VLANs & Inter-VLAN Routing¶

What is a VLAN?¶

A VLAN (Virtual Local Area Network) is a logical grouping of switch ports, isolated at Layer 2. One physical switch can be split into multiple isolated broadcast domains.

Why VLANs?¶

Security: Isolate sensitive traffic (management, guests)
Organization: Group by function (office, guest, IoT)
Performance: Reduce broadcast storms

Access vs Trunk Ports¶

Access Port — connects to end devices, assigned to ONE VLAN:

Switch(config)# interface Gi0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Trunk Port — connects switches, carries MULTIPLE VLANs:

Switch(config)# interface Gi0/48
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

Caution — the bare command replaces the list: switchport trunk allowed vlan <list> overwrites the entire allowed list, it doesn't add to it. To add a VLAN to a live trunk without dropping the others, use switchport trunk allowed vlan add <id> (and remove <id> to take one off). Typing a bare list on a live trunk instantly cuts off every VLAN not in it — including, potentially, the management VLAN you're connected through.

VLAN Configuration Example¶

! Define VLANs
vlan 10
 name Office
vlan 20
 name Guest

! Configure access ports
interface Gi0/1
 switchport mode access
 switchport access vlan 10

! Configure trunk
interface Gi0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Connecting VLANs Across Multiple Switches¶

A single trunk link can extend all your VLANs across your entire switch fabric, so devices in VLAN 10 on Switch A and VLAN 10 on Switch B behave as one broadcast domain, without a router in between.

802.1Q Tagging¶

Trunk ports use the 802.1Q standard to tag each frame with its VLAN ID as it crosses the trunk, so the receiving switch knows which VLAN the frame belongs to:

Untagged frame  → [802.1Q tag: VLAN 10] → Frame crosses trunk → Tag stripped → Delivered to VLAN 10 access ports

The tag only exists on the wire between trunk ports — end devices on access ports never see it.

Native VLAN¶

One VLAN per trunk is the native VLAN — its frames are sent untagged. By default this is VLAN 1.

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999

Caution — native VLAN mismatch: if the two ends of a trunk disagree on which VLAN is native (e.g. one side set to VLAN 1, the other to VLAN 999), traffic can leak between VLANs and switches will log CDP native VLAN mismatch warnings. Always set the native VLAN explicitly and match it on both ends — many hardening guides also recommend moving the native VLAN off VLAN 1 entirely (as above) so it isn't the default, commonly-targeted VLAN.

Editing a Trunk's Allowed List¶

A trunk carries only the VLANs in its allowed list. The trap is that the bare command replaces the entire list rather than adding to it:

! REPLACES everything — VLANs you omit stop crossing this trunk
switchport trunk allowed vlan 30

Run that on a live trunk that was carrying 10 and 30, and VLAN 10 silently stops passing. The link stays up, the port still shows trunking, and only the traffic disappears.

Use the explicit verbs to change a list without rewriting it:

Cisco IOS — interface configuration:

! Add, keeping what's already there
switchport trunk allowed vlan add 30

! Remove one, keeping the rest
switchport trunk allowed vlan remove 30

! Deliberately replace the whole list
switchport trunk allowed vlan 10,30

The native VLAN must also be in the allowed list. They are two independent settings, and it is entirely possible to set native vlan 10 while VLAN 10 is absent from allowed vlan — in which case the native VLAN's traffic is dropped. The switch reports the trunk as healthy either way.

Check what a trunk is actually carrying, rather than reading it back out of the config:

show interfaces trunk

Port        Mode    Encapsulation  Status      Native vlan
Gi0/14      on      802.1q         trunking    999

Port        Vlans allowed on trunk
Gi0/14      10,30

Port        Vlans allowed and active in management domain
Gi0/14      10,30

The third section is the useful one: a VLAN listed as allowed but missing from allowed and active exists on the trunk but not in this switch's VLAN database, so nothing will cross.

Blackhole Native VLAN¶

The native VLAN cannot be removed — 802.1Q always needs somewhere to put an untagged frame. What you can do is point it at a VLAN used for nothing, and leave that VLAN out of the allowed list so untagged frames are simply dropped:

vlan 999
 name BLACKHOLE-NATIVE
!
interface Gi0/14
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,30      ! note: 999 deliberately absent

This moves the native off VLAN 1 and ensures nothing legitimate ever rides untagged. Use it on switch-to-switch and switch-to-firewall uplinks. Do not use it on a port where something genuinely needs untagged access — an AP's management traffic, for instance (see Connecting a Ruckus AP to a Cisco Switch).

Multi-Switch Trunk Topology¶

Extending VLANs 10 and 20 between two switches over a single trunk link:

! --- Switch A ---
vlan 10
 name Office
vlan 20
 name Guest

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

! --- Switch B ---
vlan 10
 name Office
vlan 20
 name Guest

interface Gi0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

Both switches need the same VLANs defined locally, and the trunk on each end must allow the same VLAN list — a device on Switch B's VLAN 10 access port can now reach a device on Switch A's VLAN 10 access port straight across the trunk.

Verify:

! Confirm trunk state, native VLAN, and allowed/active VLANs on each end
show interfaces trunk
! Check for native VLAN mismatch warnings between adjacent switches
show cdp neighbors detail

VTP (VLAN Trunking Protocol)¶

Manually creating identical VLANs on every switch (as above) doesn't scale well. VTP lets one switch's VLAN database propagate automatically to the rest of the switches in the same VTP domain, over trunk links.

VTP Modes¶

Mode	Behavior
Server	Can create/modify/delete VLANs; propagates changes to the domain. (Default mode.)
Client	Receives and applies VLAN changes from a server; cannot create VLANs locally.
Transparent	Ignores VTP updates from others and doesn't propagate its own — forwards VTP advertisements it receives, but keeps its own VLAN database local and independent.

vtp domain OFFICE-NET
vtp mode server
vtp password <shared-secret>

Set every other switch in the domain to client (or transparent) with the matching domain name and password.

The VTP Revision Number Trap¶

Every VTP change increments a configuration revision number. When a switch joins a VTP domain, it accepts the VLAN database with the highest revision number — including from a switch in client mode, if its revision number happens to be higher than the current server's.

Real-world gotcha: plugging in a switch that was previously configured as a VTP server in some other domain — even now set to client mode — with a leftover high revision number can silently wipe out the VLAN database of an entire production network the moment its trunk comes up. Before connecting any switch to a live VTP domain, check and reset its revision number:
! Check "Configuration Revision" before connecting
Switch# show vtp status
! Temporarily go transparent to reset revision to 0, then switch back
Switch# configure terminal
Switch(config)# vtp mode transparent
Switch(config)# vtp mode server

Should You Use VTP?¶

Given the revision-number risk, many environments now run VTP transparent on every switch (or VTP version 3, which supports authentication and primary-server election to mitigate the risk) and manage VLANs manually or via automation instead. For a small, tightly controlled network, manual VLAN creation (as in the multi-switch example above) is often simpler and safer than VTP server/client mode.

Layer 3 Routing (Inter-VLAN Communication)¶

VLANs are isolated at Layer 2. To let them communicate, enable routing and create VLAN interfaces (SVIs — Switch Virtual Interfaces):

ip routing

interface Vlan10
 ip address 10.0.10.1 255.255.255.0
 no shutdown

interface Vlan20
 ip address 10.0.20.1 255.255.255.0
 no shutdown

An SVI only comes up once its VLAN exists in the VLAN database and has at least one active port in forwarding state — until then it sits down/down even with a correct config, which is easy to hit when you create SVIs before any devices are patched in. Verify with show ip interface brief (each SVI should show up/up) and show ip route (one connected route per VLAN). End devices must use the SVI address of their VLAN as their default gateway.