how to configure the vlan on cisco switch

In enterprise and campus networks, flat Layer 2 networks present significant operational challenges. Unsegmented switches forward broadcast traffic across every connected port, degrading available bandwidth and exposing endpoints to unauthorized lateral access. Virtual Local Area Networks (VLANs) resolve these issues by logically partitioning a single physical switch into distinct broadcast domains. Configuring VLANs on Cisco Catalyst and IOS-XE platforms allows network administrators to enforce security boundaries, streamline IP addressing schemes, and isolate mission-critical traffic such as voice, data, and management.

Cisco VLAN Architecture and Operational Specifications

Understanding how Cisco IOS handles logical segmentation requires familiarity with IEEE standards, hardware operational states, and identifier allocations.

Definition and Functionality

A VLAN constitutes an isolated Layer 2 broadcast domain created inside switch firmware. Frames originating within a specific VLAN are confined to ports assigned to that VLAN unless routed by a Layer 3 device (such as an inter-VLAN router or a multilayer switch). Frame tagging conforms to the IEEE 802.1Q standard, which inserts a 4-byte tag—including a 12-bit VLAN Identifier (VID)—directly into the Ethernet frame header between the Source MAC address and EtherType fields.

VLAN ID Ranges

Cisco switches support 4,096 distinct VLAN IDs (0 through 4095), categorized into operational tiers:

• Reserved IDs (0 and 4095): Reserved by IEEE 802.1Q specifications; unusable for user data traffic.
• Default and Legacy IDs (1, 1002–1005): VLAN 1 is the default native and management VLAN on Cisco hardware and cannot be deleted or renamed. VLANs 1002 through 1005 are reserved for legacy Token Ring and FDDI functions and cannot be removed.
• Normal Range (2–1001): Standard enterprise data VLANs. Stored in the non-volatile vlan.dat file in switch flash memory; supported across all Cisco switch models.
• Extended Range (1006–4094): Intended for service providers and hyper-dense enterprise networks. Stored directly in the running configuration file when the switch operates in VLAN Trunking Protocol (VTP) transparent mode or VTP version 3.

Interface Operational Modes

Cisco switchports function primarily in two Layer 2 operational states:
* Access Mode: Configured for single-host termination (e.g., workstations, printers, standard servers). Frames passing out of an access port are untagged; standard endpoints remain unaware of VLAN tagging mechanisms.
* Trunk Mode: Configured for switch-to-switch or switch-to-router point-to-point interconnects. Multiplexes traffic from multiple VLANs across a single physical link by appending the 802.1Q header to each traversing frame.

Access Ports vs. Trunk Ports vs. Switch Virtual Interfaces

Selecting the appropriate interface configuration depends on the role of the connected device and whether the port performs switching or routing functions.

Understanding these distinctions ensures that network devices receive tagged or untagged traffic appropriately while establishing the groundwork for both access layer segmentation and inter-VLAN routing.

Step-by-Step Guide: Creating VLANs and Assigning Access Ports

Configuring a functional VLAN on a Cisco switch follows a systematic progression: defining the VLAN in the database, assigning human-readable identifiers, mapping access ports, and committing the changes.

Step 1: Access Global Configuration Mode

Log in to the switch CLI via console, SSH, or Telnet. Elevate privileges to Privileged EXEC mode, then enter global configuration mode:

Switch# enable
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#

Step 2: Create and Name the VLAN

Instantiate the VLAN using an ID from the normal range. Assigning a descriptive name aids operational management and troubleshooting:

Switch(config)# vlan 10
Switch(config-vlan)# name Engineering_Dept
Switch(config-vlan)# exit
Switch(config)#

Step 3: Assign a Physical Interface to the Access VLAN

Target the specific Ethernet interface connected to the client device. Explicitly set the port to access mode before binding it to the designated VLAN:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# description Workstation-Eng-Host01
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# no shutdown
Switch(config-if)# exit

Step 4: Configure an Interface Range for Bulk Deployments

To assign multiple ports simultaneously to the same VLAN, employ the interface range macro command:

Switch(config)# interface range GigabitEthernet0/2 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# no shutdown
Switch(config-if-range)# exit

Step 5: Save the Running Configuration

Modifications to switch interfaces exist only in volatile RAM until copied to Non-Volatile RAM (NVRAM). Commit your configurations to persist across power cycles:

Switch# copy running-config startup-config
Destination filename [startup-config]? [Enter]
Building configuration...
[OK]

Cisco 802.1Q Trunk Port Configuration Template

When connecting two switches or linking a switch to an inter-VLAN router (Router-on-a-Stick topology), you must configure a trunk link to carry multiple VLANs simultaneously. Use the production-ready template below.

! ===============================================================
! CISCO IOS / IOS-XE 802.1Q TRUNK CONFIGURATION TEMPLATE
! ===============================================================

Switch# configure terminal
Switch(config)# interface <INTERFACE_ID>
Switch(config-if)# description UPLINK_TO_DISTRIBUTION_SWITCH

! Step 1: Set 802.1Q encapsulation (Required on older Catalyst 3560/3750/3850 hardware;
! omit this line on modern switches such as Catalyst 2960X/1000/9200/9300 where dot1q is the only standard)
Switch(config-if)# switchport trunk encapsulation dot1q

! Step 2: Force the port into trunking mode
Switch(config-if)# switchport mode trunk

! Step 3: Disable Dynamic Trunking Protocol (DTP) for security
Switch(config-if)# switchport nonegotiate

! Step 4: Map the Native VLAN to an unused, non-default VLAN ID
Switch(config-if)# switchport trunk native vlan <NATIVE_VLAN_ID>

! Step 5: Explicitly define allowed VLANs (Do not allow all VLANs by default)
Switch(config-if)# switchport trunk allowed vlan <VLAN_LIST>

! Step 6: Bring the interface up and return to EXEC mode
Switch(config-if)# no shutdown
Switch(config-if)# end

Production Implementation Example

Below is an applied configuration where port TenGigabitEthernet1/0/1 serves as an uplink carrying VLANs 10, 20, and 30, with VLAN 999 serving as the untagged native VLAN:

Switch# configure terminal
Switch(config)# interface TenGigabitEthernet1/0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport nonegotiate
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# no shutdown
Switch(config-if)# end

Essential Cisco IOS Commands for VLAN Verification

Once you apply VLAN definitions and port assignments, verify your implementation with targeted diagnostic commands.

1. show vlan brief
   Displays a concise table listing all configured VLAN IDs, their operational names, administrative status (active or suspended), and all assigned access ports. This is the primary verification tool for access-layer mappings.
2. show interfaces <interface-id> switchport
   Provides granular Layer 2 parameters for a specific physical port. Inspect this command to confirm whether the port is statically configured as an access or trunk interface (Administrative Mode) and its active operating state (Operational Mode).
3. show interfaces trunk
   Lists all active trunking links on the switch. It verifies the operational encapsulation (802.1Q), the native VLAN ID assigned to each trunk, and the explicit list of VLANs allowed, active, and unblocked by the Spanning Tree Protocol (STP).
4. show vlan id <vlan-id>
   Filters output specifically for a single VLAN. Useful in enterprise switches running hundreds of VLANs when verifying whether a specific broadcast domain is instantiated and populated with interfaces.
5. show mac address-table vlan <vlan-id>
   Displays dynamically learned and static MAC addresses associated with a specific VLAN. Useful during connectivity troubleshooting to verify whether packets from an endpoint are reaching the switch fabric.

Best Practices and Common VLAN Configuration Pitfalls

Misconfigurations in Layer 2 segmentation can introduce network loops, security vulnerabilities, or silent traffic drops. Adhere to these operational best practices:

• Never Use VLAN 1 for User Data or Management:
  VLAN 1 is the factory default across all Cisco equipment and automatically handles control plane protocols (such as CDP, VTP, and PAgP). Mixing user traffic into VLAN 1 exposes switches to unauthorized management access and hop attacks. Assign user traffic and in-band management (SSH/SNMP) to distinct, dedicated VLANs.
• Disable Dynamic Trunking Protocol (DTP):
  Cisco ports ship with dynamic trunking enabled (switchport mode dynamic auto or dynamic desirable). An unauthorized workstation running packet generation tools can forge DTP packets to negotiate a trunk link and capture all broadcast traffic. Always execute switchport nonegotiate alongside explicit access or trunk declarations.
• Change and Isolate the Native VLAN:
  By default, 802.1Q trunks treat VLAN 1 as the native (untagged) VLAN. Mismatched native VLANs across a link produce STP loops and VLAN leaking. Configure a dummy, unrouted VLAN (e.g., VLAN 999) as the native VLAN on both sides of every trunk link to neutralize double-tagging exploitation.
• Explicitly Prune Trunk Allowed Lists:
  By default, a Cisco trunk permits all VLANs (1–4094). Leaving trunk lines open propagates unnecessary broadcasts across switches that do not host ports in those VLANs. Always define a restrictive list using switchport trunk allowed vlan <list> to conserve backplane capacity.
• Prevent VLAN Creation Drops on Access Ports:
  If an access port is mapped to a non-existent VLAN (e.g., assigning switchport access vlan 50 without running vlan 50), modern Cisco switches will create the VLAN in the background. However, if VTP is in Client mode, the switch cannot dynamically create the VLAN, causing the interface to enter an inactive state. Always define your VLANs before binding them to interfaces.

Configuring VLANs on Cisco switches establishes the Layer 2 foundation required for a secure, high-performing network infrastructure. By correctly isolating broadcast domains into access ports, consolidating uplinks across deterministic 802.1Q trunk lines, and locking down default settings like VLAN 1 and DTP, administrators eliminate broadcast bottlenecks and mitigate lateral security risks across the enterprise. Periodic audits using verification commands like show vlan brief and show interfaces trunk ensure that your segmentation architecture remains robust and aligned with organizational policies.

Please follow and like us: