# Days 16, 17, 18: VLANs # VLANs: CCNA Reference Sheet ## Core Definitions VLAN (Virtual LAN): Logical grouping of network devices; segments a physical network into isolated broadcast domains at Layer 2 (Data Link Layer). LAN / Broadcast Domain: Single group of devices receiving broadcast frames (Dst MAC: FFFF.FFFF.FFFF) sent by any member. Access Port: Belongs to a single VLAN; connects to end hosts; does NOT tag frames. Trunk Port: Carries traffic from multiple VLANs over a single link using VLAN tagging; connects switches/routers. Native VLAN: Special VLAN on trunk port that does NOT get tagged when sent; default = VLAN 1. 802.1Q Tag: 4-byte VLAN tag inserted between Src MAC and Type/Length fields in Ethernet frame. Switch Virtual Interface (SVI): Virtual Layer 3 interface on multilayer switch representing a VLAN; acts as default gateway. Layer 3 Switch / Multilayer Switch: Device combining switch (L2) + router (L3) functionality; performs inter-VLAN routing internally. --- ## VLAN Benefits vs. Drawbacks
Issue Without VLAN With VLAN
Performance Broadcast floods entire network Broadcasts isolated to VLAN
Security No L2 segmentation; all devices reach each other directly Devices can't reach other VLANs without routing
Access Control Router policies ineffective (same LAN) Router can filter between VLANs
Scalability Single broadcast domain Multiple isolated domains
--- ## How VLANs Work Key Rule: Switches do NOT forward traffic between VLANs. Switch Logic: 1. Receive frame on interface in VLAN X 2. Check destination MAC 3. If destination in VLAN X → forward normally 4. If destination in different VLAN → DROP (do not forward) Inter-VLAN Routing Required: Traffic must pass through router or Layer 3 switch. Flow: Source VLAN → Router/L3 Switch (strips VLAN, routes IP, re-tags) → Destination VLAN --- ## Access Port Configuration Switch(config)# vlan 10 Switch(config-vlan)# name Engineering Switch(config-vlan)# exit # Switch(config)# interface Fa0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# exit # Switch(config)# interface range Fa0/2-3 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# exit # Default VLANs (cannot delete): - VLAN 1: default (exists by default, cannot be removed) - VLANs 1002-1005: reserved for legacy protocols Verification: show vlan brief → List all VLANs and assigned ports show interfaces Fa0/1 switchport → Detailed switchport info show vlan id 10 → Info for specific VLAN # --- ## Trunk Ports & 802.1Q Tagging ### Trunk Configuration Switch(config)# interface g0/0 Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk native vlan 10 Switch(config-if)# switchport trunk allowed vlan 10,20,30 Switch(config-if)# exit # Verification: show interfaces trunk → Shows encapsulation, status, native VLAN, allowed VLANs # ### 802.1Q Tag Structure 4-Byte Tag inserted between Src MAC and Type/Length:
Field Bytes Size Purpose
TPID 1–2 16 bits Always 0x8100; indicates 802.1Q tagged frame
PCP 3 (bits 7–5) 3 bits Priority Code Point (CoS: 0–7, 7=highest)
DEI 3 (bit 4) 1 bit Drop Eligible Indicator; marks droppable frames
VID 3–4 (bits 11–0) 12 bits VLAN ID (0–4095; usable: 1–4094)
VLAN Ranges: - 0: Reserved (not used) - 1–1005: Standard range - 1: Default (always exists) - 2–1005: User-defined - 1002–1005: Legacy protocols (reserved) - 1006–4094: Extended range (requires special switch mode; not common in CCNA) - 4095: Reserved (not used) - Total usable: 1–4094 (4,094 VLANs) ### Native VLAN Behavior: - Frames on native VLAN are sent untagged (no 4-byte tag) - Smaller frame size (4 bytes smaller); faster transmission - Default native VLAN = VLAN 1 Critical Rule: Native VLAN must MATCH on both ends of trunk or frames go to wrong VLAN. Example Mismatch: SW1: Native VLAN = 10 SW2: Native VLAN = 1 # Result: SW1 sends VLAN 10 untagged SW2 receives untagged frames on VLAN 1 (wrong!) → VLAN mismatch # Configuration: Switch(config-if)# switchport trunk native vlan 10 # --- ## Router on a Stick (ROAS) Use Case: Route between VLANs when router has only one physical interface. Switch Configuration (Trunk): Switch(config)# interface g0/0 Switch(config-if)# switchport mode trunk Switch(config-if)# switchport trunk encapsulation dot1q Switch(config-if)# exit # Router Configuration (Sub-Interfaces): Router(config)# interface g0/0 Router(config-if)# no shutdown Router(config-if)# exit # Router(config)# interface g0/0.10 Router(config-subif)# encapsulation dot1q 10 Router(config-subif)# ip address 192.168.10.254 255.255.255.0 Router(config-subif)# exit # Router(config)# interface g0/0.20 Router(config-subif)# encapsulation dot1q 20 Router(config-subif)# ip address 192.168.20.254 255.255.255.0 Router(config-subif)# exit # Router(config)# interface g0/0.30 Router(config-subif)# encapsulation dot1q 30 Router(config-subif)# ip address 192.168.30.254 255.255.255.0 Router(config-subif)# exit # Native VLAN Methods: - Method 1: encapsulation dot1q 10 native (sub-interface) - Method 2: IP address on physical interface = native VLAN (VLAN 10) Verification: show ip interface brief → Shows sub-interfaces and status show ip route → Routing table for all VLANs # How ROAS Works: 1. Router receives tagged frame on g0/0 2. Router examines VLAN tag (e.g., VLAN 10) 3. Router directs to sub-interface g0/0.10 4. Sub-interface routes based on IP address 5. Reply sent out appropriate sub-interface with VLAN tag re-added --- ## Layer 3 Switching & SVIs Layer 3 Switch: Combines switching (L2) + routing (L3) internally; no external router needed for inter-VLAN routing. Advantages: - Performance: Inter-VLAN routing via ASICs (hardware-based); much faster than ROAS - Cost: Single device replaces switch + router - Simplicity: All VLAN management in one device - Scalability: Supports many VLANs with fast internal routing ### SVI (Switch Virtual Interface) Configuration Switch(config)# ip routing → Enable routing on switch # Switch(config)# interface vlan 10 Switch(config-if)# ip address 192.168.10.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# interface vlan 20 Switch(config-if)# ip address 192.168.20.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# interface vlan 30 Switch(config-if)# ip address 192.168.30.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # SVI Status Conditions (must be "up/up"): 1. VLAN must exist on switch 2. At least ONE active port in VLAN (access or trunk allowing VLAN) must be "up/up" 3. SVI must not be shut down SVI Status Meanings: - up/up: SVI operational; VLAN exists; active port present; SVI not shut down - down/down: VLAN missing, no active ports, or SVI is shut down Verification: show interface vlan 10 → Detailed SVI info (status, IP, MAC) show ip interface brief → All L3 interfaces and status show ip route → Routing table # ### Converting ROAS to Layer 3 Switching Remove ROAS from Router: Router(config)# no interface g0/0.10 Router(config)# no interface g0/0.20 Router(config)# no interface g0/0.30 Router(config)# interface g0/0 Router(config-if)# ip address 192.168.1.194 255.255.255.0 Router(config-if)# no shutdown # Configure Multilayer Switch: Switch(config)# ip routing # Switch(config)# interface g0/0 Switch(config-if)# no switchport → Convert to Layer 3 routed port Switch(config-if)# ip address 192.168.1.193 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# interface vlan 10 Switch(config-if)# ip address 192.168.10.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# interface vlan 20 Switch(config-if)# ip address 192.168.20.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# interface vlan 30 Switch(config-if)# ip address 192.168.30.254 255.255.255.0 Switch(config-if)# no shutdown Switch(config-if)# exit # Switch(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.194 → Default route to external router # --- ## Key Principles & Edge Cases ✅ Switches do NOT forward traffic between VLANs — routing required (core rule) ✅ Broadcast isolation = PRIMARY benefit (improves performance & security) ✅ Access ports untagged; trunk ports tagged ✅ Native VLAN mismatch = frames routed to wrong VLAN (critical issue) ✅ VLAN 1 (default) cannot be deleted or removed from trunk allowed vlan list ✅ Sub-interface on router appears as separate interface in show ip interface output ✅ ROAS bottleneck: Single link carries all inter-VLAN traffic; Layer 3 switch faster ✅ SVI requires "up/up" status: VLAN must exist + active port in VLAN required ✅ Native VLAN = default VLAN 1 unless explicitly changed on both ends ✅ 802.1Q (IEEE standard); ISL (Cisco proprietary, obsolete) --- ## Complete Command Reference ### VLAN Creation & Deletion show vlan brief → List all VLANs and ports show vlan id 10 → Details for VLAN 10 show interfaces Fa0/1 switchport → Port VLAN assignment vlan 10 → Enter VLAN config mode name Engineering → Name the VLAN no vlan 10 → Delete VLAN 10 (if no ports assigned) # ### Access Port interface Fa0/1 switchport mode access switchport access vlan 10 # ### Trunk Port interface g0/0 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 10 switchport trunk allowed vlan 10,20,30 show interfaces trunk # ### Router on a Stick (Sub-Interfaces) interface g0/0 no shutdown # interface g0/0.10 encapsulation dot1q 10 ip address 192.168.10.254 255.255.255.0 # show ip interface brief show ip route # ### Layer 3 Switch (SVIs) ip routing → Enable routing globally interface vlan 10 → Create SVI for VLAN 10 ip address 192.168.10.254 255.255.255.0 no shutdown # interface g0/0 → Convert to routed port no switchport ip address 192.168.1.193 255.255.255.0 no shutdown # ip route 0.0.0.0 0.0.0.0 192.168.1.194 → Default route # show ip interface brief show ip route # --- ## CCNA Exam Essentials
Concept Key Detail
VLAN Isolation Switches block frames between VLANs; routing required
Default VLAN VLAN 1; cannot delete or remove from trunk allowed list
Access Ports Single VLAN; end-host facing; untagged frames
Trunk Ports Multiple VLANs; switch/router facing; tagged frames
802.1Q Tag 4 bytes: TPID (0x8100) + PCP (3b) + DEI (1b) + VID (12b)
VID Range 12 bits = 0–4095; usable = 1–4094
Native VLAN Untagged; must match on both ends or mismatch occurs
ROAS Sub-interfaces on single physical link; bottleneck risk
Layer 3 Switch Internal routing (ASICs); SVIs = default gateways
SVI Status up/up requires: VLAN exists + active port + not shut down
---