Configure a VLAN on a Cisco Catalyst Switch

Detailed guide on configuring VLANs on Cisco Catalyst switches. Covers creating VLANs, assigning ports, trunking, voice VLANs, and troubleshooting common issues in Cisco IOS.

Virtual Local Area Networks (VLANs) are a fundamental concept in modern network design, providing a mechanism to segment a single physical switch into multiple logical broadcast domains. This segmentation enhances security, improves performance by reducing broadcast traffic, and simplifies network management. This guide focuses on configuring VLANs on Cisco Catalyst switches running Cisco IOS, covering common scenarios from basic port assignment to advanced voice VLAN configurations.

Understanding VLAN Fundamentals

Before diving into configuration, it's crucial to understand how VLANs operate. Each VLAN acts as a separate broadcast domain, meaning devices within the same VLAN can communicate without a router, but communication between different VLANs requires a Layer 3 device (router or Layer 3 switch).

Broadcast Domain: A logical division of a computer network where all nodes can reach each other by broadcast at the data link layer. VLANs reduce the size of these domains.
Access Port: A switch port configured to carry traffic for a single VLAN. End devices (workstations, servers) connect to access ports.
Trunk Port: A switch port configured to carry traffic for multiple VLANs simultaneously. Trunk ports are typically used for connecting switches to other switches, or switches to routers/firewalls. Cisco uses IEEE 802.1Q for trunking, though older proprietary ISL (Inter-Switch Link) existed.
Native VLAN: On an 802.1Q trunk, untagged frames are associated with the native VLAN. It's a security best practice to change the native VLAN from the default (VLAN 1) to an unused VLAN ID.

Basic VLAN Creation and Port Assignment

The process begins with defining the VLAN and then assigning switch ports to it. For this example, we'll create VLAN 20 for 'SALES' and assign GigabitEthernet 1/0/5 to it. These commands apply to Catalyst switches running Cisco IOS 15.x or similar versions.

Creating the VLAN

First, enter global configuration mode and define the VLAN. A VLAN ID can range from 1 to 4094. VLANs 1002-1005 are reserved for older technologies (FDDI, Token Ring) and generally shouldn't be used.

Switch> enable
Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit

Assigning an Access Port to a VLAN

Next, configure the interface as an access port and assign it to the newly created VLAN. It's good practice to explicitly define the port mode, even if it's the default for some interfaces.

Switch(config)# interface GigabitEthernet1/0/5
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# description "User PC - Sales VLAN 20"
Switch(config-if)# exit

Repeat this for all access ports that need to be part of VLAN 20. If the VLAN does not exist when you assign an access port to it, the switch will automatically create the VLAN.

Configuring Trunk Ports

Trunk ports carry traffic for multiple VLANs between switches. By default, all VLANs are allowed on an 802.1Q trunk. However, for security and efficiency, it's recommended to prune unnecessary VLANs.

Setting up a Basic Trunk

Let's configure GigabitEthernet 1/0/1 as a trunk port, connecting to another switch.

Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q  // Required for some older platforms, default for modern ones
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99  // Explicitly allow specific VLANs
Switch(config-if)# description "Trunk to Core_SW_01"
Switch(config-if)# exit

Note: The switchport trunk encapsulation dot1q command is explicitly shown here. On newer Catalyst models (e.g., Catalyst 2960-X, 3850, 9200, 9300 series), 802.1Q is the only supported trunking encapsulation method, so this command is often not strictly necessary or may not even be available (it's implicit). However, on older platforms that supported ISL, it was essential.

Managing Allowed VLANs on a Trunk

You can modify the allowed VLANs on a trunk using various options:

switchport trunk allowed vlan add 40: Adds VLAN 40 to the existing list.
switchport trunk allowed vlan remove 10: Removes VLAN 10 from the list.
switchport trunk allowed vlan except 10,20: Allows all VLANs except 10 and 20.
switchport trunk allowed vlan all: Resets to allow all VLANs (default behavior).

Configuring Voice VLANs

Cisco IP Phones often require a dedicated voice VLAN to prioritize voice traffic and separate it from data traffic. Cisco Catalyst switches can detect a Cisco IP Phone (via CDP) and dynamically assign its traffic to a specified voice VLAN while passing PC traffic (connected to the phone's integrated switch) to a separate data VLAN.

For this example, let's assume VLAN 30 is for 'VOICE' and we're configuring GigabitEthernet 1/0/6.

Switch(config)# vlan 30
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit

Switch(config)# interface GigabitEthernet1/0/6
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20  // Data VLAN for the PC connected to the phone
Switch(config-if)# switchport voice vlan 30  // Voice VLAN for the IP Phone
Switch(config-if)# mls qos trust dscp  // Trust Differentiated Services Code Point for QoS
Switch(config-if)# spanning-tree portfast
Switch(config-if)# description "IP Phone and PC - Sales"
Switch(config-if)# exit

The mls qos trust dscp command tells the switch to trust the QoS markings (DSCP values) on incoming packets, which is critical for voice quality. spanning-tree portfast immediately transitions the port to the forwarding state, preventing delays for end devices.

Verification Commands

After making configuration changes, it's essential to verify their correct application.

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- ------------------------------
1    default                          active    Gi1/0/2, Gi1/0/3, Gi1/0/4
20   SALES                            active    Gi1/0/5, Gi1/0/6
30   VOICE                            active    Gi1/0/6
99   NATIVE_VLAN_99                   active
1002 fddi-default                     act/unsup
...

Switch# show interfaces GigabitEthernet1/0/5 switchport
Name: Gi1/0/5
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 20 (SALES)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: none
...

Switch# show interfaces GigabitEthernet1/0/1 trunk
Port        Mode         Encapsulation  Status        Native VLAN
Gi1/0/1     on           802.1q         trunking      99

Port        Vlans allowed on trunk
Gi1/0/1     10,20,30,99

Port        Vlans allowed and active in management domain
Gi1/0/1     10,20,30,99

Switch# show interfaces GigabitEthernet1/0/6 switchport
Name: Gi1/0/6
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: Off
Access Mode VLAN: 20 (SALES)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: enabled
Voice VLAN: 30 (VOICE)
...

Saving the Configuration

Configurations made in RAM (running-config) are lost upon reboot unless saved to NVRAM (startup-config). Always save your work!

Switch(config)# end
Switch# copy running-config startup-config
Destination filename [startup-config]? 
Building configuration...
[OK]
Switch#

Alternatively, use the shortcut write memory or wr.

Common Pitfalls and Troubleshooting

Port stuck in dynamic mode: If a port remains in dynamic desirable or auto mode and doesn't trunk or pass traffic as expected, explicitly set switchport mode access or switchport mode trunk. Dynamic Trunking Protocol (DTP) can lead to unexpected behavior or security risks. Use switchport nonegotiate on static trunks to disable DTP.
VLAN missing from trunk: Verify that the required VLAN is allowed on the trunk port using show interfaces [interface-id] trunk. If not, use switchport trunk allowed vlan add [vlan-id]. Ensure the VLAN is active (show vlan brief).
Native VLAN Mismatch: A native VLAN mismatch on a trunk link between two switches can cause connectivity issues for the native VLAN and can be a security vulnerability. The switch will log a CDP error. Use show interfaces [interface-id] trunk to check the native VLAN on both sides.
No IP Connectivity for VLANs: Remember that VLANs segment broadcast domains. For devices in different VLANs to communicate, a Layer 3 device (router or Layer 3 switch with SVI/inter-VLAN routing) is required. Ensure the SVI (Switch Virtual Interface) is configured and active for each VLAN (interface vlan [vlan-id], ip address ..., no shutdown).
VLAN not active: A VLAN might be configured but not active if no ports are assigned to it or if it's explicitly shut down (vlan [id], then shutdown in vlan configuration mode).
Incorrect IP Phone behavior: If a phone isn't getting to its voice VLAN, check switchport voice vlan [id] on the port. Ensure CDP is enabled globally (cdp run) and on the interface (cdp enable) for auto-detection.