Days 16, 17, 18: VLANs

VLANs: CCNA 200-301Reference Study Guide: VLANs, Trunking, and DTPSheet

1.0Core Foundational Concepts: Introduction to VLANsDefinitions

VLAN (Virtual LANsLAN): (VLANs)Logical providegrouping the mechanism forof network segmentationdevices; segments a physical network into isolated broadcast domains at Layer 2.2 By(Data creatingLink distinctLayer).

LAN / Broadcast Domain: Single group of devices receiving broadcast domains,frames administrators(Dst canMAC: logicallyFFFF.FFFF.FFFF) groupsent usersby regardlessany of their physical location on the switch.member.

1.1

Access ThePort: Metaphor: The Soundproof Office

Think of a large, open-plan office where everyone is shouting. This is a single broadcast domain; the noise (broadcast traffic) makes it hard for anyone to focus. Implementing VLANs is like building soundproof glass walls. People in the "Sales" room can talk to each other without distracting the "Finance" room, even though they are all in the same building (on the same physical switch).

1.2 Core Benefits

Broadcast Containment: ARP requests and other broadcasts are limitedBelongs to a single VLAN.VLAN; connects to end hosts; does NOT tag frames.

Trunk Port: Carries traffic from multiple VLANs over a single link using VLAN tagging; connects switches/routers.

Native VLAN: Special VLAN on trunk port that does NOT get tagged when sent; default = VLAN 1.

802.1Q Tag: 4-byte VLAN tag inserted between Src MAC and Type/Length fields in Ethernet frame.

Switch Virtual Interface (SVI): Virtual Layer 3 interface on multilayer switch representing a VLAN; acts as default gateway.

Layer 3 Switch / Multilayer Switch: Device combining switch (L2) + router (L3) functionality; performs inter-VLAN routing internally.

 

---

 

VLAN Benefits vs. Drawbacks

 

---

 

How VLANs Work

Key Rule: Switches do NOT forward traffic between VLANs.

Switch Logic:

Receive frame on interface in VLAN X

EnhancedCheck Security:destination Users in different VLANs cannot communicate at Layer 2. Inter-VLAN communication requires a Layer 3 device (Router or Multilayer Switch).MAC

ImprovedIf Performance:destination Reducesin CPUVLAN overheadX on→ hostforward devicesnormally

If destination in different VLAN → DROP (do not forward)

Inter-VLAN Routing Required: Traffic must pass through router or Layer 3 switch.

Flow: Source VLAN → Router/L3 Switch (strips VLAN, routes IP, re-tags) → Destination VLAN

 

---

 

Access Port Configuration

Switch(config)# vlan 10

Switch(config-vlan)# name Engineering

Switch(config-vlan)# exit

Switch(config)# interface Fa0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10

Switch(config-if)# exit

Switch(config)# interface range Fa0/2-3

Switch(config-if-range)# switchport mode access

Switch(config-if-range)# switchport access vlan 10

Switch(config-if-range)# exit

Default VLANs (cannot delete):

VLAN 1: default (exists by eliminatingdefault, irrelevantcannot broadcastbe processing.removed)

VLANs 1002-1005: reserved for legacy protocols

1.3

Verification:

show vlan brief                    → List all VLANs and assigned ports

show interfaces Fa0/1 switchport   → Detailed switchport info

show vlan id 10                    → Info for specific VLAN

Ranges

 

---

 

Trunk Ports & 802.1Q Tagging

Trunk Configuration

CiscoSwitch(config)# switchesinterface supportg0/0

two

Switch(config-if)# rangesswitchport oftrunk VLANencapsulation IDs:dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk native vlan 10

Switch(config-if)# switchport trunk allowed vlan 10,20,30

Switch(config-if)# exit

Verification:

show interfaces trunk              → Shows encapsulation, status, native VLAN, allowed VLANs

802.1Q Tag Structure

4-Byte Tag inserted between Src MAC and Type/Length:

1.4 Basic VLAN Configuration

# 1. Create and name the VLAN

Switch(config)# vlan 10

Switch(config-vlan)# name SALES

# 2. Assign a port to the VLAN (Access Port)

Switch(config)# interface g0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport access vlan 10

2.0 Inter-Switch Communication: VLAN Trunking

Trunking allows a single physical link to carry traffic for multiple VLANs between switches.

2.1 The 802.1Q Tagging Protocol

IEEE 802.1Q (Dot1q) is the industry-standard protocol for trunking. It inserts a 4-byte (32-bit) tag into the Ethernet header to identify the VLAN ID.

TPID: Set to 0x8100 to identify a tagged frame.

VLAN ID: A 12-bit field, allowing for $2^{12}$ (4,096) unique VLANs.

2.2 The Native VLAN

By default, traffic on the Native VLAN is sent across a trunk untagged.

Security Risk: VLAN 1 is the default native VLAN and a target for "VLAN hopping" attacks.

Best Practice: Change the native VLAN to an unused ID (e.g., 999) and ensure it matches on both ends of the link.

2.3 Trunk Configuration

Switch(config)# interface g0/1

# Switch(config-if)# switchport trunk encapsulation dot1q  (Required on older hardware)

Switch(config)# switchport mode trunk

Switch(config)# switchport trunk native vlan 99

Switch(config)# switchport trunk allowed vlan 10,20,30    # VLAN Pruning

3.0 Automated Negotiation: Dynamic Trunking Protocol (DTP)

DTP is a Cisco proprietary protocol that automates the formation of trunk links. While convenient, it is considered a security risk in modern networks.

3.1 DTP Operational Modes

Access: Permanent non-trunking state.

Trunk: Permanent trunking state; actively negotiates with the neighbor.

Dynamic Auto: Passive; becomes a trunk only if the neighbor is set to Trunk or Desirable.

Dynamic Desirable: Active; attempts to convert the link to a trunk.

No-Negotiate: Disables DTP advertisements entirely (switchport nonegotiate).

3.2 DTP Negotiation Outcomes

4.0 Verification and Best Practices

4.1 Key Verification Commands

4.2

VLAN SecurityRanges:

Best Practices

1. • Disable0: DTP:Reserved Use(not switchport mode access and switchport nonegotiate on user-facing ports.used)

   • Hard-code1–1005: Trunks:Standard Neverrange

     rely

on

Dynamic Auto;

1: useDefault switchport(always mode trunk.exists)

VLAN2–1005: Pruning: Only allow necessary VLANs across a trunk to save bandwidth.User-defined

Secure1002–1005: theLegacy Nativeprotocols VLAN: Move the native VLAN away from VLAN 1 and use a dedicated "dummy" VLAN.(reserved)

TL;DR Summary

VLANs1006–4094: breakExtended onerange large(requires broadcastspecial domainswitch intomode; multiplenot smallercommon logicalin ones.CCNA)

802.1Q4095: isReserved the(not standard for trunking; it uses tags to keep traffic separated on inter-switch links.used)

Total usable: 1–4094 (4,094 VLANs)

Native VLAN

traffic

Behavior:

is

untagged; mismatches

Frames causeon trafficnative "leaking"VLAN andare securitysent issues.untagged (no 4-byte tag)

DTPSmaller shouldframe besize disabled(4 onbytes allsmaller); productionfaster portstransmission

to prevent unauthorized

Default trunking andnative VLAN hopping.= VLAN 1

Critical Rule: Native VLAN must MATCH on both ends of trunk or frames go to wrong VLAN.

Example Mismatch:

SW1: Native VLAN = 10

SW2: Native VLAN = 1

Result:

  SW1 sends VLAN 10 untagged

  SW2 receives untagged frames on VLAN 1 (wrong!)

  → VLAN mismatch

Configuration:

Switch(config-if)# switchport trunk native vlan 10

 

---

 

Router on a Stick (ROAS)

Use Case: Route between VLANs when router has only one physical interface.

Switch Configuration (Trunk):

Switch(config)# interface g0/0

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# exit

Router Configuration (Sub-Interfaces):

Router(config)# interface g0/0

Router(config-if)# no shutdown

Router(config-if)# exit

Router(config)# interface g0/0.10

Router(config-subif)# encapsulation dot1q 10

Router(config-subif)# ip address 192.168.10.254 255.255.255.0

Router(config-subif)# exit

Router(config)# interface g0/0.20

Router(config-subif)# encapsulation dot1q 20

Router(config-subif)# ip address 192.168.20.254 255.255.255.0

Router(config-subif)# exit

Router(config)# interface g0/0.30

Router(config-subif)# encapsulation dot1q 30

Router(config-subif)# ip address 192.168.30.254 255.255.255.0

Router(config-subif)# exit

Native VLAN Methods:

Method 1: encapsulation dot1q 10 native (sub-interface)

Method 2: IP address on physical interface = native VLAN (VLAN 10)

Verification:

show ip interface brief            → Shows sub-interfaces and status

show ip route                      → Routing table for all VLANs

How ROAS Works:

Router receives tagged frame on g0/0

Router examines VLAN tag (e.g., VLAN 10)

Router directs to sub-interface g0/0.10

Sub-interface routes based on IP address

Reply sent out appropriate sub-interface with VLAN tag re-added

 

---

 

Layer 3 Switching & SVIs

Layer 3 Switch: Combines switching (L2) + routing (L3) internally; no external router needed for inter-VLAN routing.

Advantages:

Performance: Inter-VLAN routing via ASICs (hardware-based); much faster than ROAS

Cost: Single device replaces switch + router

Simplicity: All VLAN management in one device

Scalability: Supports many VLANs with fast internal routing

SVI (Switch Virtual Interface) Configuration

Switch(config)# ip routing                    → Enable routing on switch

Switch(config)# interface vlan 10

Switch(config-if)# ip address 192.168.10.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 20

Switch(config-if)# ip address 192.168.20.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 30

Switch(config-if)# ip address 192.168.30.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

SVI Status Conditions (must be "up/up"):

VLAN must exist on switch

At least ONE active port in VLAN (access or trunk allowing VLAN) must be "up/up"

SVI must not be shut down

SVI Status Meanings:

up/up: SVI operational; VLAN exists; active port present; SVI not shut down

down/down: VLAN missing, no active ports, or SVI is shut down

Verification:

show interface vlan 10             → Detailed SVI info (status, IP, MAC)

show ip interface brief             → All L3 interfaces and status

show ip route                       → Routing table

Converting ROAS to Layer 3 Switching

Remove ROAS from Router:

Router(config)# no interface g0/0.10

Router(config)# no interface g0/0.20

Router(config)# no interface g0/0.30

Router(config)# interface g0/0

Router(config-if)# ip address 192.168.1.194 255.255.255.0

Router(config-if)# no shutdown

Configure Multilayer Switch:

Switch(config)# ip routing

Switch(config)# interface g0/0

Switch(config-if)# no switchport                 → Convert to Layer 3 routed port

Switch(config-if)# ip address 192.168.1.193 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 10

Switch(config-if)# ip address 192.168.10.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 20

Switch(config-if)# ip address 192.168.20.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# interface vlan 30

Switch(config-if)# ip address 192.168.30.254 255.255.255.0

Switch(config-if)# no shutdown

Switch(config-if)# exit

Switch(config)# ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route to external router

 

---

 

Key Principles & Edge Cases

✅ Switches do NOT forward traffic between VLANs — routing required (core rule)

✅ Broadcast isolation = PRIMARY benefit (improves performance & security)

✅ Access ports untagged; trunk ports tagged

✅ Native VLAN mismatch = frames routed to wrong VLAN (critical issue)

✅ VLAN 1 (default) cannot be deleted or removed from trunk allowed vlan list

✅ Sub-interface on router appears as separate interface in show ip interface output

✅ ROAS bottleneck: Single link carries all inter-VLAN traffic; Layer 3 switch faster

✅ SVI requires "up/up" status: VLAN must exist + active port in VLAN required

✅ Native VLAN = default VLAN 1 unless explicitly changed on both ends

✅ 802.1Q (IEEE standard); ISL (Cisco proprietary, obsolete)

 

---

 

Complete Command Reference

VLAN Creation & Deletion

show vlan brief                    → List all VLANs and ports

show vlan id 10                    → Details for VLAN 10

show interfaces Fa0/1 switchport   → Port VLAN assignment

vlan 10                            → Enter VLAN config mode

name Engineering                   → Name the VLAN

no vlan 10                         → Delete VLAN 10 (if no ports assigned)

Access Port

interface Fa0/1

switchport mode access

switchport access vlan 10

Trunk Port

interface g0/0

switchport trunk encapsulation dot1q

switchport mode trunk

switchport trunk native vlan 10

switchport trunk allowed vlan 10,20,30

show interfaces trunk

Router on a Stick (Sub-Interfaces)

interface g0/0

no shutdown

interface g0/0.10

encapsulation dot1q 10

ip address 192.168.10.254 255.255.255.0

show ip interface brief

show ip route

Layer 3 Switch (SVIs)

ip routing                         → Enable routing globally

interface vlan 10                  → Create SVI for VLAN 10

ip address 192.168.10.254 255.255.255.0

no shutdown

interface g0/0                     → Convert to routed port

no switchport

ip address 192.168.1.193 255.255.255.0

no shutdown

ip route 0.0.0.0 0.0.0.0 192.168.1.194    → Default route

show ip interface brief

show ip route

 

---

 

CCNA Exam Essentials

 

---