VLANs & Inter-VLAN Routing¶

What is a VLAN?¶

A VLAN (Virtual Local Area Network) is a logical grouping of switch ports, isolated at Layer 2. One physical switch can be split into multiple isolated broadcast domains.

Why VLANs?¶

Security: Isolate sensitive traffic (management, guests)
Organization: Group by function (office, guest, IoT)
Performance: Reduce broadcast storms

Access vs Trunk Ports¶

Access Port — connects to end devices, assigned to ONE VLAN:

switchport mode access
switchport access vlan 10

Trunk Port — connects switches, carries MULTIPLE VLANs:

switchport mode trunk
switchport trunk allowed vlan 10,20,30

VLAN Configuration Example¶

! Define VLANs
vlan 10
 name Office
vlan 20
 name Guest

! Configure access ports
interface Gi0/1
 switchport mode access
 switchport access vlan 10

! Configure trunk
interface Gi0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20

Connecting VLANs Across Multiple Switches¶

A single trunk link can extend all your VLANs across your entire switch fabric, so devices in VLAN 10 on Switch A and VLAN 10 on Switch B behave as one broadcast domain, without a router in between.

802.1Q Tagging¶

Trunk ports use the 802.1Q standard to tag each frame with its VLAN ID as it crosses the trunk, so the receiving switch knows which VLAN the frame belongs to:

Untagged frame  → [802.1Q tag: VLAN 10] → Frame crosses trunk → Tag stripped → Delivered to VLAN 10 access ports

The tag only exists on the wire between trunk ports — end devices on access ports never see it.

Native VLAN¶

One VLAN per trunk is the native VLAN — its frames are sent untagged. By default this is VLAN 1.

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999

Caution — native VLAN mismatch: if the two ends of a trunk disagree on which VLAN is native (e.g. one side set to VLAN 1, the other to VLAN 999), traffic can leak between VLANs and switches will log CDP native VLAN mismatch warnings. Always set the native VLAN explicitly and match it on both ends — many hardening guides also recommend moving the native VLAN off VLAN 1 entirely (as above) so it isn't the default, commonly-targeted VLAN.

Multi-Switch Trunk Topology¶

Extending VLANs 10 and 20 between two switches over a single trunk link:

! --- Switch A ---
vlan 10
 name Office
vlan 20
 name Guest

interface Gi0/48
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

! --- Switch B ---
vlan 10
 name Office
vlan 20
 name Guest

interface Gi0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,999

Both switches need the same VLANs defined locally, and the trunk on each end must allow the same VLAN list — a device on Switch B's VLAN 10 access port can now reach a device on Switch A's VLAN 10 access port straight across the trunk.

Verify:

show interfaces trunk        ! Confirm trunk state, native VLAN, and allowed/active VLANs on each end
show cdp neighbors detail    ! Check for native VLAN mismatch warnings between adjacent switches

VTP (VLAN Trunking Protocol)¶

Manually creating identical VLANs on every switch (as above) doesn't scale well. VTP lets one switch's VLAN database propagate automatically to the rest of the switches in the same VTP domain, over trunk links.

VTP Modes¶

Mode	Behavior
Server	Can create/modify/delete VLANs; propagates changes to the domain. (Default mode.)
Client	Receives and applies VLAN changes from a server; cannot create VLANs locally.
Transparent	Ignores VTP updates from others and doesn't propagate its own — forwards VTP advertisements it receives, but keeps its own VLAN database local and independent.

vtp domain OFFICE-NET
vtp mode server
vtp password <shared-secret>

Set every other switch in the domain to client (or transparent) with the matching domain name and password.

The VTP Revision Number Trap¶

Every VTP change increments a configuration revision number. When a switch joins a VTP domain, it accepts the VLAN database with the highest revision number — including from a switch in client mode, if its revision number happens to be higher than the current server's.

Real-world gotcha: plugging in a switch that was previously configured as a VTP server in some other domain — even now set to client mode — with a leftover high revision number can silently wipe out the VLAN database of an entire production network the moment its trunk comes up. Before connecting any switch to a live VTP domain, check and reset its revision number:
show vtp status              ! Check "Configuration Revision" before connecting
vtp mode transparent         ! Temporarily go transparent to reset revision to 0...
vtp mode server              ! ...then switch back to the intended mode

Should You Use VTP?¶

Given the revision-number risk, many environments now run VTP transparent on every switch (or VTP version 3, which supports authentication and primary-server election to mitigate the risk) and manage VLANs manually or via automation instead. For a small, tightly controlled network, manual VLAN creation (as in the multi-switch example above) is often simpler and safer than VTP server/client mode.

Layer 3 Routing (Inter-VLAN Communication)¶

VLANs are isolated at Layer 2. To let them communicate, enable routing and create VLAN interfaces (SVIs — Switch Virtual Interfaces):

ip routing

interface Vlan10
 ip address 10.0.10.1 255.255.255.0

interface Vlan20
 ip address 10.0.20.1 255.255.255.0