Configure and verify VLANs (normal range) spanning multiple switches

What a VLAN is and why it exists

A VLAN (Virtual Local Area Network) is a way to split one physical switch into several separate logical switches. Think of an office building with one big open floor. If you put up partition walls, you get separate rooms; people in one room cannot overhear people in another. A VLAN is a partition wall inside a switch. Ports in VLAN 10 can talk to each other at Layer 2, ports in VLAN 20 can talk to each other, but a device in VLAN 10 cannot reach a device in VLAN 20 without going through a router (or a switch that can route).

Technically, a VLAN is a broadcast domain. Recall from Domain 1 that when a switch receives a broadcast frame (destination MAC FFFF.FFFF.FFFF), or a frame whose destination MAC it has not learned yet, it floods that frame out every port. Without VLANs, every port on the switch is in one broadcast domain, so every device sees every broadcast. With VLANs, a broadcast received on a VLAN 10 port is flooded only to other VLAN 10 ports.

Why do we care?

• Security. Finance PCs in VLAN 10 cannot sniff traffic from guest laptops in VLAN 30. Traffic between them must pass through a router, where you can apply access lists (Domain 5).
• Performance. Smaller broadcast domains mean fewer interruptions for every device. A chatty printer in VLAN 20 does not bother servers in VLAN 40.
• Flexibility. A user can be moved from the sales VLAN to the engineering VLAN by changing one switch port setting, with no re-cabling.
• One physical network, many logical networks. A single switch can host staff, guests, IP phones, cameras, and printers, each in its own VLAN.

Each VLAN normally maps to exactly one IP subnet. VLAN 10 might be 192.168.10.0/24, VLAN 20 192.168.20.0/24, and so on. This one-to-one mapping is a design convention, not a technical requirement, but the exam assumes it.

VLAN ranges: normal, extended, and reserved

Cisco Catalyst switches support VLAN numbers from 1 to 4094 (the number comes from the 12-bit VLAN ID field in the 802.1Q tag, covered in 2.2). They are grouped into ranges that behave differently.

VLAN 1 is the default VLAN. VLANs 1002 to 1005 are created automatically and are named fddi-default, token-ring-default, fddinet-default, and trnet-default. You will never use them, but you will see them in show vlan brief output and the exam may ask why they are there.

VTP (VLAN Trunking Protocol) is a Cisco protocol that copies the VLAN database from one switch to others. It is not on the v1.1 blueprint, so this guide only mentions it where it affects VLAN creation: on older switches, VTP must be in transparent mode (or VTP version 3) before you can create an extended-range VLAN. Many production networks disable VTP entirely because a mistake on one switch can wipe VLANs from every switch in the domain.

Creating VLANs

You create a VLAN in global configuration mode with the vlan command, which drops you into VLAN configuration mode where you can give it a name. Names are optional but strongly recommended.

SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name ENGINEERING
SW1(config-vlan)# vlan 99
SW1(config-vlan)# name MANAGEMENT
SW1(config-vlan)# exit
SW1(config)#

You can also create several at once with vlan 10,20,30 or vlan 10-30. Note that if you assign a port to a VLAN that does not exist yet, the switch creates the VLAN automatically (you will see a message such as % Access VLAN does not exist. Creating vlan 10). That is convenient but sloppy; create the VLAN explicitly so it gets a name.

To remove a VLAN, use no vlan 10. Any ports still assigned to VLAN 10 go dark: they stay assigned to a nonexistent VLAN and cannot forward traffic until you either recreate the VLAN or move the ports. This is a favorite exam scenario.

Verification: show vlan brief

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/3, Gi0/4, Gi0/6, Gi0/7
                                                Gi0/8, Gi0/9
10   SALES                            active    Gi0/1
20   ENGINEERING                      active    Gi0/2
99   MANAGEMENT                       active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

Read this output carefully; it is probably the most common show output in the domain.

• The Ports column lists only access ports in that VLAN. Trunk ports do not appear here, even though they carry the VLAN. Use show interfaces trunk (section 2.2) to see trunks.
• act/unsup on 1002 to 1005 means “active but unsupported” (the switch has no FDDI or Token Ring hardware). It is normal.
• A VLAN that exists but has no ports still shows up (VLAN 99 above).

Other useful commands: show vlan (adds the type, MTU, and other columns), show vlan id 10 (one VLAN), and show interfaces gigabitethernet0/1 switchport (everything about one port’s VLAN settings).

2.1.a Access ports (data and voice)

An access port is a switch port that belongs to exactly one data VLAN and sends and receives ordinary, untagged Ethernet frames. Access ports are what you connect PCs, printers, servers, and (usually) access points to. The device on the other end has no idea that VLANs exist; it just sends normal frames, and the switch quietly files them under the port’s VLAN.

The two commands that define an access port:

SW1(config)# interface gigabitethernet0/1
! Force the port to be an access port (never negotiate a trunk)
SW1(config-if)# switchport mode access
! Assign it to VLAN 10
SW1(config-if)# switchport access vlan 10
SW1(config-if)# description PC-SALES-01

switchport mode access does two things: it makes the port an access port and it disables DTP trunk negotiation on that port (see 2.2). Always configure both commands together. A port with only switchport access vlan 10 but left in the default dynamic auto mode could still be talked into becoming a trunk by a malicious device.

You can configure many ports at once with interface range:

SW1(config)# interface range gigabitethernet0/1 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10

Voice VLANs

Cisco IP phones have a small built-in switch. The phone plugs into the wall jack, and the user’s PC plugs into the back of the phone. So one switch port carries two devices: a phone and a PC. We want the phone’s voice traffic in its own VLAN (for QoS and security) and the PC’s traffic in the data VLAN.

The voice VLAN feature solves this. You configure the port as an access port for the data VLAN and additionally tell it which VLAN the phone should use:

SW1(config)# interface gigabitethernet0/5
SW1(config-if)# switchport mode access
! Data VLAN for the PC behind the phone
SW1(config-if)# switchport access vlan 10
! Voice VLAN for the IP phone itself
SW1(config-if)# switchport voice vlan 50
! Optional: trust the phone's QoS markings (platform dependent)
SW1(config-if)# mls qos trust cos

How it works: the switch uses CDP (section 2.3) to tell the phone “your voice VLAN is 50”. The phone then tags its own frames with VLAN 50 using an 802.1Q tag, while frames from the PC pass through the phone untagged and land in the access VLAN 10. So this port is technically carrying tagged and untagged frames, like a mini trunk, but Cisco still calls it an access port, and show interfaces switchport reports Operational Mode: static access. Some Cisco documents call it a “multi-VLAN access port”.

Verification:

SW1# show interfaces gigabitethernet0/5 switchport
Name: Gi0/5
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (SALES)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: 50 (VOICE)

2.1.b Default VLAN

Out of the box, every port on a Cisco switch is an access port in VLAN 1 (actually, in dynamic auto mode with access VLAN 1, which behaves as an access port until a neighbor negotiates a trunk). VLAN 1 is the default VLAN, and it has several special behaviors:

• It always exists and cannot be deleted or renamed.
• It is the default native VLAN on every 802.1Q trunk (see 2.2.c).
• It is the default management VLAN: the interface vlan 1 SVI exists by default (shut down) and is where beginners put the switch’s management IP.
• Control protocols such as CDP, VTP, PAgP, and DTP send their frames on VLAN 1 (untagged on the native VLAN of a trunk).
• Every port belongs to it until you move the port somewhere else.

Because everything lands in VLAN 1 by default, security best practice is to not use VLAN 1 for user traffic. Put users in other VLANs, move the management SVI to a dedicated VLAN (99 in this chapter’s examples), change the trunk native VLAN to an unused VLAN, and shut down unused ports after placing them in an unused “parking” VLAN.

Here is a switch management setup that avoids VLAN 1:

SW1(config)# vlan 99
SW1(config-vlan)# name MANAGEMENT
SW1(config-vlan)# exit
SW1(config)# interface vlan 99
SW1(config-if)# ip address 192.168.99.11 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
! Default gateway so the switch can be managed from other subnets
SW1(config)# ip default-gateway 192.168.99.1
! Park unused ports in an unused VLAN and shut them down
SW1(config)# vlan 999
SW1(config-vlan)# name UNUSED
SW1(config-vlan)# exit
SW1(config)# interface range gigabitethernet0/13 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 999
SW1(config-if-range)# shutdown

An SVI (Switched Virtual Interface, interface vlan X) is a virtual interface that gives the switch itself an IP address inside VLAN X. On a Layer 2 switch that is used only for management; on a Layer 3 switch it also becomes a router interface (see 2.1.c). An SVI comes up only when the VLAN exists and at least one port in that VLAN is up (or a trunk carrying it is up).

2.1.c InterVLAN connectivity

Devices in different VLANs are in different subnets, so a Layer 3 device must route between them. There are three ways to do this; the exam expects you to know the first two in detail.

Option 1: One router interface per VLAN. Connect a separate router port to a separate access port for each VLAN. This works but wastes ports and is rarely seen. Skip it.

Option 2: Router-on-a-stick (ROAS). One physical router interface connects to a switch trunk port. The router interface is divided into subinterfaces, one per VLAN, each with its own IP address and an 802.1Q tag. Frames come up the trunk tagged, the router routes between subinterfaces, and frames go back down the trunk with a new tag. The name comes from the picture: the router hangs off the switch on one “stick.”

Option 3: Layer 3 switch with SVIs. A multilayer switch routes internally between its own VLAN interfaces. This is the modern, fast, common approach in any network larger than a few hosts.

Router-on-a-stick configuration

Topology: R1 G0/0 connects to SW1 G0/24. VLAN 10 is 192.168.10.0/24, VLAN 20 is 192.168.20.0/24. The router will be the default gateway for both (.1 in each subnet).

Switch side, the port toward the router must be a trunk:

SW1(config)# interface gigabitethernet0/24
SW1(config-if)# description TRUNK-TO-R1
! Older switches (e.g., 3560) require the encapsulation command first
SW1(config-if)# switchport trunk encapsulation dot1q
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# switchport trunk native vlan 99

Router side:

R1(config)# interface gigabitethernet0/0
! The physical interface has NO IP address; it just needs to be up
R1(config-if)# no ip address
R1(config-if)# no shutdown
R1(config-if)# exit
! One subinterface per VLAN; the number after the dot is arbitrary but
! matching it to the VLAN ID is the convention
R1(config)# interface gigabitethernet0/0.10
R1(config-subif)# description VLAN10-SALES
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface gigabitethernet0/0.20
R1(config-subif)# description VLAN20-ENGINEERING
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit

Notes on the subinterface commands:

• encapsulation dot1q 10 tells the router “frames tagged VLAN 10 belong to this subinterface, and tag outgoing frames from it with VLAN 10.” It must come before the ip address command; the router refuses an IP address on a subinterface with no encapsulation.
• The subinterface number (.10) is just a label. G0/0.10 with encapsulation dot1q 20 is legal but confusing. The exam sometimes uses this mismatch as a trick; the VLAN that matters is the one in the encapsulation command.
• If the trunk’s native VLAN carries a subnet you want routed, add the native keyword: encapsulation dot1q 99 native. That subinterface then handles untagged frames. Without it, untagged frames are dropped. The native VLAN configured on the router must match the native VLAN on the switch trunk, or traffic for that VLAN goes nowhere.
• The physical interface must be no shutdown; subinterfaces inherit its state and cannot be up if the parent is down.

Verification:

R1# show ip interface brief
Interface              IP-Address      OK? Method Status   Protocol
GigabitEthernet0/0     unassigned      YES unset  up       up
GigabitEthernet0/0.10  192.168.10.1    YES manual up       up
GigabitEthernet0/0.20  192.168.20.1    YES manual up       up
R1# show ip route connected
C        192.168.10.0/24 is directly connected, GigabitEthernet0/0.10
L        192.168.10.1/32 is directly connected, GigabitEthernet0/0.10
C        192.168.20.0/24 is directly connected, GigabitEthernet0/0.20
L        192.168.20.1/32 is directly connected, GigabitEthernet0/0.20
R1# show vlans
Virtual LAN ID:  10 (IEEE 802.1Q Encapsulation)
   vLAN Trunk Interface:   GigabitEthernet0/0.10
   Protocols Configured:   Address:              Received:        Transmitted:
           IP              192.168.10.1                 15                  12

Each PC in VLAN 10 uses 192.168.10.1 as its default gateway; each PC in VLAN 20 uses 192.168.20.1. A ping from 192.168.10.50 to 192.168.20.50 travels up the trunk tagged 10, is routed inside R1, and comes back down the same trunk tagged 20. Yes, the same cable carries the packet in both directions; that is why ROAS does not scale to heavy traffic.

Layer 3 switch with SVIs

A Layer 3 switch (multilayer switch) can route packets in hardware. Instead of sending traffic to an external router, you give each VLAN an SVI with an IP address, and the switch routes between them at wire speed. Configuration:

SW1(config)# ip routing
! Enable IP routing globally. Without this, SVIs are management-only
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name ENGINEERING
SW1(config-vlan)# exit
SW1(config)# interface vlan 10
SW1(config-if)# ip address 192.168.10.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit
SW1(config)# interface vlan 20
SW1(config-if)# ip address 192.168.20.1 255.255.255.0
SW1(config-if)# no shutdown
SW1(config-if)# exit

Now the switch has connected routes for both subnets and forwards between them. The PCs use the SVI addresses as their gateways. No trunk to a router is needed at all for VLAN-to-VLAN traffic.

Remember the conditions for an SVI to be up/up: the VLAN must exist in the VLAN database, the SVI must not be shut down, and at least one access port in that VLAN (or a trunk that allows that VLAN) must be up. If the exam shows an SVI in down/down state, check whether the VLAN exists and whether any port in it is up. If it shows administratively down, someone forgot no shutdown.

Routed ports on a Layer 3 switch

A Layer 3 switch can also turn a physical port into a routed port that behaves exactly like a router interface: no VLAN, no switching, just an IP address. You do this with no switchport. Routed ports are typically used for the uplink from a Layer 3 access or distribution switch to a router or another Layer 3 switch.

SW1(config)# interface gigabitethernet0/24
SW1(config-if)# description UPLINK-TO-R1
! Convert from a Layer 2 switch port into a Layer 3 routed port
SW1(config-if)# no switchport
SW1(config-if)# ip address 10.0.0.2 255.255.255.252
SW1(config-if)# no shutdown
SW1(config-if)# exit
! Default route toward the router for everything not local
SW1(config)# ip route 0.0.0.0 0.0.0.0 10.0.0.1

Verification on the Layer 3 switch:

SW1# show ip route
Codes: L - local, C - connected, S - static, ...
Gateway of last resort is 10.0.0.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.0.0.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/24
L        10.0.0.2/32 is directly connected, GigabitEthernet0/24
C     192.168.10.0/24 is directly connected, Vlan10
L     192.168.10.1/32 is directly connected, Vlan10
C     192.168.20.0/24 is directly connected, Vlan20
L     192.168.20.1/32 is directly connected, Vlan20
SW1# show ip interface brief | include Vlan|Gig.*0/24
Vlan10                 192.168.10.1    YES manual up       up
Vlan20                 192.168.20.1    YES manual up       up
GigabitEthernet0/24    10.0.0.2        YES manual up       up

Comparison of the two inter-VLAN methods: