Configure VLANs on Cisco Switches

Learn how to create and name VLANs, configure Cisco switch access ports, verify VLAN membership, and save the configuration with Cisco IOS commands.

A VLAN (virtual LAN) is a logical Layer 2 network segment. It creates a separate broadcast domain on a switch, so devices in one VLAN do not receive Layer 2 broadcasts from another VLAN.

VLANs divide a switched network logically rather than by physical switch placement. Devices connected to different physical ports can belong to the same VLAN, while devices on the same switch can be placed in different VLANs.

Devices in different VLANs require inter-VLAN routing, which is Layer 3 forwarding between VLANs, before they can communicate. Assigning a port to a VLAN does not by itself provide communication with other VLANs.

Prerequisites and IOS Modes

You should know basic Ethernet switching, the difference between Layer 2 and Layer 3 communication, and how to enter Cisco IOS command modes. The examples use these common modes:

• Privileged EXEC mode: the prompt commonly ends with #. Use enable to enter it.
• Global configuration mode: entered with configure terminal. The prompt commonly ends with (config)#.
• VLAN configuration submode: entered with vlan vlan-id.
• Interface configuration mode: entered with interface interface-id.

Default VLAN Behavior

On a newly initialized Cisco switch, access ports are placed in VLAN 1 by default. VLAN 1 exists automatically, and it is commonly called the default VLAN. It is a reserved default VLAN and generally should not be used for ordinary user endpoints or routine management when a more deliberate design is possible.

Before changing the switch, inspect its current state. This provides a baseline and helps confirm which interfaces are currently listed as members of VLAN 1.

Switch> enable
Switch# show vlan brief

The output lists VLAN IDs, names, status, and access-port membership. On a newly initialized access switch, many access interfaces commonly appear beneath VLAN 1.

Access Ports and Trunk Ports

An access port carries traffic for one assigned data VLAN and is normally used for an endpoint such as a workstation or printer. A trunk port carries traffic for multiple VLANs, commonly between switches or between a switch and a router, firewall, or server.

Trunks commonly use 802.1Q, the Ethernet VLAN-tagging standard. The switch adds VLAN identification to frames crossing the trunk so multiple VLANs can share one link. The native VLAN is the VLAN whose trunk frames are untagged.

User-facing ports should normally be explicitly configured with switchport mode access. This makes the intended port role clear and prevents the endpoint connection from relying on negotiation or an unintended trunk state. Full trunk configuration is outside this access-port exercise.

View VLAN Information

List VLANs and Access-Port Membership

Use show vlan brief for the most useful first check. It displays the VLAN ID, VLAN name, status, and the access interfaces assigned to each VLAN.

Switch# show vlan brief

Trunk ports do not appear as access-port members in the port lists produced by this command. If an expected interface is missing, determine whether it is operating as a trunk or has another switchport configuration.

Inspect Detailed Switchport Settings

Use the interface-specific form when you need details about one port:

Switch# show interfaces fastethernet 0/5 switchport

To inspect switchport information for all applicable interfaces, use:

Switch# show interfaces switchport

These commands help identify the administrative and operational switchport mode, the configured access VLAN, and related switchport settings.

Create and Name a VLAN

Plan VLAN IDs consistently on switches that need to carry the same VLAN. A VLAN ID is the numeric identifier that distinguishes one VLAN from another. Use meaningful names and document the ID scheme so the purpose of each VLAN is clear.

The following commands create VLAN 20 and name it SALES:

Switch# enable
Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# name SALES
Switch(config-vlan)# end
Switch#

The command vlan 20 creates VLAN 20 or enters its VLAN configuration submode if it already exists. The name SALES command gives it a descriptive name. Verify the result:

Switch# show vlan brief

VLAN 20 should appear with its configured name and an active status. The switch's VLAN database contains the VLAN definition and related VLAN information.

Assign an Access Port to a VLAN

After the VLAN exists locally, select the endpoint interface, make it a static access port, and assign the access VLAN. The VLAN must exist on that switch before the assignment can become active.

This example places FastEthernet0/5 in VLAN 20:

Switch# configure terminal
Switch(config)# interface fastethernet 0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# end
Switch#

The port now carries traffic for VLAN 20 as an access port. Confirm the membership with:

Switch# show vlan brief
Switch# show interfaces fastethernet 0/5 switchport

FastEthernet0/5 should be listed under VLAN 20 instead of VLAN 1. The interface-specific output should also show access mode and VLAN 20 as the configured access VLAN.

Complete Configuration Workflow

1. Inspect the current state. Run show vlan brief and note the existing VLANs and port assignments.
2. Create the VLAN. Enter global configuration mode and use vlan vlan-id.
3. Name the VLAN. Use a meaningful name such as SALES or ENGINEERING.
4. Select the port. Enter the correct physical interface with interface interface-id.
5. Set access mode. Use switchport mode access for a typical endpoint port.
6. Assign the VLAN. Use switchport access vlan vlan-id.
7. Verify the result. Check both show vlan brief and the interface-specific show interfaces ... switchport command.
8. Save the configuration. Copy the running configuration to startup configuration.

Example: Segment Sales and Engineering

Suppose a switch has Sales workstations on FastEthernet0/5 through FastEthernet0/8 and Engineering workstations on FastEthernet0/9 through FastEthernet0/12. Create separate VLANs and assign each group to its own access VLAN.

Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# name SALES
Switch(config-vlan)# vlan 30
Switch(config-vlan)# name ENGINEERING
Switch(config-vlan)# interface range fastethernet 0/5 - 8
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# interface range fastethernet 0/9 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 30
Switch(config-if-range)# end
Switch# show vlan brief

Sales and Engineering are now separate Layer 2 broadcast domains. They remain unable to communicate directly across VLAN boundaries unless a Layer 3 gateway and inter-VLAN routing are configured.

Save the Configuration

Changes made to the running configuration can be lost after a reload unless they are saved to startup configuration.

Switch# copy running-config startup-config

On platforms that support it, write memory is another command used to save the configuration:

Switch# write memory

Saving should be the final step after verification. Do not save an incorrect port assignment simply because the commands were accepted.

Troubleshooting VLAN Configuration

The Intended VLAN Does Not Appear

• Run show vlan brief to confirm whether the VLAN exists.
• Make sure you configured the correct switch.
• Enter global configuration mode and create the VLAN if it is missing.
• Assign the name and verify that the VLAN is active.

Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# name SALES
Switch(config-vlan)# end
Switch# show vlan brief

The Port Still Appears Under VLAN 1

• Check that you selected the correct interface.
• Confirm that switchport access vlan 20 was entered on that interface.
• Verify the result after leaving configuration mode.

Switch# show interfaces fastethernet 0/5 switchport
Switch# show vlan brief

If necessary, re-enter the interface and apply both switchport mode access and switchport access vlan 20.

The Interface Is Missing from the Expected VLAN List

The interface may be operating as a trunk, may have a different switchport configuration, or may not have the VLAN assignment locally present. Use the interface-specific switchport command to investigate.

Switch# show interfaces fastethernet 0/5 switchport

For a normal endpoint connection, configure access mode and assign the correct locally defined VLAN.

Devices in Different VLANs Cannot Communicate

This is normally expected. Separate VLANs are separate Layer 2 broadcast domains. Verify each port's VLAN membership, the endpoint IP addresses, and the default gateways. If cross-VLAN connectivity is required, configure inter-VLAN routing separately using an appropriate Layer 3 design.

Confusion About VLAN 1 and the Native VLAN

VLAN 1 is the switch's default VLAN. The native VLAN is configured on an 802.1Q trunk and controls which trunk frames are untagged. A trunk can use a native VLAN other than VLAN 1. Avoid changing trunk settings during an access-port-only exercise unless both ends of the trunk are planned and configured consistently.

Design and Exam Notes

• Use meaningful VLAN names and document a consistent VLAN ID scheme across switches.
• VLAN IDs must be planned consistently on switches that need to carry the same VLAN.
• Use explicit access mode for ordinary user-facing ports.
• A VLAN must exist locally before an access port can use it correctly.
• A trunk carries multiple VLANs; it should not be confused with an access port carrying one typical endpoint VLAN.
• VLAN 1 is the default reserved VLAN and should generally not carry ordinary user endpoint traffic when possible.
• Putting a port in a VLAN does not create a Layer 3 path to another VLAN.
• show vlan brief is the quick membership check; show interfaces interface-id switchport provides detailed port-state information.
• Remember the sequence: inspect, create, name, select, set access mode, assign, verify, and save.

Summary

To configure a Cisco switch VLAN, first inspect the default state with show vlan brief. Create the VLAN from global configuration mode, give it a descriptive name, select the intended interface, explicitly set the interface to access mode, and assign the access VLAN. Verify membership with show vlan brief and detailed switchport state with show interfaces interface-id switchport. Finally, save the verified configuration with copy running-config startup-config.

VLANs provide Layer 2 separation, but communication between separate VLANs requires inter-VLAN routing.