VLANs and Trunking
VLANs (Virtual LANs) segment a single physical network into multiple logical networks, improving security, reducing broadcast domains, and simplifying management.
Why VLANs?
| Benefit |
Explanation |
| Broadcast domain reduction |
Each VLAN is its own broadcast domain |
| Security |
Isolate traffic between departments/users |
| Flexibility |
Users can be grouped logically regardless of physical location |
| Cost savings |
One switch can serve multiple networks |
| Traffic management |
Better control over traffic flow |
VLAN Types
| Type |
Purpose |
Notes |
| Data VLAN |
User traffic (most common) |
Carries general user data |
| Voice VLAN |
VoIP traffic |
Often has QoS prioritization |
| Management VLAN |
Switch management traffic |
Should be secured separately |
| Native VLAN |
Untagged traffic on trunk |
Usually VLAN 1 by default (security concern) |
| Default VLAN |
VLAN 1 |
All ports in VLAN 1 by default |
Access vs Trunk Ports
| Port Type |
Purpose |
Tagging |
| Access Port |
Connects to end devices (PC, printer) |
Untagged - belongs to single VLAN |
| Trunk Port |
Connects switches together |
Tagged - carries multiple VLANs (802.1Q) |
| Hybrid Port |
Mixed (less common) |
Can carry tagged and untagged |
802.1Q Trunking
IEEE 802.1Q adds a 4-byte VLAN tag to Ethernet frames on trunk links, identifying which VLAN the frame belongs to.
Tag contains: TPID (0x8100) and TCI (Priority + VLAN ID)
Frame Flow Example
- PC in VLAN 10 sends frame to access port (untagged)
- Switch tags frame with VLAN 10 when forwarding out trunk
- Receiving switch reads tag, forwards to appropriate access ports in VLAN 10
- Tag removed before sending to end device
Inter-VLAN Routing
VLANs are isolated - to communicate between VLANs, you need routing (Layer 3).
| Method |
Description |
Use Case |
| Router-on-a-Stick |
Single router interface with sub-interfaces per VLAN |
Small networks |
| Layer 3 Switch |
Switch does routing via SVIs (Switched Virtual Interfaces) |
Larger networks (more efficient) |
| External Router |
Dedicated router |
Traditional approach |
Router-on-a-Stick Concept
- Trunk between switch and router
- Router has sub-interface for each VLAN with 802.1Q encapsulation
- Each sub-interface has IP address (gateway for that VLAN)
VLAN Configuration Examples (Cisco-style)
! Create VLANs
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name IT
Switch(config-vlan)# exit
! Configure access port
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
! Configure trunk port
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 99
! Layer 3 SVI
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Security Best Practices
| Practice |
Rationale |
| Change native VLAN |
Don't use VLAN 1 for native VLAN |
| Prune unnecessary VLANs |
Only allow needed VLANs on trunks |
| Disable unused ports |
Put in unused VLAN or shutdown |
| Use Management VLAN separately |
Don't manage switches over user VLANs |
| Port Security |
Limit MAC addresses per port |
| Avoid VLAN hopping |
Configure trunk properly, disable DTP where not needed |
Troubleshooting
| Issue |
Check |
| PC can't reach gateway |
VLAN assignment, SVI/router config, trunk allowed VLANs |
| Can't communicate between VLANs |
Inter-VLAN routing configured? Correct gateway on PCs? |
| Trunk not passing traffic |
Trunk mode, allowed VLANs, native VLAN mismatch |
| VLAN not existing |
VLAN created on all switches in path? |
# Show commands (Cisco)
show vlan brief
show interfaces trunk
show interfaces switchport
show ip interface brief
Sources
- Cisco CCNA Official Cert Guide
- IEEE 802.1Q Standard
- Kurose & Ross - Computer Networking
