Cisco IOS / IOS-XEConfig2,134 downloads

Cisco IOS VLAN Configuration

Generate VLAN configuration with access and trunk ports for Cisco IOS/IOS-XE switches. Includes VLAN database, SVI interfaces, access ports, and trunk links.

↓ example.txt

What is it?

A VLAN (Virtual LAN) is a logical network segment created on a switch. Without VLANs, every device on a switch is in the same broadcast domain — any broadcast (ARP, DHCP) reaches every device. VLANs divide the switch into isolated broadcast domains at Layer 2. Traffic between VLANs requires a Layer 3 device (router or L3 switch SVI). A trunk link carries multiple VLANs between switches using 802.1Q tags. An SVI (Switched Virtual Interface) is a virtual interface on a Layer 3 switch that acts as the default gateway for that VLAN.

When to use

·Separating different departments (HR, Finance, Engineering) into isolated networks
·Creating a DMZ or guest network isolated from the corporate network
·Separating IP phones from data devices on the same physical switch (voice VLAN)
·Any time you have multiple network segments but limited physical switches
·Inter-VLAN routing when a Layer 3 switch is available (more efficient than router-on-a-stick)

When NOT to use

·As the only security boundary between sensitive networks — VLANs prevent broadcast storms but a misconfigured trunk or VLAN hopping attack can bypass them. Use a firewall for security boundaries.
·When you need more than 4094 VLANs — use VXLAN (L2 overlay over L3) for data center scale

How it compares

vs Physical network separationPhysical separation (separate switches, cables) is more secure but expensive. VLANs provide logical separation on shared infrastructure at a fraction of the cost.

vs Router-on-a-stick (ROAS)ROAS uses subinterfaces on a router for inter-VLAN routing. L3 switch SVIs are faster (hardware-switched) and cheaper (no dedicated router needed). Use L3 switch SVIs unless you need a dedicated firewall between VLANs.

vs VXLANVXLAN extends VLANs across L3 networks (e.g., between data centers). Regular VLANs are limited to L2 domains. Use VXLAN for multi-site or cloud environments.

Prerequisites

→Layer 2 switch or Layer 3 switch (for SVI routing)
→VLAN IDs planned and documented — VLAN 1 is the native/default VLAN (avoid using it for user traffic)
→Trunk links configured between switches before VLANs propagate
→Spanning tree mode selected — Rapid PVST+ is recommended for IOS switches

Config Generator

Switch Hostname *

VLANs

Trunk Interfaces

Access Ports

Native VLAN (trunk)

Spanning Tree Mode

Verification commands

show vlan brief

List all VLANs and which ports are assigned to each

ExpectedShows VLAN ID, name, status (active), and assigned ports. Ports not assigned to any VLAN show up in VLAN 1.

show interfaces trunk

Show all trunk interfaces and which VLANs are allowed/active

ExpectedShows native VLAN, allowed VLANs, and VLANs in spanning tree forwarding state per trunk

show interfaces vlan <id>

Verify SVI is up/up and has the correct IP address

ExpectedLine protocol is up only when at least one access port in that VLAN is active

show spanning-tree vlan <id>

Verify spanning tree status for a specific VLAN

ExpectedRoot bridge ID, port roles (Root/Designated/Alternate), and port states (Forwarding/Blocking)

Debug commands

show mac address-table vlan <id>

Show MAC addresses learned on a specific VLAN

Common mistakes & fixes

SymptomVLAN not appearing on remote switch after trunk config

CauseVLAN not created on the remote switch (VTP transparent mode) or trunk not allowing the VLAN

FixCreate the VLAN on both switches. Verify trunk allows it: 'switchport trunk allowed vlan add <id>'. Check VTP mode with 'show vtp status'.

SymptomSVI (Vlan interface) is down/down

CauseNo active ports assigned to that VLAN, or VLAN doesn't exist in the VLAN database

FixAssign at least one access port to the VLAN and make sure it's connected/up. Verify 'show vlan brief' shows the VLAN as active.

SymptomInter-VLAN traffic not routing

CauseSVI has wrong IP/mask, 'ip routing' not enabled on L3 switch, or no default route

FixEnable L3 routing: 'ip routing'. Verify SVI IPs match the subnet plan. Check 'show ip route' for routes to each VLAN.

SymptomNative VLAN mismatch warning (CDP/STP logs)

CauseBoth sides of the trunk have different native VLAN configured

FixMatch native VLAN on both ends: 'switchport trunk native vlan <id>'. Native VLAN 1 is the default — change to an unused VLAN as a security best practice.

Further learning

Recommended books to go deeper on this topic.

CCNA 200-301 Official Cert Guide Library

Wendell Odom · Cisco Press · VLANs, trunk ports, DTP, VTP, inter-VLAN routing

Kindle ↗Hardcover ↗

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Advanced switching — STP, RSTP, MST, PVST+