Configuring VLANs and Trunks on a Cisco Switch

VLANs (Virtual Local Area Networks) segment a broadcast domain at Layer 2, enhancing network security, performance, and manageability by isolating…

VLANs (Virtual Local Area Networks) segment a broadcast domain at Layer 2, enhancing network security, performance, and manageability by isolating traffic. Trunks allow multiple VLANs to traverse a single physical link between switches or between a switch and a router/server. This article details the configuration of VLANs and trunking on Cisco IOS Catalyst switches, focusing on industry best practices and common scenarios.

VLAN Fundamentals and Creation

VLANs logically group network devices, regardless of their physical location. Each VLAN operates as its own broadcast domain. By default, all ports on a Cisco switch are in VLAN 1. For security and operational efficiency, it is crucial to create separate VLANs for different user groups, services, or traffic types (e.g., data, voice, management).

To create VLANs on a Cisco Catalyst switch, enter global configuration mode and define each VLAN with a unique ID (1-4094, with 1002-1005 reserved for legacy technologies like FDDI and Token Ring) and an optional descriptive name.

conf t
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 99
 name MGMT
end

After creation, verify the VLANs using show vlan brief. This command displays a concise summary of all configured VLANs, their names, status, and associated ports.

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/3, Gi0/4, Gi0/5, Gi0/6, Gi0/7, Gi0/8, Gi0/9, Gi0/10, Gi0/11, Gi0/12, Gi0/13, Gi0/14, Gi0/15, Gi0/16, Gi0/17, Gi0/18, Gi0/19, Gi0/20, Gi0/21, Gi0/22, Gi0/23, Gi0/24
10   USERS                            active    
20   VOICE                            active    
99   MGMT                             active    
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup 

Configuring Access Ports

Access ports are switch ports that carry traffic for only a single VLAN. They are typically used for end devices like workstations, IP phones, servers, or printers. When a device sends untagged frames into an access port, the switch tags those frames with the VLAN ID configured on the port.

For IP Phones, Cisco implements a "Voice VLAN" feature. This allows the phone to receive its untagged voice traffic from a dedicated voice VLAN, while a PC connected to the phone's built-in switch port receives data traffic from a separate, tagged data VLAN. This configuration is particularly useful for Quality of Service (QoS) and simplifies cabling.

Consider an access port Gi0/1 connected to an IP Phone with a PC daisy-chained to it:

conf t
interface GigabitEthernet0/1
 description Access Port for IP Phone and PC
 switchport mode access
 switchport access vlan 10      ! Data VLAN for PC
 switchport voice vlan 20       ! Voice VLAN for IP Phone
 spanning-tree portfast        ! Speeds up port transition to forwarding state
end

Understanding spanning-tree portfast

The spanning-tree portfast command immediately transitions a port into the forwarding state, bypassing the Listening and Learning states. This is crucial for end-device connectivity to avoid delays during boot-up, especially for DHCP. It should only be enabled on access ports connected to end devices, never on ports connecting to other switches or network devices, as it can create Layer 2 loops and cause network outages if used improperly.

Configuring Trunk Ports

Trunk ports carry traffic for multiple VLANs between switches or between a switch and a router (Router-on-a-Stick) or hypervisor. Cisco switches primarily use IEEE 802.1Q for trunking, which adds a 4-byte tag to the Ethernet frame header to identify the VLAN. Older Cisco switches might also support Cisco's proprietary ISL (Inter-Switch Link) protocol, but 802.1Q is the industry standard and recommended for modern deployments.

To configure a trunk port, specify the encapsulation type (802.1Q) and set the port mode to trunk. It's also critical to explicitly define which VLANs are allowed to traverse the trunk and which VLAN will be the native VLAN.

Let's configure Gi0/24 as a trunk link to another switch, allowing VLANs 10, 20, and 99:

conf t
interface GigabitEthernet0/24
 description Trunk link to Distribution_Switch_01
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,99
 switchport trunk native vlan 99
end

Key Trunk Configuration Options:

• switchport trunk encapsulation dot1q: Specifies 802.1Q as the trunking protocol. This command is mandatory on some older Catalyst switch models (e.g., 2950, 3550, 3750) if they support both ISL and dot1q. Newer models (e.g., Catalyst 2960-X, 3850, 9300) default to 802.1Q and often don't require this command or only accept switchport trunk encapsulation dot1q.
• switchport mode trunk: Forces the port into permanent trunking mode. Other modes like dynamic auto and dynamic desirable exist for DTP (Dynamic Trunking Protocol) negotiation, but explicitly setting switchport mode trunk is a best practice for security and predictability, preventing unintended trunk formation or access port conversion.
• switchport trunk allowed vlan <vlan-list>: Restricts which VLANs are permitted to cross the trunk link. By default, all VLANs are allowed. Explicitly defining allowed VLANs improves security and reduces unnecessary broadcast traffic over the trunk. For example, switchport trunk allowed vlan 10,20,99. To add a VLAN without removing existing ones, use switchport trunk allowed vlan add <vlan-id>. To remove, use remove instead of add.
• switchport trunk native vlan <vlan-id>: Defines the native VLAN for the trunk. Frames belonging to the native VLAN are sent untagged over the trunk link. On the receiving end, untagged frames are assumed to belong to the configured native VLAN. It is critical that the native VLAN ID matches on both ends of a trunk link to prevent VLAN hopping attacks and connectivity issues. Best practice is to use an unused VLAN for the native VLAN (e.g., VLAN 999 or VLAN 99 in our example for management), never VLAN 1, and never a VLAN used for user data.

Verifying Trunk Ports

To verify the status and configuration of trunk ports, use the show interfaces trunk command:

Switch# show interfaces trunk

Port        Mode             Encapsulation  Status        Native VLAN
Gi0/24      on               802.1q         trunking      99
Port        Vlans allowed on trunk
Gi0/24      10,20,99

Port        Vlans allowed and active in management domain
Gi0/24      10,20,99

Port        Vlans in spanning tree forwarding state and not pruned
Gi0/24      10,20,99

This output confirms that Gi0/24 is operating as a trunk, using 802.1q encapsulation, with a native VLAN of 99, and allowing VLANs 10, 20, and 99.

VLAN Database and VTP

VLAN configurations are stored in the vlan.dat file in flash memory and in the running configuration. The VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol designed to propagate VLAN configurations across a network of switches, reducing manual configuration effort. However, VTP also carries significant risks if not managed carefully (e.g., accidentally propagating an empty VLAN database from a new switch in server mode). For this reason, many engineers disable VTP or configure switches in VTP transparent mode.

conf t
vtp mode transparent
end

In transparent mode, a switch forwards VTP advertisements but does not participate in the VTP domain itself; it maintains its own local VLAN database. This is generally the recommended approach for modern, highly segmented networks, providing greater control and preventing accidental network-wide VLAN deletions.

Summary of Key Configuration Commands

Common Pitfalls and Troubleshooting

• Native VLAN Mismatch: The most common trunking issue. If the native VLANs do not match on both ends of a trunk, the link will likely flap, and a console message "Native VLAN mismatch" will be displayed. This causes connectivity problems for all VLANs. Always ensure consistency.
• Allowed VLAN List: Forgetting to add a VLAN to the switchport trunk allowed vlan list on one side of a trunk will prevent that VLAN's traffic from traversing the link. Use show interfaces trunk to verify.
• DTP Negotiation Issues: Using switchport mode dynamic auto or dynamic desirable can lead to unexpected trunking behavior if the negotiation fails or one side is configured differently. Explicitly configure switchport mode trunk for predictable operation.
• spanning-tree portfast on Trunks: Accidentally enabling portfast on a trunk port can lead to Layer 2 loops and network instability, as it bypasses the STP convergence process. STP will log a PVID-Mismatch or Type-inconsistency error.
• VTP Misconfiguration: In VTP client/server mode, adding a new switch configured as VTP server with an empty VLAN database can overwrite the VLAN configurations of all other switches in the domain. Use VTP transparent mode or ensure careful management of VTP revisions.
• VLAN 1 Usage: While configurable, using VLAN 1 for user data or as a native VLAN is generally discouraged due to its default status and potential security implications. It's often exploited in VLAN hopping attacks.
• ACLs Blocking VTP/CDP: Ensure that any applied ACLs on interfaces or VLAN interfaces do not inadvertently block VTP (multicast MAC 01:00:0C:CC:CC:CC) or CDP (multicast MAC 01:00:0C:CC:CC:CD) traffic if these protocols are intended to function.