A virtual local area network (VLAN) separates one physical switched network into logical broadcast domains. It helps organize users and devices by role, location, or security requirement without requiring a separate switch for every group.
This guide explains VLAN basics, access ports, 802.1Q trunks, inter-VLAN routing, and practical troubleshooting on Cisco-style networks.
What Is a VLAN?
A VLAN is a Layer 2 logical network identified by a VLAN ID. Devices in the same VLAN can communicate at Layer 2, while traffic between different VLANs requires a Layer 3 device such as a router or multilayer switch. VLANs reduce unnecessary broadcasts and make network segmentation easier to manage.
Why Use VLANs?
- Segmentation: Separate departments, guest devices, voice endpoints, and management systems.
- Smaller broadcast domains: Limit broadcast traffic to the devices that need it.
- Improved security: Apply routing and firewall policies between VLANs.
- Flexible design: Keep related users in the same logical network even when they connect to different switch ports.
Access Ports and Trunk Ports
An access port normally carries traffic for one VLAN and connects to an end device such as a computer, printer, or IP phone. A trunk port carries traffic for multiple VLANs between network devices. Modern Ethernet trunks commonly use the IEEE 802.1Q standard to tag frames with a VLAN ID.
Basic Cisco VLAN Configuration
Create a VLAN and assign a name:
configure terminal vlan 20 name SALES exit
Assign an access port to that VLAN:
interface gigabitEthernet1/0/10 switchport mode access switchport access vlan 20 spanning-tree portfast end
Configure a trunk to another switch and allow only required VLANs:
interface gigabitEthernet1/0/24 switchport mode trunk switchport trunk allowed vlan 10,20,30 end
Inter-VLAN Routing
Devices in different VLANs need Layer 3 routing to communicate. On a multilayer switch, each VLAN can use a switched virtual interface (SVI) as its default gateway. For example, VLAN 20 might use an SVI with the address 192.168.20.1/24. Routing policies and firewall rules can then control which VLANs may communicate.
Common VLAN Troubleshooting Checks
- Confirm the VLAN exists with
show vlan brief. - Check the port mode and assigned VLAN with
show interfaces switchport. - Verify trunk status and allowed VLANs with
show interfaces trunk. - Check that both ends of a trunk allow the required VLAN.
- Confirm the correct IP subnet and default gateway are configured for each VLAN.
- Review spanning-tree status before changing a switch-port configuration.
Good VLAN Design Practices
Use meaningful VLAN names, document VLAN IDs and subnets, restrict trunk allowed VLANs, avoid using VLAN 1 for user traffic, and apply access controls between VLANs. Keep management, voice, guest, server, and user networks separated according to your security requirements.
Continue Learning
For related networking topics, read our IP Addressing guide and Spanning Tree Protocol guide. For structured Cisco learning materials, explore the Cisco Premium PDF collection.