What is a VLAN?
A VLAN creates a separate Layer-2 broadcast domain on shared switching infrastructure. Devices in different VLANs need a Layer-3 gateway to communicate.
Users
VLAN 10
→VLAN 10
802.1Q trunk
←Servers
VLAN 20
VLAN 20
Access ports and trunk ports
| Port type | Behaviour | Typical connection |
|---|---|---|
| Access | Carries one access VLAN for ordinary endpoint traffic; frames are normally untagged toward the endpoint. | PC, printer, phone access side, simple server |
| Trunk | Carries multiple VLANs using IEEE 802.1Q tags, subject to the allowed-VLAN list. | Switch-to-switch, switch-to-router, switch-to-firewall, hypervisor |
| Native VLAN | Frames for the native VLAN may be untagged on an 802.1Q trunk, depending on platform configuration. | Must match on both ends to avoid leaks and control-plane problems. |
How 802.1Q tagging works
An 802.1Q tag identifies the VLAN associated with an Ethernet frame across a trunk. The tag includes a 12-bit VLAN identifier field, with some values reserved. Operational VLAN ranges and platform support vary.
Security practice: Do not use the default/native VLAN casually for user traffic. Explicitly allow only required VLANs and disable unused switch ports.
Inter-VLAN routing
| Method | Description | Use case |
|---|---|---|
| Router-on-a-stick | One physical router interface uses tagged subinterfaces. | Small labs and simple branches. |
| Layer-3 switch SVI | A switched virtual interface acts as the VLAN gateway. | Campus and data-centre networks. |
| Firewall subinterfaces | A firewall routes and applies policy between VLANs. | Security zones and controlled segmentation. |
Configuration example
Cisco IOS-style example
vlan 10 name USERS vlan 20 name SERVERS ! interface GigabitEthernet1/0/10 switchport mode access switchport access vlan 10 spanning-tree portfast ! interface GigabitEthernet1/0/48 switchport trunk encapsulation dot1q switchport mode trunk switchport trunk native vlan 999 switchport trunk allowed vlan 10,20,999
Troubleshooting checklist
- Confirm the VLAN exists on every required switch.
- Check access VLAN assignment and voice-VLAN configuration.
- Check trunk state, encapsulation, native VLAN and allowed list.
- Inspect MAC learning in the expected VLAN.
- Check STP blocking state.
- Verify SVI/subinterface status, gateway IP and routing.
- Check ACL/firewall policy for inter-VLAN traffic.
Useful checks
show vlan brief show interfaces trunk show interfaces switchport show mac address-table vlan 10 show spanning-tree vlan 10 show ip interface brief
Quick self-check
1. Can hosts in different VLANs communicate through Layer 2 only?
Answer: No. They need Layer-3 routing.
2. What standard tags VLAN traffic on Ethernet trunks?
Answer: IEEE 802.1Q.
3. What happens when a VLAN is missing from the trunk allowed list?
Answer: Traffic for that VLAN does not cross the trunk.
4. Why must native VLAN configuration match?
Answer: Mismatch can place untagged traffic into different VLANs and create security or control-plane issues.
5. What is an SVI?
Answer: A Layer-3 virtual interface associated with a VLAN, often used as its default gateway.
Frequently asked questions
1. Does every port carry a VLAN?
Answer: Switch platforms associate Layer-2 ports with VLAN forwarding context, but routed ports operate differently.
2. Is a VLAN a security control by itself?
Answer: It provides segmentation, but security policy should be enforced with ACLs, firewalls, NAC and correct switch configuration.
3. What is the difference between tagged and untagged traffic?
Answer: Tagged traffic carries an 802.1Q VLAN identifier. Untagged traffic has no VLAN tag on the wire and is mapped according to port/native-VLAN rules.
Standards and further reading
Editorial note: Vendor commands and best-path tie-breakers can differ by platform and software release. Always verify production configuration against the device vendor documentation.