If you have ever wondered how a company puts finance, guests and IP phones on the same cabling without letting them see each other, the answer is almost always a VLAN. This guide explains what a VLAN is, how trunks and 802.1Q tagging carry several VLANs over one cable, how to configure and verify everything on Cisco IOS, and where the exam traps are on CompTIA Network+ and Cisco CCNA. It assumes you know what a switch and an IP address are; if the layers feel shaky, start with the OSI model guide.
Why do VLANs exist?
A basic switch forwards frames between all of its ports. That is fine in a small office, but it has three problems at scale. Broadcasts (ARP requests, DHCP discovers and others) are flooded to every port, so the more devices you add, the more noise every device processes. Everything can reach everything at Layer 2, so there is no natural place to enforce policy. And grouping users by function or department would otherwise require separate physical switches for each group.
VLANs solve this in software. You label each port with a VLAN number, and the switch treats ports with different labels as if they were on different switches. The practical benefits are smaller broadcast domains, segmentation of traffic (guest, staff, servers, voice, management), easier moves and changes because the group is defined by configuration instead of cabling, and a clean place to apply access control between groups.
How do VLANs create broadcast domains?
A broadcast domain is the set of devices that receive a Layer 2 broadcast sent by any member. By default a switch has one broadcast domain and one collision domain per port. Each VLAN you create becomes a separate broadcast domain: a broadcast from a host in VLAN 10 is flooded only to other VLAN 10 ports, never to VLAN 20.
| Device | Collision domains | Broadcast domains |
|---|---|---|
| Hub | One for all ports | One |
| Switch (single VLAN) | One per port | One |
| Switch with 3 VLANs in use | One per port | Three |
| Router | One per interface | One per interface (broadcasts are not forwarded) |
Because each VLAN is a separate broadcast domain, hosts in it also need their own IP subnet, and that is why the VLAN and the subnet are so closely linked. A host that wants to reach a different subnet sends the traffic to its default gateway, and the gateway has to be a Layer 3 device. See subnetting explained and VLSM explained for how to size those subnets.
Access ports vs trunk ports
Every switch port that carries VLAN traffic is configured in one of two operational modes:
| Feature | Access port | Trunk port |
|---|---|---|
| VLANs carried | Exactly one | Many (all, or a configured allowed list) |
| Frames on the wire | Untagged | 802.1Q tagged, except the native VLAN |
| Connects to | PCs, printers, servers, APs, cameras | Other switches, routers, hypervisors, some access points |
| Typical command | switchport mode access | switchport mode trunk |
| End device knows about VLANs? | No | Yes, the other end must understand tags |
An end device never needs to know it is in a VLAN. The switch adds the VLAN identity when the frame enters an access port and removes it when the frame leaves another access port. Tags only exist on the links between VLAN-aware devices, which is why one trunk cable can replace many separate cables between two switches.
How does 802.1Q tagging work?
IEEE 802.1Q is the standard that defines VLAN tagging on Ethernet. A trunk port inserts a 4-byte tag into the Ethernet header, between the source MAC address and the EtherType field, so that the receiving switch knows which VLAN the frame belongs to.
| Tag field | Size | Purpose |
|---|---|---|
| TPID (Tag Protocol Identifier) | 16 bits | Fixed value 0x8100, identifying the frame as 802.1Q tagged |
| PCP (Priority Code Point) | 3 bits | Layer 2 class of service (802.1p priority, 0 to 7) |
| DEI (Drop Eligible Indicator) | 1 bit | Marks frames that may be dropped first under congestion |
| VID (VLAN Identifier) | 12 bits | The VLAN number |
Twelve bits give 4,096 values. VID 0 means “priority-tagged, no VLAN” and 4095 is reserved, so usable VLAN IDs are 1 to 4094. Because the tag adds 4 bytes, the maximum tagged frame grows from 1518 to 1522 bytes; switches that support 802.1Q handle this automatically, and the payload MTU stays at 1500. Cisco's older proprietary trunking protocol, ISL, is obsolete; current Catalyst switches support only 802.1Q, so you will rarely need the switchport trunk encapsulation dot1q command, which survives only on some older platforms.
Worth knowing for the exam: 802.1Q tagging means one cable can carry traffic for many VLANs, and that the tag, not the port, is what keeps the traffic separated while it crosses the trunk. A frame that leaves a trunk without being re-tagged has lost its VLAN identity, which is exactly what happens with the native VLAN.
What is the native VLAN?
The native VLAN is the one VLAN whose frames are sent across an 802.1Q trunk untagged. Any untagged frame arriving on a trunk is assumed to belong to the native VLAN. On Cisco switches the default is VLAN 1. The feature exists for backward compatibility with devices that do not understand tags and for some management traffic.
- Both ends must match. If switch A uses native VLAN 1 and switch B uses native VLAN 99, untagged frames cross into the wrong VLAN, and you will see CDP native VLAN mismatch messages in the log.
- Change it to an unused VLAN. A dedicated, unused native VLAN (for example 999) that no host belongs to removes the foothold used by double-tagging attacks.
- It is per trunk. Native VLAN is configured on each trunk interface with
switchport trunk native vlan 999. - Router subinterfaces. On a router-on-a-stick, the native VLAN subinterface uses
encapsulation dot1q 999 native, or you can put the address on the physical interface.
VLAN ranges and VLAN 1 caveats
| VLAN ID | Meaning on Cisco switches |
|---|---|
| 0, 4095 | Reserved by 802.1Q; not usable as normal VLANs |
| 1 | Default VLAN; every port starts here; cannot be deleted or renamed |
| 2 to 1001 | Normal-range VLANs you can create, stored in the VLAN database (vlan.dat) |
| 1002 to 1005 | Reserved for FDDI and Token Ring; cannot be removed |
| 1006 to 4094 | Extended range; VTP versions 1 and 2 do not carry them (VTP version 3 does) |
The normal and extended ranges are described in Cisco's VLAN configuration guides (linked in the sources). Platform details vary, so confirm limits for your own hardware.
Why VLAN 1 is special. Because VLAN 1 is the default for every port, it is also where control-plane protocols such as CDP, VTP and by default STP BPDUs travel, and it is the default native VLAN. Using it for user traffic mixes user traffic with management, and leaving it as the native VLAN keeps the double-tagging weakness. Common hardening advice: do not put user or management hosts in VLAN 1, keep it unused, and move the native VLAN elsewhere. Note that you cannot delete VLAN 1, you simply stop using it.
What is a voice VLAN?
A voice VLAN is a separate VLAN for IP phone traffic so that voice can be prioritized and isolated from data. Phones usually have a built-in two-port switch: the phone plugs into the wall port and the PC plugs into the phone. The switch port is configured with both a data and a voice VLAN:
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# spanning-tree portfastThe switch advertises the voice VLAN to the phone using CDP or LLDP-MED. The phone then tags its own frames with VLAN 20, and frames from the PC pass through the phone untagged and land in VLAN 10. The port still behaves as an access port for the PC, with one extra VLAN for voice, which is why exams call this a “multi-VLAN access port” case. Network+ also expects you to know the reason: voice is latency-sensitive, so it is kept apart from data and given QoS priority.
How do I configure a VLAN on Cisco IOS?
The CCNA configuration workflow has three parts: create the VLAN, assign access ports, and build the trunk. Example with VLAN 10 for staff and VLAN 20 for voice:
Switch(config)# vlan 10
Switch(config-vlan)# name STAFF
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# vlan 999
Switch(config-vlan)# name NATIVE_UNUSED
Switch(config-vlan)# exit
Switch(config)# interface range GigabitEthernet0/1 - 8
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,999
Switch(config-if)# switchport nonegotiateAlways create and name VLANs first; behavior when you assign a port to a VLAN that does not exist yet varies by platform and software release, so do not rely on it. Also remember that a trunk allowed list set with switchport trunk allowed vlan 10,20 replaces the existing list, while add, remove and except modify it.
Verification commands you must know:
Switch# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi0/9, Gi0/10, Gi0/11, Gi0/12
10 STAFF active Gi0/1, Gi0/2, Gi0/3, Gi0/4
Gi0/5, Gi0/6, Gi0/7, Gi0/8
20 VOICE active
999 NATIVE_UNUSED active
Switch# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi0/24 on 802.1q trunking 999
Port Vlans allowed on trunk
Gi0/24 10,20,999
Switch# show interfaces GigabitEthernet0/1 switchportTwo observations that trip candidates. First, show vlan brief does not list trunk ports under any VLAN, because a trunk belongs to all allowed VLANs rather than to one. Second, the Status column tells you whether the VLAN exists and is active; ports administratively shut down or assigned to a missing VLAN appear differently. For a quick reference of these commands, see the CCNA cheat sheet.
Practice what you just read
Test your VLAN and switching knowledge with free exam-style questions: 30 questions per session, practice mode, no signup needed.
Check yourself
Three quick questions before moving on to routing between VLANs.
Check 1. Two PCs on the same switch are in VLAN 10 and VLAN 20. Can they ping each other with no router or Layer 3 switch?
No. Different VLANs are different broadcast domains and, by design, different IP subnets. Traffic between them has to be routed, either by a router with subinterfaces or by a Layer 3 switch with SVIs.
Check 2. How many bits does the 802.1Q VLAN ID field use, and what is the highest usable VLAN ID?
12 bits, which allows 4,096 values. IDs 0 and 4095 are reserved, so the highest usable VLAN ID is 4094.
Check 3. Which command makes a Cisco switch port carry multiple VLANs between two switches: switchport mode access or switchport mode trunk?
switchport mode trunk. An access port carries one VLAN, untagged. A trunk carries many VLANs using 802.1Q tags.
How does inter-VLAN routing work?
Hosts in different VLANs sit in different subnets, so they need a Layer 3 device. There are three ways to do it, and two matter for the exams.
| Method | How it works | Trade-off |
|---|---|---|
| Legacy: one router interface per VLAN | Each VLAN gets its own physical link to the router | Does not scale; wastes ports |
| Router-on-a-stick | One trunk link; one subinterface per VLAN with 802.1Q encapsulation | Cheap; the single link is a bottleneck and a single point of failure |
| Layer 3 switch with SVIs | A switched virtual interface (interface vlan 10) per VLAN routes inside the switch | Hardware-speed routing; the standard campus design |
Router-on-a-stick configuration, with the switch port facing the router set to trunk:
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0Layer 3 switch with SVIs:
MLS(config)# ip routing
MLS(config)# interface vlan 10
MLS(config-if)# ip address 192.168.10.1 255.255.255.0
MLS(config-if)# no shutdown
MLS(config-if)# interface vlan 20
MLS(config-if)# ip address 192.168.20.1 255.255.255.0
MLS(config-if)# no shutdownEach IP address above becomes the default gateway for hosts in that VLAN. Two classic gotchas: ip routing must be enabled on a Layer 3 switch or it will not route between SVIs, and an SVI stays down/down unless the VLAN exists and at least one active port (access port in the VLAN, or a trunk carrying it) is up. On a router-on-a-stick, the subinterface number is only a label (0/0.10 is conventional), and the encapsulation dot1q value is what actually matters. A packet that moves from VLAN 10 to VLAN 20 is routed, so its TTL decreases and it gets a new Layer 2 header at the router.
To control who can talk to whom, apply access lists on the routed interfaces. If you want to see how routers learn the other networks, read OSPF explained.
Are VLANs secure? VLAN hopping and best practices
VLANs are segmentation, not a security boundary on their own, because misconfigured trunks allow VLAN hopping. The two attacks most often tested are VLAN hopping variants, switch spoofing and double tagging:
| Attack | How it works | Mitigation |
|---|---|---|
| Switch spoofing | Attacker's device pretends to be a switch and negotiates a trunk using DTP, gaining access to all VLANs | Set user ports to switchport mode access; disable DTP with switchport nonegotiate on trunks |
| Double tagging | Attacker in the native VLAN sends a frame with two tags; the first switch strips the outer tag and forwards the inner one into the target VLAN (one-way traffic) | Use an unused native VLAN; never place users in the native VLAN; tag the native VLAN (vlan dot1q tag native) where supported |
General hardening checklist:
- Set every user-facing port to static access mode and assign its VLAN explicitly.
- Shut down unused ports and move them into an unused “parking” VLAN.
- Move the native VLAN to an unused VLAN and make both trunk ends match.
- Prune the trunk allowed list to only the VLANs that need to cross it.
- Keep user and management traffic out of VLAN 1 and put switch management on a dedicated VLAN.
- Add port security, DHCP snooping and dynamic ARP inspection where the exam or the environment calls for them.
- Control inter-VLAN traffic with access lists or a firewall; routing between VLANs is open by default.
This ties into broader design ideas such as the principle of least privilege and defense in depth: VLANs are one layer, not the whole defense.
How do I troubleshoot VLAN problems?
| Symptom | Likely cause | Check / fix |
|---|---|---|
| Host cannot reach anything, link light on | Port in wrong VLAN, or VLAN does not exist | show vlan brief, show interfaces gi0/1 switchport; create the VLAN and correct the assignment |
| Same-VLAN hosts on different switches cannot talk | Trunk down, VLAN not in allowed list, or VLAN missing on the other switch | show interfaces trunk; add the VLAN to the allowed list; create it on both switches |
| Native VLAN mismatch log messages | Different native VLANs on the two trunk ends | Align switchport trunk native vlan |
| Trunk not forming | Both ends set to dynamic auto, or one end is access | Set switchport mode trunk on both ends |
| Hosts in a VLAN reach each other but not other VLANs | No Layer 3 gateway, wrong gateway address, ip routing missing, or SVI down | show ip interface brief, show ip route; verify host default gateway |
| Router-on-a-stick fails | Switch port facing router is access, or wrong dot1q ID on subinterface | Make the switch port a trunk; match encapsulation dot1q to the VLAN ID |
| Phone works, PC behind it does not (or vice versa) | Voice VLAN or access VLAN missing | Check both switchport access vlan and switchport voice vlan |
A reliable method: start with the host's IP, mask and gateway, verify the access port VLAN, follow the path along each trunk checking the allowed list, and finish at the gateway. This bottom-up flow mirrors the OSI approach in our guide on the OSI model.
VLAN vs subnet: what is the difference?
A VLAN is Layer 2: it decides which ports share a broadcast domain. A subnet is Layer 3: it decides which IP addresses belong together. Best practice is one VLAN per subnet, so a host's VLAN number often appears in its IP address (VLAN 10 is 192.168.10.0/24, for instance), but nothing in the protocols forces that. You can technically place two subnets in one VLAN (it works but wastes the isolation) and you should never stretch one subnet across two VLANs. Think of the VLAN as the physical-ish “room” and the subnet as the addressing scheme used inside it. Sizing the subnet for the number of hosts is covered in subnetting explained.
How do Network+ and CCNA test VLANs?
CompTIA Network+ N10-009 expects the concept: what a VLAN does, access vs trunk, tagging with 802.1Q, the voice VLAN idea, segmentation for security, and recognizing a VLAN issue from a scenario. CompTIA also pairs VLANs with the broader domain of network configuration, so expect “which technology isolates departments on the same switch” style questions. See the Network+ exam guide and the Network+ cheat sheet; always confirm the current objective list on the official CompTIA page.
Cisco CCNA 200-301 goes hands-on: creating VLANs, access and trunk configuration, native VLAN, voice VLAN, inter-VLAN routing with subinterfaces and SVIs, and reading show output. VLANs sit in the Network Access domain of the exam blueprint, and the topic list is published on Cisco's exam page, so verify the current wording there. The CCNA exam guide maps domains to study time, and Network+ vs CCNA explains how the depth differs: Network+ asks you to recognize, CCNA asks you to configure and troubleshoot.
Related transport and addressing topics you will meet together with VLANs: TCP vs UDP, what is NAT, private IP address ranges and IPv4 vs IPv6.
VLAN practice questions with answers
Answer each one before you open it. For a timed bank, use the CCNA practice exam or the Network+ practice exam.
1. What does a VLAN define?
A separate Layer 2 broadcast domain on shared switch hardware. It does not define a collision domain (each switch port already is one) and it does not by itself define a routing boundary, although each VLAN normally maps to one IP subnet.
2. A switch has 24 ports in the default configuration. How many broadcast domains and collision domains does it have?
One broadcast domain (all ports are in VLAN 1) and 24 collision domains (one per port). Creating more VLANs raises the broadcast-domain count and leaves the collision-domain count unchanged.
3. Which field in an 802.1Q tag carries the VLAN number, and how big is the whole tag?
The 12-bit VLAN Identifier (VID). The full tag is 4 bytes: a 16-bit Tag Protocol Identifier (0x8100), a 3-bit Priority Code Point, a 1-bit Drop Eligible Indicator and the 12-bit VID. Inserting it raises the maximum Ethernet frame from 1518 to 1522 bytes.
4. Switch A and Switch B are joined by a trunk. A has native VLAN 1 and B has native VLAN 99. What is the result?
A native VLAN mismatch. Untagged frames sent by A are placed into VLAN 99 on B and vice versa, so traffic leaks between VLANs and CDP logs a native VLAN mismatch message. Fix it by setting the same native VLAN on both ends of the trunk, ideally an unused one.
5. Users in VLAN 10 and VLAN 20 must communicate, and the design has one router with a single physical link to the switch. What is this design called and what does the router need?
Router-on-a-stick. The switch port is a trunk and the router has one subinterface per VLAN, each with encapsulation dot1q <vlan-id> and an IP address that serves as the default gateway for that VLAN. A routed interface without subinterfaces, or an access port, would only serve one VLAN.
6. An IP phone and a PC share one switch port. Which configuration lets the phone use VLAN 20 and the PC use VLAN 10?
An access port with switchport access vlan 10 and switchport voice vlan 20. The switch tells the phone its voice VLAN using CDP or LLDP-MED, the phone tags its own frames with VLAN 20 and passes the PC traffic through untagged. Making the port a full trunk is not the standard approach for phones.
7. Which two measures best reduce double-tagging VLAN hopping?
Use a native VLAN that no access port belongs to (for example VLAN 999), and never assign user ports to the native VLAN; where supported, also tag the native VLAN on trunks with vlan dot1q tag native. Double tagging only works when the attacker's access port is in the same VLAN as the trunk native VLAN, so separating them breaks the attack. Static access ports and disabling DTP (switchport nonegotiate) address a different attack, switch spoofing, so they are not the answer to double tagging.
8. A host in VLAN 30 cannot reach the network, and show interfaces trunk shows VLAN 30 missing from the "allowed" list but present in "active". What is the problem?
The trunk's allowed VLAN list does not include VLAN 30, so frames for VLAN 30 are not forwarded across the trunk. Add it with switchport trunk allowed vlan add 30 on both ends. Note that the add keyword preserves the existing list; omitting it replaces the list.
Frequently asked questions
What is a VLAN in simple terms?
A VLAN (virtual LAN) is a logical network carved out of one or more physical switches. Ports assigned to the same VLAN share a single broadcast domain and can talk at Layer 2, while ports in different VLANs cannot talk directly even if they sit on the same switch. A router or Layer 3 switch is needed to move traffic between VLANs.
What is the difference between an access port and a trunk port?
An access port belongs to exactly one VLAN and sends and receives untagged Ethernet frames, which suits end devices such as PCs and printers. A trunk port carries traffic for multiple VLANs between switches or to a router by adding an IEEE 802.1Q tag to each frame, except frames in the native VLAN, which cross the trunk untagged.
What is the VLAN ID range?
The 802.1Q VLAN ID field is 12 bits, giving 4,096 values, of which 1 to 4094 are usable (0 and 4095 are reserved). On Cisco switches, 1 to 1005 is the normal range and 1006 to 4094 is the extended range. VLAN 1 is the default and cannot be deleted, and 1002 to 1005 are reserved for legacy FDDI and Token Ring.
What is the native VLAN?
The native VLAN is the VLAN whose frames cross an 802.1Q trunk without a tag. Cisco switches default to VLAN 1. Both ends of a trunk must agree on the native VLAN or traffic leaks between VLANs and the switches log a native VLAN mismatch from CDP. Best practice is to move it to an unused VLAN.
Do VLANs need a router?
Devices in the same VLAN do not need a router. Devices in different VLANs do, because each VLAN is its own IP subnet and moving between subnets is Layer 3 routing. You can use a router with subinterfaces (router-on-a-stick) or a Layer 3 switch with switched virtual interfaces (SVIs), which is the usual design in modern campus networks.
Are VLANs secure?
VLANs provide segmentation, not strong security. They reduce broadcast exposure and let you apply access lists between segments, but misconfiguration can allow VLAN hopping through switch spoofing (DTP) or double tagging. Hardening steps include setting ports to static access mode, disabling DTP on trunks, using an unused native VLAN, pruning allowed VLANs and shutting down unused ports.
What is the difference between a VLAN and a subnet?
A VLAN is a Layer 2 construct that defines a broadcast domain. A subnet is a Layer 3 construct that defines an IP address range. Best practice maps one VLAN to one subnet, so the two are tightly linked, but they are different things and are configured in different places: the VLAN on the switch, the subnet on the routed interface or SVI.
How we wrote and checked this
CertSharp is a practice-exam provider, and we sell the Network+ and CCNA practice questions linked in this guide. We wrote this article from the IEEE 802.1Q standard page and Cisco's VLAN configuration guide, linked in Sources, and checked the 802.1Q field sizes, VLAN ranges and command behavior against them. The show output is illustrative, not captured from production equipment. Last reviewed October 2026. Defaults vary by platform and release, so confirm on your own switch and on the official exam pages.
Sources and further reading
- IEEE 802.1Q-2022: Bridges and Bridged Networks
- Cisco: Configuring VLANs (Catalyst 9300, IOS XE 17.9)
- Cisco Learning Network: CCNA 200-301 exam topics
- CompTIA Network+ certification page
Practice VLANs the way the exam asks
30 free questions per session on Network+ and CCNA, practice mode, no signup and no credit card. The full 500-question bank with exam mode is $11.99 lifetime per certification, or $9.99/month Pro unlocks every CertSharp certification.