VLAN Configuration on Switch: Easy Tutorial for Beginners

 Here is the sentence that makes VLANs finally click for most beginners: a VLAN lets you build several separate networks inside one physical switch.

Not separate cables. Not separate hardware. One switch, behaving as though it were four or five completely isolated switches, with devices in one group unable to reach devices in another unless you explicitly permit it.

Once that idea lands, everything else — tagging, trunks, native VLANs — is just the mechanics of making it work. This tutorial covers VLAN configuration on switch equipment from first principles to a working setup.

Why VLANs Exist

A switch forwards broadcast frames out every port. Every device connected to that switch, and every switch connected to it, shares one broadcast domain.

That creates three problems as networks grow:

1. Performance. Broadcast traffic reaches every device whether relevant or not. On a large flat network, a meaningful share of bandwidth is consumed by traffic most devices discard.
2. Security. Any device can attempt to reach any other. A visitor's laptop sits on the same network as your accounting server.
3. Organization. Departments, floors, and functions are mixed together with no logical structure.

Before VLANs, the only solution was buying more switches and more routers. VLANs solve all three problems in software.

The critical rule: devices in different VLANs cannot communicate without a router. That isolation is the entire point.

Access Ports and Trunk Ports

Access port vs trunk port is the distinction that confuses every beginner, and it is genuinely simple once stated clearly.

An access port:

• Belongs to exactly one VLAN.
• Connects to an end device — a computer, printer, phone, or camera.
• Carries untagged traffic. The device has no idea VLANs exist.

A trunk port:

• Carries traffic for multiple VLANs simultaneously.
• Connects switch to switch, or switch to router.
• Tags each frame so the receiving device knows which VLAN it belongs to.

A useful way to picture it: an access port is a private door into one specific room. A trunk port is a corridor carrying people to every room, with each person wearing a label saying which room they belong to.

How 802.1Q Tagging Works

802.1Q tagging is the standard that makes trunks possible.

When a frame leaves a switch on a trunk port, the switch inserts a small tag into the frame header containing the VLAN number. When the frame arrives at the far switch, that switch reads the tag, removes it, and forwards the frame only to ports in that VLAN.

Three consequences worth understanding:

1. The tag exists only between switches. End devices never see it.
2. The tag adds 4 bytes to the frame. This occasionally causes MTU issues on links that are already at their limit.
3. VLAN numbers range from 1 to 4094, with some reserved. In practice, most networks use a small, deliberately chosen set.

The Native VLAN

The native VLAN is the one exception to tagging, and it causes more confusion than any other VLAN topic.

On a trunk, one VLAN is designated native and its traffic is sent untagged. This exists for backward compatibility with devices that do not understand tagging.

Two things you must know:

1. The native VLAN must match on both ends of a trunk. A mismatch means traffic from one VLAN silently arrives in another — a real security issue, and a maddening fault to diagnose because the link appears to work.
2. The default native VLAN is 1, and leaving it that way enables a known VLAN hopping technique. Change it to an unused VLAN that carries no real traffic.

Step by Step: Creating VLANs

Step 1: Create the VLANs

enable
configure terminal
vlan 10
 name SALES
 exit
vlan 20
 name ACCOUNTS
 exit
vlan 30
 name GUEST
 exit

Name every VLAN. A number alone tells a future engineer nothing.

Verify immediately:

show vlan brief

This is the command you will run constantly. It lists every VLAN and every port assigned to it.

Step 2: Assign access ports

interface range gigabitEthernet 0/1 - 8
 switchport mode access
 switchport access vlan 10
 description Sales-Department
 exit

interface range gigabitEthernet 0/9 - 16
 switchport mode access
 switchport access vlan 20
 description Accounts-Department
 exit

Why switchport mode access matters: without it, the port uses dynamic negotiation and may unexpectedly become a trunk. Setting access mode explicitly is both correct practice and a security measure.

The interface range command is essential here. Configuring twenty-four ports individually wastes an afternoon.

Step 3: Configure the trunk

interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 description Trunk-to-SW2
 exit

Three deliberate choices in that block:

1. allowed vlan restricts what crosses the trunk. A trunk permits all VLANs by default, which carries traffic you did not intend to carry.
2. native vlan 999 moves untagged traffic to an unused VLAN.
3. A description so nobody disables the uplink during a cleanup.

Create VLAN 999 as well, even though nothing uses it:

vlan 999
 name UNUSED-NATIVE
 exit

Step 4: Repeat on the second switch

VLANs must exist on every switch that carries them. A VLAN created on SW1 does not automatically appear on SW2.

Configure identical VLAN numbers, identical names, and a matching trunk with the same native VLAN.

Step 5: Save

end
copy running-config startup-config

Verification Commands

Run all three after any VLAN change:

show vlan brief

Lists VLANs and their assigned ports. A port missing from the list is usually a trunk — trunks do not appear as members of a single VLAN.

show interfaces trunk

Shows every trunk port, its mode, its native VLAN, and which VLANs are allowed and active. This is the command that finds native VLAN mismatches and forgotten allowed-VLAN entries.

show interfaces gigabitEthernet 0/5 switchport

Detailed per-port information: administrative mode, operational mode, access VLAN, and trunk settings. Use this when one specific port behaves unexpectedly.

Inter-VLAN Routing: Making VLANs Talk

VLANs are isolated by design. When you need controlled communication between them, you need a router or a Layer 3 switch.

Method 1: Router on a stick

Router on a stick uses a single physical router interface divided into logical subinterfaces, one per VLAN.

On the switch, the port facing the router must be a trunk:

interface gigabitEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

On the router:

interface gigabitEthernet 0/0
 no shutdown
 exit

interface gigabitEthernet 0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 exit

interface gigabitEthernet 0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 exit

interface gigabitEthernet 0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 exit

Two points that catch people:

1. The physical interface needs no shutdown, even though you configure addresses on the subinterfaces.
2. The subinterface number does not have to match the VLAN number, but making them match is standard practice and prevents confusion.

Each subinterface IP becomes the default gateway for devices in that VLAN.

The limitation: all inter-VLAN traffic crosses one physical link in both directions. On a busy network that link becomes a bottleneck.

Method 2: Switched Virtual Interfaces on a Layer 3 switch

This is the preferred method in real networks, because routing happens in hardware at switch speed.

ip routing

interface vlan 10
 ip address 192.168.10.1 255.255.255.0
 no shutdown
 exit

interface vlan 20
 ip address 192.168.20.1 255.255.255.0
 no shutdown
 exit

ip routing is essential and frequently forgotten. Without it, the switch creates the interfaces but refuses to route between them, and everything appears configured while nothing works.

VLAN Troubleshooting

VLAN troubleshooting follows a predictable order, because the same handful of mistakes cause most failures.

Two devices in the same VLAN cannot reach each other:

1. Check both ports are in that VLAN with show vlan brief.
2. Check both ports are in access mode, not trunk.
3. Check the VLAN exists on both switches if they connect to different ones.
4. Check the trunk allows that VLAN with show interfaces trunk.
5. Check IP addressing — devices must be in the same subnet as well as the same VLAN.

Devices in different VLANs cannot reach each other:

1. This is correct behaviour unless you have configured routing.
2. Check the router subinterface exists for each VLAN.
3. Check ip routing is enabled on a Layer 3 switch.
4. Check the devices have the correct default gateway — the router interface for their VLAN.
5. Check no shutdown on the relevant interfaces.

The trunk does not come up or behaves oddly:

1. Check both ends are configured as trunks.
2. Check the native VLAN matches. A mismatch usually generates a log message — read the logs.
3. Check allowed VLAN lists match on both ends.

Mistakes That Cost Hours

1. Creating a VLAN on one switch but not the other.
2. Forgetting switchport mode access and leaving the port to negotiate.
3. Not adding a VLAN to the trunk's allowed list after creating it.
4. A native VLAN mismatch between trunk ends.
5. Forgetting ip routing on a Layer 3 switch.
6. Assigning a device the wrong default gateway for its VLAN.
7. Leaving the native VLAN as 1 and creating a security exposure.
8. Using VTP without understanding it — a misconfigured VTP server has erased VLAN databases across entire networks.
9. Not saving, then losing everything on reload.

A Sensible VLAN Design

For a small office, something like this works well:

• VLAN 10 — staff workstations.
• VLAN 20 — servers and printers.
• VLAN 30 — guest wireless, with no route to anything internal.
• VLAN 40 — IP phones, separated for quality of service.
• VLAN 99 — management interfaces only.
• VLAN 999 — native VLAN, carrying nothing.

Two design principles worth following:

1. Match your subnet to your VLAN number. VLAN 10 uses 192.168.10.0/24. This makes troubleshooting dramatically easier.
2. Leave gaps between numbers. Using 10, 20, 30 rather than 1, 2, 3 leaves room to insert a VLAN later without renumbering everything.

Conclusion

VLANs are not complicated once the core idea is clear: one switch, several isolated networks, with access ports serving devices and trunk ports carrying everything between switches.

Build one today in a free network simulator: two switches, two VLANs, four computers, and a trunk between the switches. Then confirm that devices in VLAN 10 can reach each other and cannot reach VLAN 20. That single lab teaches you more about VLAN configuration on switch equipment than any amount of reading, because it forces you to meet the trunk and the allowed-VLAN list personally.