CCNA VLANs and Trunking

VLAN Concepts and Access Ports

A VLAN (Virtual LAN) is a broadcast domain created in software on a switch — devices in different VLANs cannot talk to each other without a router, even though they share the same hardware. VLANs shrink broadcast domains, enforce separation (keeping guests off the staff network, for example), and let one switch serve many logical networks. VLAN IDs 1–4094 are usable; VLAN 1 is the default on every port, and 1002–1005 are reserved legacy ranges you should never use.

An access port belongs to exactly one VLAN and carries untagged frames to end devices — PCs, printers, phones. Configure it with switchport mode access followed by switchport access vlan 10. Create the VLAN itself with vlan 10 then name SALES. Verify with show vlan brief — if a port sits in the wrong VLAN, traffic lands in the wrong broadcast domain and "the network is down" for that user.

IP phones introduce the voice VLAN: one port carries two VLANs, with the PC's data untagged and the phone's traffic tagged. Configure with switchport voice vlan 20 alongside the access VLAN. The exam also expects you to know that unused ports should be shut down or parked in an unused VLAN — an open port in VLAN 1 is an invitation.

Trunks, 802.1Q and the Native VLAN

A trunk is a link between switches (or to a router) that carries traffic for multiple VLANs, tagging each frame with 802.1Q so the far end knows which VLAN it belongs to. The tag is a 4-byte header inserted into the Ethernet frame carrying the 12-bit VLAN ID. The one exception is the native VLAN: its frames cross the trunk untagged, exactly as if it were an access port. Native VLAN defaults to VLAN 1, and both ends of a trunk must agree on it — a native mismatch lets traffic leak between VLANs and logs angry console messages.

Configure a trunk with switchport mode trunk, set the native VLAN with switchport trunk native vlan 99, and prune with switchport trunk allowed vlan 10,20,30. Verify with show interfaces trunk and show interfaces switchport. Best practice: change the native VLAN to an unused VLAN (never VLAN 1, never a user VLAN) to defeat double-tagging VLAN hopping attacks.

DTP (Dynamic Trunking Protocol) negotiates trunking automatically: dynamic desirable actively tries to trunk, dynamic auto only trunks if the other side asks (auto + auto = access, no trunk), while trunk and access are statically set. Disable negotiation on inter-switch links with switchport nonegotiate — negotiated trunks are both a security risk and a source of exam troubleshooting questions.

Inter-VLAN Routing

VLANs can't talk to each other at Layer 2 — routing between them needs a Layer 3 device. The classic method is router-on-a-stick: one router interface divided into subinterfaces, one per VLAN, each with 802.1Q encapsulation. The switch side is a trunk; the router routes between subnets as normal. Configuration looks like this:
interface g0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0

The modern alternative is multilayer switching using SVIs (Switched Virtual Interfaces): interface vlan 10 with an IP address, plus ip routing enabled on the Layer 3 switch. It's faster (hardware-switched) and removes the single-trunk bottleneck of router-on-a-stick. The exam tests both — know that router-on-a-stick needs subinterfaces with encapsulation, while SVIs need no shutdown and at least one active port in the VLAN (or the SVI stays down).

Troubleshooting inter-VLAN routing follows a checklist: is the trunk up and allowing the VLAN? Does the subinterface/SVI have the right IP and encapsulation? Is the host's default gateway pointing at the router's address in its own VLAN? A host with the wrong gateway can reach its own subnet but nothing else — the single most common exam symptom.

Related CCNA study guides

• CCNA Switching Fundamentals
• CCNA Spanning Tree (STP/RSTP)
• CCNA Routing Fundamentals
• CCNA Network Security Fundamentals

Frequently asked questions