VLANs & Trunking

Virtual Local Area Networks (VLANs) represent one of the most powerful and fundamental technologies in modern networking, enabling network administrators to logically segment a single physical switched network into multiple isolated broadcast domains. Before VLANs existed, network segmentation required separate physical switches for each department or security zone—an expensive and inflexible approach. VLANs solve this limitation by allowing a single switch to host multiple logical networks, each functioning as if it had its own dedicated hardware. The primary benefits of VLAN implementation are substantial and multifaceted. Security improves dramatically because devices in different VLANs cannot communicate without passing through a Layer 3 device (router or Layer 3 switch), where access control lists and firewall rules can enforce security policies. For example, you might place all accounting department computers in VLAN 10 and HR computers in VLAN 20, ensuring that HR employees cannot accidentally or maliciously access accounting servers without explicit routing permission. This segmentation creates clear security boundaries at the network layer. Broadcast control provides another critical advantage. In a traditional flat network, broadcast frames (like ARP requests or DHCP discoveries) propagate to every device on the network, consuming bandwidth and processing power on devices that don't need to see these frames. VLANs contain broadcasts within their VLAN boundary—an ARP broadcast from a device in VLAN 10 only reaches other VLAN 10 devices, not the entire switch. This broadcast domain containment significantly improves network performance, especially in large networks with hundreds or thousands of devices. Smaller broadcast domains mean faster convergence, less wasted bandwidth, and better overall network efficiency. Flexibility and ease of management represent perhaps the most practical daily benefits of VLANs. Users can be logically grouped regardless of physical location. An accounting employee on the third floor and another on the first floor can both belong to VLAN 10 and access the same resources with identical security policies, even though they connect to different physical switches. When an employee changes departments, you simply reassign their switch port to a different VLAN rather than physically moving cables or reconfiguring multiple devices. This logical flexibility dramatically reduces administrative overhead and enables rapid network changes to accommodate organizational restructuring. VLAN identification uses VLAN IDs ranging from 1 to 4094, providing 4,094 possible VLANs (VLAN 0 and 4095 are reserved and cannot be used). However, not all VLANs in this range are equally available. VLAN 1 is the default VLAN that exists on all Cisco switches and cannot be deleted—all switch ports belong to VLAN 1 by default until reconfigured. VLANs 1002-1005 are reserved for legacy Token Ring and FDDI networks and cannot be deleted in most switch configurations. VLANs 1-1005 are considered the normal range and are stored in the vlan.dat file on the switch, while VLANs 1006-4094 are the extended range, requiring VTP transparent mode and storage in the running-config file. Best practices recommend never using VLAN 1 for user traffic or as the native VLAN on trunk ports due to well-documented security vulnerabilities. Instead, configure all switch ports into other VLANs and use a dedicated VLAN (often VLAN 999 or similar high number) as the native VLAN on trunks. This simple practice significantly improves network security by preventing VLAN hopping attacks and other exploits that target the default VLAN 1 configuration. Understanding VLAN fundamentals is essential for the CCNA exam and for designing secure, efficient enterprise networks.

Switch ports operate in two fundamentally different modes that determine how they handle VLAN traffic: access mode and trunk mode. Understanding the critical differences between these modes, when to use each, and how they interact is essential for both CCNA exam success and practical network configuration. Misconfiguring port modes represents one of the most common mistakes in networking, often resulting in connectivity failures or security vulnerabilities. Access ports are designed to connect end-user devices—computers, printers, IP phones, servers, access points, or any device that isn't VLAN-aware. An access port belongs to exactly one VLAN and carries traffic for only that VLAN. When a frame enters an access port, the switch tags it internally with the port's assigned VLAN ID for processing within the switch. When a frame exits an access port toward the end device, the switch removes any VLAN tag, sending the frame as a standard Ethernet frame without VLAN information. The connected device remains completely unaware of VLANs—it simply sends and receives normal Ethernet frames. This transparency makes access ports appropriate for virtually all end-user equipment. Configuring an access port requires two simple commands in interface configuration mode. First, 'switchport mode access' explicitly sets the port to access mode, preventing accidental trunking through DTP (Dynamic Trunking Protocol) negotiation. Second, 'switchport access vlan X' assigns the port to a specific VLAN number. For example, to assign port FastEthernet0/5 to VLAN 20, you would enter interface configuration mode and issue 'switchport mode access' followed by 'switchport access vlan 20'. If the specified VLAN doesn't exist, the switch automatically creates it when you commit the configuration. Best practice recommends disabling DTP on access ports using 'switchport nonegotiate' to prevent potential security exploits and reduce unnecessary protocol overhead. Trunk ports, in stark contrast, are designed to carry traffic for multiple VLANs simultaneously, typically connecting switches to other switches or to routers performing inter-VLAN routing. Trunk ports accomplish this multiplexing by adding VLAN tags to frames, allowing the receiving device to identify which VLAN each frame belongs to. Without trunking, you would need separate physical cables for each VLAN between switches—clearly impractical in networks with dozens or hundreds of VLANs. A single trunk port can carry traffic for all VLANs configured on the switch, consolidating what would require hundreds of physical cables into one connection. The dominant trunking protocol is 802.1Q, an IEEE standard supported by virtually all modern switches regardless of manufacturer. When a frame from VLAN 20 enters a trunk port, the switch inserts a 4-byte 802.1Q tag into the Ethernet frame header, identifying the frame as belonging to VLAN 20. This tag includes the VLAN ID, priority information for Quality of Service (QoS), and a Canonical Format Indicator. The receiving switch reads this tag, removes it, and forwards the frame appropriately based on its VLAN membership. Cisco's older ISL (Inter-Switch Link) protocol is proprietary and largely obsolete, though you may encounter it on legacy equipment. Configuring trunk ports requires careful attention to detail. The basic command 'switchport mode trunk' sets the port to permanent trunking mode. However, additional configuration often proves necessary. 'switchport trunk allowed vlan' controls which VLANs can traverse the trunk—by default, all VLANs are allowed, but security best practices recommend explicitly allowing only needed VLANs using 'switchport trunk allowed vlan 10,20,30' syntax. The 'switchport trunk native vlan X' command sets the native VLAN, which deserves special attention in the next lesson. Understanding the fundamental difference between access and trunk ports prevents configuration errors and enables efficient network design.

The 802.1Q trunking protocol, defined by the IEEE 802.1Q standard, represents the universal method for carrying multiple VLANs across a single physical link in modern networks. Understanding how 802.1Q tagging works, the role of the native VLAN, and common configuration pitfalls is crucial for CCNA certification and safe network operation. While the concept seems straightforward—adding a tag to identify VLAN membership—the implementation details and security implications require careful study. The 802.1Q tag is a 4-byte (32-bit) insertion into the Ethernet frame header, placed between the source MAC address field and the EtherType/Length field. This tag doesn't encapsulate the original frame (like ISL did); instead, it modifies the existing frame by inserting additional information. The tag structure includes several components: a 16-bit Tag Protocol Identifier (TPID) set to 0x8100 (identifying this as an 802.1Q frame), a 3-bit Priority Code Point (PCP) for QoS priority marking, a 1-bit Canonical Format Indicator (CFI) for compatibility with Token Ring networks, and most importantly, a 12-bit VLAN Identifier (VID) providing 4,096 possible VLAN values (0-4095, though 0 and 4095 are reserved). When a switch receives an untagged frame on an access port, it internally assigns the frame to that port's configured VLAN. When forwarding this frame to a trunk port, the switch inserts an 802.1Q tag identifying the VLAN. The receiving switch examines the tag, determines VLAN membership, removes the tag if forwarding to an access port, or may modify and retain it if forwarding to another trunk. This process happens at wire speed in modern switches using specialized ASIC hardware, ensuring VLAN tagging doesn't impact network performance. The native VLAN concept introduces a critical exception to the tagging process and represents one of the most misunderstood and security-sensitive aspects of trunking. Frames belonging to the native VLAN traverse trunk links without 802.1Q tags—they're sent as standard, untagged Ethernet frames. The native VLAN serves two purposes: backward compatibility with non-VLAN-aware devices that might connect to a trunk port, and providing a default VLAN for untagged traffic. By default, VLAN 1 serves as the native VLAN on all Cisco switches, though this can and should be changed. The native VLAN configuration on both ends of a trunk must match—this is absolutely critical. If Switch A uses native VLAN 1 and Switch B uses native VLAN 99 on the same trunk, serious problems occur. Frames sent from Switch A in VLAN 1 arrive untagged at Switch B, which assigns them to VLAN 99 because that's its native VLAN. Traffic crosses VLAN boundaries without authorization, security policies fail, and connectivity becomes unpredictable. Cisco switches generate CDP warnings when native VLAN mismatches are detected, but these warnings are often ignored or missed. Always verify native VLAN consistency using 'show interfaces trunk' on both trunk ends. Security best practices strongly recommend changing the native VLAN from the default VLAN 1 to an unused VLAN number, typically a high number like 999. This prevents VLAN hopping attacks where an attacker sends frames with double 802.1Q tags to access VLANs they shouldn't reach. The outer tag specifies the native VLAN (untagged by the first switch), while the inner tag specifies the target VLAN (processed by the receiving switch). By using an unused VLAN as the native VLAN and ensuring no access ports are assigned to it, you eliminate one attack vector. Configure native VLAN with 'switchport trunk native vlan 999' on both trunk ends. Additional trunk security measures include explicitly defining allowed VLANs using 'switchport trunk allowed vlan 10,20,30,40' rather than allowing all VLANs by default. This limits VLAN propagation across the trunk to only necessary VLANs. Disable DTP (Dynamic Trunking Protocol) using 'switchport nonegotiate' to prevent trunk negotiation exploits. Understanding 802.1Q trunking thoroughly enables you to design secure, efficient switched networks and troubleshoot VLAN connectivity issues rapidly.

VLANs create Layer 2 broadcast domains that are completely isolated from each other by design—devices in different VLANs cannot communicate without a Layer 3 device to route traffic between them. This isolation provides excellent security and broadcast control, but it creates a problem: how do users in different VLANs communicate when necessary? For example, accounting users in VLAN 10 need to access a database server in VLAN 30, or HR users in VLAN 20 need to print to a printer in VLAN 40. Inter-VLAN routing solves this challenge by introducing Layer 3 routing functionality to forward traffic between VLANs while maintaining security through access control. Historically, inter-VLAN routing was accomplished using a traditional router with separate physical interfaces connected to each VLAN. Each router interface connected to a switch access port assigned to a specific VLAN, and the router forwarded packets between its interfaces based on IP routing. While functional, this approach doesn't scale well—a network with 20 VLANs would require a router with 20 physical interfaces, quickly consuming available ports and becoming economically impractical. This method, though outdated, helps understand the fundamental concept: routing is required to move packets between different IP subnets (which correspond to different VLANs in most designs). Router-on-a-stick represents a more efficient evolution that uses subinterfaces and VLAN trunking to eliminate the need for multiple physical router interfaces. In this configuration, a single physical router interface connects to a switch trunk port carrying multiple VLANs. The router creates virtual subinterfaces (like GigabitEthernet0/0.10, GigabitEthernet0/0.20, etc.), each configured for a specific VLAN using 802.1Q encapsulation. Each subinterface receives an IP address serving as the default gateway for its VLAN. For example, subinterface g0/0.10 might have IP 192.168.10.1 and serve as the gateway for VLAN 10 (subnet 192.168.10.0/24), while g0/0.20 has IP 192.168.20.1 for VLAN 20. Configuration requires several coordinated steps. On the switch side, configure the port connecting to the router as a trunk: 'switchport mode trunk' and explicitly allow necessary VLANs. On the router, create subinterfaces using 'interface gigabitEthernet0/0.10' (where .10 conventionally matches VLAN 10, though the number is arbitrary). Specify VLAN encapsulation with 'encapsulation dot1q 10', assign an IP address with 'ip address 192.168.10.1 255.255.255.0', and bring up the subinterface. Repeat for each VLAN requiring routing. The physical interface must be enabled using 'no shutdown' in interface configuration mode—a common oversight that prevents all subinterfaces from working. While router-on-a-stick works acceptably for small networks, it has limitations. All inter-VLAN traffic must traverse the single physical link to the router and back, potentially creating a bottleneck. If 100 devices in VLAN 10 simultaneously access servers in VLAN 20, the router interface can become saturated even with Gigabit connectivity. Modern networks overcome this limitation using Layer 3 switches that integrate routing functionality directly into the switch hardware. Layer 3 switches perform inter-VLAN routing using Switch Virtual Interfaces (SVIs), also called VLAN interfaces. An SVI is a virtual Layer 3 interface representing a VLAN, configured with 'interface vlan 10' followed by 'ip address 192.168.10.1 255.255.255.0'. IP routing must be enabled globally using 'ip routing' (often disabled by default on Layer 2 switches). Traffic between VLANs routes internally within the switch at wire speed using ASIC hardware, providing dramatically better performance than router-on-a-stick. Modern enterprise networks almost exclusively use Layer 3 switches for inter-VLAN routing due to superior performance, reduced complexity, and better scalability. Understanding both methods prepares you for CCNA exam scenarios and real-world network design decisions.