VLANs and trunks: organising a switched network

VLANs separate broadcast domains

Without additional segmentation, ports in the same VLAN share a broadcast domain. Smaller domains improve organisation and limit broadcast traffic and fault scope. Logical grouping can follow communication needs instead of the physical cable location.

An access port assigns untagged endpoint traffic to one VLAN. A trunk transports frames from several permitted VLANs using IEEE 802.1Q tags; the native VLAN may travel untagged depending on configuration. The four-byte tag appears between the source MAC and type fields and carries a VLAN ID in the range 1–4094.

Devices in different VLANs need Layer-3 routing even on the same physical switch. Segmentation becomes a security control only with rules governing traffic between VLANs. Plan server, user, management, voice and guest networks around required communication, not only departments.

Access and trunk configuration examples

An endpoint can send ordinary Ethernet frames while the switch assigns its access VLAN. A link between network devices can instead carry several VLANs. These Cisco-style examples illustrate the configuration; apply them only to the intended interfaces and an agreed design.

• Access port: interface Gi0/1 → switchport mode access → switchport access vlan 10
• Trunk port: interface Gi0/24 → switchport mode trunk → switchport trunk allowed vlan 10,20

Both ends of a trunk need the same agreement

Configure trunk mode, native VLAN and allowed VLANs consistently at both ends. A VLAN missing from a trunk may work in only part of the network. A native-VLAN mismatch can produce warnings, incorrect classification and security problems. Do not carry every VLAN over every trunk without a need.

Many environments restrict VLAN 1 and automatic trunk negotiation. Disable unused access ports and place them in an unused VLAN. Management access belongs in a separate controlled network.

Use the MAC table to see where frames arrive

Check VLAN existence, port mode, access VLAN, trunk permissions and Spanning Tree state. The MAC table should show endpoints on the expected VLAN and port. If an entry is absent, the frame has not arrived or was dropped earlier.

Ping is not a complete VLAN test because routing, ACLs and host firewalls also affect it. Packet captures and targeted Layer-2 checks separate segmentation problems from faults higher in the stack.