VLANs & Trunking Lab

VLAN Theory

A VLAN (Virtual LAN) is a logical grouping of switch ports that creates a separate broadcast domain. Devices in different VLANs cannot communicate at Layer 2 — a router or Layer 3 switch is needed for inter-VLAN routing.

Trunks carry multiple VLANs between switches and to routers using 802.1Q tagging — a 4-byte tag inserted into the Ethernet frame identifying which VLAN the frame belongs to.

Step 1 — Create VLANs

# On Cisco switch
Switch> enable
Switch# configure terminal

# Create VLANs
vlan 10
 name SALES
vlan 20
 name IT
vlan 30
 name MANAGEMENT
vlan 99
 name NATIVE
vlan 999
 name UNUSED

# Verify VLANs were created
show vlan brief

Step 2 — Access Port Configuration

# Assign a single port to a VLAN (PC connection)
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
 no shutdown

interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20
 no shutdown

# Configure a range of ports at once
interface range FastEthernet0/3-10
 switchport mode access
 switchport access vlan 10
 no shutdown

Step 3 — Trunk Port Configuration

# Uplink to router or another switch (carries all VLANs)
interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q   # required on older IOS
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 no shutdown

# Add a VLAN to existing trunk allowed list
 switchport trunk allowed vlan add 40

# Remove a VLAN from trunk
 switchport trunk allowed vlan remove 30

Step 4 — Native VLAN

# Set native VLAN to VLAN 99 (must match on both ends!)
interface GigabitEthernet0/1
 switchport trunk native vlan 99

# Verify trunk config
show interfaces trunk

# Shut down VLAN 1 to prevent use
interface vlan 1
 shutdown

Step 5 — Verify VLANs

# Show all VLANs and assigned ports
show vlan brief

# Show trunk ports
show interfaces trunk

# Show specific interface switchport config
show interfaces FastEthernet0/1 switchport

# Check what VLAN a port is in
show mac address-table vlan 10

Step 6 — Router-on-a-Stick (Inter-VLAN Routing)

One physical router interface with sub-interfaces — one per VLAN. The trunk carries all VLAN traffic to the router, which routes between them.

# On the switch: trunk port toward router
interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

# On the router: sub-interfaces
interface GigabitEthernet0/0
 no ip address
 no shutdown

interface GigabitEthernet0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

interface GigabitEthernet0/0.30
 encapsulation dot1q 30
 ip address 192.168.30.1 255.255.255.0

# Hosts in VLAN 10 use 192.168.10.1 as default gateway
# Hosts in VLAN 20 use 192.168.20.1 as default gateway

Step 7 — Layer 3 Switch (SVIs)

A Layer 3 switch has built-in routing. SVIs (Switched Virtual Interfaces) are virtual Layer 3 interfaces for each VLAN — no external router needed.

# Enable IP routing on L3 switch
ip routing

# Create SVI for each VLAN
interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown

interface vlan 30
 ip address 192.168.30.1 255.255.255.0
 no shutdown

# Verify SVIs
show ip interface brief | include Vlan

Step 8 — Voice VLANs

# Port with both data and voice VLAN (IP phone + PC)
interface FastEthernet0/5
 switchport mode access
 switchport access vlan 10      # data VLAN for PC
 switchport voice vlan 50       # voice VLAN for IP phone
 spanning-tree portfast

Step 9 — Security & Trunk Pruning

# VLAN Pruning — only allow needed VLANs on each trunk
# (Reduces broadcast traffic on trunks)
interface GigabitEthernet0/1
 switchport trunk allowed vlan 10,20   # only what's needed

# Disable DTP (Dynamic Trunking Protocol) — prevent VLAN hopping
interface FastEthernet0/1
 switchport mode access
 switchport nonegotiate   # disable DTP

# Shutdown unused ports and assign to unused VLAN
interface range FastEthernet0/20-24
 switchport mode access
 switchport access vlan 999
 shutdown

📋 VLAN Command Reference