Days 16, 17, 18: VLANs

VLANs: CCNA Reference Sheet

Core Definitions

VLAN (Virtual LAN): Logical grouping of network devices; segments a physical network into isolated broadcast domains at Layer 2 (Data Link Layer).

LAN / Broadcast Domain: Single group of devices receiving broadcast frames (Dst MAC: FFFF.FFFF.FFFF) sent by any member.

Access Port: Belongs to a single VLAN; connects to end hosts; does NOT tag frames.

Trunk Port: Carries traffic from multiple VLANs over a single link using VLAN tagging; connects switches/routers.

Native VLAN: Special VLAN on trunk port that does NOT get tagged when sent; default = VLAN 1.

802.1Q Tag: 4-byte VLAN tag inserted between Src MAC and Type/Length fields in Ethernet frame.

Switch Virtual Interface (SVI): Virtual Layer 3 interface on multilayer switch representing a VLAN; acts as default gateway.

Layer 3 Switch / Multilayer Switch: Device combining switch (L2) + router (L3) functionality; performs inter-VLAN routing internally.

 

---

 

VLAN Benefits vs. Drawbacks

 

---

 

How VLANs Work

Key Rule: Switches do NOT forward traffic between VLANs.

Switch Logic:

1. Receive frame on interface in VLAN X

2. Check destination MAC

3. If destination in VLAN X → forward normally

4. If destination in different VLAN → DROP (do not forward)

Inter-VLAN Routing Required: Traffic must pass through router or Layer 3 switch.

Flow: Source VLAN → Router/L3 Switch (strips VLAN, routes IP, re-tags) → Destination VLAN

 

---

 

Access Port Configuration

Switch(config)# vlan 10

Switch(config-vlan)# name Engineering

Switch(config-vlan)# exit

Switch(config)# interface Fa0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10

Switch(config-if)# exit

Switch(config)# interface range Fa0/2-3

Switch(config-if-range)# switchport mode access

Switch(config-if-range)# switchport access vlan 10

Switch(config-if-range)# exit

Default VLANs (cannot delete):

• VLAN 1: default (exists by default, cannot be removed)

• VLANs 1002-1005: reserved for legacy protocols

Verification:

show vlan brief                    → List all VLANs and assigned ports

show interfaces Fa0/1 switchport   → Detailed switchport info

show vlan id 10                    → Info for specific VLAN

 

---

 

Trunk Ports & 802.1Q Tagging

Trunk Configuration

Switch(config)# interface g0/0

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 10

Switch(config-if)# switchport trunk allowed vlan 10,20,30

Switch(config-if)# exit

Verification:

show interfaces trunk              → Shows encapsulation, status, native VLAN, allowed VLANs

802.1Q Tag Structure

4-Byte Tag inserted between Src MAC and Type/Length:

VLAN Ranges:

• 0: Reserved (not used)

• 1–1005: Standard range

  • 1: Default (always exists)

  • 2–1005: User-defined

  • 1002–1005: Legacy protocols (reserved)

• 1006–4094: Extended range (requires special switch mode; not common in CCNA)

• 4095: Reserved (not used)

• Total usable: 1–4094 (4,094 VLANs)

Native VLAN

Behavior:

• Frames on native VLAN are sent untagged (no 4-byte tag)

• Smaller frame size (4 bytes smaller); faster transmission

• Default native VLAN = VLAN 1

Critical Rule: Native VLAN must MATCH on both ends of trunk or frames go to wrong VLAN.

Example Mismatch:

SW1: Native VLAN = 10

SW2: Native VLAN = 1

Result:

  SW1 sends VLAN 10 untagged

  SW2 receives untagged frames on VLAN 1 (wrong!)

  → VLAN mismatch

Configuration:

Switch(config-if)# switchport trunk native vlan 10

 

---

 

Router on a Stick (ROAS)

Use Case: Route between VLANs when router has only one physical interface.

Switch Configuration (Trunk):

Switch(config)# interface g0/0

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# exit

Router Configuration (Sub-Interfaces):

Router(config)# interface g0/0

Router(config-if)# no shutdown

Router(config-if)# exit

Router(config)# interface g0/0.10

Router(config-subif)# encapsulation dot1q 10

Router(config-subif)# ip address 192.168.10.254 255.255.255.0

Router(config-subif)# exit

Router(config)# interface g0/0.20

Router(config-subif)# encapsulation dot1q 20

Router(config-subif)# ip address 192.168.20.254 255.255.255.0

Router(config-subif)# exit

Router(config)# interface g0/0.30

Router(config-subif)# encapsulation dot1q 30

Router(config-subif)# ip address 192.168.30.254 255.255.255.0

Router(config-subif)# exit

Native VLAN Methods:

• Method 1: encapsulation dot1q 10 native (sub-interface)

• Method 2: IP address on physical interface = native VLAN (VLAN 10)

Verification:

show ip interface brief            → Shows sub-interfaces and status

show ip route                      → Routing table for all VLANs

How ROAS Works:

1. Router receives tagged frame on g0/0

2. Router examines VLAN tag (e.g., VLAN 10)

3. Router directs to sub-interface g0/0.10

4. Sub-interface routes based on IP address

5. Reply sent out appropriate sub-interface with VLAN tag re-added

 

---

 

Layer 3 Switching & SVIs

Layer 3 Switch: Combines switching (L2) + routing (L3) internally; no external router needed for inter-VLAN routing.

Advantages:

• Performance: Inter-VLAN routing via ASICs (hardware-based); much faster than ROAS

• Cost: Single device replaces switch + router

• Simplicity: All VLAN management in one device

• Scalability: Supports many VLANs with fast internal routing

SVI (Switch Virtual Interface) Configuration

Switch(config)# ip routing                    → Enable routing on switch

Switch(config)# interface vlan 10

Switch(config-if)# ip address 192.168.10.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 20

Switch(config-if)# ip address 192.168.20.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 30

Switch(config-if)# ip address 192.168.30.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

SVI Status Conditions (must be "up/up"):

1. VLAN must exist on switch

2. At least ONE active port in VLAN (access or trunk allowing VLAN) must be "up/up"

3. SVI must not be shut down

SVI Status Meanings:

• up/up: SVI operational; VLAN exists; active port present; SVI not shut down

• down/down: VLAN missing, no active ports, or SVI is shut down

Verification:

show interface vlan 10             → Detailed SVI info (status, IP, MAC)

show ip interface brief             → All L3 interfaces and status

show ip route                       → Routing table

Converting ROAS to Layer 3 Switching

Remove ROAS from Router:

Router(config)# no interface g0/0.10

Router(config)# no interface g0/0.20

Router(config)# no interface g0/0.30

Router(config)# interface g0/0

Router(config-if)# ip address 192.168.1.194 255.255.255.0

Router(config-if)# no shutdown

Configure Multilayer Switch:

Switch(config)# ip routing

Switch(config)# interface g0/0

Switch(config-if)# no switchport                 → Convert to Layer 3 routed port

Switch(config-if)# ip address 192.168.1.193 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 10

Switch(config-if)# ip address 192.168.10.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 20

Switch(config-if)# ip address 192.168.20.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 30

Switch(config-if)# ip address 192.168.30.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route to external router

 

---

 

Key Principles & Edge Cases

✅ Switches do NOT forward traffic between VLANs — routing required (core rule)

✅ Broadcast isolation = PRIMARY benefit (improves performance & security)

✅ Access ports untagged; trunk ports tagged

✅ Native VLAN mismatch = frames routed to wrong VLAN (critical issue)

✅ VLAN 1 (default) cannot be deleted or removed from trunk allowed vlan list

✅ Sub-interface on router appears as separate interface in show ip interface output

✅ ROAS bottleneck: Single link carries all inter-VLAN traffic; Layer 3 switch faster

✅ SVI requires "up/up" status: VLAN must exist + active port in VLAN required

✅ Native VLAN = default VLAN 1 unless explicitly changed on both ends

✅ 802.1Q (IEEE standard); ISL (Cisco proprietary, obsolete)

 

---

 

Complete Command Reference

VLAN Creation & Deletion

show vlan brief                    → List all VLANs and ports

show vlan id 10                    → Details for VLAN 10

show interfaces Fa0/1 switchport   → Port VLAN assignment

vlan 10                            → Enter VLAN config mode

name Engineering                   → Name the VLAN

no vlan 10                         → Delete VLAN 10 (if no ports assigned)

Access Port

interface Fa0/1

switchport mode access

switchport access vlan 10

Trunk Port

interface g0/0

switchport trunk encapsulation dot1q

switchport mode trunk

switchport trunk native vlan 10

switchport trunk allowed vlan 10,20,30

show interfaces trunk

Router on a Stick (Sub-Interfaces)

interface g0/0

no shutdown

interface g0/0.10

encapsulation dot1q 10

ip address 192.168.10.254 255.255.255.0

show ip interface brief

show ip route

Layer 3 Switch (SVIs)

ip routing                         → Enable routing globally

interface vlan 10                  → Create SVI for VLAN 10

ip address 192.168.10.254 255.255.255.0

no shutdown

interface g0/0                     → Convert to routed port

no switchport

ip address 192.168.1.193 255.255.255.0

no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route

show ip interface brief

show ip route

 

---

 

CCNA Exam Essentials

 

---