VLAN Configuration: Segmenting Networks with Trunk and Access Ports

1. What Are VLANs and Why Do We Use Them?

In the previous lesson, you created VLAN 99 for management. But what exactly is a VLAN? In simple terms, a VLAN allows you to take a single physical switch and split it into multiple, logically separate virtual switches. Devices in one VLAN cannot communicate with devices in another VLAN without a router, even if they are plugged into the same physical piece of hardware.

Before we jump into the command line, it's crucial to understand the "why." The following video provides an excellent conceptual overview of LANs, VLANs, and their benefits.

To summarize the key benefits for a job interview context:

• Security: This is the primary driver. By placing sensitive departments like Finance (VLAN 20) on a separate VLAN from general users (VLAN 30) or guests (VLAN 999), you prevent users from snooping on traffic that they shouldn't have access to. A security breach in one VLAN is contained and doesn't immediately compromise the entire network.
• Organization & Management: Grouping devices by function (e.g., VoIP phones, security cameras, servers) simplifies network management and policy application.
• Performance: VLANs reduce unnecessary broadcast traffic. A broadcast message sent by a device will only be forwarded to other devices within the same VLAN, not to every single port on the switch. This reduces network congestion and improves overall efficiency.

2. Access Ports vs. Trunk Ports: The Rules of the Road

Now that you know why we use VLANs, we need to understand how a switch enforces them. This is done by configuring each port to behave in one of two ways: as an access port or a trunk port. Getting this right is critical.

The next segment of the video we just watched introduces this terminology perfectly.

Here’s a breakdown of the key terms:

• Access Port:

  • Purpose: Connects to an end device (e.g., a user's computer, a printer, a server).
  • Rule: An access port belongs to only one VLAN.
  • Traffic: It sends and receives regular, untagged Ethernet frames. When an untagged frame arrives at an access port, the switch knows it belongs to the VLAN assigned to that port.

• Trunk Port:

  • Purpose: Connects a switch to another switch, a router, or a server that needs to handle traffic from multiple VLANs.
  • Rule: A trunk port can carry traffic for multiple VLANs simultaneously.
  • Traffic: It uses a special protocol, most commonly 802.1Q, to insert a tag into each Ethernet frame. This tag contains the VLAN ID, telling the receiving device which VLAN the frame belongs to.

3. Practical Configuration: Building the VLANs

Let's apply these concepts. Imagine our task is to set up a new switch for two departments: Engineering (VLAN 10) and Sales (VLAN 20).

The following video demonstrates the exact Cisco IOS commands needed to accomplish this. We'll watch it in segments as we build our configuration.

Step 1: Create the VLANs

First, we need to tell the switch that VLAN 10 and VLAN 20 exist.

From global configuration mode (Switch(config)#):

# Create VLAN 10 for Engineering
vlan 10
name Engineering




# Create VLAN 20 for Sales
vlan 20
name Sales

exit

Giving VLANs a descriptive name is a crucial best practice. show vlan brief will now show "Engineering" instead of the generic "VLAN0010".

Step 2: Configure Access Ports

Next, we'll assign switch ports to these new VLANs. Let's say ports 1-8 are for Engineering, and ports 9-16 are for Sales.

The commands are:

# Configure ports for the Engineering department
interface range gigabitethernet1/0/1 - 8
 switchport mode access
 switchport access vlan 10
 exit




# Configure ports for the Sales department
interface range gigabitethernet1/0/9 - 16
 switchport mode access
 switchport access vlan 20
 exit

The interface range command is a huge time-saver, allowing you to apply the same configuration to many ports at once.

Step 3: Configure a Trunk Port

Finally, let's configure port 24 to be the trunk link that will connect to our main network router. This will allow traffic from both VLANs (and our management VLAN 99) to travel to the router.

The commands are:

interface gigabitethernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99

The switchport trunk allowed vlan command is an important security and performance best practice. It ensures that only traffic from the specified VLANs can pass through this trunk. If you omit this command, the trunk will, by default, carry traffic for every VLAN known to the switch, which might not be desirable.

4. Verifying Your Configuration

Configuration without verification is just a hopeful guess. You must always check that the switch is operating as you intended.

The following article from PracticalNetworking.net is an excellent, in-depth reference for both configuration and verification. For now, focus on the verification commands it presents.

Here are the essential verification commands to commit to memory:

• show vlan brief: This is your primary tool. It gives you a quick table showing all created VLANs, their names, and which access ports are assigned to each.
• show interfaces trunk: This command lists all active trunk ports. It tells you their encapsulation type (802.1q), their status, and, crucially, which VLANs are allowed on the trunk.
• show interfaces <interface_id> switchport: This command provides a highly detailed report for a single port, including its administrative mode (e.g., static access or trunk), its operational mode, the VLAN it belongs to (if access), or the native VLAN (if trunk).

5. Practice Application

Time to use your "katana." Let's say you need to prepare a switch for a new office floor. The requirements are:

• VLAN 110 for Marketing on ports GigabitEthernet1/0/1 through 1/0/10.
• VLAN 120 for Logistics on ports GigabitEthernet1/0/11 through 1/0/20.
• Port GigabitEthernet1/0/24 should be a trunk port connecting to another switch. It should only carry traffic for the Marketing and Logistics VLANs.

Write down the full sequence of commands, starting from global configuration mode (Switch(config)#), to implement this setup. Then, list the verification commands you would use to confirm your configuration is correct.

Conclusion

You have just configured the fundamental building block of a modern switched network. By segmenting traffic with VLANs, you dramatically improve security and organization.

Key Takeaways:

• VLANs create logically separate broadcast domains on a single physical switch.
• Access ports belong to a single VLAN and connect to end devices like PCs. They handle untagged traffic.
• Trunk ports carry traffic for multiple VLANs between switches or to a router. They use 802.1Q tagging to identify the VLAN for each frame.
• The configuration process is:
  1. Create and name the VLANs (vlan <id>, name ...).
  2. Assign access ports (switchport mode access, switchport access vlan <id>).
  3. Configure trunk ports (switchport mode trunk, switchport trunk allowed vlan ...).
• Always verify your work with show vlan brief and show interfaces trunk.

In our next lesson, we will move to the device that our new trunk port connects to: the router. You will learn to configure interface settings on a router, including assigning IP addresses. This will be the first step in enabling communication between the VLANs you just created, a process known as inter-VLAN routing.