VLAN Configuration on Cisco Switches: Complete Guide

 VLAN Configuration on Cisco Switches: Complete Step-by-Step Guide

---

VLAN configuration is an essential skill for network engineers and IT professionals. It allows administrators to divide a physical network into multiple logical networks, improving network organization, management, and security.

Cisco switches support VLANs, making it possible to separate employee computers, IP phones, and guest devices into different network segments while using the same physical infrastructure.

In this tutorial, you will learn how to configure VLANs on Cisco switches step by step, assign switch ports, configure trunk links between switches, verify the configuration, and build a practical lab using Cisco Packet Tracer.

1. What Is a VLAN?

A Virtual Local Area Network (VLAN) is a logical network that separates devices into different Layer 2 broadcast domains, even when they are connected to the same physical switch.

For example, an organization can create separate VLANs for employees, IP phones, and guest devices.

VLAN Design Example

VLAN ID	VLAN Name	Purpose	IP Subnet
10	DATA	Employee computers	192.168.10.0/24
20	VOICE	IP phones	192.168.20.0/24
30	GUEST	Guest devices	192.168.30.0/24

Each VLAN provides a separate Layer 2 broadcast domain. Devices in different VLANs generally require a router, Layer 3 switch, or firewall to communicate with one another.

[Insert the main VLAN Configuration infographic here, directly below the article title or introduction.]

2. Why Do We Use VLANs?

VLANs provide several benefits in enterprise networks:

• Network segmentation: Separate users and devices according to their purpose.
• Improved security: Apply access-control policies between network segments.
• Reduced broadcast traffic: Limit Layer 2 broadcast traffic to devices within the same VLAN.
• Simplified management: Organize departments and device types logically.
• Scalability: Add new logical networks without installing separate physical switches for every group.

For example, a guest VLAN can be configured to access the internet while being prevented from reaching internal servers and employee devices. This requires appropriate firewall or Layer 3 access-control policies in addition to VLAN configuration.

3. Access Ports vs. Trunk Ports

Before configuring VLANs, it is important to understand two common switchport modes.

3.1 Access Port

An access port normally carries traffic for a single VLAN. It is commonly used to connect computers, printers, cameras, and other end devices.

Example:

interface fastEthernet 0/1
 switchport mode access
 switchport access vlan 10
 no shutdown

This configuration assigns FastEthernet 0/1 to VLAN 10.

3.2 Trunk Port

A trunk port carries traffic for multiple VLANs over one physical link. It is commonly used between switches or between a switch and a VLAN-aware router or firewall.

Example:

interface fastEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 no shutdown

This configuration allows VLANs 10, 20, and 30 across the trunk link.

The interface names and available commands may vary depending on the Cisco switch model and software version.

4. Network Topology and Port Plan

In this example, we will configure two Cisco switches, S1 and S2, connected through a trunk link.

The following port plan will be used on both switches.

Interface	Mode	VLAN / Purpose
Fa0/1–Fa0/3	Access	VLAN 10 — DATA
Fa0/4–Fa0/5	Access	VLAN 20 — VOICE
Fa0/6–Fa0/7	Access	VLAN 30 — GUEST
Fa0/24	Trunk	VLANs 10, 20, 30

The example assumes that the listed ports are available on your switches. Adjust the interface numbers to match your actual hardware and cabling.

5. Configure VLANs on Switch S1

Step 1: Enter Configuration Mode

Connect to S1 using the console or an authorized management session.

Enter privileged EXEC mode:

enable

Enter global configuration mode:

configure terminal

Set the switch hostname:

hostname S1

The hostname makes it easier to identify which switch you are configuring.

Step 2: Create VLAN 10 — DATA

vlan 10
 name DATA
exit

This creates VLAN 10 and assigns it the name DATA.

Step 3: Create VLAN 20 — VOICE

vlan 20
 name VOICE
exit

This creates VLAN 20 for voice traffic.

Step 4: Create VLAN 30 — GUEST

vlan 30
 name GUEST
exit

This creates VLAN 30 for guest devices.

At this stage, all three VLANs have been created on S1.

Step 5: Assign Access Ports to VLAN 10

Assign FastEthernet 0/1 through FastEthernet 0/3 to VLAN 10.

interface range fastEthernet 0/1-3
 switchport mode access
 switchport access vlan 10
 no shutdown
exit

Explanation:

• interface range fastEthernet 0/1-3 selects ports Fa0/1, Fa0/2, and Fa0/3.
• switchport mode access configures them as access ports. 
• switchport access vlan 10 assigns the ports to VLAN 10. 
• no shutdown enables the interfaces administratively.

Step 6: Assign Access Ports to VLAN 20

Assign FastEthernet 0/4 and FastEthernet 0/5 to VLAN 20.

interface range fastEthernet 0/4-5
 switchport mode access
 switchport access vlan 20
 no shutdown
exit

These ports are now assigned to the VOICE VLAN.

Step 7: Assign Access Ports to VLAN 30

Assign FastEthernet 0/6 and FastEthernet 0/7 to VLAN 30.

interface range fastEthernet 0/6-7
 switchport mode access
 switchport access vlan 30
 no shutdown
exit

These ports are now assigned to the GUEST VLAN.

Step 8: Configure the Trunk Port on S1

Configure FastEthernet 0/24 as the trunk link connecting S1 to S2.

interface fastEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 no shutdown
exit

This configuration allows VLANs 10, 20, and 30 to pass through the trunk.

6. Configure VLANs on Switch S2

For this manual configuration, create the same VLANs on S2 and configure its access ports and trunk link.

Step 1: Enter Configuration Mode

enable
configure terminal
hostname S2

Step 2: Create the VLANs

vlan 10
 name DATA
exit

vlan 20
 name VOICE
exit

vlan 30
 name GUEST
exit

Step 3: Assign Access Ports

Configure the DATA ports:

interface range fastEthernet 0/1-3
 switchport mode access
 switchport access vlan 10
 no shutdown
exit

Configure the VOICE ports:

interface range fastEthernet 0/4-5
 switchport mode access
 switchport access vlan 20
 no shutdown
exit

Configure the GUEST ports:

interface range fastEthernet 0/6-7
 switchport mode access
 switchport access vlan 30
 no shutdown
exit

Step 4: Configure the Trunk Port on S2

interface fastEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 no shutdown
exit

The trunk configuration on S2 must be compatible with the trunk configuration on S1.

Important: Confirm that Fa0/24 is the actual inter-switch link on both switches. If your cable connects different ports, configure those interfaces instead.

7. Verify the VLAN Configuration

After configuring both switches, use the following commands to verify the results.

Step 1: Display the VLAN Table

show vlan brief

This command displays VLAN IDs, names, status, and associated access ports.

You should see VLAN 10 named DATA, VLAN 20 named VOICE, and VLAN 30 named GUEST.

The access ports should appear under their assigned VLANs.

Step 2: Verify the Trunk Link

show interfaces trunk

Check that:

1. The intended interface is operating as a trunk.
2. VLANs 10, 20, and 30 are allowed.  
3. The required VLANs are active and forwarding as expected.

Step 3: Check Interface Status

show interfaces status

This command displays the interface status, VLAN assignment, speed, and duplex information.

If a port is disconnected, its operational status may show as not connected even if the interface is administratively enabled.

Step 4: Review the Interface Configuration

show running-config

This command displays the current running configuration, including interface settings.

Step 5: Save the Configuration

When you have verified the configuration, save it:

copy running-config startup-config

Repeat the verification and save steps on both switches.

8. Practical Lab Using Cisco Packet Tracer

Now let's apply the configuration in Cisco Packet Tracer.

Step 1: Add the Devices

Add the following devices to your Packet Tracer workspace:

1. Two Cisco switches: S1 and S2.
2. One PC connected to VLAN 10. 
3. One PC connected to VLAN 30. 
4. Optionally, an IP phone or additional PCs for VLAN 20.

Step 2: Connect the Devices

For this lab, use the following connections:

From	To	Purpose
PC-A	S1 Fa0/1	DATA — VLAN 10
PC-B	S2 Fa0/6	GUEST — VLAN 30
S1 Fa0/24	S2 Fa0/24	Trunk — VLANs 10, 20, 30

Use the correct cable type or the automatic connection tool in Packet Tracer.

Step 3: Configure IP Addresses

Assign the following addresses to the PCs.

Device	VLAN	IP Address	Subnet Mask
PC-A	10	192.168.10.10	255.255.255.0
PC-B	30	192.168.30.10	255.255.255.0

To configure PC-A:

1. Click PC-A.
2. Open Desktop.
3. Select IP Configuration.
4. Choose Static.
5. Enter IP address 192.168.10.10.
6. Enter subnet mask 255.255.255.0.

Repeat the process for PC-B using IP address 192.168.30.10 and subnet mask 255.255.255.0.

Leave the default gateway empty because this lab does not include inter-VLAN routing.

Step 4: Apply the Switch Configurations

Enter the S1 and S2 commands from Sections 5 and 6.

Check that the access ports match the physical connections in your Packet Tracer topology. The trunk ports must also match the ports connected by the inter-switch cable.

Step 5: Test Connectivity

On PC-A, open Desktop → Command Prompt and run:

ipconfig

Confirm that the IP address and subnet mask are correct.

You can test PC-A's own IP address with:

ping 192.168.10.10

Then verify the switch configuration with:

show vlan brief
show interfaces trunk

Expected result: VLAN 10, VLAN 20, and VLAN 30 should exist on both switches. The configured access ports should belong to the correct VLANs, and the trunk should carry all three VLANs.

PC-A and PC-B should not be able to communicate with each other because they are in different VLANs and no Layer 3 routing has been configured.

To enable communication between VLANs, configure inter-VLAN routing on a router, Layer 3 switch, or firewall.

9. Important Security Consideration for the Guest VLAN

Creating VLAN 30 separates guest devices at Layer 2, but it does not automatically prevent all access to internal resources.

For a production network, configure the router, Layer 3 switch, or firewall to:

• Allow guest devices to access the internet as required.
• Block access from the guest network to internal server and user subnets. 
• Restrict access to management interfaces and network infrastructure. 
• Allow only necessary services, such as DHCP and DNS, according to your design.

For example, if a FortiGate firewall provides inter-VLAN routing, use firewall policies to control guest traffic and prevent unauthorized access to internal networks.

10. Common VLAN Configuration Problems

Problem 1: The VLAN Does Not Appear

Run:

show vlan brief

If the VLAN is missing, create it on the switch.

Problem 2: The Port Is Assigned to the Wrong VLAN

Check the VLAN table and confirm that the connected access port belongs to the intended VLAN.

Problem 3: The Trunk Is Not Working

Run:

show interfaces trunk
show interfaces status

Verify the physical connection, trunk mode, allowed VLAN list, and interface status.

Problem 4: Devices in Different VLANs Cannot Communicate

This is expected without Layer 3 routing. A trunk transports traffic for multiple VLANs; it does not route traffic between different IP subnets.

Problem 5: The Configuration Was Not Saved

Run:

copy running-config startup-config

This saves the running configuration so it can be retained after a reboot.

11. VLAN Configuration Best Practices

• Follow these recommendations when configuring VLANs in a production environment:
• Use consistent VLAN IDs and descriptive names.
• Document VLAN purposes, IP subnets, and assigned switch ports.
• Allow only required VLANs on trunk links.
• Separate DATA, VOICE, GUEST, server, and management traffic according to your network design.
• Apply access-control policies between VLANs where necessary.
• Shut down unused ports when appropriate.
• Test configuration changes in a lab before applying them to production infrastructure.
• Verify the configuration and save it after successful testing.

12. Frequently Asked Questions (FAQ)

What is the command to create a VLAN on a Cisco switch?

configure terminal
vlan 10
 name DATA

How do I assign a port to VLAN 30?

interface fastEthernet 0/6
 switchport mode access
 switchport access vlan 30

How do I configure a trunk for VLANs 10, 20, and 30?

interface fastEthernet 0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

How can I verify VLANs on a Cisco switch?

show vlan brief

Can VLANs communicate with each other?

Yes. Communication between different VLANs generally requires Layer 3 routing through a router, Layer 3 switch, or firewall, along with suitable security policies.

Does a guest VLAN automatically block access to the internal network?

No. A VLAN provides Layer 2 segmentation. To block guest access to internal networks, configure appropriate routing and firewall or access-control policies.

Conclusion

VLANs are a fundamental component of modern network design. They help network engineers separate users and devices into logical networks, manage traffic more effectively, and implement better security controls.

In this tutorial, you learned how to create VLANs 10, 20, and 30, assign access ports, configure trunk links between Cisco switches, verify the configuration, and test a basic VLAN topology using Cisco Packet Tracer.

Practice these commands in a lab environment before making changes to a production network.

Recommended next article: Access Port vs. Trunk Port on Cisco Switches: Configuration and Examples