How to Configure a VLAN: A Complete Guide for Any Switch

Whether you’re segmenting a small office network or managing dozens of switches across an enterprise campus, VLAN configuration follows the same core logic everywhere — even though the exact commands and menus differ from vendor to vendor. This guide starts with the fundamental concepts, walks through a full Cisco CLI configuration step by step, compares how the major switch vendors handle the same tasks, and closes with a ready-to-use command cheat sheet.

VLAN Basics: Access Ports, Trunk Ports, and Tagging Explained

Before touching a switch, it helps to understand exactly what a VLAN does and how switches keep traffic from different VLANs separated.

1. Understand the problem VLANs solve. Without VLANs, every device connected to a switch (or interconnected switches) shares a single broadcast domain, meaning broadcast traffic from any device reaches every other device — this becomes both a performance issue and a security concern as a network grows.
2. Understand what a VLAN actually is. A VLAN (Virtual Local Area Network) creates a separate, logical broadcast domain within the same physical switching infrastructure, without needing separate physical switches for each group of devices.
3. Learn the difference between access and trunk ports. An access port connects to a single end device (a PC, printer, access point, etc.) and belongs to exactly one VLAN — the device itself has no awareness that VLANs exist. A trunk port, by contrast, connects two switches (or a switch and a router) and carries traffic for multiple VLANs over a single physical link.
4. Understand 802.1Q tagging on trunk links. Since a trunk carries multiple VLANs’ worth of traffic, each frame needs a way to identify which VLAN it belongs to — the 802.1Q standard inserts a small tag into the Ethernet frame header for exactly this purpose. The tag is added when a frame enters the trunk and removed again before the frame reaches an access port on the far end.
5. Understand the native VLAN. One VLAN on a trunk is typically designated as “native,” meaning its frames travel untagged rather than carrying an 802.1Q tag — this exists mainly for compatibility with older equipment, and both ends of a trunk need to agree on which VLAN is native to avoid misdelivered traffic.
6. Understand how devices in different VLANs communicate — or don’t. By default, devices in different VLANs cannot reach each other, since they’re in separate broadcast domains. Communication between VLANs requires a router or a Layer 3-capable switch to route traffic between them, which gives you a deliberate point to apply security policy.

With the concepts in place, the next step is putting them into practice — starting with a full walkthrough on Cisco hardware, since its syntax is the most widely referenced starting point across the industry.

Configuring VLANs on a Cisco Switch: Step by Step

Here’s the complete process for creating VLANs and assigning both access and trunk ports on a Cisco Catalyst-style switch.

1. Enter global configuration mode.

Switch> enable
Switch# configure terminal

2. Create a VLAN and give it a descriptive name.

Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit

3. Repeat for any additional VLANs you need.

Switch(config)# vlan 20
Switch(config-vlan)# name ENGINEERING
Switch(config-vlan)# exit

4. Assign an access port to a VLAN.

Switch(config)# interface gigabitEthernet 1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit

5. Configure a trunk port to carry multiple VLANs between switches.

Switch(config)# interface gigabitEthernet 1/0/48
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# exit

6. Save the configuration so it survives a reboot.

Switch# copy running-config startup-config

7. Verify your VLANs and port assignments.

Switch# show vlan brief
Switch# show interfaces trunk

8. Test connectivity from an end device. Confirm a device on VLAN 10 can reach other devices in the same VLAN, and — as expected — cannot directly reach devices in VLAN 20 without a routing point in between.

With Cisco’s process as a reference point, it’s worth seeing how the same fundamental steps translate to other vendors’ equipment, since the underlying logic stays identical even when the commands and menus don’t.

VLAN Configuration Across Vendors: Cisco, HP/Aruba, TP-Link, and Netgear

The concepts of VLAN creation, access ports, and trunk ports are universal — but how you actually issue those commands varies significantly by manufacturer.

The biggest practical difference to internalize: Cisco and HP/Aruba both offer full CLI access with a philosophy fairly close to each other (even though exact syntax differs), while TP-Link and Netgear’s managed switch lines lean heavily on web GUI configuration, with tagged/untagged port membership and PVID settings doing the same conceptual job that switchport trunk allowed vlan and switchport access vlan do on Cisco. If you’re moving between vendors, mapping “tagged” to “trunk member” and “untagged + PVID” to “access port” will get you through almost any managed switch’s VLAN configuration.

VLAN Configuration Command Cheat Sheet

For fast reference during deployment, here’s a consolidated command set covering the CLI-based platforms discussed above.

# --- Cisco IOS ---
Switch(config)# vlan <vlan-id>
Switch(config-vlan)# name <vlan-name>
Switch(config)# interface <interface>
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan <vlan-id>
Switch(config)# interface <interface>
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan <vlan-id-list>
Switch(config-if)# switchport trunk native vlan <native-vlan-id>
Switch# copy running-config startup-config
Switch# show vlan brief
Switch# show interfaces trunk

# --- HP/Aruba (ArubaOS-Switch / ProVision CLI) ---
switch(config)# vlan <vlan-id>
switch(vlan-<vlan-id>)# name <vlan-name>
switch(vlan-<vlan-id>)# untagged <port-number>          # Access port equivalent
switch(vlan-<vlan-id>)# tagged <port-number>              # Trunk member equivalent
switch# write memory
switch# show vlans
switch# show vlan ports <port-number>

# --- General workflow for web-GUI-managed switches (TP-Link, Netgear, similar) ---
# 1. Log into the web interface (default gateway IP, admin credentials)
# 2. Navigate to the VLAN configuration section (varies by model/firmware)
# 3. Create the VLAN with an ID and descriptive name
# 4. For each port:
#    - Set "Untagged" + matching PVID for access-port behavior
#    - Set "Tagged" for trunk-member behavior (multiple VLANs per port)
# 5. Apply/save the configuration explicitly if not auto-saved
# 6. Review the VLAN summary table to confirm port memberships

# --- Universal verification checklist (any vendor) ---
# - Confirm the VLAN exists and has the expected ID/name
# - Confirm each access port shows the correct single VLAN membership
# - Confirm each trunk/tagged port shows the correct VLAN list
# - Confirm the native/untagged VLAN matches on both ends of any trunk link
# - Test end-to-end connectivity from a device in each VLAN

Keep the Cisco and HP/Aruba command blocks handy for CLI-based work, and use the general web-GUI workflow as your mental checklist when working with TP-Link, Netgear, or other GUI-first managed switches — the steps map onto the same tagged/untagged and PVID concepts even when the exact screen layout differs by model and firmware version.

Please follow and like us: