VLAN Technical Guide

VLAN Technical Guide

TABLE OF CONTENTS
Introduction to VLANs........................................................................................................ 3
What is a VLAN?........................................................................................................... 3
VLAN Configuration............................................................................................................ 3
Basic VLAN Configuration on Cisco Switch......................................................................3
Trunking Between Switches............................................................................................4
Inter-VLAN Routing (Router-on-a-Stick Method)..............................................................5
Layer 3 Switching for VLAN Routing................................................................................5
VLAN Best Practices........................................................................................................... 6
Troubleshooting VLANs...................................................................................................... 6
Conclusion......................................................................................................................... 6

2
 VLAN Technical Guide

INTRODUCTION TO VLANS

WHAT IS A VLAN?
 VLAN stands for Virtual Local Area Network.

 It logically segments a network, creating isolated broadcast domains.

 VLANs improve security, reduce unnecessary traffic, and enhance network

 Operates at Layer 2 (Data Link Layer) but can interact with Layer 3 (Network
Layer) through routing.

 VLANs are identified by VLAN IDs (1-4094).

 Helps organizations group devices logically rather than by physical location.

HOW VLANS WORK

 Access ports are assigned to a single VLAN and forward only traffic from that
VLAN.

 Trunk ports carry traffic from multiple VLANs using 802.1Q tagging.

 VLANs must be routed by a Layer 3 device (router or Layer 3 switch) to

TYPES OF VLANS
VLAN Type Description

Data VLAN Used for regular data traffic.

Voice VLAN Prioritizes VoIP traffic.

Management VLAN Used for switch management (e.g., VLAN 1).

Native VLAN Untagged VLAN for trunk links.

Guest VLAN Provides limited access to guest users.

Extended VLAN VLANs above 1005, used in service provider networks.

VLAN CONFIGURATION

BASIC VLAN CONFIGURATION ON CISCO SWITCH

# Enter global configuration mode

3
 VLAN Technical Guide

enable

configure terminal

# Create VLANs

vlan 10

name HR

vlan 20

name IT

# Assign ports to VLANs

interface range fastEthernet 0/1-5

switchport mode access

switchport access vlan 10

interface range fastEthernet 0/6-10

switchport mode access

switchport access vlan 20

# Verify VLANs

show vlan brief

TRUNKING BETWEEN SWITCHES

 Trunking allows multiple VLANs to pass through a single physical link.

 802.1Q tagging is used to identify VLANs on trunk links.

 Each Ethernet frame is tagged with a VLAN ID before transmission over a trunk.

 Native VLAN traffic remains untagged.

# Configure trunk ports

interface fastEthernet 0/24

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 10,20

INTER-VLAN ROUTING (ROUTER-ON-A-STICK METHOD)

4
 VLAN Technical Guide

 VLANs on different subnets require a router to communicate.

 Sub-interfaces are created on a router for each VLAN.

 Packets are tagged and forwarded between VLANs via a trunk link to the router.

# Configure inter-VLAN routing

interface gigabitEthernet 0/0

no shutdown

interface gigabitEthernet 0/0.10

encapsulation dot1Q 10

ip address 192.168.10.1 255.255.255.0

interface gigabitEthernet 0/0.20

encapsulation dot1Q 20

ip address 192.168.20.1 255.255.255.0

LAYER 3 SWITCHING FOR VLAN ROUTING

 A Layer 3 switch can route VLANs without needing an external router.

 Instead of using sub-interfaces, SVIs (Switch Virtual Interfaces) are created.

# Enable IP routing on Layer 3 switch

ip routing

# Create SVIs for VLANs

interface vlan 10

ip address 192.168.10.1 255.255.255.0

no shutdown

interface vlan 20

ip address 192.168.20.1 255.255.255.0

no shutdown

VLAN BEST PRACTICES

5
 VLAN Technical Guide

 Change the Native VLAN: Use a VLAN other than VLAN 1 to prevent VLAN
hopping attacks.

 Use VLAN Pruning: Restrict VLANs on trunk links to reduce unnecessary traffic.

 Enable BPDU Guard: Helps prevent malicious STP (Spanning Tree Protocol)
manipulation.

 Use Access Control Lists (ACLs): Control traffic between VLANs to enhance
security.

 Document VLAN Configurations: Keep track of VLAN assignments and IP

TROUBLESHOOTING VLANS

Issue Troubleshooting Command

VLAN not configured show vlan brief

Trunk port issues show interfaces trunk

Incorrect VLAN assignment show interfaces switchport

Inter-VLAN communication issues show ip route

Native VLAN mismatch show interfaces trunk

MAC address table issues show mac address-table

CONCLUSION
VLANs improve network segmentation, security, and efficiency. Proper VLAN design and
configuration ensure optimal performance. Use VLAN best practices to prevent security
vulnerabilities.