What is a VLAN in simple terms?

A VLAN is a logical network created on a switch. It separates connected devices into different Layer 2 broadcast domains even when they use the same physical switching infrastructure.

What is the difference between an access port and a trunk port?

An access port normally carries traffic for one data VLAN and connects to an endpoint. A trunk port carries multiple VLANs between devices by using 802.1Q tags.

Can devices in different VLANs communicate?

Devices in different VLANs cannot communicate through Layer 2 switching alone. They need a router or Layer 3 switch configured for inter-VLAN routing.

What is the native VLAN on an 802.1Q trunk?

The native VLAN carries untagged traffic on an 802.1Q trunk by default. Both ends of the trunk should have the same native VLAN to prevent mismatches and incorrect traffic placement.

What is router-on-a-stick?

Router-on-a-stick is an inter-VLAN routing method that uses one physical router interface divided into multiple 802.1Q subinterfaces. Each subinterface serves as the default gateway for a different VLAN.

Why is an SVI interface down?

An SVI can remain down if its VLAN does not exist or if the VLAN has no active Layer 2 port in a forwarding state. Verify the VLAN database, connected ports, trunk allowed list and interface status.

VLAN Explained: Access Ports, Trunks and Routing

A VLAN explained in practical terms is a logical Layer 2 network created inside a physical switch. VLANs let administrators separate users, devices and broadcast traffic without installing a different switch for every group.

This guide covers access ports, 802.1Q trunks and two methods of inter-VLAN routing. It also includes a Cisco IOS lab, diagrams in words and a structured troubleshooting process suitable for CCNA practice.

What Is a VLAN?

A virtual local area network, or VLAN, divides a switched network into separate broadcast domains. Devices in the same VLAN can communicate at Layer 2, while traffic between different VLANs must pass through a router or Layer 3 switch.

Imagine one 24-port switch connected to the Sales and Engineering departments. Without VLANs, all ports belong to the same default broadcast domain. An ARP broadcast sent by a Sales computer is forwarded to Engineering computers as well.

VLANs create logical boundaries:

Physical switch
|
|-- Ports Gi0/1 to Gi0/8   -> VLAN 10 SALES
|-- Ports Gi0/9 to Gi0/16  -> VLAN 20 ENGINEERING
|-- Ports Gi0/17 to Gi0/20 -> VLAN 30 SERVERS

A broadcast received on a VLAN 10 port remains inside VLAN 10. It is not forwarded into VLAN 20 or VLAN 30.

VLANs and IP subnets are different concepts, but network designs normally assign one IP subnet to each VLAN.

VLAN	Purpose	IPv4 subnet	Default gateway
10	Sales	192.168.10.0/24	192.168.10.1
20	Engineering	192.168.20.0/24	192.168.20.1
99	Network management	192.168.99.0/24	192.168.99.1

If you need a refresher on subnet selection and CIDR notation, read how IP addressing, private ranges and CIDR work.

What Is an Access Port?

An access port carries traffic for one data VLAN and normally connects to an endpoint such as a computer, printer or server. Ethernet frames sent by an ordinary endpoint arrive untagged, and the switch associates them with the access VLAN configured on that port.

For example, configure GigabitEthernet0/1 as an access port in VLAN 10:

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# description Sales-PC
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# end

The switchport mode access command statically sets the interface as an access port. The switchport access vlan 10 command assigns untagged frames received on that interface to VLAN 10.

PortFast allows an endpoint-facing port to move to the forwarding state quickly. It should not be enabled on links where another switch could create a Layer 2 loop unless the design specifically accounts for it.

Verify the assignment with:

Switch# show interfaces gigabitEthernet0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (SALES)

You can also use show vlan brief to see VLANs and their assigned access ports.

What Is a Trunk Port?

A trunk port carries multiple VLANs across one physical link. Cisco switches commonly use IEEE 802.1Q tagging so that the receiving switch or router can identify the VLAN associated with each frame.

A common design uses a trunk between two switches:

Sales PC -- access VLAN 10 -- SW1
                                \
                                 trunk: VLANs 10,20,99
                                /
Engineering PC -- access VLAN 20 -- SW2

Configure a static trunk on a Cisco switch:

Switch(config)# interface gigabitEthernet0/24
Switch(config-if)# description Trunk-to-SW2
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,99
Switch(config-if)# switchport nonegotiate

The allowed VLAN list limits which VLANs can cross the trunk. VLANs not included in the list cannot use that link, even if they exist on both switches.

How does 802.1Q tagging work?

An 802.1Q trunk adds a tag containing VLAN information to most Ethernet frames. The switch at the other end reads the tag and places the frame into the correct VLAN before forwarding it.

Frames in the native VLAN are normally sent untagged. Both ends of a trunk must use the same native VLAN; otherwise, traffic can enter the wrong broadcast domain and Cisco Discovery Protocol may report a native VLAN mismatch.

Feature	Access port	Trunk port
Typical connection	PC, printer or server	Switch, router, firewall or access point
Number of data VLANs	One	Multiple
Frames from a normal endpoint	Untagged	Usually 802.1Q tagged
Main command	`switchport mode access`	`switchport mode trunk`
VLAN selection	Access VLAN	Allowed VLAN list

How Do You Build a Two-Switch VLAN Lab?

Create the required VLANs on both switches, assign endpoint ports and configure the link between the switches as a trunk. A VLAN must exist locally on each switch that needs to forward traffic for it.

Use this diagram in words:

PC-A: 192.168.10.10/24
  |
SW1 Gi0/1: access VLAN 10
SW1 Gi0/24 ===== 802.1Q trunk ===== SW2 Gi0/24
                                      |
                              SW2 Gi0/1: access VLAN 10
                                      |
                              PC-B: 192.168.10.20/24

Configure SW1:

vlan 10
 name SALES
vlan 20
 name ENGINEERING
vlan 99
 name MANAGEMENT
!
interface gigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
!
interface gigabitEthernet0/24
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99

Create the same VLANs on SW2, configure Gi0/1 in VLAN 10 and apply the same trunk settings to Gi0/24.

Check the trunk from either switch:

SW1# show interfaces trunk
Port      Mode   Encapsulation  Status    Native vlan
Gi0/24    on     802.1q         trunking  99

Port      Vlans allowed on trunk
Gi0/24    10,20,99

Port      Vlans in spanning tree forwarding state and not pruned
Gi0/24    10,20,99

PC-A and PC-B should communicate because both are in VLAN 10 and the trunk carries VLAN 10. A PC in VLAN 20 cannot communicate with them until a Layer 3 gateway provides inter-VLAN routing.

What Is Inter-VLAN Routing?

Inter-VLAN routing forwards IP packets between VLANs because a Layer 2 switch cannot route traffic from one broadcast domain to another. The gateway can be implemented with router subinterfaces or switched virtual interfaces on a multilayer switch.

When a VLAN 10 host sends traffic to VLAN 20, it sees that the destination is outside its local subnet. The host sends the packet to its default gateway, which routes the packet into VLAN 20.

Method 1: Router-on-a-stick

Router-on-a-stick uses one physical router interface with multiple logical subinterfaces. The switch-facing interface is a trunk, and each router subinterface handles one VLAN.

VLAN 10 hosts --\
                 SW1 Gi0/24 trunk ===== R1 Gi0/0
VLAN 20 hosts --/                         |-- Gi0/0.10
                                           |-- Gi0/0.20
                                           |-- Gi0/0.99 native

Configure the switch port connected to the router:

interface gigabitEthernet0/24
 description Trunk-to-R1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99

Configure the router:

interface gigabitEthernet0/0
 no shutdown
!
interface gigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface gigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface gigabitEthernet0/0.99
 encapsulation dot1Q 99 native
 ip address 192.168.99.1 255.255.255.0

Set VLAN 10 hosts to use 192.168.10.1 as their default gateway. VLAN 20 hosts use 192.168.20.1.

Router-on-a-stick is useful for learning and smaller environments, but all inter-VLAN traffic shares one physical router link.

Method 2: Layer 3 switch SVIs

A multilayer switch can route between VLANs using switched virtual interfaces, or SVIs. Each SVI acts as the default gateway for its VLAN, and ip routing enables Layer 3 forwarding.

Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown

Verify the interfaces and connected routes:

L3SW# show ip interface brief | include Vlan
Vlan10     192.168.10.1    YES manual up   up
Vlan20     192.168.20.1    YES manual up   up

L3SW# show ip route connected
C 192.168.10.0/24 is directly connected, Vlan10
C 192.168.20.0/24 is directly connected, Vlan20

An SVI may remain down if its VLAN does not exist or if the VLAN has no active Layer 2 port in a forwarding state. Check both the VLAN database and physical interfaces when diagnosing this condition.

Students who want guided practice with VLANs, routing and switching can review the lab-based CCNA course. More advanced multilayer switching and enterprise routing are covered in the CCNP Enterprise course.

How Do You Troubleshoot VLAN Connectivity?

Troubleshoot one layer at a time: endpoint addressing, access port assignment, trunk operation and Layer 3 routing. Avoid changing several commands at once because doing so can hide the original cause.

1. Check the endpoint configuration

Confirm the IP address, subnet mask and default gateway. Two hosts in the same VLAN and subnet do not need a router to communicate, but hosts in different VLANs require valid gateways.

2. Verify the access VLAN

Switch# show vlan brief
Switch# show interfaces gigabitEthernet0/1 switchport

If a port is assigned to the wrong VLAN, correct it with switchport access vlan <vlan-id>. Also verify that the interface is not administratively shut down.

3. Verify the trunk

Switch# show interfaces trunk
Switch# show interface gigabitEthernet0/24 switchport

Check that the interface is operationally trunking and that the required VLAN appears in the allowed and forwarding lists. A common mistake is allowing VLAN 10 on one trunk end but omitting it on the other.

4. Check for a native VLAN mismatch

A Cisco switch may display a message similar to:

%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on Gi0/24

Configure the same native VLAN on both ends. Do not solve the problem by disabling CDP; that only hides the warning.

5. Verify the gateway and routing

For router-on-a-stick, check subinterfaces and encapsulation:

Router# show ip interface brief
Router# show running-config interface gigabitEthernet0/0.10
Router# show ip route

For a Layer 3 switch, confirm that ip routing is enabled and the SVIs are up. Test progressively: ping the local gateway first, then the remote gateway, and finally the destination host.

6. Inspect MAC address learning

Switch# show mac address-table dynamic vlan 10

The output should show endpoint MAC addresses on expected access or trunk ports. An empty table can indicate that the endpoint is disconnected, silent or assigned to another VLAN.

What Are Good VLAN Configuration Practices?

Use descriptive VLAN names, configure trunks statically and allow only the VLANs required on each trunk. Keep user, server, management and other security zones separated according to the network design.

Additional practical rules include:

Do not use VLAN 1 for routine user or management traffic where the design allows an alternative.
Keep native VLAN settings consistent on both ends of every trunk.
Document VLAN IDs, subnets, gateways and trunk paths.
Remove unused VLANs from trunk allowed lists.
Shut down unused access ports and place them in an unused VLAN.
Apply access control lists or firewall policy when communication between VLANs must be restricted.

VLANs provide Layer 2 segmentation, but they are not a complete security control. Routing policy, ACLs, authentication and endpoint security are still required.

Summary

A VLAN creates a separate Layer 2 broadcast domain inside a switched network. Access ports connect endpoints to one VLAN, while 802.1Q trunks carry multiple VLANs between network devices.

Devices in different VLANs require inter-VLAN routing through router subinterfaces or Layer 3 switch SVIs. Reliable troubleshooting starts with host addressing and then checks access ports, trunk VLAN lists, gateway interfaces, routes and MAC address learning.

To practise these concepts on Cisco IOS with guided switching and routing labs, enquire about upcoming batch details for the Network Rhinos CCNA course.

Reviewed by Network Rhinos networking trainers.

VLANs Explained: Access Ports, Trunks and Inter-VLAN Routing