Configuring VLANs on a Cisco Switch: Setup, Ranges, and Troubleshooting

Getting a VLAN running on a Cisco switch is usually the easy part — assigning a port, creating the VLAN, and confirming connectivity takes just a few commands. The harder parts show up later: understanding why VLAN IDs above 1005 behave differently, and diagnosing exactly why a device suddenly can’t ping across a VLAN it could reach yesterday. This guide covers the full picture, from your first VLAN configuration through range-specific rules and a systematic troubleshooting workflow, closing with a command cheat sheet for fast reference.

Configuring VLANs on a Cisco Catalyst Switch: Step by Step

Here’s the complete process for creating a VLAN and assigning both access and trunk ports.

1. Enter privileged and global configuration mode.

Switch> enable
Switch# configure terminal

2. Create the VLAN and assign it a descriptive name.

Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit

3. Assign an access port to the VLAN. Access ports connect end devices — PCs, printers, phones — and belong to exactly one VLAN each.

Switch(config)# interface gigabitEthernet 1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit

4. Configure a trunk port to carry the VLAN between switches. Trunk ports use 802.1Q tagging to carry traffic for multiple VLANs over a single physical link.

Switch(config)# interface gigabitEthernet 1/0/48
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10
Switch(config-if)# exit

5. Create a Switch Virtual Interface (SVI) if this VLAN needs a Layer 3 gateway. This step is required only if you need inter-VLAN routing or want the VLAN to have its own IP subnet with a gateway.

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

6. Save the configuration.

Switch# copy running-config startup-config

7. Verify the VLAN, port assignment, and trunk status.

Switch# show vlan brief
Switch# show interfaces gigabitEthernet 1/0/5 switchport
Switch# show interfaces trunk

8. Test end-to-end connectivity. Confirm a device on the new VLAN can reach its gateway (if an SVI was configured) and other devices within the same VLAN.

With basic configuration covered, it’s worth understanding a distinction that becomes relevant the moment you need more VLANs than the first 1005 IDs allow — since the rules genuinely change once you cross that boundary.

Normal Range vs. Extended Range VLANs on Cisco Switches

VLAN IDs 1–1005 and 1006–4094 aren’t just different numbers — they’re governed by different storage and VTP rules that are worth understanding before you run into them unexpectedly.

The single most important operational takeaway: if you’re creating extended-range VLANs, confirm you’re in VTP transparent mode first (or running VTP v3), and save your configuration immediately afterward — skipping either step is the most common reason an extended VLAN “disappears” after a switch reload.

Troubleshooting VLAN Ping Failures and Connectivity Issues

When a device can’t reach something it should be able to — whether that’s its gateway, another device in the same VLAN, or a device across VLANs — work through this sequence rather than guessing.

1. Confirm the port is actually in the VLAN you expect. This is the single most common root cause of “device can’t reach anything” — a port left in the default VLAN, or moved to the wrong VLAN during a previous change, looks identical to a working port until you check.

Switch# show interfaces gigabitEthernet 1/0/5 switchport

2. Check whether the VLAN itself is active. A VLAN can exist in the database but show as “act/unsup” or otherwise inactive on certain platforms if it references an unsupported STP type or hasn’t been properly created — confirm it shows as active before looking further.

Switch# show vlan brief

3. Check for “line protocol down” on the physical interface. If an interface shows up/down or down/down rather than up/up, the problem is at Layer 1/2, not VLAN configuration at all — check cabling, the far-end device, or a disabled port before troubleshooting VLAN assignment further.

Switch# show interfaces gigabitEthernet 1/0/5

4. Confirm the VLAN is allowed across every trunk link between the source and destination. If two devices in the same VLAN sit behind different switches, every trunk link connecting those switches needs that VLAN in its allowed list — missing it on even one link in the path breaks connectivity silently.

Switch# show interfaces trunk

5. Check for a native VLAN mismatch if the symptom is inconsistent or affects only untagged traffic. Cisco switches log an explicit warning when they detect this, but it’s worth confirming directly by comparing native VLAN settings on both ends of a trunk.

Switch# show interfaces gigabitEthernet 1/0/48 trunk

6. If the issue is cross-VLAN connectivity specifically, confirm the SVI exists and is up. A common oversight is creating the VLAN and assigning ports, but forgetting to bring up the corresponding SVI with no shutdown, or never creating it at all.

Switch# show ip interface brief | include Vlan

7. Confirm the SVI has a correctly configured IP address and is in the expected subnet. A typo in the SVI’s IP address or subnet mask will cause routing failures that look identical to a VLAN misconfiguration from the end-user’s perspective.

Switch# show running-config interface vlan 10

8. Test connectivity in stages rather than jumping straight to the final destination. Ping the local gateway first, then a device in the same VLAN, then a device in a different VLAN — this immediately narrows down whether the issue is local (port/VLAN assignment), trunk-related, or routing-related.
9. Re-verify after each fix. Confirm the specific symptom is resolved before assuming the whole path is healthy — a fixed VLAN assignment doesn’t guarantee the trunk path or SVI configuration downstream is also correct.

Working through port VLAN assignment, VLAN active state, physical link status, trunk allowed-VLAN lists, and SVI configuration in that order resolves the overwhelming majority of real-world VLAN connectivity issues without needing deeper packet-level diagnostics.

Cisco VLAN Configuration Command Cheat Sheet

For quick reference during deployment or troubleshooting, here’s a consolidated command set covering everything above.

# --- VLAN creation ---
Switch(config)# vlan <vlan-id>
Switch(config-vlan)# name <vlan-name>

# --- Access port assignment ---
Switch(config)# interface <interface>
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan <vlan-id>

# --- Trunk port configuration ---
Switch(config)# interface <interface>
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan <vlan-id-list>
Switch(config-if)# switchport trunk native vlan <native-vlan-id>

# --- SVI (Layer 3 interface) for inter-VLAN routing ---
Switch(config)# interface vlan <vlan-id>
Switch(config-if)# ip address <ip-address> <subnet-mask>
Switch(config-if)# no shutdown

# --- VTP mode (required for extended-range VLANs on VTPv1/v2) ---
Switch(config)# vtp mode transparent
Switch(config)# vtp version 3                          # Alternative: supports extended VLANs in server mode

# --- Persisting configuration ---
Switch# copy running-config startup-config

# --- Verification and troubleshooting ---
Switch# show vlan brief                                          # All VLANs and port membership
Switch# show interfaces <interface> switchport                     # Port VLAN/trunk detail
Switch# show interfaces trunk                                        # Trunk state, native VLAN, allowed VLANs
Switch# show interfaces <interface>                                    # Physical/line protocol status
Switch# show ip interface brief | include Vlan                          # SVI status at a glance
Switch# show running-config interface vlan <vlan-id>                      # SVI configuration detail
Switch# show vtp status                                                     # VTP mode/version check

Keep this reference alongside the troubleshooting sequence above — show interfaces <interface> switchport and show interfaces trunk together answer the majority of “why can’t this device connect” questions in a single pair of commands.

Please follow and like us: