Segmenting a local area network (LAN) into Virtual Local Area Networks (VLANs) is one of the fundamental tasks in network administration. VLANs isolate Layer 2 broadcast domains on a physical switch, which improves security, reduces broadcast collisions, and groups network endpoints logically by role or department (such as Data, Voice, Management, and Guest networks) regardless of physical location.
On Cisco Catalyst switches operating either classic Cisco IOS or modern Cisco IOS-XE, configuring VLANs follows a consistent, reliable Command-Line Interface (CLI) workflow. This guide covers the technical specifications, step-by-step commands for creating VLANs, interface assignment methods, ready-to-use deployment scripts, Layer 3 routing configuration, and diagnostics.
Table of Contents
Cisco Catalyst VLAN Architecture and Specifications
Cisco Catalyst switches implement the IEEE 802.1Q standard for VLAN identification and tagging. Before creating VLANs, it is critical to understand the identifier ranges, platform limits, and configuration storage rules across Cisco IOS and IOS-XE platforms.
VLAN ID Ranges and System Defaults
- Normal-Range VLANs (1–1005):
- VLAN 1: The default factory VLAN. All switchports belong to VLAN 1 by default. It cannot be deleted, renamed, or suspended.
- VLANs 2–1001: User-configurable normal-range VLANs for general traffic segmentation.
- VLANs 1002–1005: Cisco-reserved IDs for legacy media types (FDDI and Token Ring). These cannot be deleted or re-allocated for standard Ethernet traffic.
- Storage Behavior: Historically stored in flash memory inside the
vlan.datdatabase file. In modern IOS-XE environments, normal-range VLAN definitions are fully saved to the ASCIIrunning-config.
- Extended-Range VLANs (1006–4094):
- Designed for service providers and large enterprise network deployments requiring greater segmentation.
- Saved directly to the
running-configfile. - On older switches running VLAN Trunking Protocol (VTP) versions 1 or 2, the switch must operate in VTP Transparent mode to support extended-range VLANs. VTP version 3 supports extended VLANs natively in Client and Server modes.
- Reserved System IDs (0 and 4095):
- VLAN 0 is reserved for 802.1p priority tagging without a VLAN identifier.
- VLAN 4095 is reserved by the 802.1Q standard for system implementation and cannot be configured.
Deprecated Syntax Notice
The legacy command vlan database (executed directly from Privileged EXEC mode) has been deprecated for over a decade. All modern Cisco Catalyst switches utilize Global Configuration mode (vlan <vlan-id>) to manage the VLAN database.
Step-by-Step Guide: Creating a VLAN in Cisco IOS CLI
Creating a VLAN on a Cisco switch involves defining the VLAN ID in the switch database and assigning it a descriptive name to simplify maintenance and auditing. Follow these sequential steps:
Step 1: Access Privileged EXEC Mode
Log into the switch console, SSH, or Telnet session. Elevate your session privileges:
Switch> enable
Switch#
Step 2: Enter Global Configuration Mode
Open the configuration terminal:
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#
Step 3: Define the VLAN Identifier
Enter the VLAN configuration context by specifying an unused ID within the valid range (1–4094):
Switch(config)# vlan 10
Switch(config-vlan)#
Step 4: Assign a Descriptive Name
Assign a clear label indicating the purpose or department for the VLAN. Cisco IOS accepts alphanumeric characters without spaces (use underscores or hyphens instead):
Switch(config-vlan)# name Sales_Department
Switch(config-vlan)# exit
Switch(config)#
(Optional) If you need to create multiple VLANs at once without assigning names immediately, you can supply a comma-separated list or range:
Switch(config)# vlan 20,30,40-45
Switch(config-vlan)# exit
Step 5: Save the Configuration to Non-Volatile RAM (NVRAM)
Exit configuration mode and commit the changes from volatile memory (running-config) to non-volatile storage (startup-config):
Switch(config)# end
Switch# copy running-config startup-config
Destination filename [startup-config]? [Press Enter]
Building configuration...
[OK]
At this stage, the VLAN exists in the switch’s database, but no physical interfaces are actively passing traffic for it.
Assigning Switchports: Access vs. Trunk Ports
For a VLAN to handle network traffic, physical interfaces must be assigned to it. Cisco switchports typically operate in one of two Layer 2 modes:
- Access Port: Dedicated to a single VLAN; designed to connect end devices such as PCs, printers, IP phones, or single-NIC servers. Access ports strip 802.1Q tags before sending frames out to endpoints.
- Trunk Port: Designed to connect switch-to-switch or switch-to-router uplinks. Trunk ports multiplex traffic across multiple VLANs over a single link by appending an 802.1Q tag header to each frame.
Method 1: Assigning an Access Port to a Single Interface
To bind a specific physical port to your newly created VLAN:
Switch# configure terminal
Switch(config)# interface GigabitEthernet 1/0/5
Switch(config-if)# description Workstation-Sales-01
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# no shutdown
Switch(config-if)# end
Note: The spanning-tree portfast command allows edge access ports to bypass listening and learning states, moving immediately to the forwarding state to prevent DHCP timeout issues on boot.
Method 2: Assigning an Access VLAN to a Range of Ports
When provisioning multiple ports at once, use the interface range macro:
Switch# configure terminal
Switch(config)# interface range GigabitEthernet 1/0/1 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# no shutdown
Switch(config-if-range)# end
Method 3: Configuring an 802.1Q Trunk Port
To allow the VLAN’s traffic to travel across an uplink to a core switch or distribution layer, configure a trunk port.
Switch# configure terminal
Switch(config)# interface GigabitEthernet 1/0/48
Switch(config-if)# description UPLINK_TO_CORE
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99
Switch(config-if)# no shutdown
Switch(config-if)# end
Important Details:
1. On newer switches (such as Catalyst 9000 series), the command switchport trunk encapsulation dot1q is not required because 802.1Q is the only supported encapsulation protocol.
2. The switchport trunk allowed vlan command restricts trunk links to carry only necessary traffic, which prevents broadcast floods from spreading across non-participating switches.
3. Changing the default native VLAN from VLAN 1 to an unused VLAN (e.g., VLAN 99) is an industry security standard that mitigates double-tagging VLAN hopping attacks.
Ready-to-Deploy VLAN Configuration Templates
Use these pre-tested configuration scripts for rapid switch deployment. Replace bracketed placeholders (<...>) with your network values.
Template 1: Multi-VLAN Setup with Access Port Assignments
! ==========================================
! TEMPLATE: Standard Multi-VLAN Deployment
! ==========================================
configure terminal
! 1. Define VLANs
vlan 10
name DATA_DEPT
!
vlan 20
name VOICE_DEPT
!
vlan 30
name GUEST_WIFI
!
vlan 99
name MANAGEMENT
!
exit
! 2. Configure Access Ports for Users (VLAN 10 Data + VLAN 20 Voice)
interface range GigabitEthernet 1/0/1 - 24
description User_Edge_Ports
switchport mode access
switchport access vlan 10
switchport voice vlan 20
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
exit
! 3. Configure Dedicated Ports for Guest Access (VLAN 30)
interface range GigabitEthernet 1/0/25 - 30
description Guest_Access_Points
switchport mode access
switchport access vlan 30
spanning-tree portfast
no shutdown
exit
end
copy running-config startup-config
Template 2: Upstream Trunk Interface Configuration
! ==========================================
! TEMPLATE: High-Capacity Trunk Uplink
! ==========================================
configure terminal
interface GigabitEthernet 1/0/48
description TRUNK_TO_DISTRIBUTION_SWITCH
! Modern IOS-XE uses dot1q by default; uncomment line below if on legacy IOS:
! switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,99
switchport nonegotiate
no shutdown
exit
end
copy running-config startup-config
Enabling Inter-VLAN Routing with Switch Virtual Interfaces (SVIs)
By default, Layer 2 VLANs isolate traffic completely. A device in VLAN 10 cannot ping or access a device in VLAN 20 without a Layer 3 routing mechanism.
If you are deploying a Layer 3-capable Catalyst switch (such as a 3650, 3850, or Catalyst 9300), you can route traffic between VLANs at hardware speeds using Switch Virtual Interfaces (SVIs), also referred to as routed VLAN interfaces.
Step 1: Enable the Switch Routing Engine
By default, Layer 3 packet forwarding is disabled on many switch models. Activate it globally:
Switch# configure terminal
Switch(config)# ip routing
Step 2: Configure the SVI for VLAN 10
The IP address assigned to the SVI serves as the default gateway for all endpoints residing in that VLAN:
Switch(config)# interface vlan 10
Switch(config-if)# description Default_Gateway_VLAN10_Sales
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Step 3: Configure the SVI for VLAN 20
Repeat the process for the second subnet:
Switch(config)# interface vlan 20
Switch(config-if)# description Default_Gateway_VLAN20_Voice
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Step 4: Verify the Routing Table
Ensure the switch has registered both subnets as directly connected routes:
Switch# show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
Gateway of last resort is not set
C 192.168.10.0/24 is directly connected, Vlan10
C 192.168.20.0/24 is directly connected, Vlan20
Note on SVI State: An SVI interface will show as Vlan10 is up, line protocol is up only when at least one access port assigned to that VLAN is active (up/up) or a trunk carrying that VLAN is active. If no ports in that VLAN are active, the SVI status remains down/down.
Troubleshooting and Verification FAQ
How do I verify that a VLAN has been created and active ports are assigned?
Run the command show vlan brief from Privileged EXEC mode. This command displays a table of all normal- and extended-range VLANs, their administrative state, and the physical ports associated with them:
Switch# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/13, Gi1/0/14
10 Sales_Department active Gi1/0/1, Gi1/0/2, Gi1/0/5
20 Voice_Dept active
99 MANAGEMENT active
If a port does not appear in this list, it has either been configured as a trunk port (trunk ports do not appear in show vlan brief) or it remains in another VLAN.
Why is a VLAN showing a status of “act/lshut” or “suspended”?
A status of act/lshut indicates that the VLAN has been administratively shut down in the VLAN database. To re-enable it:
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# no shutdown
Switch(config-vlan)# end
If the status is suspended, the VLAN was temporarily disabled using the state suspend sub-command, or the switch received an overriding VTP update. Run state active within the vlan <vlan-id> context to resolve it.
Why are devices inside the same VLAN unable to communicate?
If two devices plugged into ports within the same VLAN cannot reach each other, verify the following:
1. Port Status: Run show interfaces status to ensure the physical links are connected (connected, not notconnect or err-disabled).
2. Access Assignment: Run show interfaces <interface-id> switchport and verify the line Access Mode VLAN: <vlan-id> matches on both switchports.
3. Port Security / BPDU Guard: If a port is in an err-disabled state, check for MAC violations or unauthorized switches/bridges connected to PortFast-enabled ports.
How do I check if an uplink is passing trunked VLAN traffic?
Do not use show vlan brief to check trunk links. Instead, use:
Switch# show interfaces trunk
Inspect the output under three specific sections:
* Vlans allowed on trunk: Confirms the configuration permits the VLAN (e.g., 10,20,30,99).
* Vlans allowed and active in management domain: Verifies that the VLAN exists in the local database. If a VLAN is allowed on the trunk but not created on the switch, it cannot pass frames.
* Vlans in spanning tree forwarding state and not pruned: Confirms the Spanning Tree Protocol (STP) has not blocked the VLAN to prevent a loop.
Why can devices within a VLAN communicate, but Inter-VLAN routing fails?
If hosts in VLAN 10 cannot ping hosts in VLAN 20:
1. Global Routing: Ensure ip routing has been executed in global configuration mode. Without it, the switch behaves strictly as a Layer 2 bridge.
2. SVI Status: Run show ip interface brief and verify both Vlan10 and Vlan20 show Status: up and Protocol: up.
3. Endpoint Default Gateways: Ensure the connected host machines have their default gateway configured with the exact IP address assigned to their respective SVI (e.g., host in VLAN 10 must have its gateway set to 192.168.10.1).
4. Local Firewall Settings: Ensure host-level software firewalls (such as Windows Defender Firewall) are not dropping cross-subnet ICMP Echo Requests.
Conclusion
Creating and configuring VLANs on a Cisco switch follows a systematic operational path: defining the VLAN in the database, assigning ports to access or trunk modes, and applying SVIs if inter-VLAN routing is required. By reserving VLAN IDs logically, limiting trunk exposure with allowed lists, and using clear diagnostic commands like show vlan brief and show interfaces trunk, you can ensure an organized, secure, and easily maintainable enterprise network topology.
Comments