Cisco IOS: configure VLANs and 802.1Q trunks

Virtual Local Area Networks (VLANs) segment broadcast domains at Layer 2, enhancing security, reducing network congestion, and simplifying network…

Virtual Local Area Networks (VLANs) segment broadcast domains at Layer 2, enhancing security, reducing network congestion, and simplifying network management. IEEE 802.1Q is the industry-standard trunking protocol used to carry traffic for multiple VLANs over a single physical link. This article details the configuration of VLANs and 802.1Q trunks on Cisco IOS-based Catalyst switches, covering access ports, trunk ports, and relevant best practices.

Effective VLAN deployment requires careful planning of VLAN IDs, IP subnets, and port assignments. The following configurations apply broadly to Cisco Catalyst switches running IOS releases 12.x through 15.x, though specific command availability or default behaviors might vary slightly with older or newer versions (e.g., CatOS vs. IOS, or modern Catalyst 9000 series with IOS XE).

VLAN Creation and Management

VLANs must be defined globally on the switch before they can be assigned to interfaces. Cisco IOS stores VLAN definitions in the vlan.dat file, typically located in flash memory, which is independent of the running configuration. This allows VLANs to persist even if the startup-config is erased, but it also means VLAN changes require a specific save command.


Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit
Switch(config)# vlan 30
Switch(config-vlan)# name SERVERS
Switch(config-vlan)# exit
Switch(config)# vlan 999
Switch(config-vlan)# name NATIVE_VLAN_DMZ
Switch(config-vlan)# exit
Switch(config)# end
Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/1, Gi1/0/2, ..., Gi1/0/24
10   USERS                            active
20   VOICE                            active
30   SERVERS                          active
999  NATIVE_VLAN_DMZ                  active

The show vlan brief command verifies the creation of VLANs and their status. Initially, newly created VLANs have no ports assigned.

Access Port Configuration

Access ports are end-device facing and carry traffic for a single VLAN. For IP phones, a common practice is to configure a voice VLAN, allowing the phone to receive a separate VLAN tag for its own traffic (e.g., VLAN 20) while untagged traffic from a connected PC flows through an access VLAN (e.g., VLAN 10). This requires specific commands.


Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# description End-user workstation and IP Phone
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# spanning-tree portfast
Switch(config-if)# spanning-tree bpduguard enable
Switch(config-if)# exit

switchport mode access: Explicitly configures the port as an access port, preventing dynamic trunking.
switchport access vlan 10: Assigns the port to VLAN 10 for untagged data traffic.
switchport voice vlan 20: Designates VLAN 20 as the voice VLAN. The switch uses CDP (Cisco Discovery Protocol) or LLDP-MED to inform the IP phone to tag its voice traffic with VLAN 20. Traffic from the PC connected to the phone remains untagged and is placed in VLAN 10.
spanning-tree portfast: Skips the listening and learning states of STP on access ports, allowing them to transition to the forwarding state immediately. This is crucial for end-device connectivity.
spanning-tree bpduguard enable: Shuts down a port if it receives a Bridge Protocol Data Unit (BPDU), preventing rogue switches from interfering with the STP topology. Essential for security on access ports.

To verify the access port configuration:


Switch# show interface GigabitEthernet1/0/1 switchport

Name: Gi1/0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: native
Negotiation of Trunking: Off
Access Mode VLAN: 10 (USERS)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Voice VLAN: 20 (VOICE)

Trunk Port Configuration (802.1Q)

Trunk ports carry traffic for multiple VLANs between switches, or between a switch and a router/server. IEEE 802.1Q is the standard trunking protocol, adding a 4-byte tag to Ethernet frames to identify the VLAN. Cisco's proprietary ISL (Inter-Switch Link) is deprecated on most modern hardware.


Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# description Uplink to Distribution Switch A
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30,999
Switch(config-if)# exit

switchport trunk encapsulation dot1q: Specifies 802.1Q as the trunking encapsulation protocol. This command might be optional on newer switches where 802.1Q is the only supported trunking type.
switchport mode trunk: Explicitly configures the port as a trunk port, disabling dynamic trunking protocols like DTP.
switchport trunk native vlan 999: Designates VLAN 999 as the native VLAN. Untagged frames received on this trunk port are assigned to VLAN 999, and frames from VLAN 999 are sent untagged. Best practice is to use an unused VLAN ID for the native VLAN and ensure it's consistent across all interconnected trunks to prevent VLAN hopping attacks. Avoid using VLAN 1 for the native VLAN.
switchport trunk allowed vlan 10,20,30,999: This command explicitly defines which VLANs are permitted to traverse the trunk. By default, all VLANs are allowed. Restricting allowed VLANs is a security best practice and reduces unnecessary broadcast traffic.

To verify the trunk port configuration:


Switch# show interfaces GigabitEthernet1/0/24 trunk

Port        Mode             Encapsulation  Status        Native VLAN
Gi1/0/24    on               802.1q         trunking      999

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30,999

Port        Vlans allowed and active in management domain
Gi1/0/24    10,20,30,999

Port        Vlans in spanning tree forwarding state and not pruned
Gi1/0/24    10,20,30,999

Dynamic Trunking Protocol (DTP)

Cisco's Dynamic Trunking Protocol (DTP) attempts to negotiate trunking on a link. While convenient in some scenarios, it introduces security risks and can lead to unintended trunking. It's generally recommended to explicitly configure access or trunk ports and disable DTP.

`switchport mode` Command	Description
`access`	Permanently puts the port into nontrunking mode and negotiates to convert the link into a nontrunk link. DTP is effectively off.
`trunk`	Permanently puts the port into trunking mode and negotiates to convert the link into a trunk link. DTP is effectively off.
`dynamic auto`	Makes the port willing to convert the link to a trunk link. The port becomes a trunk port if the neighboring port is set to `trunk` or `dynamic desirable`. This is often the default.
`dynamic desirable`	Actively attempts to convert the link to a trunk link. The port becomes a trunk port if the neighboring port is set to `trunk`, `dynamic desirable`, or `dynamic auto`.
`nonegotiate`	Used with `switchport mode trunk` to prevent DTP frames from being sent. The link still functions as a trunk but without negotiation.

For explicit and secure configurations, use switchport mode access or switchport mode trunk, optionally followed by switchport nonegotiate on trunk ports if DTP frames are not desired even with explicit trunking.

Inter-VLAN Routing (SVI Configuration)

To allow devices in different VLANs to communicate, a Layer 3 device (router or Layer 3 switch) is required. On a Layer 3 switch, this is achieved by configuring Switched Virtual Interfaces (SVIs).


Switch(config)# interface vlan 10
Switch(config-if)# description SVI for USERS VLAN
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# description SVI for VOICE VLAN
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# ip routing

interface vlan [VLAN_ID]: Creates and enters the SVI configuration for the specified VLAN.
ip address [IP_ADDRESS] [SUBNET_MASK]: Assigns an IP address and subnet mask to the SVI, acting as the default gateway for devices in that VLAN.
no shutdown: Activates the SVI. It will only come up if at least one physical port is active in that VLAN.
ip routing: Globally enables IP routing on the Layer 3 switch. Without this, SVIs will not route traffic between VLANs.

Common Pitfalls and Troubleshooting

VLAN Mismatch: Ensure VLAN IDs are consistent across switches for the same logical network. A missing VLAN definition on one switch can prevent connectivity.
Native VLAN Mismatch: The native VLAN ID must be identical on both ends of a trunk link. A mismatch creates a "VLAN mismatch" error, leading to dropped frames for the native VLAN and potential security vulnerabilities. Use show interface trunk to check.
Allowed VLAN List: If devices in a specific VLAN cannot communicate over a trunk, verify that the VLAN is included in the switchport trunk allowed vlan list on both ends.
DTP Negotiation Issues: If a link isn't forming a trunk, check show dtp interface [interface_id]. Explicitly setting switchport mode access or switchport mode trunk is generally more reliable than relying on DTP.
SVI Not Up/Down: If an SVI shows as "down, down", check if no shutdown is applied and if there is at least one active port (access or trunk with allowed VLAN) associated with that VLAN on the switch.
Missing ip routing: On Layer 3 switches, inter-VLAN communication won't occur if ip routing is not enabled globally.
Spanning Tree Issues: PortFast should only be enabled on end-device facing ports. Enabling it on inter-switch links can lead to bridging loops. BPDU Guard should always be enabled with PortFast.