Switch(config-vlan)# name Sales_Department\nSwitch(config-vlan)# exit\nSwitch(config)#\n<\/code><\/pre>\n(Optional)<\/em> If you need to create multiple VLANs at once without assigning names immediately, you can supply a comma-separated list or range:<\/p>\nSwitch(config)# vlan 20,30,40-45\nSwitch(config-vlan)# exit\n<\/code><\/pre>\n<\/span>Step 5: Save the Configuration to Non-Volatile RAM (NVRAM)<\/span><\/h3>\nExit configuration mode and commit the changes from volatile memory (running-config<\/code>) to non-volatile storage (startup-config<\/code>):<\/p>\nSwitch(config)# end\nSwitch# copy running-config startup-config\nDestination filename [startup-config]? [Press Enter]\nBuilding configuration...\n[OK]\n<\/code><\/pre>\nAt this stage, the VLAN exists in the switch’s database, but no physical interfaces are actively passing traffic for it.<\/p>\n
\n<\/span>Assigning Switchports: Access vs. Trunk Ports<\/span><\/h2>\nFor a VLAN to handle network traffic, physical interfaces must be assigned to it. Cisco switchports typically operate in one of two Layer 2 modes:<\/p>\n
\n- Access Port:<\/strong> Dedicated to a single VLAN; designed to connect end devices such as PCs, printers, IP phones, or single-NIC servers. Access ports strip 802.1Q tags before sending frames out to endpoints.<\/li>\n
- Trunk Port:<\/strong> Designed to connect switch-to-switch or switch-to-router uplinks. Trunk ports multiplex traffic across multiple VLANs over a single link by appending an 802.1Q tag header to each frame.<\/li>\n<\/ul>\n
<\/span>Method 1: Assigning an Access Port to a Single Interface<\/span><\/h3>\nTo bind a specific physical port to your newly created VLAN:<\/p>\n
Switch# configure terminal\nSwitch(config)# interface GigabitEthernet 1\/0\/5\nSwitch(config-if)# description Workstation-Sales-01\nSwitch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 10\nSwitch(config-if)# spanning-tree portfast\nSwitch(config-if)# no shutdown\nSwitch(config-if)# end\n<\/code><\/pre>\nNote: The spanning-tree portfast<\/code> command allows edge access ports to bypass listening and learning states, moving immediately to the forwarding state to prevent DHCP timeout issues on boot.<\/em><\/p>\n<\/span>Method 2: Assigning an Access VLAN to a Range of Ports<\/span><\/h3>\nWhen provisioning multiple ports at once, use the interface range<\/code> macro:<\/p>\nSwitch# configure terminal\nSwitch(config)# interface range GigabitEthernet 1\/0\/1 - 12\nSwitch(config-if-range)# switchport mode access\nSwitch(config-if-range)# switchport access vlan 10\nSwitch(config-if-range)# spanning-tree portfast\nSwitch(config-if-range)# no shutdown\nSwitch(config-if-range)# end\n<\/code><\/pre>\n<\/span>Method 3: Configuring an 802.1Q Trunk Port<\/span><\/h3>\nTo allow the VLAN’s traffic to travel across an uplink to a core switch or distribution layer, configure a trunk port.<\/p>\n
Switch# configure terminal\nSwitch(config)# interface GigabitEthernet 1\/0\/48\nSwitch(config-if)# description UPLINK_TO_CORE\nSwitch(config-if)# switchport trunk encapsulation dot1q\nSwitch(config-if)# switchport mode trunk\nSwitch(config-if)# switchport trunk native vlan 99\nSwitch(config-if)# switchport trunk allowed vlan 10,20,30,99\nSwitch(config-if)# no shutdown\nSwitch(config-if)# end\n<\/code><\/pre>\nImportant Details:<\/em>
\n1. On newer switches (such as Catalyst 9000 series), the command switchport trunk encapsulation dot1q<\/code> is not required because 802.1Q is the only supported encapsulation protocol.
\n2. The switchport trunk allowed vlan<\/code> command restricts trunk links to carry only necessary traffic, which prevents broadcast floods from spreading across non-participating switches.
\n3. Changing the default native VLAN from VLAN 1 to an unused VLAN (e.g., VLAN 99) is an industry security standard that mitigates double-tagging VLAN hopping attacks.<\/p>\n
\n<\/span>Ready-to-Deploy VLAN Configuration Templates<\/span><\/h2>\nUse these pre-tested configuration scripts for rapid switch deployment. Replace bracketed placeholders (<...><\/code>) with your network values.<\/p>\n<\/span>Template 1: Multi-VLAN Setup with Access Port Assignments<\/span><\/h3>\n! ==========================================\n! TEMPLATE: Standard Multi-VLAN Deployment\n! ==========================================\nconfigure terminal\n\n! 1. Define VLANs\nvlan 10\n name DATA_DEPT\n!\nvlan 20\n name VOICE_DEPT\n!\nvlan 30\n name GUEST_WIFI\n!\nvlan 99\n name MANAGEMENT\n!\nexit\n\n! 2. Configure Access Ports for Users (VLAN 10 Data + VLAN 20 Voice)\ninterface range GigabitEthernet 1\/0\/1 - 24\n description User_Edge_Ports\n switchport mode access\n switchport access vlan 10\n switchport voice vlan 20\n spanning-tree portfast\n spanning-tree bpduguard enable\n no shutdown\nexit\n\n! 3. Configure Dedicated Ports for Guest Access (VLAN 30)\ninterface range GigabitEthernet 1\/0\/25 - 30\n description Guest_Access_Points\n switchport mode access\n switchport access vlan 30\n spanning-tree portfast\n no shutdown\nexit\n\nend\ncopy running-config startup-config\n<\/code><\/pre>\n<\/span>Template 2: Upstream Trunk Interface Configuration<\/span><\/h3>\n! ==========================================\n! TEMPLATE: High-Capacity Trunk Uplink\n! ==========================================\nconfigure terminal\n\ninterface GigabitEthernet 1\/0\/48\n description TRUNK_TO_DISTRIBUTION_SWITCH\n ! Modern IOS-XE uses dot1q by default; uncomment line below if on legacy IOS:\n ! switchport trunk encapsulation dot1q\n switchport mode trunk\n switchport trunk native vlan 99\n switchport trunk allowed vlan 10,20,30,99\n switchport nonegotiate\n no shutdown\nexit\n\nend\ncopy running-config startup-config\n<\/code><\/pre>\n
\n<\/span>Enabling Inter-VLAN Routing with Switch Virtual Interfaces (SVIs)<\/span><\/h2>\nBy default, Layer 2 VLANs isolate traffic completely. A device in VLAN 10 cannot ping or access a device in VLAN 20 without a Layer 3 routing mechanism.<\/p>\n
If you are deploying a Layer 3-capable Catalyst switch (such as a 3650, 3850, or Catalyst 9300), you can route traffic between VLANs at hardware speeds using Switch Virtual Interfaces (SVIs), also referred to as routed VLAN interfaces.<\/p>\n
<\/span>Step 1: Enable the Switch Routing Engine<\/span><\/h3>\nBy default, Layer 3 packet forwarding is disabled on many switch models. Activate it globally:<\/p>\n
Switch# configure terminal\nSwitch(config)# ip routing\n<\/code><\/pre>\n<\/span>Step 2: Configure the SVI for VLAN 10<\/span><\/h3>\nThe IP address assigned to the SVI serves as the default gateway for all endpoints residing in that VLAN:<\/p>\n
Switch(config)# interface vlan 10\nSwitch(config-if)# description Default_Gateway_VLAN10_Sales\nSwitch(config-if)# ip address 192.168.10.1 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 3: Configure the SVI for VLAN 20<\/span><\/h3>\nRepeat the process for the second subnet:<\/p>\n
Switch(config)# interface vlan 20\nSwitch(config-if)# description Default_Gateway_VLAN20_Voice\nSwitch(config-if)# ip address 192.168.20.1 255.255.255.0\nSwitch(config-if)# no shutdown\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 4: Verify the Routing Table<\/span><\/h3>\nEnsure the switch has registered both subnets as directly connected routes:<\/p>\n
Switch# show ip route\nCodes: C - connected, S - static, R - RIP, M - mobile, B - BGP\nGateway of last resort is not set\n\nC 192.168.10.0\/24 is directly connected, Vlan10\nC 192.168.20.0\/24 is directly connected, Vlan20\n<\/code><\/pre>\nNote on SVI State:<\/em> An SVI interface will show as Vlan10 is up, line protocol is up<\/code> only when at least one access port assigned to that VLAN is active (up\/up) or a trunk carrying that VLAN is active. If no ports in that VLAN are active, the SVI status remains down\/down<\/code>.<\/p>\n
\n<\/span>Troubleshooting and Verification FAQ<\/span><\/h2>\n<\/span>How do I verify that a VLAN has been created and active ports are assigned?<\/span><\/h3>\nRun the command show vlan brief<\/code> from Privileged EXEC mode. This command displays a table of all normal- and extended-range VLANs, their administrative state, and the physical ports associated with them:<\/p>\nSwitch# show vlan brief\n\nVLAN Name Status Ports\n---- -------------------------------- --------- -------------------------------\n1 default active Gi1\/0\/13, Gi1\/0\/14\n10 Sales_Department active Gi1\/0\/1, Gi1\/0\/2, Gi1\/0\/5\n20 Voice_Dept active \n99 MANAGEMENT active \n<\/code><\/pre>\nIf a port does not appear in this list, it has either been configured as a trunk port (trunk ports do not appear in show vlan brief<\/code>) or it remains in another VLAN.<\/p>\n<\/span>Why is a VLAN showing a status of “act\/lshut” or “suspended”?<\/span><\/h3>\nA status of act\/lshut<\/code> indicates that the VLAN has been administratively shut down in the VLAN database. To re-enable it:<\/p>\nSwitch# configure terminal\nSwitch(config)# vlan 10\nSwitch(config-vlan)# no shutdown\nSwitch(config-vlan)# end\n<\/code><\/pre>\nIf the status is suspended<\/code>, the VLAN was temporarily disabled using the state suspend<\/code> sub-command, or the switch received an overriding VTP update. Run state active<\/code> within the vlan <vlan-id><\/code> context to resolve it.<\/p>\n<\/span>Why are devices inside the same VLAN unable to communicate?<\/span><\/h3>\nIf two devices plugged into ports within the same VLAN cannot reach each other, verify the following:
\n1. Port Status:<\/strong> Run show interfaces status<\/code> to ensure the physical links are connected (connected<\/code>, not notconnect<\/code> or err-disabled<\/code>).
\n2. Access Assignment:<\/strong> Run show interfaces <interface-id> switchport<\/code> and verify the line Access Mode VLAN: <vlan-id><\/code> matches on both switchports.
\n3. Port Security \/ BPDU Guard:<\/strong> If a port is in an err-disabled<\/code> state, check for MAC violations or unauthorized switches\/bridges connected to PortFast-enabled ports.<\/p>\n<\/span>How do I check if an uplink is passing trunked VLAN traffic?