VLANs

What It Is

A VLAN is a Layer 2 broadcast domain carried over Ethernet switching infrastructure. VLAN tags let multiple logical LANs share physical links, but a VLAN is not a security boundary by itself. Routing, firewall policy, host controls, and switch configuration decide what can actually talk.

Core Concepts

Modern note: VLANs are still everywhere, but modern designs try to keep Layer 2 domains smaller and push routing closer to the access, distribution, or leaf layer.

802.1Q Tag Basics

Watch out: VLAN IDs 0 and 4095 are reserved in normal 802.1Q operation. Platform defaults also reserve or treat some VLANs specially.

Access Vs Trunk

Design note: If a link only needs one routed network, make it routed when the platform supports it. Do not build a trunk just because trunks are familiar.

Native VLAN Guidance

Watch out: "Native VLAN" is not a management VLAN. It is the VLAN used for untagged traffic on a trunk.

VLANs And Security

Modern note: In modern networks, VLANs are usually one layer in segmentation. Identity, firewall policy, NAC, SASE, microsegmentation, or cloud security groups may also define the real boundary.

Design Patterns

Design note: Name VLANs for purpose, not just number. VLAN 120 - CORP-WIRED-USERS is easier to operate than VLAN 120.

Common VLAN Plan

Watch out: A management VLAN is sensitive. Do not let normal users reach switch, AP, firewall, hypervisor, or controller management just because it is "inside."

Troubleshooting

Cisco IOS/IOS-XE Examples

Create VLANs:

vlan 20
 name CORP-WIRED
!
vlan 30
 name CORP-WIFI
!
vlan 999
 name BLACKHOLE-NATIVE

Access port:

interface GigabitEthernet1/0/10
 description Workstation
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable

Trunk with explicit allowed VLANs:

interface GigabitEthernet1/0/48
 description Uplink to DIST-01
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,40,50,60
 switchport nonegotiate

SVI gateway:

interface Vlan20
 description CORP-WIRED gateway
 ip address 10.10.20.1 255.255.255.0
 no shutdown

Notes:

• Keep trunk allowed lists explicit.
• Use an unused native VLAN when the design still has an untagged native VLAN.
• switchport nonegotiate disables DTP, but both sides must be manually configured correctly.
• Add Layer 3 policy somewhere. VLANs alone do not decide who can talk.

Commands

show vlan brief
show interfaces trunk
show interfaces switchport
show spanning-tree vlan 20
show mac address-table vlan 20
show arp vlan 20

bridge vlan show
ip link show
ip addr show
ip route show

Expected clues:

• Access port is in the intended VLAN.
• Trunk carries the VLAN on both ends.
• Native VLAN matches or is intentionally tagged.
• SVI is up/up when at least one active port exists in the VLAN.
• STP is not blocking the only path.
• MAC table learns hosts in the expected VLAN.
• DHCP relay or scope matches the VLAN subnet.

Watch Out

• Do not leave trunks allowing every VLAN by default.
• Do not put users, management, servers, guest, and IoT in one flat VLAN.
• Do not treat VLAN separation as firewall policy.
• Do not stretch VLANs between sites unless there is a specific, tested requirement.
• Do not reuse VLAN IDs across locations without clear documentation.
• Do not trunk to phones, APs, hypervisors, or cameras without knowing which VLANs they actually need.
• Do not forget that wireless SSIDs often map to VLANs behind the scenes.

References

• IEEE 802.1Q-2022: Bridges and Bridged Networks
• IEEE 802.1Q-2018 overview
• Cisco IOS XE 17.12 VLAN Configuration Guide: Configuring VLAN Trunks