What is a VLAN? It is a logical, software-based segmentation of a physical network, so devices on shared switches behave as separate networks and reach each other only through routing.
A trunk carries several VLANs over one link by tagging frames, and a router or Layer 3 switch joins them. The sections below follow that order, ending with a small lab. Anyone studying for the exam can pair it with how to prepare for ccna.
What a VLAN does and why it is used
A VLAN divides LAN devices logically, not physically, into segments, according to FiberMall’s VLAN overview. The switches and cables stay the same, and the configuration decides which devices belong together. That is why a finance team and a guest Wi-Fi network can share hardware without sharing a network.
Reasons to create VLANs
- Smaller broadcast groups. Broadcasts in a VLAN reach only its members, which limits broadcast storms.
- Isolation. Cycle.io’s VLAN basics guide notes that VLANs isolate network traffic, which helps prevent unauthorized access to sensitive data.
- Flexible changes. The same guide says VLANs allow network reconfiguration without physical changes, which makes the network more scalable.
- Voice separation. NinjaOne’s VLAN explainer describes voice VLANs that separate voice traffic from data traffic to support low-latency calls.
Isolation is the point to remember when judging a design. Devices in different VLANs cannot communicate directly unless rules allow it, so a VLAN is a boundary you later open deliberately, not a firewall by itself. Hosts in each VLAN also need addressing and name resolution, which dhcp vs dns covers.
Ways to assign membership
Cycle.io lists port-based, protocol-based and MAC address-based VLANs as three common types. Port-based is the type a beginner lab uses, because each physical port is assigned to a specific VLAN. The trade-off is that membership belongs to the port. If a user moves to a port on a new switch, the assignment must be redefined. MAC-based VLANs avoid this because membership follows the user, not the switch port. They suit devices that move often, while port-based assignment suits fixed desks, printers and servers.
Access ports, trunk ports and the native VLAN
An access port belongs to one VLAN and faces an end device. A trunk port carries several VLANs and faces another switch or a router. The native VLAN is the exception on a trunk, because its frames travel untagged.
| Port role | What it carries | Planning use |
|---|---|---|
| Access port | Traffic for a single VLAN, assigned per physical port | PCs, printers and servers that belong to one VLAN |
| Trunk port | Traffic for multiple VLANs, kept separate by VLAN tagging | Links between switches, and between a switch and a router serving several VLANs |
| Native VLAN (default VLAN 1 for untagged frames) | Frames without a VLAN tag | A setting to review on every trunk, not to leave unexamined |
The port roles follow the descriptions in NinjaOne, and the untagged-frame behaviour follows Cycle.io.
How a trunk carries several VLANs over one link
A VLAN trunk is a network link that can carry multiple VLANs simultaneously over a single physical connection. Separation survives because each packet is tagged with a VLAN identifier, so the receiving switch can place it in the correct VLAN. Trunk ports are essential for connecting switches and routers that serve multiple VLANs.
What 802.1Q adds to a frame
IEEE 802.1Q is the most common VLAN tagging protocol. It adds a 4-byte tag to Ethernet frames, as Cycle.io describes. The tag is metadata added to the Ethernet frame header. FiberMall reports that the IEEE issued the draft 802.1Q standard in 1999 to standardize VLAN implementation.
Because the field is so small, VLAN numbering is a planning task. Give each department or function a documented ID before configuring any switch.
The stages of a tagged frame
- A host sends an ordinary frame into an access port.
- The switch notes which VLAN that port belongs to.
- When the frame leaves through a trunk port, the switch adds the VLAN tag.
- The next switch reads the tag and delivers the frame only to ports in that VLAN.
Native VLAN and default VLAN behaviour
Frames without a VLAN tag are typically associated with the default VLAN, which is VLAN 1 on Cisco-style switches. On a trunk, the native VLAN is the VLAN assigned to those untagged frames. This is why mismatched native VLAN settings at the two ends of a trunk cause confusing leaks of traffic into the wrong VLAN.
Why it matters for security
Cycle.io recommends minimising the number of trunk links, securing trunk ports and using 802.1Q tagging to prevent VLAN hopping attacks. In practice that means three habits. Do not keep user ports in the default VLAN. Treat the native VLAN as a deliberate setting instead of an inherited default. Enable trunking only on the links that truly need it. A trunk left running toward an end-user port widens the attack surface the VLANs were meant to shrink.
How inter-VLAN routing works
Without routing, different VLANs cannot communicate with each other. Inter-VLAN routing lets data traverse between VLANs with the assistance of routers or Layer 3 switches, as NinjaOne explains. The router or Layer 3 switch acts as the gateway for each VLAN, and every VLAN needs its own gateway address on it.
Router-on-a-stick
Router-on-a-stick uses a single router interface connected to a switch trunk port. Tagged frames from every VLAN arrive on that one link, and the router forwards them back out on the same link toward the destination VLAN. On a Cisco router, each VLAN gets a subinterface with dot1q encapsulation and that VLAN’s gateway address. It suits labs and small sites. A Layer 3 switch is the usual choice when many VLANs share heavy traffic. For the underlying device roles, see switch vs router.
A pair-of-switches lab, step by step
The lab fits Packet Tracer or real switches: a pair of switches joined by a trunk, hosts in separate VLANs, and a router on a trunk port. Commands are shown without numbers, so substitute the VLAN IDs and interface names from your own plan.
- Create the VLANs. On each switch, enter vlan <id> and give it a name for every VLAN in the plan.
- Assign access ports. On each host-facing interface, enter switchport mode access and then switchport access vlan <id>.
- Verify membership. Run show vlan brief on both switches to confirm each VLAN exists and shows the right ports.
- Build the trunk. On the interconnecting interfaces of both switches, enter switchport mode trunk. Set the native VLAN to the same value on both ends.
- Verify the trunk. Run show interfaces trunk to confirm the trunking interface, the allowed VLANs and the native VLAN.
- Test inside each VLAN. Hosts in the same VLAN should reach each other across both switches. Hosts in different VLANs should not yet.
- Add the router. Trunk the switch port facing the router, create a subinterface per VLAN with encapsulation dot1q <id> and a gateway address, and point each host’s gateway at it.
- Test across VLANs. Hosts in different VLANs should now communicate through the router.
If step six fails, check the access port assignments before touching the trunk. If step eight fails, the trunk’s allowed VLANs and the subinterface encapsulation are the likeliest causes.
Frequently asked questions
What is a VLAN and why are VLANs used?
A VLAN is a logical segment of a physical network. VLANs are used to limit broadcasts to members, isolate sensitive traffic and reconfigure the network without physical changes.
How does a trunk carry several VLANs?
A trunk tags each frame with a VLAN identifier, using the 4-byte 802.1Q tag, so one physical link can carry many VLANs while keeping them separate.
What is the native VLAN?
It is the VLAN handled without a tag on a trunk, with untagged frames typically associated with default VLAN 1. Treat it as a setting to configure deliberately, and keep trunk links to a minimum to reduce VLAN hopping risk.
How does inter-VLAN routing work?
A router or Layer 3 switch acts as the gateway between VLANs. In router-on-a-stick, one router link to a switch trunk port serves every VLAN.
