2.1 VLANs, Access Ports, Voice VLANs, and 802.1Q Trunks

​Lesson Overview

1. VLAN Fundamentals

1.1 What a VLAN Actually Does

A VLAN (Virtual LAN) creates a logical Layer 2 broadcast domain inside a switched Ethernet network. Multiple VLANs can coexist on the same physical switch, but a frame is always processed in the context of one VLAN. This is the core idea that allows one switch infrastructure to serve users, servers, phones, wireless devices, cameras, and management systems while keeping their Layer 2 traffic separated.

The most important CCNA mental model is a VLAN is a broadcast-domain boundary at Layer 2. A switch floods a broadcast only to forwarding ports that belong to the same VLAN. A broadcast received in VLAN 10 is not automatically copied into VLAN 20. Communication between different VLANs requires a Layer 3 function such as a router or multilayer switch.

Figure 1 - A single access switch can contain multiple logical broadcast domains.

1.2 Why Enterprises Use VLANs

Logical segmentation: users can be grouped by role or security zone instead of by physical location.

Broadcast containment: ARP, DHCP discovery, and other Layer 2 broadcasts stay within the VLAN.

Policy boundaries: traffic between VLANs must cross Layer 3, where ACLs, firewalls, QoS, and routing policy can be applied.

Operational consistency: the same VLAN can span multiple access switches through trunks.

Voice/data separation: IP phones can use a voice VLAN while the attached workstation uses a data VLAN on the same switch port.

1.3 Broadcast Example

Assume Sales-PC1 and Sales-PC2 are in VLAN 10, while HR-PC1 and HR-PC2 are in VLAN 20. When Sales-PC1 sends an ARP request to FF:FF:FF:FF:FF:FF, the switch learns the source MAC address on the receiving port, then floods the broadcast only to other forwarding ports in VLAN 10. Ports in VLAN 20 are outside that broadcast domain and do not receive the frame.

2. VLAN IDs, Ranges, and the Default VLAN

2.1 VLAN IDs

IEEE 802.1Q provides a 12-bit VLAN Identifier (VID), which supports values from 0 through 4095. For ordinary configuration, VLAN IDs 1 through 4094 are the practical usable space; 0 and 4095 have special/reserved meaning. Cisco commonly describes VLANs 1-1005 as the normal range and 1006-4094 as the extended range. The CCNA v1.1 objective specifically calls out normal-range VLANs spanning multiple switches.

2.2 The Default VLAN

On a Cisco switch, access ports start in VLAN 1 unless you explicitly assign them elsewhere. This is the default VLAN concept. The default VLAN and the native VLAN are related only because VLAN 1 is also the default native VLAN on an 802.1Q trunk. They are not the same concept: "default VLAN" describes initial access-port membership, while "native VLAN" describes how a trunk treats a particular VLAN.

Verification

show vlan brief

The output lists VLAN IDs, names, status, and access ports. Trunk ports generally are not listed under a single VLAN in this command because they can carry multiple VLANs.

3. Access Ports

3.1 Access-Port Behavior

An access port is normally assigned to one data VLAN and is used for an endpoint that does not need to understand 802.1Q tags. When an untagged Ethernet frame enters an access port, the switch internally associates that frame with the port's access VLAN. When the switch transmits a data frame out a normal access port toward the endpoint, the endpoint receives an ordinary Ethernet frame without an 802.1Q VLAN tag.

The VLAN association is therefore primarily switch-internal at the access edge. The endpoint knows its IP subnet and default gateway, but it does not need to know that the switch calls its Layer 2 segment "VLAN 10."

3.2 Create VLANs

Create the VLAN database

enable

configure terminal

!

vlan 10

name USERS

vlan 20

name SERVERS

vlan 30

name VOICE

vlan 999

name NATIVE

end

The vlan <id> command creates or enters VLAN configuration mode. Naming a VLAN is not required for forwarding, but meaningful names make operations and troubleshooting much easier.

3.3 Configure a User Access Port

Example: place Gi1/0/1 in VLAN 10

configure terminal

interface GigabitEthernet1/0/1

description USER-PC1

switchport mode access

switchport access vlan 10

spanning-tree portfast

end

The command switchport mode access forces the interface to behave as a Layer 2 access port. switchport access vlan 10 assigns the data VLAN. PortFast is not a VLAN command, but it is commonly enabled on true endpoint-facing ports so the port can transition to forwarding rapidly. Do not apply endpoint assumptions to links that might create a Layer 2 loop.

3.4 Verify Access-Port State

show vlan brief

show interfaces GigabitEthernet1/0/1 switchport

show interfaces status

show mac address-table interface GigabitEthernet1/0/1

The first command checks VLAN existence and access-port membership. The switchport command shows the administrative/operational mode and access VLAN. The MAC table confirms whether the switch is actually learning the endpoint source MAC address on the expected VLAN and interface.

4. Voice VLANs

4.1 Why Voice VLANs Exist

A common office design places an IP phone on the switch port and plugs the user PC into an Ethernet port on the phone. The phone contains a small internal switch. This lets one building cable support both the workstation and the phone, while preserving logical separation between user data and voice traffic.

Figure 4 - A phone + PC connection can carry an access/data VLAN and a separate tagged voice VLAN.

4.2 Data Versus Voice Traffic on the Same Physical Port

For a typical Cisco-style voice VLAN design, the PC sends ordinary untagged Ethernet frames through the phone. The access switch classifies those frames into the configured access VLAN, such as VLAN 10. The phone sends its own voice traffic with an 802.1Q tag identifying the configured voice VLAN, such as VLAN 30. This is why a phone-facing port is still configured as an access port even though voice traffic can be tagged.

The switch can advertise the voice VLAN to a compatible IP phone through discovery mechanisms such as CDP or LLDP-MED. The phone then knows which VLAN ID to tag for voice traffic. The exact discovery and phone behavior depends on vendor/platform, but the CCNA concept is the separation of data and voice VLANs on the same access interface.

4.3 Configure Data + Voice VLANs

configure terminal

interface GigabitEthernet1/0/10

description IP-PHONE1-AND-USER-PC

switchport mode access

switchport access vlan 10

switchport voice vlan 30

spanning-tree portfast

end

5. 802.1Q Trunks

5.1 Why a Trunk Is Needed

Access ports solve endpoint connectivity, but enterprises need the same VLAN to exist on multiple switches. A trunk is a Layer 2 interface designed to carry traffic for multiple VLANs over one physical link. Instead of dedicating one cable to VLAN 10, another cable to VLAN 20, and another to VLAN 30, a trunk multiplexes those VLANs on a single Ethernet connection.

Figure 5.1 - Access ports connect endpoints; the inter-switch trunk carries multiple VLANs.

5.2 How 802.1Q Identifies VLAN Traffic

IEEE 802.1Q inserts a four-byte tag into Ethernet frames carried across a trunk. The tag contains, among other fields, a 12-bit VLAN ID. When the receiving switch reads that tag, it knows the Layer 2 broadcast domain to which the frame belongs. This preserves VLAN separation across shared trunk infrastructure.

Figure 5.2 - 802.1Q adds a 4-byte tag that includes the VLAN ID.

6. Configure and Verify an 802.1Q Trunk

6.1 Basic Static Trunk

configure terminal

interface GigabitEthernet1/0/24

description TRUNK-TO-SW2

switchport mode trunk

end

On modern Cisco switches, 802.1Q is typically the trunk encapsulation in use. Some older platforms exposed a switchport trunk encapsulation dot1q command; many current fixed-access switches do not require or even offer that command because 802.1Q is the only supported encapsulation.

6.2 Restrict the Allowed VLAN List

configure terminal

interface GigabitEthernet1/0/24

switchport mode trunk

switchport trunk allowed vlan 10,20,30,999

end

The allowed-VLAN list controls which VLANs are permitted to use the trunk. A VLAN can exist on both switches and still fail across the link if it is missing from the allowed list. This is one of the highest-value CCNA troubleshooting checks.

6.3 Native VLAN

The native VLAN is the VLAN whose frames are sent untagged on an 802.1Q trunk by default on common Cisco behavior. The default native VLAN is VLAN 1. Both ends of the trunk should agree on the native VLAN. A mismatch can create confusing forwarding behavior and normally generates a control-plane warning such as a CDP native-VLAN mismatch message.

configure terminal

interface GigabitEthernet1/0/24

switchport mode trunk

switchport trunk native vlan 999

switchport trunk allowed vlan 10,20,30,999

end

In this example, VLAN 999 is used as the native VLAN. If SW1 uses native VLAN 999, SW2 should also use native VLAN 999 on the opposite end of the same trunk.

6.4 Verify Trunk Operation

show interfaces trunk

show interfaces GigabitEthernet1/0/24 switchport

show running-config interface GigabitEthernet1/0/24

show interfaces trunk is the fastest operational view. Focus on: whether the interface is actually trunking, the native VLAN, VLANs allowed on the trunk, VLANs allowed and active in the management domain, and VLANs in spanning-tree forwarding state that are not pruned.

7. End-to-End Two-Switch Configuration

The following example builds VLAN 10 (USERS), VLAN 20 (SERVERS), VLAN 30 (VOICE), and VLAN 999 (NATIVE) on two access switches. Endpoints in the same VLAN should be able to communicate across the trunk when their IP addressing is correct. Different VLANs still require Layer 3 routing.

7.1 SW1 Configuration

enable

configure terminal

hostname SW1

!

vlan 10

name USERS

vlan 20

name SERVERS

vlan 30

name VOICE

vlan 999

name NATIVE

!

interface GigabitEthernet1/0/1

description USER-PC1

switchport mode access

switchport access vlan 10

spanning-tree portfast

!

interface GigabitEthernet1/0/5

description APP-SERVER1

switchport mode access

switchport access vlan 20

spanning-tree portfast

!

interface GigabitEthernet1/0/10

description IP-PHONE1-AND-PC

switchport mode access

switchport access vlan 10

switchport voice vlan 30

spanning-tree portfast

!

interface GigabitEthernet1/0/24

description TRUNK-TO-SW2

switchport mode trunk

switchport trunk native vlan 999

switchport trunk allowed vlan 10,20,30,999

!

end

write memory

7.2 SW2 Configuration

enable

configure terminal

hostname SW2

!

vlan 10

name USERS

vlan 20

name SERVERS

vlan 30

name VOICE

vlan 999

name NATIVE

!

interface GigabitEthernet1/0/1

description USER-PC2

switchport mode access

switchport access vlan 10

spanning-tree portfast

!

interface GigabitEthernet1/0/5

description APP-SERVER2

switchport mode access

switchport access vlan 20

spanning-tree portfast

!

interface GigabitEthernet1/0/10

description IP-PHONE2-AND-PC

switchport mode access

switchport access vlan 10

switchport voice vlan 30

spanning-tree portfast

!

interface GigabitEthernet1/0/24

description TRUNK-TO-SW1

switchport mode trunk

switchport trunk native vlan 999

switchport trunk allowed vlan 10,20,30,999

!

end

write memory

8. Frame Walk: Same-VLAN Traffic Across Two Switches

Assume PC-A is 192.168.10.11/24 on SW1 and PC-C is 192.168.10.21/24 on SW2. Both switch access ports are in VLAN 10, and VLAN 10 is allowed on the trunk.

1. PC-A determines that 192.168.10.21 is in the same IPv4 subnet, so it ARPs for PC-C instead of sending the packet to a default gateway.

2. PC-A sends an untagged ARP broadcast into its access port on SW1.

3. SW1 learns PC-A's source MAC address in VLAN 10 and floods the broadcast to other eligible VLAN 10 ports, including the trunk toward SW2.

4. Before forwarding over the trunk, SW1 identifies the frame as VLAN 10 traffic using the 802.1Q tag.

5. SW2 receives the tagged frame, reads VLAN ID 10, and floods it only to its VLAN 10 access ports.

6. PC-C receives the ARP request and replies. The switches learn PC-C's MAC address in VLAN 10.

7. Subsequent unicast frames can be forwarded based on the MAC address tables rather than flooded.

9. Different VLANs: Why Layer 3 Is Required

If a user in VLAN 10 needs to reach a server in VLAN 20, the destination is in a different IP subnet. The user sends the packet to its default gateway. A router or Layer 3 switch must receive the packet, make a routing decision, and forward it into VLAN 20. A Layer 2 trunk by itself does not route between VLANs; it only transports multiple VLANs.

The CCNA 2.1 objective includes inter-VLAN connectivity. A full router-on-a-stick and SVI configuration is best treated as a dedicated lesson, but remember the dependency: VLAN separation creates separate Layer 2 domains, and Layer 3 routing is what reconnects those domains under policy control.

10. Enterprise-Style Lab Topology

Figure 10 - Enterprise-style training topology with two access switches and an upstream Layer 3 distribution switch.

The upstream multilayer switch is shown for enterprise context. For this lesson, your primary tasks are to create VLANs consistently, assign access/voice VLANs, form trunks, align the native VLAN, and verify which VLANs are carried. Routing/SVI configuration can be added in the next lesson.

11. Verification Commands - What Each One Tells You

11.1 Example: show vlan brief

SW1# show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- -------------------------------

1 default active

10 USERS active Gi1/0/1

20 SERVERS active Gi1/0/5

30 VOICE active

999 NATIVE active

Notice that a trunk port such as Gi1/0/24 is not simply listed under one VLAN. Also note that a voice VLAN can be active even if its phone-facing interface is not displayed exactly like a simple access-only VLAN membership in every platform output. Use the interface switchport command for authoritative per-port details.

11.2 Example: show interfaces trunk

SW1# show interfaces trunk

Port Mode Encapsulation Status Native vlan

Gi1/0/24 on 802.1q trunking 999

Port Vlans allowed on trunk

Gi1/0/24 10,20,30,999

Port Vlans allowed and active in management domain

Gi1/0/24 10,20,30,999

Port Vlans in spanning tree forwarding state and not pruned

Gi1/0/24 10,20,30,999

Read this output from top to bottom: operational trunk state first, then native VLAN, then allowed list, then whether the VLANs actually exist/are active, and finally whether spanning tree permits forwarding. This helps separate configuration problems from STP forwarding problems.

12. Troubleshooting VLAN and Trunk Problems

Use a layered approach rather than changing configuration randomly. Start with physical/link state, then confirm VLAN existence, then access/voice membership, then trunk operation, then MAC learning, and finally IP/subnet/gateway behavior. This keeps troubleshooting deterministic.

1. Confirm interfaces are physically up and not err-disabled.

2. Confirm the required VLAN exists on every switch that must forward it.

3. Confirm endpoint-facing ports are assigned to the correct access VLAN.

4. For phone ports, confirm both the data VLAN and voice VLAN.

5. Confirm inter-switch interfaces are operational trunks.

6. Confirm both ends use the intended native VLAN.

7. Confirm the required VLAN is present in the allowed-VLAN list on every trunk in the path.

8. Confirm spanning tree is forwarding for the VLAN on the expected path.

9. Confirm MAC addresses are being learned in the correct VLAN and on the expected interfaces.

10. Only after Layer 2 is validated, check endpoint IP address, subnet mask, and default gateway.

12.1 Scenario A - Wrong Access VLAN

Symptom: PC-A can link up but cannot reach another user that should be in the same subnet. show vlan brief reveals Gi1/0/1 in VLAN 20 instead of VLAN 10.

show vlan brief

show interfaces GigabitEthernet1/0/1 switchport

configure terminal

interface GigabitEthernet1/0/1

switchport mode access

switchport access vlan 10

end

12.2 Scenario B - VLAN Missing from Allowed List

Symptom: VLAN 10 works across the trunk, but VLAN 20 fails even though local VLAN 20 endpoints work on each switch. This strongly suggests a VLAN-specific path issue rather than a physical trunk failure.

show interfaces trunk

configure terminal

interface GigabitEthernet1/0/24

switchport trunk allowed vlan 10,20,30,999

end

12.3 Scenario C - Native VLAN Mismatch

Symptom: the trunk is up, but CDP reports a native-VLAN mismatch and untagged/control traffic behaves unexpectedly. Check both ends.

SW1# show interfaces trunk

SW2# show interfaces trunk

! Make both ends consistent

interface GigabitEthernet1/0/24

switchport trunk native vlan 999

12.4 Scenario D - Voice Works, PC Does Not (or the Reverse)

Because a phone-facing port can carry data and voice in different VLANs, one service can fail while the other continues working. Verify access VLAN, voice VLAN, DHCP availability for each subnet, phone discovery, MAC learning by VLAN, and any security feature such as port security.

show interfaces GigabitEthernet1/0/10 switchport

show mac address-table interface GigabitEthernet1/0/10

show cdp neighbors detail

show lldp neighbors detail