2.1VLANs and trunking

CCNA tests VLANs not as a concept but as something you configure, verify, and troubleshoot on real gear. When you logically split one Catalyst switch by department and extend that split across multiple switches, you must decide which ports become access ports, which links become trunk ports, and how to read a misconfiguration out of show command output. The goal of this section is to choose the right port configuration from a set of requirements and to diagnose the result of switchport commands.

2.1.1VLAN fundamentals and the default VLAN

• A VLAN logically splits one switch into multiple broadcast domains. Hosts in the same VLAN communicate as one L2 segment, but hosts in different VLANs cannot communicate unless a router or Layer 3 switch is involved. The normal-range VLANs in CCNA scope are VLAN 1-1005 (of which 1002-1005 are legacy reserved), and in practice you use the 1-1005 range.
• The default VLAN (VLAN 1) is the VLAN every switch port belongs to out of the box. Management traffic such as CDP, DTP, VTP, and STP also flows in VLAN 1 by default. VLAN 1 cannot be deleted or renamed, so as a security best practice you move user traffic onto a different, unused VLAN.
• You create a VLAN in global config with vlan 10 then name SALES. To verify, show vlan brief lists each VLAN and which ports are assigned to it.

2.1.2Access ports and spanning multiple switches

• An access port belongs to exactly one VLAN, carries untagged frames, and connects end hosts (PCs, printers, IP phones). Configure it with switchport mode access then switchport access vlan 10. The host is never aware of the 802.1Q tag.
• To extend the same VLAN (e.g., VLAN 10) across multiple switches, create the same VLAN ID on each switch and make the inter-switch link a trunk. Hosts in VLAN 10 attached to different switches can then communicate at L2 as if they were on the same switch.
• If you assign a VLAN to an access port but forget to create that VLAN on the switch, the port goes inactive and cannot pass traffic. Always confirm the VLAN exists in show vlan brief, and that the access VLAN is as intended with show interfaces <if> switchport.

2.1.3802.1Q trunks and the native VLAN

• A trunk port carries frames from multiple VLANs over one link, using an IEEE 802.1Q VLAN tag (12-bit VLAN ID) to identify each VLAN. Configure it with switchport mode trunk. Verify which VLANs traverse the trunk with show interfaces trunk.
• The native VLAN is the one VLAN sent untagged on a trunk (VLAN 1 by default). If the native VLAN does not match on both ends of a trunk, one side receives frames as a different VLAN, causing VLAN leaking and STP inconsistency. CDP detects and warns of a Native VLAN mismatch. As a best practice, change it to an unused VLAN, e.g. switchport trunk native vlan 99.
• A trunk allows all VLANs by default, but you can explicitly restrict them with switchport trunk allowed vlan 10,20,99, preventing unneeded VLANs' broadcasts from crossing the trunk (a pruning-like effect).

A company spans sales (VLAN 10) and development (VLAN 20) across two Catalyst switches, SW1 and SW2. SW1 Gi0/1 has a VLAN 10 PC, SW2 Gi0/1 has a VLAN 20 PC, and SW1 and SW2 are connected via their Gi0/24 ports. The administrator configured each PC port with switchport mode access plus switchport access vlan 10 (or 20), but VLAN 20 was never created on SW2, so SW2 Gi0/1 went inactive and the development PC could not communicate at all. First, show vlan brief confirms VLAN 20 does not exist on SW2; creating it with vlan 20 plus name DEV restores service. Next, to let a VLAN 10 PC on SW1 talk to a VLAN 10 PC newly added on SW2, the inter-switch Gi0/24 must be a trunk, so it is set with switchport mode trunk, and show interfaces trunk confirms that VLANs 10 and 20 are allowed and the native VLAN matches (VLAN 1) on both ends. If the admin then changes only SW1 to switchport trunk native vlan 99 and forgets SW2, the native VLANs disagree, and CDP warns of a Native VLAN mismatch. That mismatch causes untagged frames to be received as the wrong VLAN—VLAN leaking—so the fix is to set the same native VLAN on both ends of the trunk. VLAN troubleshooting thus works through three checks in order with show vlan brief and show interfaces trunk: is the VLAN created, does the port mode (access/trunk) fit the requirement, and do the allowed VLANs and native VLAN match on both ends of the trunk.

2.1.4Section summary

• A VLAN splits one switch logically (normal range 1-1005); the default VLAN (VLAN 1) cannot be deleted and is every port's initial VLAN
• Access port = one VLAN, untagged, for end hosts; trunk port = multiple VLANs, 802.1Q tagged, for switch interconnects. Extending a VLAN across switches requires a trunk
• The native VLAN is the only untagged VLAN on a trunk and must match on both ends. Verify with show vlan brief (VLANs and access assignment) and show interfaces trunk (allowed and native VLANs)