Why a Single Broadcast Domain Becomes a Problem
Every device connected to the same switch, discussed earlier in this series, shares a single Broadcast Domain by default — a broadcast sent by any device reaches every other device on that switch. As a network grows, this creates two problems: broadcast traffic consumes bandwidth across the entire network even when only a small group of devices actually needs to communicate, and there is no way to isolate different groups of devices (such as separating a guest network from an internal corporate network) without physically separate switches.
What a VLAN Actually Does
A VLAN (Virtual LAN) logically divides a single physical switch into multiple separate broadcast domains, each behaving as if it were a completely separate physical switch, without requiring any additional hardware.
Example: one physical switch, three VLANs
VLAN 10 (Sales): ports 1-8
VLAN 20 (Engineering): ports 9-16
VLAN 30 (Guest): ports 17-24
A broadcast sent by a device on port 3 (VLAN 10)
reaches only other devices in VLAN 10 — ports 9-24
never see that broadcast at allDevices in different VLANs cannot communicate with each other directly at Layer 2, even though they share the same physical switch — reaching another VLAN requires routing through a Layer 3 device, a topic covered in the next article of this series regarding inter-VLAN routing.
Creating VLANs and Assigning Ports
Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
-- Assign a specific port to a VLAN
Switch(config)# interface gigabitethernet 1/0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
-- Assign a range of ports at once
Switch(config)# interface range gigabitethernet 1/0/9-16
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20The switchport mode access command explicitly configures the port as an Access Port, meaning it carries traffic for exactly one VLAN and is typically connected to an end-user device like a PC or printer that has no awareness of VLANs at all.
The Problem: Connecting Switches That Share Multiple VLANs
When two switches both need to carry traffic for the same set of VLANs, connecting them with a simple access port would only allow one VLAN's traffic to cross the link. Running a separate physical cable for every VLAN between two switches would work but scales terribly as the number of VLANs grows.
Trunk Links and 802.1Q Tagging
A Trunk Link solves this by carrying traffic for multiple VLANs over a single physical connection, using 802.1Q Tagging to mark each frame with the VLAN it belongs to as it crosses the trunk.
802.1Q tag added to an Ethernet frame:
| Dest MAC | Src MAC | 802.1Q Tag | Type | Data | FCS |
(4 bytes, includes
12-bit VLAN ID)
This tag is added only while the frame traverses
the trunk link, and removed before delivery to
the destination access portThe receiving switch reads the VLAN tag to determine which VLAN's broadcast domain the frame belongs to, then forwards it accordingly — this is what allows a single cable to correctly carry traffic for dozens of separate VLANs simultaneously.
Configuring a Trunk Link
Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
-- Restricting allowed VLANs limits which VLANs'
-- traffic is permitted to cross this specific trunk,
-- a common security and traffic-management practiceThe switchport trunk allowed vlan command is optional but strongly recommended in production networks — without it, a trunk carries every VLAN configured on the switch by default, which can unintentionally expose traffic across links that should be more restricted.
The Native VLAN
Every trunk has a Native VLAN (VLAN 1 by default), which carries traffic without an 802.1Q tag at all, preserved for compatibility with older equipment that does not understand tagging.
Switch(config-if)# switchport trunk native vlan 99
-- Changing the native VLAN away from the default
-- VLAN 1 is a common security best practice, since
-- VLAN 1 is a well-known default target for certain
-- Layer 2 attacksBoth ends of a trunk must agree on which VLAN is native — a mismatch causes untagged traffic to be incorrectly associated with the wrong VLAN on one side of the link, a subtle misconfiguration that can be difficult to diagnose without specifically checking this setting.
Essential VLAN Verification Commands
Switch# show vlan brief
VLAN Name Status Ports
---- ---------- --------- -----------------------
1 default active Gi1/0/1, Gi1/0/2
10 Sales active Gi1/0/3
20 Engineering active Gi1/0/9, Gi1/0/10
Switch# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/24 on 802.1q trunking 99show vlan brief confirms which ports belong to which VLAN, and show interfaces trunk confirms trunk status, allowed VLANs, and native VLAN — these two commands together resolve the vast majority of VLAN-related connectivity problems by directly revealing whether the configuration matches what was actually intended.
Why VLANs Are Foundational to Modern Switch Design
Virtually every enterprise network uses VLANs to separate traffic by department, function, or security requirement, and trunk links are the standard mechanism connecting the switches that make up that segmented topology. Understanding exactly how access ports, trunk ports, and 802.1Q tagging work together is essential before moving to inter-VLAN routing, Spanning Tree Protocol, and the more advanced Layer 2 topics covered later in this series, since all of them build directly on the VLAN segmentation introduced here.