# VLANs and Trunking

VLANs (Virtual LANs) segment a single physical network into multiple logical networks, improving security, reducing broadcast domains, and simplifying management.

## Why VLANs?

| Benefit | Explanation |
|---|---|
| **Broadcast domain reduction** | Each VLAN is its own broadcast domain |
| **Security** | Isolate traffic between departments/users |
| **Flexibility** | Users can be grouped logically regardless of physical location |
| **Cost savings** | One switch can serve multiple networks |
| **Traffic management** | Better control over traffic flow |

## VLAN Types

| Type | Purpose | Notes |
|---|---|---|
| **Data VLAN** | User traffic (most common) | Carries general user data |
| **Voice VLAN** | VoIP traffic | Often has QoS prioritization |
| **Management VLAN** | Switch management traffic | Should be secured separately |
| **Native VLAN** | Untagged traffic on trunk | Usually VLAN 1 by default (security concern) |
| **Default VLAN** | VLAN 1 | All ports in VLAN 1 by default |

## Access vs Trunk Ports

| Port Type | Purpose | Tagging |
|---|---|---|
| **Access Port** | Connects to end devices (PC, printer) | Untagged - belongs to single VLAN |
| **Trunk Port** | Connects switches together | Tagged - carries multiple VLANs (802.1Q) |
| **Hybrid Port** | Mixed (less common) | Can carry tagged and untagged |

## 802.1Q Trunking

IEEE 802.1Q adds a 4-byte VLAN tag to Ethernet frames on trunk links, identifying which VLAN the frame belongs to.

**Tag contains:** TPID (0x8100) and TCI (Priority + VLAN ID)

### Frame Flow Example
1. PC in VLAN 10 sends frame to access port (untagged)
2. Switch tags frame with VLAN 10 when forwarding out trunk
3. Receiving switch reads tag, forwards to appropriate access ports in VLAN 10
4. Tag removed before sending to end device

## Inter-VLAN Routing

VLANs are isolated - to communicate between VLANs, you need routing (Layer 3).

| Method | Description | Use Case |
|---|---|---|
| **Router-on-a-Stick** | Single router interface with sub-interfaces per VLAN | Small networks |
| **Layer 3 Switch** | Switch does routing via SVIs (Switched Virtual Interfaces) | Larger networks (more efficient) |
| **External Router** | Dedicated router | Traditional approach |

### Router-on-a-Stick Concept
- Trunk between switch and router
- Router has sub-interface for each VLAN with 802.1Q encapsulation
- Each sub-interface has IP address (gateway for that VLAN)

## VLAN Configuration Examples (Cisco-style)

```cisco
! Create VLANs
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name IT
Switch(config-vlan)# exit

! Configure access port
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Configure trunk port
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 99

! Layer 3 SVI
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
```

## Security Best Practices

| Practice | Rationale |
|---|---|
| **Change native VLAN** | Don't use VLAN 1 for native VLAN |
| **Prune unnecessary VLANs** | Only allow needed VLANs on trunks |
| **Disable unused ports** | Put in unused VLAN or shutdown |
| **Use Management VLAN separately** | Don't manage switches over user VLANs |
| **Port Security** | Limit MAC addresses per port |
| **Avoid VLAN hopping** | Configure trunk properly, disable DTP where not needed |

## Troubleshooting

| Issue | Check |
|---|---|
| **PC can't reach gateway** | VLAN assignment, SVI/router config, trunk allowed VLANs |
| **Can't communicate between VLANs** | Inter-VLAN routing configured? Correct gateway on PCs? |
| **Trunk not passing traffic** | Trunk mode, allowed VLANs, native VLAN mismatch |
| **VLAN not existing** | VLAN created on all switches in path? |

```bash
# Show commands (Cisco)
show vlan brief
show interfaces trunk
show interfaces switchport
show ip interface brief
```

## Related Notes

- [[Switching-LAN/STP-And-Loop-Prevention.md]] — Preventing loops
- [[Routing/Routing-Fundamentals.md]] — Inter-VLAN routing details
- [[Security/Zero-Trust-And-Segmentation.md]] — VLANs as segmentation
- [[Foundations/OSI-TCPIP-Models.md]] — Layer 2 concepts

## Sources

* Cisco CCNA Official Cert Guide  
* IEEE 802.1Q Standard  
* Kurose & Ross - *Computer Networking*