CCNA 200-301 · 6 of 16

VLANs and trunks: one switch pretending to be many

Why one broadcast domain stops being enough, how an access port assigns a VLAN, what 802.1Q actually adds to a frame, the native VLAN trap, and the three ways to route between VLANs.

Updated 2026-09-09

On this page

A switch with no configuration is one big network: every device hears every broadcast, and anyone with a cable is inside. VLANs let one physical switch behave as several separate switches that happen to share a chassis, and trunks let those separate switches span the building over a single cable. It is the most useful trick in campus networking, and almost every switching problem you will ever meet is a VLAN that does not reach where somebody assumed it did.

The map

Read this first when short on time. Every branch is a section below.

Figure 1. The whole article on one page. Every branch is a section below; fold what you know, open what you do not.

What a VLAN buys you

A VLAN is a broadcast domain defined in software rather than by cabling. Ports assigned to VLAN 10 behave as if they were plugged into their own private switch: frames sent by one of them can reach the others and nothing else, even though VLAN 20's ports are millimetres away on the same board.

Three reasons this matters, in the order people usually discover them.

Broadcast control. Every ARP request, DHCP discover and Windows discovery broadcast reaches every host in the broadcast domain. At fifty hosts nobody notices. At five hundred, every machine is spending real CPU time on frames it will discard, and one misbehaving device can flood the lot. Splitting into ten VLANs divides that noise by ten.

Separation. Guests, security cameras, payment terminals and the finance department have no reason to be able to reach each other at layer 2. Putting them in separate VLANs means traffic between them must pass through a router, which is where an access list can say no. A compromised camera on a flat network can attack anything; on its own VLAN it can attack the router's interface and nothing else.

Flexibility. Without VLANs, which network a desk belongs to is decided by which cupboard its cable runs to. With them, it is one line of configuration, so a team can move floors without an electrician.

VLAN	Typical use	Note
1	Default for every port	Cannot be deleted; best left carrying nothing
10, 20, 30…	Data VLANs per department or floor	Numbers are arbitrary; pick a scheme and keep it
Voice VLAN	IP phones	Tagged to the phone, untagged to the PC behind it
Management VLAN	Switch and router management addresses	Should not be VLAN 1, and should not be reachable from user VLANs
1002–1005	Reserved legacy FDDI and Token Ring	Present on every switch, ignorable

In the wild

Retail chains put payment terminals on a dedicated VLAN because card-industry rules require the cardholder data environment to be segmented from everything else, and a VLAN plus an ACL is the cheapest way to demonstrate it.
Hypervisors present a trunk to the switch and assign each virtual machine a VLAN, so a physical server can host machines from a dozen different networks on one cable.
Guest Wi-Fi is almost always its own VLAN routed straight to the internet edge, so guest devices never see the corporate network at layer 2 or 3.

Access ports: one VLAN, no tag

An access port belongs to exactly one VLAN and sends frames to the attached device with no VLAN information at all. The host has no idea VLANs exist, which is the point: an ordinary laptop needs no configuration.

! create the VLANs first — they must exist before ports can join them
Switch(config)# vlan 10
Switch(config-vlan)# name STAFF
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name GUEST
Switch(config-vlan)# exit

! assign ports
Switch(config)# interface range GigabitEthernet1/0/1 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# exit

switchport mode access is not optional decoration. Without it the port is left in dynamic mode and will try to negotiate trunking with whatever is plugged in, which is both unpredictable and a security hole. Stating the mode explicitly on every port is the single most valuable habit in switch configuration.

The VLAN list lives in a file called vlan.dat in flash, separate from the running configuration — which surprises people who erase the startup configuration expecting a clean switch and find their VLANs still there. Deleting vlan.dat as well is part of a genuine factory reset.

Switch# show vlan brief

VLAN Name              Status    Ports
---- ----------------- --------- -------------------------------
1    default           active    Gi1/0/13, Gi1/0/14, Gi1/0/15
10   STAFF             active    Gi1/0/1, Gi1/0/2, Gi1/0/3
20   GUEST             active    Gi1/0/16, Gi1/0/17
99   MGMT              active
1002 fddi-default      act/unsup

Two things to read in that output. Ports listed under a VLAN are access ports in it — trunk ports do not appear here at all, which is a common source of confusion when a VLAN looks empty. And a VLAN in act/lshut state has been shut down, which stops it forwarding as surely as unplugging every cable.

Trunks and the 802.1Q tag

VLANs are only useful if they span more than one switch, which raises an obvious problem: a frame crossing the link between two switches needs to say which VLAN it belongs to. A trunk is a link that carries many VLANs, and it works by adding a tag.

Figure 2. 802.1Q inserts four bytes between the source address and the type field. The frame is rebuilt and its checksum recalculated, which is why a device that does not understand tagging sees a corrupt or oversized frame.

Configuring a trunk is short:

Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,99
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport nonegotiate

The encapsulation line is only needed on older switches that also supported Cisco's proprietary ISL; anything modern is 802.1Q only and rejects the command.

The allowed VLAN list is worth setting deliberately. By default a trunk carries every VLAN that exists, which means a broadcast in VLAN 20 travels to switches that have no ports in VLAN 20 at all. Pruning the list to what each link actually needs cuts traffic and shrinks the blast radius of a broadcast storm.

Watch out

switchport trunk allowed vlan 30 replaces the list; it does not add to it. Typing it on a working trunk removes every other VLAN instantly. Use switchport trunk allowed vlan add 30 — the missing add is one of the most reliable ways to cause an outage from a single line of configuration.

The native VLAN, and why it keeps causing trouble

One VLAN on every trunk travels untagged. That VLAN is the native VLAN, it is VLAN 1 by default, and it exists for backward compatibility with devices that predate tagging.

The rule that follows is simple and unforgiving: a frame arriving on a trunk with no tag is placed in the native VLAN. So if one switch has native VLAN 1 and the other has native VLAN 99, untagged frames sent by the first land in VLAN 99 on the second. Two broadcast domains have quietly merged, and neither switch reports an error beyond a spanning-tree complaint that is easy to ignore.

flowchart TD
  A["Frame arrives on a trunk"] --> B{"Has an 802.1Q tag?"}
  B -->|Yes| C["Put it in the VLAN<br/>the tag names"]
  B -->|No| D["Put it in the native VLAN<br/>of this port"]
  C --> E{"Is that VLAN in the<br/>allowed list?"}
  D --> E
  E -->|Yes| F["Forward normally"]
  E -->|No| G["Drop the frame"]

Figure 3. How a trunk port classifies an arriving frame. The untagged path is where mismatched native VLANs merge two networks without anything obviously breaking.

Two hardening rules follow, and both are standard practice:

Change the native VLAN to something unused on both ends of every trunk. VLAN 999 named NATIVE-UNUSED is a common choice.
Never put user traffic in the native VLAN. That closes the double-tagging attack, where an attacker on the native VLAN sends a frame with two tags: the first switch strips the outer tag (it matches the native VLAN, so it is removed) and forwards the frame with its inner tag intact, delivering it into a VLAN the attacker was never supposed to reach. The attack is one-way and it depends entirely on the attacker's access port being in the native VLAN of the trunk.

Cisco Discovery Protocol will report a native VLAN mismatch in the log, which is one of the reasons to leave CDP running on trunk links even when you disable it elsewhere:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on
GigabitEthernet1/0/24 (1), with DIST-SW1 GigabitEthernet1/0/1 (99).

Negotiation, VTP and the voice VLAN

DTP: turn it off

Dynamic Trunking Protocol lets two Cisco switches work out for themselves whether a link should be a trunk. It saves a line of configuration and costs far more than it saves. A port left in dynamic auto or dynamic desirable will form a trunk with anything that asks — including a laptop running software that speaks DTP, which then receives every VLAN on the switch. That is the switch spoofing attack, and it needs no privileged access at all.

Mode	Behaviour	Use
`access`	Always an access port, never negotiates	Every user-facing port
`trunk`	Always a trunk	Every uplink, with `nonegotiate`
`dynamic desirable`	Actively asks to trunk	Avoid
`dynamic auto`	Trunks if asked	Avoid — and it is the default on many platforms

The rule is one line: configure every port explicitly as access or trunk, and add switchport nonegotiate to trunks.

VTP: know what it is, then leave it alone

VLAN Trunking Protocol synchronises the VLAN database across switches in a domain, so creating VLAN 40 on one switch creates it everywhere. Convenient, and famous for the failure mode: a switch in server mode with a higher revision number overwrites everyone else's database. Plugging in an old lab switch that happens to have a high revision number and an empty VLAN list has deleted the VLANs of entire production networks.

Most organisations run VTP in transparent mode, where the switch passes advertisements through but keeps its own local VLAN list, or use VTP version 3, which requires a switch to be explicitly designated as primary before it can change anything.

Voice VLAN: two networks on one cable

An IP phone with a PC plugged into the back of it needs the phone on one VLAN and the PC on another, over a single cable. The voice VLAN feature does exactly this: the port stays an access port for the PC's untagged traffic, and the switch tells the phone via CDP or LLDP to tag its own traffic with the voice VLAN.

Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 150

The port is still an access port, not a trunk — a distinction that matters because port security, spanning-tree PortFast and 802.1X all treat access ports differently. What it carries is one untagged VLAN plus one tagged voice VLAN, which is a special case rather than a general trunk.

Getting between VLANs

VLANs are separate broadcast domains, so by definition traffic between them needs a router. There are three ways to provide one, and they arrived in this order.

One router interface per VLAN

The original approach: a physical router interface cabled into an access port in each VLAN. It works, it is trivially easy to understand, and it consumes a router port and a switch port per VLAN. Nobody builds this deliberately any more, but it is the mental model the other two are optimisations of.

Router on a stick

One physical link between switch and router, configured as a trunk, with a subinterface on the router for each VLAN. Each subinterface is told which VLAN tag it owns and given the gateway address for that subnet.

flowchart TD
  P1["PC in VLAN 10<br/>10.10.10.50"] --> SW["Switch"]
  P2["PC in VLAN 20<br/>10.10.20.50"] --> SW
  SW -->|"trunk, tags 10 and 20"| R["Router Gi0/0<br/>Gi0/0.10 is 10.10.10.1<br/>Gi0/0.20 is 10.10.20.1"]
  R -->|"routes, retags, returns"| SW

Figure 4. Router on a stick. A frame from VLAN 10 to VLAN 20 travels up the trunk tagged 10, is routed inside the router, and comes back down the same trunk tagged 20 — so it crosses the link twice.

Router(config)# interface GigabitEthernet0/0
Router(config-if)# no shutdown
Router(config-if)# exit
Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 10.10.10.1 255.255.255.0
Router(config-subif)# exit
Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 10.10.20.1 255.255.255.0

Points that catch people: the physical interface needs no shutdown even though no address goes on it; the subinterface number is conventionally the VLAN ID but is not required to be; and if the trunk's native VLAN needs routing, its subinterface takes encapsulation dot1q 99 native.

The weakness is in the picture: every inter-VLAN packet crosses the one link twice, so that link is a bottleneck and a single point of failure.

Layer 3 switch with SVIs

The modern answer. A layer 3 switch routes between VLANs in the same hardware that switches within them, at line rate, with no external link involved. Each VLAN gets a switched virtual interface — a virtual routed interface named after the VLAN.

Switch(config)# ip routing                 ! off by default, and easy to forget
Switch(config)# interface vlan 10
Switch(config-if)# ip address 10.10.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip address 10.10.20.1 255.255.255.0
Switch(config-if)# no shutdown

An SVI comes up only when the VLAN exists and at least one port in it is up, which is a sensible rule that produces a confusing symptom: configure an SVI for a VLAN with no active ports and it sits down/down, looking like a configuration error when it is simply waiting.

The related trick is no switchport, which converts a physical switch port into a routed port that takes an IP address directly — used for links between layer 3 switches and routers, where a VLAN would add nothing.

	Router on a stick	Layer 3 switch
Forwarding	Software, on the router CPU	Hardware, at line rate
Bottleneck	The single trunk link	The switch backplane
Cost	Uses a router you may already have	Needs a layer 3 capable switch
Typical use	Small sites, labs, branch offices	Any campus of real size

In the wild

Campus designs put SVIs on the distribution switches, so inter-VLAN traffic never leaves the wiring closet block and the core only carries traffic between blocks.
Branch routers such as the Cisco ISR family still use router on a stick, because a branch has one switch and a handful of VLANs and the router is there anyway for the WAN link.
Cloud and virtualised networks keep the abstraction and drop the hardware: a VMware distributed switch or an AWS subnet is a VLAN-shaped construct whose routing is a distributed function rather than a box.

When a VLAN does not work

Nearly every VLAN fault is one of five things, and they can be checked in about a minute.

Does the VLAN exist on this switch, and is it active? show vlan brief. A VLAN that was never created, or one in act/lshut, forwards nothing.
Is the access port in the VLAN you think? show interfaces GigabitEthernet1/0/5 switchport shows the operational mode and the access VLAN, which is not always what the configuration suggests.
Is the link between switches actually a trunk? show interfaces trunk lists only ports that are trunking right now. A port missing from that output is not trunking, whatever it was configured to do.
Is the VLAN allowed and active on the trunk? The same command has a column for allowed VLANs and another for those in spanning-tree forwarding state. A VLAN can be allowed but pruned or blocked.
Do the native VLANs match? A mismatch shows in show interfaces trunk and in the CDP log message.

Switch# show interfaces trunk

Port        Mode      Encapsulation  Status        Native vlan
Gi1/0/24    on        802.1q         trunking      999

Port        Vlans allowed on trunk
Gi1/0/24    10,20,99

Port        Vlans allowed and active in management domain
Gi1/0/24    10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    10,20,99

Those four sections narrow a fault precisely. A VLAN in the allowed list but missing from "allowed and active" does not exist on this switch. A VLAN present there but missing from the forwarding list is being blocked by spanning tree — which is a topic of its own, and the next article.

VLAN: A broadcast domain defined by configuration rather than cabling. Frames in one VLAN never reach another without passing through a router.
Access port: A switch port belonging to a single VLAN, sending and receiving untagged frames.
Trunk: A switch port carrying several VLANs, tagging frames with 802.1Q so the far end can tell them apart.
Native VLAN: The one VLAN whose frames cross a trunk untagged. Must match on both ends.
SVI: Switched virtual interface: a virtual layer 3 interface on a switch representing one VLAN, used as the default gateway for that VLAN.

Recap

A VLAN is a broadcast domain defined in software; ports in different VLANs cannot reach each other without routing.
VLANs control broadcast noise, separate traffic for security, and decouple network membership from cabling.
An access port carries one VLAN and sends untagged frames, so the host needs no configuration.
The VLAN database lives in vlan.dat, separate from the startup configuration.
A trunk carries many VLANs by inserting a four-byte 802.1Q tag containing a 12-bit VLAN ID.
switchport trunk allowed vlan replaces the list; use add to extend it.
The native VLAN travels untagged, must match on both ends, and should be an unused VLAN carrying no user traffic.
Double tagging exploits the native VLAN, and switch spoofing exploits DTP — both are closed by explicit port modes.
Configure every port explicitly as access or trunk, and add switchport nonegotiate to trunks.
VTP can wipe a VLAN database from a single stale switch; transparent mode or version 3 avoids it.
A voice VLAN gives a phone a tagged VLAN and the PC behind it an untagged one, while the port remains an access port.
Route between VLANs with router on a stick for small sites or SVIs on a layer 3 switch for anything larger, and remember ip routing.

Questions

Say the answer out loud before opening it.

What problem do VLANs solve?

They divide one physical switch into several independent broadcast domains, so traffic is contained, separated and no longer tied to cabling.

Broadcast traffic stays inside one VLAN rather than reaching every host.
Devices in different VLANs must pass through a router, which is where filtering can be applied.
Which network a port belongs to becomes a configuration line rather than a cable run.

The security benefit is real but partial: a VLAN separates at layer 2, and the separation only holds if the routing between VLANs is also controlled.

What does an 802.1Q tag contain and where does it go?

Four bytes inserted between the source MAC address and the type field, containing a fixed 0x8100 marker, three priority bits and a 12-bit VLAN ID.

Twelve bits give 4096 values, of which 0 and 4095 are reserved, leaving 4094 usable VLANs.
The three priority bits carry class-of-service markings used by quality of service.
The frame's checksum is recalculated, since the frame has changed.

Because the frame grows by four bytes, a device that does not understand tagging counts tagged frames as giants — which is a useful clue that a trunk is landing on an access device.

What is the native VLAN and what happens if it does not match?

It is the one VLAN whose frames cross a trunk untagged; if the two ends disagree, untagged frames land in different VLANs on each side and two broadcast domains merge.

It defaults to VLAN 1 and is set with switchport trunk native vlan.
The merge is silent apart from a CDP log message and a spanning-tree inconsistency.
Best practice is an unused VLAN, matched on both ends, carrying no user traffic.

Leaving user traffic in the native VLAN is also what makes the double-tagging attack possible, so the hardening and the correctness argument point the same way.

Explain the double-tagging attack.

An attacker whose access port is in the native VLAN sends a frame carrying two 802.1Q tags; the first switch strips the outer tag because it matches the native VLAN and forwards the frame still carrying its inner tag, delivering it into a VLAN the attacker cannot otherwise reach.

It requires the attacker's VLAN to be the trunk's native VLAN.
It is one-way: replies cannot come back the same route.
It is prevented by making the native VLAN an unused one and by pruning trunks to the VLANs they need.

The related attack is switch spoofing, where the attacker negotiates a trunk via DTP and receives every VLAN — closed by setting ports explicitly to access mode.

Why should DTP be disabled?

Because a port that negotiates trunking will form a trunk with any device that asks, including an attacker's laptop, handing over every VLAN on the switch.

dynamic auto is the default on many platforms and trunks when asked.
switchport mode access on user ports stops negotiation entirely.
switchport nonegotiate on trunks stops the DTP frames being sent at all.

Explicit port modes also make configurations readable: a port whose mode is stated cannot change behaviour because of what somebody plugged into it.

Why does "switchport trunk allowed vlan 30" cause an outage?

Because it replaces the allowed list rather than adding to it, so every other VLAN is instantly removed from the trunk.

The correct command to extend the list is switchport trunk allowed vlan add 30.
remove, except and all are the other forms.
The effect is immediate and silent — the trunk stays up, carrying only VLAN 30.

It is a good argument for making changes with a saved configuration and a reload in timer, since the outage removes your own management path if management runs over that trunk.

Describe router on a stick and its main weakness.

One physical link between switch and router carries all VLANs as a trunk, with a router subinterface per VLAN holding that VLAN's gateway address; the weakness is that every inter-VLAN packet crosses that single link twice.

Each subinterface uses encapsulation dot1q <vlan> and its own IP address.
The physical interface needs no shutdown even though it has no address.
The link is both a bandwidth bottleneck and a single point of failure.

It survives in branch offices because the router is already there for the WAN link, so the design costs nothing extra to build.

What is an SVI and when does it come up?

A switched virtual interface: a virtual layer 3 interface representing one VLAN on a switch, used as that VLAN's default gateway. It comes up only when the VLAN exists and at least one port in it is up.

Created with interface vlan 10 and given an address like any routed interface.
Requires ip routing to be enabled before the switch will route between SVIs.
A trunk carrying the VLAN also counts towards keeping the SVI up.

The "no active ports" rule produces the classic confusion of a correctly configured SVI sitting down/down, which looks like an error and is actually the design working.

What is the difference between an SVI and a routed port?

An SVI is a virtual interface for a whole VLAN; a routed port is a physical port taken out of switching entirely with no switchport and given its own address.

An SVI serves many access ports in one VLAN.
A routed port serves exactly one link and belongs to no VLAN.
Routed ports are used for links between layer 3 switches and routers, where a VLAN adds nothing.

Routed ports also remove the port from spanning tree, which is why layer 3 links between distribution and core switches converge faster than layer 2 ones.

How does a voice VLAN work on an access port?

The port carries the PC's untagged traffic in the access VLAN and tells the phone, via CDP or LLDP, to tag its own traffic with the voice VLAN.

Configured with switchport access vlan 10 and switchport voice vlan 150 on the same port.
The port remains an access port, so PortFast, port security and 802.1X behave as expected.
The phone acts as a small switch, passing the PC's untagged frames through.

It is a special case rather than a general trunk: exactly one tagged VLAN is permitted, and only to a device the switch has identified as a phone.

Why is VTP considered risky?

Because any switch in server mode with a higher configuration revision number overwrites the VLAN database of every other switch in the domain.

Connecting a lab or replacement switch with a high revision number and an empty VLAN list deletes VLANs network-wide.
The revision number is not reset by a reload, only by changing the domain name or the mode.
Transparent mode keeps a local VLAN list while still forwarding advertisements.

VTP version 3 addresses this by requiring an explicitly designated primary server before any database change is accepted.

A PC in VLAN 20 on switch A cannot reach a PC in VLAN 20 on switch B. What do you check?

Whether VLAN 20 exists on both switches, whether the link between them is trunking, and whether VLAN 20 is allowed and forwarding on that trunk.

show vlan brief on both switches confirms the VLAN exists and is active.
show interfaces trunk confirms the link is actually trunking and lists which VLANs are allowed and forwarding.
show interfaces switchport on the access ports confirms both PCs are really in VLAN 20.

The most common single cause is a VLAN missing from the allowed list on one trunk in the middle of the path, which is invisible from either end.

Why do trunk ports not appear under a VLAN in "show vlan brief"?

Because that output lists access ports assigned to each VLAN, and a trunk belongs to many VLANs rather than one.

Trunk membership is shown by show interfaces trunk instead.
A VLAN with no access ports on this switch appears with an empty port list even though it is carried across trunks.
This regularly leads people to think a VLAN is unused when it is simply transiting.

The same distinction explains why deleting a VLAN that "looks empty" can break traffic passing through the switch between two other switches.

How many VLANs can 802.1Q support, and what are the ranges?

4094 usable, from a 12-bit field where 0 and 4095 are reserved.

1 to 1005 is the normal range, stored in vlan.dat and propagated by VTP.
1006 to 4094 is the extended range, which requires VTP transparent mode on older platforms.
1002 to 1005 are reserved for legacy FDDI and Token Ring and exist on every switch.

Very large multi-tenant networks exhaust 4094 quickly, which is why data centres moved to VXLAN with its 24-bit identifier and 16 million segments.

Where does the VLAN database live, and why does erasing the configuration not remove VLANs?

In a separate file, vlan.dat, in flash memory rather than in NVRAM with the startup configuration.

erase startup-config clears the configuration but leaves vlan.dat intact.
A genuine reset requires delete vlan.dat as well, followed by a reload.
Extended-range VLANs are stored in the running configuration instead on some platforms.

This catches people repurposing a switch: it boots with no configuration but still carries the previous owner's VLAN list, and ports default into VLAN 1 of a database that is not empty.