CCNA guide

VLANs and Trunks Explained (802.1Q, Native VLAN, Inter-VLAN Routing)

VLANs are a simple idea, but they come with a few details (native VLAN, the allowed VLAN list, DTP) that break a lot of labs and generate a lot of exam questions.

In this guide you'll learn why VLANs exist, how access and trunk ports work, what's inside the 802.1Q tag, what the native VLAN is, why you turn DTP off, how inter-VLAN routing works and which Cisco IOS commands you use to configure and verify it all. At the end there's a troubleshooting table and exercises with answers.

In the Networking Academy CCNA v8 courses, these topics are in CCNA 2 · IEN: VLANs and trunks in module 3, inter-VLAN routing in module 4, and VLAN hopping attacks in module 11 (access and Layer 2 security).

Why we use VLANs

Without VLANs, every port on a switch is in the same local network and the same broadcast domain. A broadcast sent by one PC (for example an ARP or DHCP request) reaches all the others. In a company with hundreds of devices, that means pointless traffic and no separation between departments.

A VLAN (Virtual LAN) logically splits the switch into several separate networks: ports in VLAN 10 don't see frames from VLAN 20. What you gain:

• smaller broadcast domains: a broadcast stays inside its own VLAN;
• security: traffic between VLANs passes through a Layer 3 device, where you can apply rules (ACLs);
• organization: the VLAN follows the function (Sales, Accounting, Voice), not the physical location;
• lower cost: the same switches serve several networks.

The basic rule: one VLAN = one broadcast domain = one IP subnet. If you need help splitting up the addresses, see the subnetting step-by-step guide.

VLAN types and ranges

On most Catalyst switches, normal-range VLANs are stored in the vlan.dat file in flash memory, separately from the running configuration.

Access ports and trunk ports

An access port belongs to a single data VLAN. Frames leave and arrive on it untagged, so the connected device (a PC, for example) doesn't even know VLANs exist. The switch keeps track internally of which VLAN each port is in.

A trunk port carries multiple VLANs over the same cable. So that the switch at the other end knows which VLAN each frame came from, frames are marked with a tag. Trunks usually connect switches to each other, a switch to a router, or a switch to a virtualization server.

PC-A (VLAN 10) ---access---+        802.1Q trunk         +---access--- PC-C (VLAN 10)
                           S1 ======================== S2
PC-B (VLAN 20) ---access---+  (carries VLANs 10 and 20)  +---access--- PC-D (VLAN 20)

PC-A and PC-C are in the same network even though they're on different switches. PC-A and PC-B are on the same switch but in different networks: without a router or a Layer 3 switch, they can't communicate.

The 802.1Q tag

The IEEE 802.1Q standard inserts a 4-byte tag into the Ethernet frame, between the source MAC address and the type field (EtherType):

Untagged:   | Dest. MAC | Source MAC |          | Type | Data | FCS |
802.1Q:     | Dest. MAC | Source MAC | 4-B tag  | Type | Data | FCS |

Because the tag changes the frame's contents, the switch recalculates the FCS. The maximum frame size grows from 1,518 to 1,522 bytes. There used to be a Cisco-proprietary method too, ISL, which is no longer used on current equipment.

The native VLAN

On an 802.1Q trunk, exactly one VLAN travels untagged: the native VLAN. Any frame received untagged on a trunk is treated as belonging to the native VLAN. By default, the native VLAN is VLAN 1.

Three practical rules:

1. The native VLAN must match at both ends. If one end has 1 and the other has 99, untagged frames "jump" from one VLAN to another. CDP notices this and logs a message like %CDP-4-NATIVE_VLAN_MISMATCH.
2. Move the native VLAN off VLAN 1 to a dedicated VLAN with no users in it (for example 999). This reduces the risk of a double-tagging attack: an attacker connected to a port in the native VLAN sends a frame with two tags; the first switch strips the outer one (the native VLAN's, which leaves on the trunk untagged), and the second switch reads the inner one and delivers the frame into a different VLAN.
3. Don't use the native VLAN for data or management.

The allowed VLAN list

By default, a trunk lets all VLANs through. It's safer and cleaner to allow only what you need:

S1(config-if)# switchport trunk allowed vlan 10,20,99,999
S1(config-if)# switchport trunk allowed vlan add 30
S1(config-if)# switchport trunk allowed vlan remove 20

The classic trap: switchport trunk allowed vlan 30 without add replaces the whole list. The trunk that carried 10, 20 and 99 will now carry only 30, and users in the other VLANs suddenly lose their network. When adding, always type add.

DTP and why you turn it off

DTP (Dynamic Trunking Protocol) is a Cisco protocol that automatically negotiates whether a link becomes a trunk. The port modes:

The result of each combination:

On many Catalyst switches (for example the 2960 series), the default mode is dynamic auto. Two new switches connected to each other do not form a trunk on their own, because both are waiting. This is a very common exam question.

Why you turn DTP off: if a user port negotiates, an attacker can pretend to be a switch (switch spoofing), form a trunk and receive traffic from every VLAN. Recommended practice:

• user ports: switchport mode access (optionally also switchport nonegotiate);
• trunks: switchport mode trunk and switchport nonegotiate;
• unused ports: shutdown and moved into an unused VLAN.

The voice VLAN

When the PC is connected through an IP phone, two traffic flows share the same port. The solution is an access port with a voice VLAN:

S1(config)# interface FastEthernet0/5
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 10
S1(config-if)# switchport voice vlan 150

The phone learns the voice VLAN from the switch via CDP (or LLDP-MED) and tags its traffic with the 802.1Q tag for VLAN 150, including the priority in the PCP field. The PC's traffic stays untagged, in VLAN 10.

Full switch configuration

The example below creates two data VLANs, a management VLAN and a native VLAN, puts the ports into VLANs and configures the trunk to another switch.

S1# configure terminal
S1(config)# vlan 10
S1(config-vlan)# name SALES
S1(config-vlan)# exit
S1(config)# vlan 20
S1(config-vlan)# name ACCOUNTING
S1(config-vlan)# exit
S1(config)# vlan 99
S1(config-vlan)# name MANAGEMENT
S1(config-vlan)# exit
S1(config)# vlan 999
S1(config-vlan)# name NATIVE
S1(config-vlan)# exit
S1(config)# interface range FastEthernet0/1 - 10
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 10
S1(config-if-range)# exit
S1(config)# interface range FastEthernet0/11 - 20
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 20
S1(config-if-range)# exit
S1(config)# interface GigabitEthernet0/1
S1(config-if)# switchport mode trunk
S1(config-if)# switchport trunk native vlan 999
S1(config-if)# switchport trunk allowed vlan 10,20,99,999
S1(config-if)# switchport nonegotiate
S1(config-if)# exit
S1(config)# interface vlan 99
S1(config-if)# ip address 192.168.99.11 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.99.1
S1(config)# end
S1# copy running-config startup-config

A few useful details:

• On switches that also support ISL (Cisco's legacy trunking method), you must choose the encapsulation before switchport mode trunk: switchport trunk encapsulation dot1q. On the 2960 series the command doesn't exist, because it only knows 802.1Q.
• If you assign a port to a VLAN that doesn't exist, the switch creates it automatically and tells you.
• no vlan 20 deletes the VLAN, but the ports stay assigned to it and become inactive. Move them to another VLAN first.
• The vlan 99 interface (an SVI) and ip default-gateway let you manage the switch remotely. A Layer 2 switch doesn't route, so it needs a gateway to reply to devices in other networks.

Verification

Sample output for the trunk configured above:

S1# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      999

Port        Vlans allowed on trunk
Gi0/1       10,20,99,999

Port        Vlans allowed and active in management domain
Gi0/1       10,20,99,999

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/1       10,20,99,999

"Mode on" = static trunk. A VLAN listed under "allowed" but missing from "allowed and active" probably hasn't been created on the switch.

Inter-VLAN routing

VLANs are separate networks, so they need a Layer 3 device to communicate. There are three options.

1. The legacy option: one router interface per VLAN

Each VLAN uses its own cable and a separate router interface. It doesn't scale.

2. Router-on-a-stick

A single cable, configured as a trunk on the switch, while on the router the physical interface is split into subinterfaces, one per VLAN. Each subinterface knows which tag to read and apply (encapsulation dot1Q) and holds the gateway address for its VLAN.

R1(config)# interface GigabitEthernet0/0/1.10
R1(config-subif)# description Gateway VLAN 10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0/1.20
R1(config-subif)# description Gateway VLAN 20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0/1.99
R1(config-subif)# encapsulation dot1Q 99
R1(config-subif)# ip address 192.168.99.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0/1.999
R1(config-subif)# encapsulation dot1Q 999 native
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# no shutdown

Things to remember:

• the subinterface number (.10) is just a name; what counts is the VLAN in encapsulation dot1Q 10 (keep them identical);
• the physical interface gets no IP address, but it must be brought up with no shutdown; the subinterfaces follow its state;
• encapsulation dot1Q 999 native tells the router that the native VLAN is 999, just like on the switch;
• the router doesn't negotiate DTP, so the switch port facing the router must be set manually with switchport mode trunk;
• PCs in VLAN 10 use gateway 192.168.10.1, and PCs in VLAN 20 use 192.168.20.1.

Verification: show ip interface brief (subinterfaces must be up/up), show ip route (one connected "C" network per VLAN) and show vlans on the router (with an "s"; on the switch the command is show vlan brief).

The limitation: traffic between VLANs crosses the same cable twice, so in a large network it becomes the bottleneck.

3. Layer 3 switch with SVIs

A multilayer switch can route by itself. For each VLAN you create an SVI (Switch Virtual Interface), that is, a virtual interface vlan X with the VLAN's gateway address, and you enable routing:

D1(config)# ip routing
D1(config)# interface vlan 10
D1(config-if)# ip address 192.168.10.1 255.255.255.0
D1(config-if)# no shutdown
D1(config-if)# exit
D1(config)# interface vlan 20
D1(config-if)# ip address 192.168.20.1 255.255.255.0
D1(config-if)# no shutdown
D1(config-if)# exit
D1(config)# interface GigabitEthernet1/0/24
D1(config-if)# no switchport
D1(config-if)# ip address 10.0.0.1 255.255.255.252
D1(config-if)# no shutdown

• ip routing is mandatory; without it the switch has an address in each VLAN but doesn't route between them.
• An SVI is up/up only if the VLAN exists, at least one port in that VLAN (an access port, or a trunk carrying it) is up and in the STP forwarding state, and the SVI itself isn't shutdown.
• no switchport turns a physical port into a routed port, like a router interface, which is useful toward a router or another Layer 3 switch.

Troubleshooting: common mistakes

Exercises

1. PCs in VLAN 10 on S1 and S2 can't talk to each other. On the trunk, show interfaces trunk shows "Vlans allowed on trunk: 1,20,30". What's the problem, and which command fixes it without affecting the other VLANs?
2. You connect two new 2960 switches with the default configuration (dynamic auto on both). Does a trunk form? What do you do to make it a trunk?
3. Write the router-on-a-stick configuration for VLAN 30, with network 192.168.30.0/24 and gateway .1, on interface GigabitEthernet0/0/0.
4. How many values does the 802.1Q VLAN ID field have, and how many VLANs can you actually use? Why?
5. On a trunk that carried VLANs 10, 20 and 30, someone typed switchport trunk allowed vlan 40. What happens, and how should the command have been written?

R1(config)# interface GigabitEthernet0/0/0.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# no shutdown

The fastest way to learn this

• Build the same lab three times: with router-on-a-stick, with a Layer 3 switch, and deliberately broken (mismatched native VLAN, a VLAN missing from the trunk), then fixed using only show commands.
• Memorize the DTP table.
• Tie VLANs to the layers: trunks are Layer 2, inter-VLAN routing is Layer 3. See OSI vs TCP/IP.
• Master the basic commands in the Cisco IOS commands cheat sheet.

Frequently asked questions

Routerel is an independent app and is not affiliated with, sponsored by or endorsed by Cisco Systems, Inc. Cisco, CCNA, Cisco IOS, Catalyst and Networking Academy are trademarks of Cisco Systems, Inc.