What Is a VLAN? Cisco Switch Setup Guide

A VLAN (Virtual Local Area Network) divides one physical switched network into separate logical broadcast domains. VLANs help organizations group devices by purpose, improve security, reduce unnecessary broadcast traffic, and apply different network policies without requiring a separate switch for every group.

What Is a LAN?

A local area network connects devices within a limited location such as an office, school, or home. Devices in the same Layer 2 broadcast domain receive broadcast frames. A router or Layer 3 switch separates broadcast domains and forwards traffic between different IP networks.

What Is a VLAN?

A VLAN creates a logical LAN on a switch. Ports assigned to VLAN 10 belong to a different broadcast domain from ports assigned to VLAN 20, even when both groups use the same physical switch. Each VLAN normally uses its own IP subnet.

For example, an organization might place staff computers in VLAN 10, voice phones in VLAN 20, guest devices in VLAN 30, and management interfaces in VLAN 99. Traffic between these VLANs requires inter-VLAN routing and can be controlled with access lists or firewall policies.

Access Ports and Trunk Ports

• Access port: normally carries traffic for one data VLAN and connects to an endpoint such as a computer or printer.
• Trunk port: carries traffic for multiple VLANs between switches, routers, wireless infrastructure, or other network devices.

IEEE 802.1Q trunking identifies VLAN traffic by inserting a VLAN tag into Ethernet frames. Native-VLAN traffic is usually sent untagged, so the native VLAN must match on both ends of a trunk.

How to Create a VLAN on a Cisco Switch

enable
configure terminal
vlan 10
 name STAFF
exit
interface gigabitEthernet 0/1
 switchport mode access
 switchport access vlan 10
 no shutdown
end

This configuration creates VLAN 10 and assigns an access interface to it. Interface names vary by switch model, so confirm the available ports before applying commands.

How to Configure an 802.1Q Trunk

configure terminal
interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
end

Restricting the allowed VLAN list can reduce unnecessary traffic and prevent unintended VLANs from crossing the link. Configure both ends consistently.

How to Verify VLAN Configuration

• show vlan brief displays VLANs and access-port membership.
• show interfaces trunk displays operational trunks, native VLANs, and allowed VLANs.
• show interfaces switchport shows the Layer 2 mode and VLAN settings for an interface.
• show mac address-table shows learned MAC addresses by VLAN and port.

Common VLAN Problems

1. The VLAN does not exist on one of the switches.
2. An access port is assigned to the wrong VLAN.
3. One side of a link is not operating as a trunk.
4. The required VLAN is missing from the allowed list.
5. Native VLANs do not match.
6. The endpoint has an incorrect IP address or default gateway.
7. Inter-VLAN routing is missing or blocked by a security policy.

Frequently Asked Questions

Does a VLAN require its own subnet?

In normal network design, each VLAN maps to a separate IP subnet. Mixing multiple VLANs in one subnet makes routing and troubleshooting difficult.

Can devices in different VLANs communicate?

Yes, but they need inter-VLAN routing through a router, multilayer switch, or firewall.

Where can I practice more switching questions?

Continue with our CCNA interview questions and answers. For focused preparation, see the Cisco 200-301 Premium PDF with the latest available questions and answers.

CiscoForAll provides independent study and practice material. Always use official Cisco documentation as a primary preparation source.