How to Configure VLANs on Cisco Switch

Virtual Local Area Networks (VLANs) form the core of modern enterprise switching architectures. By partitioning a single physical local area network into multiple isolated logical broadcast domains, VLANs enhance security, mitigate broadcast storms, and optimize traffic flow across departmental boundaries. Whether deploying a campus environment or isolating management and voice traffic in a branch office, configuring VLANs on Cisco Catalyst switches is an essential network engineering skill.

This comprehensive guide covers everything from fundamental port modes and Layer 2 switch configurations to 802.1Q trunking, multilayer inter-VLAN routing, systematic troubleshooting, and ready-to-deploy configuration templates.

VLAN Port Modes: Access vs. Trunk vs. Native VLAN Explained

Before configuring switch ports, it is vital to understand how Cisco switches process Ethernet frames across different port modes. Cisco IOS switches categorize physical interfaces primarily into access ports and trunk ports, with specific rules governing native VLAN traffic.

With these distinctions established, you can begin provisioning Layer 2 broadcast domains and assigning physical interfaces on your Cisco switch.

Step-by-Step Guide to Creating and Assigning VLANs

Configuring basic VLANs involves creating the VLAN in the switch’s Layer 2 database, giving it a descriptive label for administrative tracking, and assigning access ports to that VLAN. Follow these sequential steps in the Cisco IOS CLI:

Step 1: Access Global Configuration Mode

Log in to your Cisco switch via console, SSH, or Telnet, enter privileged EXEC mode, and transition to global configuration mode:

Switch> enable
Switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Switch(config)#

Step 2: Create the VLANs and Assign Names

Define each VLAN ID and give it an identifying name. VLAN IDs typically range from 1 to 1005 (normal range) and 1006 to 4094 (extended range):

Switch(config)# vlan 10
Switch(config-vlan)# name Users
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name Voice
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name Management
Switch(config-vlan)# exit

Step 3: Assign Interfaces to Access Mode

Specify the target physical interface, explicitly enforce access mode (which disables dynamic trunking negotiation), and allocate the interface to the desired VLAN:

Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# description Workstation-Finance
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# no shutdown
Switch(config-if)# exit

If you need to assign multiple consecutive ports simultaneously, use the interface range command:

Switch(config)# interface range GigabitEthernet0/2 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# no shutdown
Switch(config-if-range)# exit

Step 4: Save the Configuration

Ensure your changes persist across switch reboots by writing the running configuration to NVRAM:

Switch# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]

Configuring 802.1Q Trunk Ports Between Cisco Switches

When network traffic must travel between switches while maintaining VLAN separation, access ports are insufficient. A trunk port encapsulates frames using the IEEE 802.1Q standard, allowing multiple VLANs to share a single physical uplink.

Follow these steps to establish a secure, deterministic trunk link between two switches:

Step 1: Select the Uplink Interface

Enter interface configuration mode for the physical port or EtherChannel bundle connecting to the adjacent switch:

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# description Trunk-to-Distribution-SW01

Step 2: Configure Trunk Encapsulation (Platform Dependent)

On older Catalyst hardware (such as Catalyst 3560 or 3750 series switches) that supports both ISL and 802.1Q encapsulation, you must specify the encapsulation type before setting the trunk mode. Modern switches (like Catalyst 2960X, 1000, 9200, and 9300 series) use 802.1Q exclusively and omit this command:

Switch(config-if)# switchport trunk encapsulation dot1q

Note: If the switch returns an % Invalid input detected error at encapsulation, your switch platform defaults to 802.1Q and does not require this line.

Step 3: Set Static Trunking and Disable DTP

Explicitly force the port into trunk mode and disable Dynamic Trunking Protocol (DTP) to avoid unexpected negotiation behavior and mitigate trunk spoofing risks:

Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport nonegotiate

Step 4: Prune Allowed VLANs (Best Practice)

By default, a Cisco trunk forwards traffic for all VLANs (1–4094). Restrict the trunk to forward only active, necessary VLANs:

Switch(config-if)# switchport trunk allowed vlan 10,20,30

To add or remove specific VLANs later without overwriting your existing list, use the add or remove parameters:

Switch(config-if)# switchport trunk allowed vlan add 40
Switch(config-if)# switchport trunk allowed vlan remove 20

Step 5: Modify the Native VLAN

To enhance security, change the native VLAN away from the default VLAN 1 to an unused VLAN ID across both ends of the trunk:

Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# no shutdown
Switch(config-if)# exit

Configuring Inter-VLAN Routing on a Cisco Layer 3 Switch

Because VLANs represent independent broadcast domains, devices in separate VLANs cannot communicate without a Layer 3 routing mechanism. Multilayer switches perform this function in hardware at wire speed using Switch Virtual Interfaces (SVIs).

Follow these sequential steps to configure inter-VLAN routing on a Layer 3 Cisco switch:

Step 1: Enable IPv4 Routing Globally

Layer 3 switching requires the global routing engine to be active. Verify and enable IP routing:

Switch(config)# ip routing

Step 2: Create Switch Virtual Interfaces (SVIs)

An SVI acts as the default gateway for all hosts residing within that specific VLAN. Create an SVI for each VLAN requiring routing, assign an IP address and subnet mask, and bring up the interface:

Switch(config)# interface vlan 10
Switch(config-if)# description Gateway-Users
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Switch(config)# interface vlan 20
Switch(config-if)# description Gateway-Voice
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Switch(config)# interface vlan 30
Switch(config-if)# description Gateway-Management
Switch(config-if)# ip address 192.168.30.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Step 3: Validate SVI Operational State

For an SVI to transition to an up/up operational state, two criteria must be satisfied:
1. The VLAN ID must exist in the switch’s Layer 2 VLAN database.
2. At least one Layer 2 physical port (access or trunk) assigned to that VLAN must be in an up/up spanning-tree forwarding state.

Switch# show ip interface brief | include Vlan
Vlan10                 192.168.10.1    YES manual up                    up
Vlan20                 192.168.20.1    YES manual up                    up
Vlan30                 192.168.30.1    YES manual up                    up

Hosts assigned to VLAN 10 configured with the default gateway 192.168.10.1 can now communicate directly with devices in VLAN 20 (192.168.20.0/24) through the switch’s backplane.

Verifying and Troubleshooting Cisco VLAN Configurations

When connectivity fails across access ports or trunk links, follow this systematic diagnostic workflow to isolate and resolve the issue.

Step 1: Verify the VLAN Database and Port Assignments

Run show vlan brief to check that the VLAN exists, is active, and includes the expected physical interfaces:

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/13, Gi0/14, Gi0/15, Gi0/16
10   Users                            active    Gi0/1, Gi0/2, Gi0/3, Gi0/4
20   Voice                            active    
30   Management                       active    

Diagnosis Check: If a port does not appear next to the VLAN, verify if it was mistakenly set as a trunk port (trunk ports do not appear in show vlan brief) or if the interface is shut down.

Step 2: Validate Trunk Port Operational Status

Inspect operational trunk links to ensure encapsulation, mode, and native VLAN match across connected devices:

Switch# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan
Gi0/24      on               802.1q         trunking      99

Port        Vlans allowed on trunk
Gi0/24      10,20,30

Port        Vlans allowed and active in management domain
Gi0/24      10,20,30

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/24      10,20,30

Diagnosis Check: Compare the Native vlan and Vlans allowed on trunk on both ends of the cable. A mismatched native VLAN triggers CDP error messages (%CDP-4-NATIVE_VLAN_MISMATCH) and can leak or drop untagged frames.

Step 3: Inspect Interface Switchport Parameters

Review detailed Layer 2 characteristics of an individual interface to identify negotiation or administrative misconfigurations:

Switch# show interfaces GigabitEthernet0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (Users)
Trunking Native Mode VLAN: 1 (default)
Administrative Voice VLAN: none

Step 4: Common VLAN Failure Modes and Remedies

• Inactive VLAN State: If show vlan brief marks a VLAN as act/lshut, enter vlan <id> configuration mode and execute no shutdown.
• Missing VLAN in Database: If an access port is mapped to a non-existent VLAN ID, traffic is discarded. Run vlan <id> to initialize it.
• DTP Negotiation Hangs: When connecting to non-Cisco equipment or devices with DTP turned off, an interface set to dynamic desirable or dynamic auto may default to an access port instead of forming a trunk. Fix this by explicitly issuing switchport mode trunk.
• Spanning Tree Blocking: Ensure Spanning Tree Protocol (STP) has not blocked the port due to bridge loops or BPDU Guard violations (show spanning-tree vlan <id>).

Production-Ready VLAN Configuration Script Template

Use this consolidated CLI script to deploy standard VLANs, configure edge access ports, and provision an 802.1Q trunk link. Replace bracketed placeholders (<...>) with your site-specific network values.

! ===================================================================
! CISCO SWITCH BASELINE VLAN CONFIGURATION TEMPLATE
! ===================================================================

enable
configure terminal

! --- Step 1: Define Layer 2 VLANs ---
vlan <VLAN_DATA_ID>
 name <DATA_NETWORK_NAME>
 exit

vlan <VLAN_VOICE_ID>
 name <VOICE_NETWORK_NAME>
 exit

vlan <VLAN_NATIVE_ID>
 name <NATIVE_MANAGEMENT_NAME>
 exit

! --- Step 2: Configure Edge Access Ports ---
interface range <ACCESS_PORT_RANGE>
 description User-Access-Ports
 switchport mode access
 switchport access vlan <VLAN_DATA_ID>
 switchport voice vlan <VLAN_VOICE_ID>
 spanning-tree portfast
 spanning-tree bpduguard enable
 no shutdown
 exit

! --- Step 3: Configure 802.1Q Uplink Trunk ---
interface <TRUNK_PORT_ID>
 description Uplink-Trunk-to-Core
 ! Uncomment the following line on older Catalyst hardware requiring manual encapsulation:
 ! switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
 switchport trunk native vlan <VLAN_NATIVE_ID>
 switchport trunk allowed vlan <VLAN_DATA_ID>,<VLAN_VOICE_ID>,<VLAN_NATIVE_ID>
 no shutdown
 exit

! --- Step 4: Optional Layer 3 SVI Gateway (Multilayer Switches) ---
ip routing

interface vlan <VLAN_DATA_ID>
 description Default-Gateway-Data
 ip address <GATEWAY_DATA_IP> <NETMASK>
 no shutdown
 exit

! --- Step 5: Commit Configuration ---
end
write memory

Cisco Official Documentation and Technical References

Consult authoritative Cisco technical documentation and command references to verify platform-specific limits, command deprecations, and release guidelines across different Cisco IOS and Cisco IOS-XE versions.

1. Platform Documentation Hierarchies

• Cisco Catalyst 9000 Series Switches (IOS-XE): Configuration guidelines for modern enterprise access and distribution platforms are documented under the Layer 2 Configuration Guide (Catalyst 9000 Switches). Specific chapters include “Configuring VLANs” and “Configuring VLAN Trunks.”
• Cisco Catalyst 2960-X / 3650 / 3850 Series (Classic IOS / Early IOS-XE): Refer to the Software Configuration Guide, Cisco IOS Release 15.x, specifically the “Configuring Normal-Range VLANs” and “Configuring Inter-VLAN Routing” sections.

2. Command References and Syntax Lookups

• VLAN Command Reference: Consult the VLAN Configuration Command Reference on Cisco.com for detailed argument syntax, defaults, and command history for primitives like switchport trunk allowed vlan, vlan database (deprecated), and encapsulation dot1q.
• Cisco Feature Navigator: Accessible via the Cisco Services & Support portal (cisco.com/go/fn). Use this tool to map specific VLAN features (such as Private VLANs, Dynamic ARP Inspection, or 802.1Q-in-Q tunneling) to required software images, license levels (Network Essentials vs. Network Advantage), and hardware models.

3. Platform Guidelines and Architectural Constraints

• Normal-range VLANs (1–1005) are stored in flash memory in the vlan.dat file, whereas extended-range VLANs (1006–4094) are stored within the running configuration file when the switch operates in VTP (VLAN Trunking Protocol) transparent or off mode.
• Newer Cisco enterprise platforms running Cisco IOS-XE (e.g., Catalyst 9200, 9300, 9500) do not support the older Cisco Inter-Switch Link (ISL) protocol; IEEE 802.1Q is the permanent, hardcoded encapsulation standard.

Configuring VLANs on a Cisco switch separates physical hardware into modular, secure broadcast segments. By combining well-defined access ports for end systems, hardened 802.1Q trunking uplinks for inter-switch transport, and SVIs for Layer 3 inter-VLAN routing, network administrators can construct scalable, high-performance campus networks. Regular verification using commands like show vlan brief and show interfaces trunk guarantees predictable operation across all segments of the switching fabric.

Please follow and like us: