Switch(config)# vlan 10\nSwitch(config-vlan)# name CORPORATE_DATA\nSwitch(config-vlan)# exit\n\nSwitch(config)# vlan 20\nSwitch(config-vlan)# name VOIP_TELEPHONY\nSwitch(config-vlan)# exit\n<\/code><\/pre>\nNote: Entering the vlan <id><\/code> command automatically generates the VLAN in the local vlan.dat<\/code> database.<\/em><\/p>\n<\/span>Step 3: Select the Target Physical Interface<\/span><\/h3>\nSelect the individual interface connecting to your end device, or specify a continuous range of ports using the range<\/code> keyword:<\/p>\nSwitch(config)# interface GigabitEthernet1\/0\/5\n<\/code><\/pre>\nTo configure ports 1 through 12 simultaneously:<\/em><\/p>\nSwitch(config)# interface range GigabitEthernet1\/0\/1 - 12\n<\/code><\/pre>\n<\/span>Step 4: Configure the Port as an Access Link<\/span><\/h3>\nForce the port mode to access, which prevents it from forming dynamic trunk links via Dynamic Trunking Protocol (DTP), and assign it to the desired data VLAN:<\/p>\n
Switch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 10\n<\/code><\/pre>\n<\/span>Step 5: (Optional) Apply Auxiliary Voice VLAN and Spanning Tree PortFast<\/span><\/h3>\nWhen deploying an IP phone with an integrated switch port connected to a PC, add the voice VLAN and enable Spanning Tree PortFast to bypass listening and learning states:<\/p>\n
Switch(config-if)# switchport voice vlan 20\nSwitch(config-if)# spanning-tree portfast\nSwitch(config-if)# exit\n<\/code><\/pre>\n<\/span>Step 6: Commit Changes to Non-Volatile Storage<\/span><\/h3>\nReturn to Privileged EXEC mode and write the running configuration to the startup configuration:<\/p>\n
Switch(config)# end\nSwitch# copy running-config startup-config\n<\/code><\/pre>\n
\n<\/span>Configuring 802.1Q Trunk Ports and Managing Allowed VLANs<\/span><\/h2>\nWhen traffic from multiple VLANs must traverse a single physical cable between two switches or between a switch and a router, access mode is insufficient. An 802.1Q Trunk Link<\/strong> must be configured to tag frames with their originating VLAN identifier as they cross the boundary.<\/p>\n+--------------------+ +--------------------+\n| Cisco Switch A | [Trunk Link: 802.1Q] | Cisco Switch B |\n| VLAN 10, 20, 99 |=======================| VLAN 10, 20, 99 |\n| Gi1\/0\/24 (Trunk) | | Gi1\/0\/24 (Trunk) |\n+--------------------+ +--------------------+\n<\/code><\/pre>\n<\/span>Step 1: Select the Uplink Interface<\/span><\/h3>\nIdentify the interconnecting physical port (for example, GigabitEthernet1\/0\/24):<\/p>\n
Switch# configure terminal\nSwitch(config)# interface GigabitEthernet1\/0\/24\nSwitch(config-if)# description UPLINK_TO_DISTRIBUTION_SWITCH\n<\/code><\/pre>\n<\/span>Step 2: Set Trunk Encapsulation (Platform Dependent)<\/span><\/h3>\nLegacy Cisco Catalyst switches (such as the 3560 or 3750) support both Cisco Inter-Switch Link (ISL) and IEEE 802.1Q encapsulation. On these devices, you must define 802.1Q encapsulation before setting the trunk mode. Modern switches (including the Catalyst 2960, 9200, and 9300 series) run 802.1Q natively and skip this requirement:<\/p>\n
Switch(config-if)# switchport trunk encapsulation dot1q\n<\/code><\/pre>\n<\/span>Step 3: Force the Interface into Permanent Trunk Mode<\/span><\/h3>\nSet the port mode explicitly to trunk, and disable Dynamic Trunking Protocol (DTP) negotiation frames to harden the link against unauthorized trunk negotiation:<\/p>\n
Switch(config-if)# switchport mode trunk\nSwitch(config-if)# switchport nonegotiate\n<\/code><\/pre>\n<\/span>Step 4: Redefine the Native VLAN<\/span><\/h3>\nMove the native VLAN away from default VLAN 1 to a dedicated, unrouted native VLAN ID (e.g., VLAN 999):<\/p>\n
Switch(config-if)# switchport trunk native vlan 999\n<\/code><\/pre>\nCrucial: Ensure the identical native VLAN ID is configured on the opposing switch interface to prevent native VLAN mismatch alerts.<\/em><\/p>\n<\/span>Step 5: Prune Unused VLANs with the Allowed List<\/span><\/h3>\nBy default, a Cisco trunk forwards traffic for all active VLANs (1\u20134094). To conserve bandwidth and prevent unnecessary broadcast propagation across switches, restrict the trunk to only active, authorized VLANs:<\/p>\n
Switch(config-if)# switchport trunk allowed vlan 10,20,99\n<\/code><\/pre>\nTip: When adding future VLANs, always use switchport trunk allowed vlan add <id><\/code>. Running the base command without add<\/code> overwrites the existing list with the newly specified ID.<\/em><\/p>\nSwitch(config-if)# end\n<\/code><\/pre>\n
\n<\/span>Inter-VLAN Routing Architectures: Router-on-a-Stick vs. Layer 3 Switch<\/span><\/h2>\nBecause VLANs isolate traffic at Layer 2, devices in different VLANs cannot communicate without a Layer 3 routing mechanism. Two primary architectural models handle inter-VLAN routing in enterprise networks: Router-on-a-Stick (ROAS)<\/strong> and Layer 3 Switch Multi-Layer Routing<\/strong> using Switch Virtual Interfaces (SVIs).<\/p>\n<\/span>Architectural Comparison<\/span><\/h3>\n\n\n\n| Architecture Feature<\/th>\n | Router-on-a-Stick (ROAS)<\/th>\n | Layer 3 Switch (SVI \/ Multi-Layer Routing)<\/th>\n<\/tr>\n<\/thead>\n |
\n\nPrimary Hardware Device<\/strong><\/td>\n| Layer 2 Switch paired with an external Router<\/td>\n | Layer 3 Multi-Layer Switch (e.g., Catalyst 9300)<\/td>\n<\/tr>\n | \nForwarding Plane<\/strong><\/td>\n| Software\/ASIC router subinterfaces<\/td>\n | Dedicated Application-Specific Integrated Circuits (ASICs)<\/td>\n<\/tr>\n | \nThroughput & Bandwidth<\/strong><\/td>\n| Bottlenecked by the single physical link to the router<\/td>\n | Line-rate hardware switching across backplane<\/td>\n<\/tr>\n | \nLatency<\/strong><\/td>\n| Higher (traffic leaves switch, hits router, re-enters switch)<\/td>\n | Ultra-low (routed inside the switch chassis)<\/td>\n<\/tr>\n | \nConfiguration Model<\/strong><\/td>\n| Subinterfaces with 802.1Q encapsulation tags<\/td>\n | Routed ports or Switched Virtual Interfaces (interface Vlan <id><\/code>)<\/td>\n<\/tr>\n\nScalability<\/strong><\/td>\n| Limited; practical for small branches and labs<\/td>\n | Enterprise-grade; supports thousands of endpoints<\/td>\n<\/tr>\n | \nPhysical Cabling Complexity<\/strong><\/td>\n| Single physical trunk link (“stick”)<\/td>\n | No external loopback cable required; internal routing<\/td>\n<\/tr>\n | \nCost<\/strong><\/td>\n| Low (reuses existing branch router)<\/td>\n | Higher (requires Layer 3 capable switch hardware)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/span>When to Select Each Model<\/span><\/h3>\n\n- Router-on-a-Stick:<\/strong> Ideal for small branch offices, retail locations, or lab networks where inter-VLAN traffic volume is low, and budget constraints prevent deploying multi-layer switches.<\/li>\n
- Layer 3 Switch (SVI):<\/strong> The enterprise standard for campus cores, distribution layers, and data centers. High-volume, east-west inter-VLAN communication is processed at multi-gigabit line rates without traversing external router uplinks.<\/li>\n<\/ul>\n
\n<\/span>Verification and Troubleshooting: Frequently Asked Questions<\/span><\/h2>\nAfter completing VLAN and trunk configurations, verify operational state and diagnose any discrepancies using the following troubleshooting guidelines.<\/p>\n <\/span>How do I verify active VLANs and assigned ports on a Cisco switch?<\/span><\/h3>\nExecute show vlan brief<\/code> from Privileged EXEC mode. This display lists all created VLANs, their administrative status (active<\/code> or act\/unsup<\/code>), and every physical port assigned to each VLAN in access mode.<\/p>\nSwitch# show vlan brief\n\nVLAN Name Status Ports\n---- -------------------------------- --------- -------------------------------\n1 default active Gi1\/0\/13, Gi1\/0\/14\n10 CORPORATE_DATA active Gi1\/0\/1, Gi1\/0\/2, Gi1\/0\/3, Gi1\/0\/4\n20 VOIP_TELEPHONY active Gi1\/0\/1, Gi1\/0\/2\n99 MANAGEMENT active \n<\/code><\/pre>\nTo view trunk ports (which do not appear under show vlan brief<\/code>), run:<\/p>\nSwitch# show interfaces trunk\n<\/code><\/pre>\nThis confirms trunking encapsulation, operational status, native VLAN mapping, and the list of allowed VLANs.<\/p>\n <\/span>Why is an access port showing an “inactive” VLAN state?<\/span><\/h3>\nA port shows an
| | | | | | | | | |