLAN assignments may not have been applied.
• An unintended bridge or switch connection may join parts of the topology.

Inspect endpoint-facing port assignments, review the MAC address table by VLAN, and compare the physical topology with the intended logical design.

Same-VLAN hosts on separate switches cannot communicate

• The inter-switch link may not be operating as a trunk.
• The VLAN may be missing from the trunk's allowed VLAN list.
• The VLAN may exist on only one switch.
• A trunk tagging or native-VLAN mismatch may affect the link.

Run show interfaces trunk on both switches. Verify that the VLAN exists and is active on both devices, and confirm compatible trunk settings at both ends.

Different VLANs cannot communicate

• No router or multilayer-switch routing interface may be configured.
• Hosts may have incorrect default gateways.
• The Layer 3 device may lack a gateway interface for one VLAN.
• An access control list or other security policy may block routed traffic.

Test reachability to each VLAN gateway, inspect router subinterfaces or multilayer-switch VLAN interfaces, review the routing table, and check access-control configuration.

Exam-Relevant Summary

• A VLAN is a logical Layer 2 segment implemented on switches.
• Each VLAN is a separate broadcast domain.
• Broadcasts, unknown unicasts, and applicable flooded frames remain within their VLAN.
• VLAN 1 is commonly the default VLAN, and access ports often begin there.
• An access port normally carries one VLAN for an endpoint.
• A trunk carries multiple VLANs between network devices and commonly uses IEEE 802.1Q tagging.
• The same VLAN can span multiple switches only when the VLAN exists and is carried across the inter-switch path.
• Different VLANs require a router or multilayer switch for communication.
• Each VLAN commonly maps to its own IP subnet and default gateway.
• VLAN segmentation is useful for traffic management and security, but routed access policies are needed to control communication between VLANs.