VLAN Fundamentals

Network learning path · Step 5Available

Separate Layer 2 broadcast domains with access ports and 802.1Q trunks, then connect them through controlled Layer 3 routing.

Difficulty: Intermediate
Time: 70 min
Practice: VLAN design
Assessment: Knowledge check

Before you start

Who is this for?

For learners with IPv4 and subnetting fundamentals who want to structurally separate local networks.

Prerequisites

MAC addresses and switching
IPv4 subnets and gateways

What you'll be able to do

Distinguish access ports and trunks
Assign appropriate subnets to VLANs
Explain inter-VLAN routing and typical errors

Practical outcome

You can plan two VLANs with trunk, gateways, and a limiting access rule.

An Ethernet switch connects devices within a Layer-2 network. VLANs divide this physical infrastructure into separate logical broadcast domains. This allows clients, servers, guests, and management devices to be cleanly separated from one another. The details on frames, MAC learning, and flooding are covered in the previous lesson Ethernet & Switching; here you apply them to segmentation.

1. Switching as a Prerequisite

A switch learns from the source MAC of each incoming frame which port the address is reachable on. It then checks the destination MAC:

known unicast destination: send only to the assigned port;
unknown unicast destination: flood to other ports within the same VLAN;
broadcast: distribute to all matching ports within the VLAN;
multicast: treat selectively based on group knowledge or similar to a broadcast.

A switch port forms its own collision domain. A VLAN, on the other hand, forms a broadcast domain. The dynamic MAC table is periodically cleaned so that changed connections can be relearned.

2. Why VLANs Are Used

Without VLANs, many switch ports belong to the same Layer-2 domain. Broadcasts then reach all participants, and different device groups are not logically separated. VLANs help with:

clear assignment by function rather than location;
limiting broadcast traffic;
separate IP subnets for clients, servers, guests, or VoIP;
controlled traffic between areas via router or firewall;
consistent configuration across multiple switches.

A VLAN alone is not yet a complete security control. Communication between VLANs must be explicitly allowed or blocked at Layer 3.

3. Access Ports and Trunks

An access port normally carries exactly one VLAN to an end device. Frames typically leave it without a visible 802.1Q tag. The switch assigns incoming untagged frames to the configured access VLAN.

A trunk carries multiple VLANs between switches or to a router, firewall, access point, or hypervisor. IEEE 802.1Q adds VLAN information to the Ethernet frame. Allowed VLANs should be limited to what is necessary.

The native VLAN of an 802.1Q trunk is transported untagged depending on the platform. Both sides must match; otherwise, misassignments and security problems can arise. For production designs, the native VLAN should not thoughtlessly match the normal client VLAN.

4. VLAN and IP Subnet

In typical planning, each VLAN has its own IP subnet:

Function	VLAN	IPv4 Network	Gateway
Clients	10	`10.20.10.0/24`	`10.20.10.1`
Server	20	`10.20.20.0/24`	`10.20.20.1`
Guests	30	`10.20.30.0/24`	`10.20.30.1`
Management	99	`10.20.99.0/24`	`10.20.99.1`

The VLAN ID and IP prefix are different things. The numbers do not need to look alike; however, a logical scheme simplifies operation and troubleshooting.

5. Inter-VLAN-Routing

Hosts in different VLANs require a Layer-3 path. For this, there are two common variants:

Router-on-a-stick: A router interface operates as a trunk and uses a logical subinterface per VLAN.
Layer-3-Switch: For each VLAN, a switch virtual interface (SVI) exists that can serve as a gateway.

The flow from client VLAN 10 to server VLAN 20:

The client determines from its mask that the destination is not local.
It determines the MAC of its gateway and sends the frame there.
The Layer-3 device checks routing and access rules.
It creates a new Layer-2 frame for VLAN 20 toward the server.

Firewalls or ACLs should allow only the actually needed connections – for example, DNS to the resolver and HTTPS to specific servers, but no free access from the guest network.

6. Loops and Redundancy

Redundant switch links increase availability but can cause Layer-2 loops without protection. Ethernet frames have no TTL; broadcasts could therefore circulate endlessly and destabilize MAC tables. Spanning Tree Protocol (STP) creates a loop-free active topology and can release backup paths upon failure.

Link aggregation bundles compatible physical connections into a logical channel. Both sides must be consistently configured regarding VLANs, trunking, and the aggregation protocol.

7. Troubleshooting

Work from Layer 1 up to Layer 3:

Are link and port active?
Is the end device port in the correct access VLAN?
Does the VLAN exist on the involved switches?
Is it permitted on all necessary trunks?
Do the native VLANs and tagging match on both sides?
Does the client have address, mask, and gateway from the correct subnet?
Is the SVI or router subinterface active?
Do ACL or firewall block the desired traffic?

Typical Cisco IOS diagnostic commands in the authorized lab are:

show vlan brief
show interfaces trunk
show mac address-table
show spanning-tree
show ip interface brief

Practice Lab

Plan two VLANs for employees and guests. Assign each a /27 subnet from 192.168.50.0/24 and document VLAN ID, network, host range, broadcast, and gateway. Connect two switches via a trunk and place one test client per VLAN.

First test communication within a VLAN. Then add inter-VLAN routing and a rule that allows guests only DNS, DHCP, and web access, but blocks access to the employee network. For each test, record source, destination, expected, and actual results.

Common mistakes

Assign an end device port to the wrong access VLAN.
Fail to create the VLAN on a involved switch or to allow it on the trunk.
Configure different native VLANs at the two trunk ends.
Spread the same IP subnet across multiple VLANs without a deliberate special design.
Treat VLAN separation as complete access control without defining an inter-VLAN policy.

Knowledge check

What You Should Now Be Able To Do

Distinguish access ports and trunks;
Assign each VLAN an appropriate IP subnet and gateway;
Separately check Layer 2, routing, and firewall errors;