Typical Target Device<\/strong><\/td>\n| Laptops, desktop computers, single-NIC servers, IP phones (via voice VLAN).<\/td>\n | Downstream\/upstream switches, wireless LAN controllers, hypervisor virtual switches.<\/td>\n | Management transit traffic, legacy devices, or unencapsulated control frames.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n With these distinctions established, you can begin provisioning Layer 2 broadcast domains and assigning physical interfaces on your Cisco switch.<\/p>\n
\n<\/span>Step-by-Step Guide to Creating and Assigning VLANs<\/span><\/h2>\nConfiguring basic VLANs involves creating the VLAN in the switch’s Layer 2 database, giving it a descriptive label for administrative tracking, and assigning access ports to that VLAN. Follow these sequential steps in the Cisco IOS CLI:<\/p>\n <\/span>Step 1: Access Global Configuration Mode<\/span><\/h3>\nLog in to your Cisco switch via console, SSH, or Telnet, enter privileged EXEC mode, and transition to global configuration mode:<\/p>\n Switch> enable\nSwitch# configure terminal\nEnter configuration commands, one per line. End with CNTL\/Z.\nSwitch(config)#\n<\/code><\/pre>\n<\/span>Step 2: Create the VLANs and Assign Names<\/span><\/h3>\nDefine each VLAN ID and give it an identifying name. VLAN IDs typically range from 1 to 1005 (normal range) and 1006 to 4094 (extended range):<\/p>\n Switch(config)# vlan 10\nSwitch(config-vlan)# name Users\nSwitch(config-vlan)# exit\n\nSwitch(config)# vlan 20\nSwitch(config-vlan)# name Voice\nSwitch(config-vlan)# exit\n\nSwitch(config)# vlan 30\nSwitch(config-vlan)# name Management\nSwitch(config-vlan)# exit\n<\/code><\/pre>\n<\/span>Step 3: Assign Interfaces to Access Mode<\/span><\/h3>\nSpecify the target physical interface, explicitly enforce access mode (which disables dynamic trunking negotiation), and allocate the interface to the desired VLAN:<\/p>\n Switch(config)# interface GigabitEthernet0\/1\nSwitch(config-if)# description Workstation-Finance\nSwitch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 10\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\nIf you need to assign multiple consecutive ports simultaneously, use the interface range<\/code> command:<\/p>\nSwitch(config)# interface range GigabitEthernet0\/2 - 12\nSwitch(config-if-range)# switchport mode access\nSwitch(config-if-range)# switchport access vlan 10\nSwitch(config-if-range)# no shutdown\nSwitch(config-if-range)# exit\n<\/code><\/pre>\n<\/span>Step 4: Save the Configuration<\/span><\/h3>\nEnsure your changes persist across switch reboots by writing the running configuration to NVRAM:<\/p>\n Switch# copy running-config startup-config\nDestination filename [startup-config]? \nBuilding configuration...\n[OK]\n<\/code><\/pre>\n
\n<\/span>Configuring 802.1Q Trunk Ports Between Cisco Switches<\/span><\/h2>\nWhen network traffic must travel between switches while maintaining VLAN separation, access ports are insufficient. A trunk port encapsulates frames using the IEEE 802.1Q standard, allowing multiple VLANs to share a single physical uplink.<\/p>\n Follow these steps to establish a secure, deterministic trunk link between two switches:<\/p>\n <\/span>Step 1: Select the Uplink Interface<\/span><\/h3>\nEnter interface configuration mode for the physical port or EtherChannel bundle connecting to the adjacent switch:<\/p>\n Switch(config)# interface GigabitEthernet0\/24\nSwitch(config-if)# description Trunk-to-Distribution-SW01\n<\/code><\/pre>\n<\/span>Step 2: Configure Trunk Encapsulation (Platform Dependent)<\/span><\/h3>\nOn older Catalyst hardware (such as Catalyst 3560 or 3750 series switches) that supports both ISL and 802.1Q encapsulation, you must specify the encapsulation type before setting the trunk mode. Modern switches (like Catalyst 2960X, 1000, 9200, and 9300 series) use 802.1Q exclusively and omit this command:<\/p>\n Switch(config-if)# switchport trunk encapsulation dot1q\n<\/code><\/pre>\nNote: If the switch returns an % Invalid input detected<\/code> error at encapsulation<\/code>, your switch platform defaults to 802.1Q and does not require this line.<\/em><\/p>\n<\/span>Step 3: Set Static Trunking and Disable DTP<\/span><\/h3>\nExplicitly force the port into trunk mode and disable Dynamic Trunking Protocol (DTP) to avoid unexpected negotiation behavior and mitigate trunk spoofing risks:<\/p>\n Switch(config-if)# switchport mode trunk\nSwitch(config-if)# switchport nonegotiate\n<\/code><\/pre>\n<\/span>Step 4: Prune Allowed VLANs (Best Practice)<\/span><\/h3>\nBy default, a Cisco trunk forwards traffic for all VLANs (1\u20134094). Restrict the trunk to forward only active, necessary VLANs:<\/p>\n Switch(config-if)# switchport trunk allowed vlan 10,20,30\n<\/code><\/pre>\nTo add or remove specific VLANs later without overwriting your existing list, use the add<\/code> or remove<\/code> parameters:<\/p>\nSwitch(config-if)# switchport trunk allowed vlan add 40\nSwitch(config-if)# switchport trunk allowed vlan remove 20\n<\/code><\/pre>\n<\/span>Step 5: Modify the Native VLAN<\/span><\/h3>\nTo enhance security, change the native VLAN away from the default VLAN 1 to an unused VLAN ID across both ends of the trunk:<\/p>\n Switch(config-if)# switchport trunk native vlan 99\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n
\n<\/span>Configuring Inter-VLAN Routing on a Cisco Layer 3 Switch<\/span><\/h2>\nBecause VLANs represent independent broadcast domains, devices in separate VLANs cannot communicate without a Layer 3 routing mechanism. Multilayer switches perform this function in hardware at wire speed using Switch Virtual Interfaces (SVIs).<\/p>\n Follow these sequential steps to configure inter-VLAN routing on a Layer 3 Cisco switch:<\/p>\n <\/span>Step 1: Enable IPv4 Routing Globally<\/span><\/h3>\nLayer 3 switching requires the global routing engine to be active. Verify and enable IP routing:<\/p>\n Switch(config)# ip routing\n<\/code><\/pre>\n<\/span>Step 2: Create Switch Virtual Interfaces (SVIs)<\/span><\/h3>\nAn SVI acts as the default gateway for all hosts residing within that specific VLAN. Create an SVI for each VLAN requiring routing, assign an IP address and subnet mask, and bring up the interface:<\/p>\n Switch(config)# interface vlan 10\nSwitch(config-if)# description Gateway-Users\nSwitch(config-if)# ip address 192.168.10.1 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n\nSwitch(config)# interface vlan 20\nSwitch(config-if)# description Gateway-Voice\nSwitch(config-if)# ip address 192.168.20.1 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n\nSwitch(config)# interface vlan 30\nSwitch(config-if)# description Gateway-Management\nSwitch(config-if)# ip address 192.168.30.1 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 3: Validate SVI Operational State<\/span><\/h3>\nFor an SVI to transition to an up\/up<\/code> operational state, two criteria must be satisfied:
\n1. The VLAN ID must exist in the switch\u2019s Layer 2 VLAN database.
\n2. At least one Layer 2 physical port (access or trunk) assigned to that VLAN must be in an up\/up<\/code> spanning-tree forwarding state.<\/p>\nSwitch# show ip interface brief | include Vlan\nVlan10 192.168.10.1 YES manual up up\nVlan20 192.168.20.1 YES manual up up\nVlan30 192.168.30.1 YES manual up up\n<\/code><\/pre>\nHosts assigned to VLAN 10 configured with the default gateway 192.168.10.1<\/code> can now communicate directly with devices in VLAN 20 (192.168.20.0\/24<\/code>) through the switch’s backplane.<\/p>\n
\n<\/span>Verifying and Troubleshooting Cisco VLAN Configurations<\/span><\/h2>\nWhen connectivity fails across access ports or trunk links, follow this systematic diagnostic workflow to isolate and resolve the issue.<\/p>\n <\/span>Step 1: Verify the VLAN Database and Port Assignments<\/span><\/h3>\nRun show vlan brief<\/code> to check that the VLAN exists, is active, and includes the expected physical interfaces:<\/p>\nSwitch# show vlan brief\n\nVLAN Name Status Ports\n---- -------------------------------- --------- -------------------------------\n1 default active Gi0\/13, Gi0\/14, Gi0\/15, Gi0\/16\n10 Users active Gi0\/1, Gi0\/2, Gi0\/3, Gi0\/4\n20 Voice active \n30 Management active \n<\/code><\/pre>\nDiagnosis Check:<\/em> If a port does not appear next to the VLAN, verify if it was mistakenly set as a trunk port (trunk ports do not appear in show vlan brief<\/code>) or if the interface is shut down.<\/p>\n<\/span>Step 2: Validate Trunk Port Operational Status<\/span><\/h3>\nInspect operational trunk links to ensure encapsulation, mode, and native VLAN match across connected devices:<\/p>\n Switch# show interfaces trunk\n\nPort Mode Encapsulation Status Native vlan\nGi0\/24 on 802.1q trunking 99\n\nPort Vlans allowed on trunk\nGi0\/24 10,20,30\n\nPort Vlans allowed and active in management domain\nGi0\/24 10,20,30\n\nPort Vlans in spanning tree forwarding state and not pruned\nGi0\/24 10,20,30\n<\/code><\/pre>\nDiagnosis Check:<\/em> Compare the Native vlan<\/code> and Vlans allowed on trunk<\/code> on both ends of the cable. A mismatched native VLAN triggers CDP error messages (%CDP-4-NATIVE_VLAN_MISMATCH<\/code>) and can leak or drop untagged frames.<\/p>\n<\/span>Step 3: Inspect Interface Switchport Parameters<\/span><\/h3>\nReview detailed Layer 2 characteristics of an individual interface to identify negotiation or administrative misconfigurations:<\/p>\n Switch# show interfaces GigabitEthernet0\/1 switchport\nName: Gi0\/1\nSwitchport: Enabled\nAdministrative Mode: static access\nOperational Mode: static access\nAdministrative Trunking Encapsulation: dot1q\nOperational Trunking Encapsulation: native\nNegotiation of Trunking: Off\nAccess Mode VLAN: 10 (Users)\nTrunking Native Mode VLAN: 1 (default)\nAdministrative Voice VLAN: none\n<\/code><\/pre>\n<\/span>Step 4: Common VLAN Failure Modes and Remedies<\/span><\/h3>\n\n- Inactive VLAN State:<\/strong> If
show vlan brief<\/code> marks a VLAN as act\/lshut<\/code>, enter vlan <id><\/code> configuration mode and execute no shutdown<\/code>.<\/li>\n- Missing VLAN in Database:<\/strong> If an access port is mapped to a non-existent VLAN ID, traffic is discarded. Run
vlan <id><\/code> to initialize it.<\/li>\n- DTP Negotiation Hangs:<\/strong> When connecting to non-Cisco equipment or devices with DTP turned off, an interface set to
dynamic desirable<\/code> or dynamic auto<\/code> may default to an access port instead of forming a trunk. Fix this by explicitly issuing switchport mode trunk<\/code>.<\/li>\n- Spanning Tree Blocking:<\/strong> Ensure Spanning Tree Protocol (STP) has not blocked the port due to bridge loops or BPDU Guard violations (
show spanning-tree vlan <id><\/code>).<\/li>\n<\/ul>\n
\n<\/span>Production-Ready VLAN Configuration Script Template<\/span><\/h2>\nUse this consolidated CLI script to deploy standard VLANs, configure edge access ports, and provision an 802.1Q trunk link. Replace bracketed placeholders (<...><\/code>) with your site-specific network values.<\/p>\n! ===================================================================\n! CISCO SWITCH BASELINE VLAN CONFIGURATION TEMPLATE\n! ===================================================================\n\nenable\nconfigure terminal\n\n! --- Step 1: Define Layer 2 VLANs ---\nvlan <VLAN_DATA_ID>\n name <DATA_NETWORK_NAME>\n exit\n\nvlan <VLAN_VOICE_ID>\n name <VOICE_NETWORK_NAME>\n exit\n\nvlan <VLAN_NATIVE_ID>\n name <NATIVE_MANAGEMENT_NAME>\n exit\n\n! --- Step 2: Configure Edge Access Ports ---\ninterface range <ACCESS_PORT_RANGE>\n description User-Access-Ports\n switchport mode access\n switchport access vlan <VLAN_DATA_ID>\n switchport voice vlan <VLAN_VOICE_ID>\n spanning-tree portfast\n spanning-tree bpduguard enable\n no shutdown\n exit\n\n! --- Step 3: Configure 802.1Q Uplink Trunk ---\ninterface <TRUNK_PORT_ID>\n description Uplink-Trunk-to-Core\n ! Uncomment the following line on older Catalyst hardware requiring manual encapsulation:\n ! switchport trunk encapsulation dot1q\n switchport mode trunk\n switchport nonegotiate\n switchport trunk native vlan <VLAN_NATIVE_ID>\n switchport trunk allowed vlan <VLAN_DATA_ID>,<VLAN_VOICE_ID>,<VLAN_NATIVE_ID>\n no shutdown\n exit\n\n! --- Step 4: Optional Layer 3 SVI Gateway (Multilayer Switches) ---\nip routing\n\ninterface vlan <VLAN_DATA_ID>\n description Default-Gateway-Data\n ip address <GATEWAY_DATA_IP> <NETMASK>\n no shutdown\n exit\n\n! --- Step 5: Commit Configuration ---\nend\nwrite memory\n<\/code><\/pre>\n
\n<\/span>Cisco Official Documentation and Technical References<\/span><\/h2>\nConsult authoritative Cisco technical documentation and command references to verify platform-specific limits, command deprecations, and release guidelines across different Cisco IOS and Cisco IOS-XE versions.<\/p>\n <\/span>1. Platform Documentation Hierarchies<\/span><\/h3>\n\n- Cisco Catalyst 9000 Series Switches (IOS-XE):<\/strong> Configuration guidelines for modern enterprise access and distribution platforms are documented under the Layer 2 Configuration Guide (Catalyst 9000 Switches)<\/em>. Specific chapters include “Configuring VLANs” and “Configuring VLAN Trunks.”<\/li>\n
- Cisco Catalyst 2960-X \/ 3650 \/ 3850 Series (Classic IOS \/ Early IOS-XE):<\/strong> Refer to the Software Configuration Guide, Cisco IOS Release 15.x<\/em>, specifically the “Configuring Normal-Range VLANs” and “Configuring Inter-VLAN Routing” sections.<\/li>\n<\/ul>\n
<\/span>2. Command References and Syntax Lookups<\/span><\/h3>\n
|