Understanding VLANs: Access Ports, Trunks, and Inter-VLAN Routing
VLANs split a physical switch into multiple logical networks. This guide explains access ports, trunks, tags, native VLANs, gateways, and common troubleshooting commands.
Understanding VLANs: Access Ports, Trunks, and: Table of Contents
1. What a VLAN Does
A VLAN is a separate Layer 2 broadcast domain. Devices in different VLANs need routing to communicate.
VLANs let one physical switching infrastructure carry logically separated networks for users, phones, servers, management, or guests. A broadcast stays within its VLAN unless a router or multilayer switch forwards traffic to another subnet. VLAN separation is useful for organization and policy, but it is not a complete security boundary without routing ACLs, firewall rules, and secure switch configuration.
2. Access vs Trunk Ports
Access ports carry one VLAN for endpoints. Trunk ports carry multiple VLANs with 802.1Q tags.
- switchport mode access
- switchport access vlan 10
- switchport mode trunk
- switchport trunk allowed vlan 10,20,30
An access port normally sends and receives untagged endpoint frames and associates them with its configured access VLAN. A trunk inserts an 802.1Q tag for most VLANs so the receiving switch can preserve membership. Configure the mode explicitly, restrict the allowed VLAN list, and disable unused ports rather than depending on dynamic trunk negotiation.
3. Native VLAN and Allowed VLANs
The native VLAN carries untagged traffic on an 802.1Q trunk. Keep it consistent on both sides and avoid using VLAN 1 for managed trunks.
- Match native VLANs.
- Prune unused VLANs.
- Document trunk purpose.
A native-VLAN mismatch can place untagged traffic into different broadcast domains and may trigger spanning-tree warnings. It does not necessarily take the trunk down, which makes the fault easy to overlook. Compare both ends with show interfaces trunk and verify that every required VLAN exists, is active, and is allowed across each trunk in the path.
4. Inter-VLAN Routing
Use router-on-a-stick, switched virtual interfaces, or a firewall to route between VLANs.
- encapsulation dot1Q 10
- ip address 192.168.10.1 255.255.255.0
- no shutdown
Router-on-a-stick uses one physical router link with a tagged subinterface for each VLAN. A multilayer switch uses switched virtual interfaces and needs Layer 3 routing enabled. The default gateway configured on a host must be in the same subnet and should normally be the SVI, router subinterface, or first-hop redundancy address for that VLAN.
5. VLAN Troubleshooting
Most VLAN problems are wrong access VLAN, trunk pruning, native VLAN mismatch, missing gateway, or wrong IP subnet.
- show vlan brief
- show interfaces trunk
- show mac address-table
- show spanning-tree vlan 10
Follow the frame from source to destination. Confirm the source port and access VLAN, check whether the source MAC is learned in that VLAN, verify all trunks permit the VLAN, and inspect spanning-tree forwarding state. For inter-VLAN traffic, then check the host gateway, SVI state, routing table, ACLs, and return path.
Understanding VLANs: Access Ports, Trunks, and: Frequently Asked Questions
What is a VLAN?
A VLAN is a logical Layer 2 broadcast domain.
What is a trunk port?
A trunk port carries multiple VLANs using tags.
Do VLANs need different subnets?
Most designs use one subnet per VLAN.
Safe implementation checklist
Document the VLAN ID, name, subnet, gateway, DHCP scope, permitted trunks, security policy, and owner before deployment. Create the VLAN across the intended switching domain, permit it only where needed, verify spanning tree, then move a test port. Keep management traffic off an unprotected default VLAN and retain console or out-of-band access when changing trunks remotely.