Chapter 12: VLANs

Introduction

Introduces VLANs as a way to divide a LAN at Layer 2, contrasting them with Layer 3 subnetting.

• VLANs and network segmentation: Explain that VLANs divide a LAN, or broadcast domain, into smaller LANs at Layer 2, whereas subnets segment a network at Layer 3.
  Why it matters: This distinction explains what kind of network division VLANs provide.

Key terms: Virtual LANs, VLANs, subnets, network segmentation, Layer 2, Layer 3

12.1 Why we need VLANs

Introduces the question of why VLANs are needed by previewing a comparison of unsegmented networks with networks segmented at Layer 3 and at both Layer 3 and Layer 2.

12.1.1 Layer 3 segmentation with subnets

This section explains how assigning departments separate IP subnets makes their traffic pass through a router, where security policies can control it, without requiring separate switches.

• Subnet segmentation and traffic control: Explain how placing departments in separate subnets changes their communication and creates an opportunity to control traffic between them.
  Why it matters: Subnetting gives the network a point at which to control communication between departments.
• Shared switches across subnets: Describe why assigning departments separate subnets does not necessarily mean giving each subnet its own switch.
  Why it matters: Logical subnet boundaries do not require a separate physical switch for every department.

Key terms: subnetting, Layer 3, router, security policies, subnet, switch, SW1

12.1.2 Layer 2 segmentation with VLANs

Explains why subnets alone do not separate a switch’s broadcast domains and how VLANs provide Layer 2 segmentation.

• Limits of subnet segmentation: Explain why placing hosts in different subnets does not stop SW1 from flooding broadcast and unknown unicast frames to all connected hosts, and why that matters.
  Why it matters: This is why separate subnets do not, by themselves, solve the Layer 2 flooding problem.
• VLAN broadcast domain separation: Describe how assigning a switch’s ports to VLANs divides one physical switch into separate virtual switches and broadcast domains.
  Why it matters: VLANs provide Layer 2 separation without requiring a separate physical switch for each group.
• Traffic between separate VLANs: Explain what happens to frames between VLANs and describe the subnet-to-VLAN relationship used in this example.
  Why it matters: This connects VLAN separation to how hosts in different groups can still communicate.

Key terms: subnetting, Layer 3, broadcast domain, broadcast frame, unknown unicast frames, VLANs, ports, virtual switches, broadcast domains, forward

12.2 Configuring VLANs and access ports

The section contrasts a switch’s automatic frame forwarding with the port configuration needed to use VLANs.

• Switch configuration for VLANs: Explain why a switch can forward frames without particular configuration but needs its ports configured to use VLANs.
  Why it matters: It explains why VLANs require switch setup even though basic frame forwarding does not.

Key terms: MAC address table, source MAC address, VLANs, switch’s ports

12.2.1 Creating and naming VLANs

Explains the switch’s default VLANs and shows how to create, name, temporarily disable, and delete VLANs in Cisco IOS.

• Default and reserved VLANs: Describe which VLAN contains switch ports by default, what show vlan brief displays, and why VLANs 1002–1005 cannot be used for Ethernet VLANs.
  Why it matters: The default state gives you a baseline for checking whether VLAN configuration has changed port membership.
• VLAN creation and naming: Explain how to create a VLAN and optionally give it a name in Cisco IOS, including what name it receives if none is configured.
  Why it matters: These commands let you establish and identify the VLANs that ports can later join.
• VLAN shutdown and deletion: Distinguish temporarily disabling a VLAN with shutdown from deleting it with no vlan, and describe the displayed shutdown status.
  Why it matters: Disabling a VLAN and removing it are different changes, even though both stop it from operating normally.

Key terms: show vlan brief, VLAN database, VLAN 1, VLANs 1002–1005, vlan vlan-id, VLAN configuration mode, name vlan-name, VLANxxxx, shutdown, act/lshut

12.2.2 Assigning ports to VLANs

This section shows how to assign switch ports to VLANs and explains what that assignment means for frame forwarding and connected hosts.

• Access port VLAN assignment: Describe how to configure a switch port as an access port and assign it to a VLAN, and distinguish an access port from a trunk port.
  Why it matters: These two settings determine which VLAN an access port serves without leaving its mode to automatic negotiation.
• Automatic VLAN creation: Explain what happens if a port is assigned to a VLAN that does not yet exist on the switch, and when explicitly creating the VLAN remains necessary.
  Why it matters: It explains why assigning an access VLAN can work even when that VLAN was not created first.
• VLAN forwarding boundaries: Explain how SW1 handles frames after its ports are assigned to VLANs and clarify whether typical connected hosts know their VLAN.
  Why it matters: It connects port configuration to the traffic separation VLANs provide.

Key terms: access port, trunk port, access mode, switchport mode access, switchport access vlan vlan-id, Dynamic Trunking Protocol (DTP), switchport access vlan, vlan command, name command, forward

12.3 Connecting switches with trunk ports

Explains why switches use trunk links to carry multiple VLANs and how tagged trunk traffic differs from untagged access-port traffic.

• Trunk links between switches: Explain why switches with hosts in the same VLANs need a trunk link and why separate access links for each VLAN are less scalable.
  Why it matters: This explains why trunk ports are useful when several VLANs span multiple switches.
• VLAN tags on trunk frames: Trace what happens to a frame sent through a trunk port and explain why its VLAN tag matters at the receiving switch.
  Why it matters: The tag lets a shared inter-switch link preserve each frame’s VLAN membership.
• Untagged access port traffic: Distinguish access-port traffic from trunk traffic, including how a received access-port frame gets its VLAN.
  Why it matters: This contrast explains why access ports can leave frames untagged while trunk ports need tags.

Key terms: trunk port, trunk link, access link, VLAN, tag, tagged port, access port, untagged port, switchport access vlan

12.3.1 The IEEE 802.1Q tag

This subsection explains how IEEE 802.1Q tags identify VLANs on trunked Ethernet frames, what the tag’s fields mean, and how Cisco’s older ISL tagging differs.

• 802.1Q tag placement and detection: Describe where an 802.1Q tag is inserted in an Ethernet frame and how a switch recognizes a tagged frame.
  Why it matters: This explains how a switch can recognize VLAN-tagged traffic on a trunk.
• VLAN identifier within the tag: Explain what the VID field conveys and how its size relates to the number of VLANs.
  Why it matters: The VID is the part of the tag that identifies the frame’s VLAN.
• Priority and drop indicators: Describe the purposes of the PCP and DEI fields within the tag’s TCI.
  Why it matters: Not every field in the VLAN tag identifies a VLAN; some mark traffic priority or drop eligibility.
• ISL and 802.1Q differences: Distinguish Cisco ISL from 802.1Q in how they add tagging information, and state the configuration implication of older switches supporting ISL.
  Why it matters: Older Cisco switches that support both tagging protocols need an extra trunk-configuration step.

Key terms: IEEE 802.1Q, trunk ports, Tag Protocol Identifier (TPID), EtherType, 0x8100, VLAN Identifier (VID), Tag Control Information (TCI), Priority Code Point (PCP), Drop Eligible Indicator (DEI), Quality of Service (QoS)

12.3.2 Configuring trunk ports

This section shows how to configure and verify trunk ports, control which VLANs they carry, and handle native VLAN traffic safely.

• Trunk configuration and verification: Explain when a switch requires an encapsulation command before manually setting a port to trunk mode, and describe how to verify the resulting trunk.
  Why it matters: You need to know why a trunk command might be rejected and how to confirm that the port is trunking.
• Allowed VLAN list control: Distinguish VLANs allowed on a trunk from VLANs it can actually forward, and explain how the allowed-list commands replace or modify that list.
  Why it matters: An accidental replacement of the allowed list can block communications for other VLANs.
• Native VLAN traffic handling: Explain how a trunk treats untagged frames and native VLAN frames, and distinguish the native VLAN from the default VLAN.
  Why it matters: The native VLAN determines how untagged traffic is classified on a trunk.
• Native VLAN mismatch consequences: Trace what can happen to an untagged frame when the two ends of a trunk use different native VLANs.
  Why it matters: Matching native VLANs prevents untagged frames from being interpreted as belonging to a different VLAN across the link.
• Unused native VLAN practice: Justify the recommendation to configure an unused, nondefault VLAN as the native VLAN on trunk ports.
  Why it matters: An unused native VLAN reduces reliance on untagged trunk traffic without claiming the feature can be switched off.

Key terms: switchport trunk encapsulation, switchport mode trunk, show vlan brief, show interfaces trunk, DTP, Vlans allowed on trunk, Vlans allowed and active in management domain, switchport trunk allowed vlan, add, remove

12.4 Inter-VLAN routing

Defines inter-VLAN routing and explains why a separate router link for every VLAN is usually impractical.

• Purpose of inter-VLAN routing: Explain why a LAN segmented into subnets and VLANs may still need routing, and what inter-VLAN routing means in this context.
  Why it matters: It explains how devices in different VLANs can communicate rather than remaining isolated.
• Separate links and alternatives: Describe the one-link-per-VLAN inter-VLAN routing option, why it is uncommon in LANs with many VLANs, and the alternatives named here.
  Why it matters: The physical-port limitation explains why other inter-VLAN routing designs are usually preferred.

Key terms: inter-VLAN routing, subnets, VLANs, Layer 2, Layer 3, access ports, router on a stick, trunk link, multilayer switch

12.4.1 Router on a stick

Explains how router on a stick routes between VLANs through one switch-to-router trunk, how to configure its subinterfaces, and how to handle the native VLAN.

• Router on a stick operation: Explain how one physical router interface can route between VLANs using a trunk and virtual subinterfaces, and how VLAN tags identify the receiving subinterface.
  Why it matters: This explains how a single router connection can serve several VLANs.
• Basic ROAS configuration: Describe how to configure the switch trunk and router subinterfaces for inter-VLAN routing, including what determines each subinterface’s VLAN and where IP addresses go.
  Why it matters: These settings let one physical trunk connection carry traffic for several routed VLANs.
• Native VLAN configuration options: Distinguish the two ways to configure a native VLAN on the router side of a ROAS trunk, and state when no native-VLAN router configuration is needed.
  Why it matters: The native VLAN changes where its router-side IP address can be configured, and both ends of the trunk must agree on it.

Key terms: router on a stick, ROAS, trunk link, subinterfaces, VLAN tag, subinterface configuration mode, encapsulation dot1q vlan-id, no shutdown, show ip interface brief, native VLAN

12.4.2 Multilayer switching

Explains how a multilayer switch routes between VLANs using SVIs and reaches external networks through a routed port.

• Multilayer switch inter-VLAN routing: Explain how a multilayer switch uses SVIs to route between VLANs without an external router.
  Why it matters: This explains how devices in different VLANs can communicate without relying on a separate router for inter-VLAN routing.
• VLAN and SVI configuration: Distinguish a VLAN from an SVI and describe the basic configuration that enables a multilayer switch to route between them.
  Why it matters: Creating a VLAN alone does not give its hosts a Layer 3 gateway.
• SVI operational requirements: State the conditions for an SVI to reach an up/up state and explain why they matter for routing.
  Why it matters: These checks help pinpoint why a configured VLAN gateway cannot route traffic.
• Routed port external connectivity: Explain how a routed port connects a multilayer switch to external networks and why another route is needed.
  Why it matters: An IP-addressed uplink is not enough unless the switch also knows where to send traffic beyond the LAN.
• Trunk mode configuration precedence: Apply the stated port mode to determine how a switch treats untagged frames when access and trunk settings coexist.
  Why it matters: It prevents a misleading access-VLAN setting from changing your interpretation of a trunk port.

Key terms: multilayer switch, Layer 3 switch, switch virtual interface, SVI, default gateway, VLAN, ip routing, interface vlan vlan-id, up/up, access port

12.5 Summary