Switch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 20\n<\/code><\/pre>\n(Optional)<\/em> If the port also supports an IP phone with a PC daisy-chained behind it, configure an auxiliary voice VLAN alongside the data VLAN:<\/p>\nSwitch(config-if)# switchport voice vlan 150\n<\/code><\/pre>\n<\/span>Step 5: Exit Configuration Mode and Save Changes<\/span><\/h3>\nExit interface configuration and commit the active running configuration to NVRAM so changes persist across switch reboots:<\/p>\n
Switch(config-if)# end\nSwitch# copy running-config startup-config\nDestination filename [startup-config]? [Enter]\nBuilding configuration...\n[OK]\n<\/code><\/pre>\n
\n<\/span>Changing the VLAN on Multiple Ports Simultaneously<\/span><\/h2>\nWhen provisioning an entire department, floor, or switch module, updating ports one by one is inefficient. Cisco IOS provides the interface range<\/code> command to apply VLAN configurations across multiple contiguous or non-contiguous ports at once.<\/p>\n<\/span>Step 1: Enter Global Configuration Mode<\/span><\/h3>\nSwitch# configure terminal\nSwitch(config)#\n<\/code><\/pre>\n<\/span>Step 2: Define the Port Range<\/span><\/h3>\nUse the interface range<\/code> macro. You can specify a continuous block using a hyphen, separate non-contiguous ports with commas, or mix both:<\/p>\n\n- Contiguous range:<\/strong>
\n text
\n Switch(config)# interface range GigabitEthernet 1\/0\/1 - 24<\/code><\/li>\n- Non-contiguous ports and ranges:<\/strong>
\n text
\n Switch(config)# interface range GigabitEthernet 1\/0\/1 - 10, GigabitEthernet 1\/0\/15, GigabitEthernet 1\/0\/20 - 22<\/code><\/li>\n<\/ul>\nOnce entered, the prompt changes to Switch(config-if-range)#<\/code>.<\/p>\n<\/span>Step 3: Apply the New VLAN Assignment<\/span><\/h3>\nCommands entered in this mode execute simultaneously on every interface included in the range:<\/p>\n
Switch(config-if-range)# switchport mode access\nSwitch(config-if-range)# switchport access vlan 30\nSwitch(config-if-range)# no shutdown\n<\/code><\/pre>\n<\/span>Step 4: Exit and Commit to NVRAM<\/span><\/h3>\nSwitch(config-if-range)# end\nSwitch# write memory\nBuilding configuration...\n[OK]\n<\/code><\/pre>\n
\n<\/span>How to Verify Port VLAN Assignments<\/span><\/h2>\nAfter applying configuration changes, always verify that the interfaces are in the expected administrative and operational states. Three primary Cisco IOS commands provide complete visibility into switchport VLAN mappings.<\/p>\n
<\/span>1. Quick Table Overview: show interfaces status<\/code><\/span><\/h3>\nThe fastest way to view interface status and VLAN memberships in a tabular format is show interfaces status<\/code>.<\/p>\nSwitch# show interfaces status\n<\/code><\/pre>\nSample Output:<\/strong><\/p>\nPort Name Status Vlan Duplex Speed Type\nGi1\/0\/1 Workstation-A connected 30 a-full a-1000 10\/100\/1000BaseTX\nGi1\/0\/2 notconnect 30 auto auto 10\/100\/1000BaseTX\nGi1\/0\/12 Printer-Office connected 20 a-full a-100 10\/100\/1000BaseTX\nGi1\/0\/24 Uplink-Core connected trunk a-full a-1000 10\/100\/1000BaseTX\n<\/code><\/pre>\nCheck the Vlan<\/strong> column: access ports display their numerical VLAN ID, while trunk ports display trunk<\/code>.<\/p>\n<\/span>2. VLAN-Centric Audit: show vlan brief<\/code><\/span><\/h3>\nTo check which ports belong to a specific VLAN from the database perspective, use show vlan brief<\/code> or filter by VLAN ID:<\/p>\nSwitch# show vlan brief\n<\/code><\/pre>\nSample Output:<\/strong><\/p>\nVLAN Name Status Ports\n---- -------------------------------- --------- -------------------------------\n1 default active Gi1\/0\/13, Gi1\/0\/14\n20 Marketing active Gi1\/0\/12\n30 Engineering active Gi1\/0\/1, Gi1\/0\/2, Gi1\/0\/3\n<\/code><\/pre>\nTo isolate a single VLAN:<\/p>\n
Switch# show vlan id 20\n<\/code><\/pre>\n<\/span>3. Detailed Interface Inspection: show interfaces <interface> switchport<\/code><\/span><\/h3>\nFor an in-depth audit of an individual port\u2014including administrative mode, operational mode, access VLAN, and voice VLAN\u2014run:<\/p>\n
Switch# show interfaces GigabitEthernet 1\/0\/12 switchport\n<\/code><\/pre>\nKey Fields to Inspect:<\/strong>
\n* Administrative Mode: static access<\/code> (confirms manual access configuration)
\n* Operational Mode: static access<\/code> (confirms port is actively running in access mode)
\n* Access Mode VLAN: 20 (Marketing)<\/code> (confirms active data VLAN)
\n* Voice VLAN: 150<\/code> (confirms auxiliary voice VLAN assignment, if configured)<\/p>\n
\n<\/span>Ready-to-Use CLI Configuration Templates<\/span><\/h2>\nUse the following modular templates to quickly deploy single-port updates, multi-port migrations, or voice-enabled endpoints. Replace bracketed placeholders (e.g., <interface_id><\/code>, <vlan_id><\/code>) with your environment’s parameters.<\/p>\n<\/span>Template 1: Single Access Port Migration<\/span><\/h3>\nconfigure terminal\ninterface <interface_id>\n description <port_description>\n switchport mode access\n switchport access vlan <data_vlan_id>\n spanning-tree portfast\n no shutdown\nend\nwrite memory\n<\/code><\/pre>\n<\/span>Template 2: Port with Integrated Voice VLAN (IP Phone + Workstation)<\/span><\/h3>\nconfigure terminal\ninterface <interface_id>\n description Workstation-and-VoIP\n switchport mode access\n switchport access vlan <data_vlan_id>\n switchport voice vlan <voice_vlan_id>\n spanning-tree portfast\n trust device cisco-phone\n no shutdown\nend\nwrite memory\n<\/code><\/pre>\n<\/span>Template 3: Batch Port Range Migration<\/span><\/h3>\nconfigure terminal\ninterface range <slot\/start_port> - <end_port>\n switchport mode access\n switchport access vlan <data_vlan_id>\n spanning-tree portfast\n no shutdown\nend\nwrite memory\n<\/code><\/pre>\n<\/span>Template 4: Reverting a Port to Default VLAN 1<\/span><\/h3>\nconfigure terminal\ninterface <interface_id>\n no switchport access vlan\n no switchport voice vlan\n default interface <interface_id>\nend\nwrite memory\n<\/code><\/pre>\n
\n<\/span>Official Cisco VLAN Configuration Guidelines and Standards<\/span><\/h2>\nWhen managing VLAN architectures on Cisco Catalyst (running Cisco IOS or IOS XE) and Cisco Business Series platforms, configurations must adhere to standardized operating bounds documented in the Cisco Catalyst Software Configuration Guides<\/em>:<\/p>\n\n- VLAN Numbering Ranges<\/strong>:<\/li>\n
- Normal-Range VLANs (1\u20131005)<\/strong>: Supported on all switches. Configurations for VLANs 1 to 1005 are traditionally stored in flash memory within the
vlan.dat<\/code> file (or NVRAM depending on VTP mode). VLANs 1 and 1002\u20131005 are automatically created factory defaults and cannot be altered or deleted.<\/li>\n- Extended-Range VLANs (1006\u20134094)<\/strong>: Designed for service providers and large enterprise networks. Extended-range VLAN configurations are saved directly to the running configuration file (and subsequently startup configuration) when the switch operates in VLAN Trunking Protocol (VTP) transparent mode or VTP version 3 mode.<\/li>\n
- Default Port State<\/strong>: On enterprise Cisco Catalyst switches, all unconfigured physical interfaces belong to
VLAN 1<\/code> by default. Best practice security frameworks (such as the Cisco Hardening Guide) mandate relocating unused ports to an isolated blackhole VLAN and disabling them (shutdown<\/code>).<\/li>\n- Dynamic Trunking Protocol (DTP)<\/strong>: Many legacy Catalyst switches ship with switchports set to
dynamic auto<\/code> or dynamic desirable<\/code>. When assigning an access port, always execute switchport mode access<\/code> explicitly rather than relying solely on switchport access vlan <id><\/code>. This hardcodes the port state and suppresses DTP negotiation, preventing unauthorized trunk negotiation attacks.<\/li>\n