How to Change VLAN Port on Cisco Switch

Segmenting local network traffic into Virtual Local Area Networks (VLANs) is a fundamental task for network engineers and system administrators. Whether onboarding a new workstation into an accounting subnet, reassigning a VoIP desk phone, or isolating an IoT device into an untrusted zone, knowing how to reassign switchports between VLANs in Cisco IOS and Cisco IOS XE is essential.

Before changing port configurations on a Cisco Catalyst or CBS switch, it is critical to identify the port’s current operating mode, apply the appropriate commands sequentially, and verify that the switchport has adopted the new broadcast domain without interrupting unintended network traffic.

Access Ports vs. Trunk Ports: Key VLAN Differences

A switchport on a Cisco switch typically operates in one of two modes: access or trunk. Modifying the VLAN of an access port changes the broadcast domain for a single end device, whereas modifying VLANs on a trunk interface alters which tagged traffic is permitted across an uplink between switches, routers, or hypervisors.

The following comparison highlights the operational and functional differences between the two modes:

Understanding this distinction ensures that you do not inadvertently configure an access command on an uplink or strip 802.1Q encapsulation from a trunk link.

Step-by-Step Guide: Changing the VLAN on a Single Access Port

Reassigning a single port from one VLAN to another requires entering the Cisco IOS interface configuration mode and overriding the existing access VLAN parameter.

Step 1: Connect to the Switch and Enter Privileged EXEC Mode

Access the switch via SSH or console cable, then elevate your privilege level:

Switch> enable
Password: **********
Switch#

Step 2: Enter Global Configuration Mode

Open global configuration mode to make system-level changes:

Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#

Step 3: Select the Target Interface

Specify the exact physical interface you intend to modify (for example, FastEthernet 0/5, GigabitEthernet 1/0/12, or TenGigabitEthernet 1/0/1):

Switch(config)# interface GigabitEthernet 1/0/12
Switch(config-if)#

Step 4: Set the Mode to Access and Assign the New VLAN

Explicitly enforce access mode and assign the new VLAN ID (for example, VLAN 20). If VLAN 20 does not already exist in the switch’s local database, Cisco IOS will automatically create it:

Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20

(Optional) If the port also supports an IP phone with a PC daisy-chained behind it, configure an auxiliary voice VLAN alongside the data VLAN:

Switch(config-if)# switchport voice vlan 150

Step 5: Exit Configuration Mode and Save Changes

Exit interface configuration and commit the active running configuration to NVRAM so changes persist across switch reboots:

Switch(config-if)# end
Switch# copy running-config startup-config
Destination filename [startup-config]? [Enter]
Building configuration...
[OK]

Changing the VLAN on Multiple Ports Simultaneously

When provisioning an entire department, floor, or switch module, updating ports one by one is inefficient. Cisco IOS provides the interface range command to apply VLAN configurations across multiple contiguous or non-contiguous ports at once.

Step 1: Enter Global Configuration Mode

Switch# configure terminal
Switch(config)#

Step 2: Define the Port Range

Use the interface range macro. You can specify a continuous block using a hyphen, separate non-contiguous ports with commas, or mix both:

• Contiguous range:
  text
Switch(config)# interface range GigabitEthernet 1/0/1 - 24
• Non-contiguous ports and ranges:
  text
Switch(config)# interface range GigabitEthernet 1/0/1 - 10, GigabitEthernet 1/0/15, GigabitEthernet 1/0/20 - 22

Once entered, the prompt changes to Switch(config-if-range)#.

Step 3: Apply the New VLAN Assignment

Commands entered in this mode execute simultaneously on every interface included in the range:

Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 30
Switch(config-if-range)# no shutdown

Step 4: Exit and Commit to NVRAM

Switch(config-if-range)# end
Switch# write memory
Building configuration...
[OK]

How to Verify Port VLAN Assignments

After applying configuration changes, always verify that the interfaces are in the expected administrative and operational states. Three primary Cisco IOS commands provide complete visibility into switchport VLAN mappings.

1. Quick Table Overview: show interfaces status

The fastest way to view interface status and VLAN memberships in a tabular format is show interfaces status.

Switch# show interfaces status

Sample Output:

Port      Name               Status       Vlan       Duplex  Speed Type
Gi1/0/1   Workstation-A      connected    30         a-full  a-1000 10/100/1000BaseTX
Gi1/0/2                      notconnect   30           auto    auto 10/100/1000BaseTX
Gi1/0/12  Printer-Office     connected    20         a-full   a-100 10/100/1000BaseTX
Gi1/0/24  Uplink-Core        connected    trunk      a-full  a-1000 10/100/1000BaseTX

Check the Vlan column: access ports display their numerical VLAN ID, while trunk ports display trunk.

2. VLAN-Centric Audit: show vlan brief

To check which ports belong to a specific VLAN from the database perspective, use show vlan brief or filter by VLAN ID:

Switch# show vlan brief

Sample Output:

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/13, Gi1/0/14
20   Marketing                        active    Gi1/0/12
30   Engineering                      active    Gi1/0/1, Gi1/0/2, Gi1/0/3

To isolate a single VLAN:

Switch# show vlan id 20

3. Detailed Interface Inspection: show interfaces <interface> switchport

For an in-depth audit of an individual port—including administrative mode, operational mode, access VLAN, and voice VLAN—run:

Switch# show interfaces GigabitEthernet 1/0/12 switchport

Key Fields to Inspect:
* Administrative Mode: static access (confirms manual access configuration)
* Operational Mode: static access (confirms port is actively running in access mode)
* Access Mode VLAN: 20 (Marketing) (confirms active data VLAN)
* Voice VLAN: 150 (confirms auxiliary voice VLAN assignment, if configured)

Ready-to-Use CLI Configuration Templates

Use the following modular templates to quickly deploy single-port updates, multi-port migrations, or voice-enabled endpoints. Replace bracketed placeholders (e.g., <interface_id>, <vlan_id>) with your environment’s parameters.

Template 1: Single Access Port Migration

configure terminal
interface <interface_id>
 description <port_description>
 switchport mode access
 switchport access vlan <data_vlan_id>
 spanning-tree portfast
 no shutdown
end
write memory

Template 2: Port with Integrated Voice VLAN (IP Phone + Workstation)

configure terminal
interface <interface_id>
 description Workstation-and-VoIP
 switchport mode access
 switchport access vlan <data_vlan_id>
 switchport voice vlan <voice_vlan_id>
 spanning-tree portfast
 trust device cisco-phone
 no shutdown
end
write memory

Template 3: Batch Port Range Migration

configure terminal
interface range <slot/start_port> - <end_port>
 switchport mode access
 switchport access vlan <data_vlan_id>
 spanning-tree portfast
 no shutdown
end
write memory

Template 4: Reverting a Port to Default VLAN 1

configure terminal
interface <interface_id>
 no switchport access vlan
 no switchport voice vlan
 default interface <interface_id>
end
write memory

Official Cisco VLAN Configuration Guidelines and Standards

When managing VLAN architectures on Cisco Catalyst (running Cisco IOS or IOS XE) and Cisco Business Series platforms, configurations must adhere to standardized operating bounds documented in the Cisco Catalyst Software Configuration Guides:

• VLAN Numbering Ranges:
• Normal-Range VLANs (1–1005): Supported on all switches. Configurations for VLANs 1 to 1005 are traditionally stored in flash memory within the vlan.dat file (or NVRAM depending on VTP mode). VLANs 1 and 1002–1005 are automatically created factory defaults and cannot be altered or deleted.
• Extended-Range VLANs (1006–4094): Designed for service providers and large enterprise networks. Extended-range VLAN configurations are saved directly to the running configuration file (and subsequently startup configuration) when the switch operates in VLAN Trunking Protocol (VTP) transparent mode or VTP version 3 mode.
• Default Port State: On enterprise Cisco Catalyst switches, all unconfigured physical interfaces belong to VLAN 1 by default. Best practice security frameworks (such as the Cisco Hardening Guide) mandate relocating unused ports to an isolated blackhole VLAN and disabling them (shutdown).
• Dynamic Trunking Protocol (DTP): Many legacy Catalyst switches ship with switchports set to dynamic auto or dynamic desirable. When assigning an access port, always execute switchport mode access explicitly rather than relying solely on switchport access vlan <id>. This hardcodes the port state and suppresses DTP negotiation, preventing unauthorized trunk negotiation attacks.
• Pre-Creation of VLAN Entities: While assigning an access port to a non-existent VLAN automatically generates that VLAN in local database mode, enterprise best practice dictates pre-defining the VLAN explicitly in global configuration mode (vlan <vlan-id> followed by name <name>) to maintain standardized naming conventions and VTP domain synchronization.

Modifying a switchport’s VLAN assignment in Cisco IOS is a quick and straightforward procedure, whether performed on an isolated interface or across a wide block of ports via interface range. By verifying your changes with show interfaces status and committing your active settings to NVRAM with write memory or copy running-config startup-config, you ensure predictable traffic forwarding, clean segmentation, and persistent network stability.

Please follow and like us: