VLANs and Trunking: Segmenting Switched Networks

Why a Single Broadcast Domain Becomes a Problem

Every device connected to the same switch, discussed earlier in this series, shares a single Broadcast Domain by default — a broadcast sent by any device reaches every other device on that switch. As a network grows, this creates two problems: broadcast traffic consumes bandwidth across the entire network even when only a small group of devices actually needs to communicate, and there is no way to isolate different groups of devices (such as separating a guest network from an internal corporate network) without physically separate switches.

What a VLAN Actually Does

A VLAN (Virtual LAN) logically divides a single physical switch into multiple separate broadcast domains, each behaving as if it were a completely separate physical switch, without requiring any additional hardware.

Example: one physical switch, three VLANs

VLAN 10 (Sales):     ports 1-8
VLAN 20 (Engineering): ports 9-16
VLAN 30 (Guest):      ports 17-24

A broadcast sent by a device on port 3 (VLAN 10)
reaches only other devices in VLAN 10 — ports 9-24
never see that broadcast at all

Devices in different VLANs cannot communicate with each other directly at Layer 2, even though they share the same physical switch — reaching another VLAN requires routing through a Layer 3 device, a topic covered in the next article of this series regarding inter-VLAN routing.

Creating VLANs and Assigning Ports

Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit

-- Assign a specific port to a VLAN
Switch(config)# interface gigabitethernet 1/0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

-- Assign a range of ports at once
Switch(config)# interface range gigabitethernet 1/0/9-16
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20

The switchport mode access command explicitly configures the port as an Access Port, meaning it carries traffic for exactly one VLAN and is typically connected to an end-user device like a PC or printer that has no awareness of VLANs at all.

The Problem: Connecting Switches That Share Multiple VLANs

When two switches both need to carry traffic for the same set of VLANs, connecting them with a simple access port would only allow one VLAN's traffic to cross the link. Running a separate physical cable for every VLAN between two switches would work but scales terribly as the number of VLANs grows.

Trunk Links and 802.1Q Tagging

A Trunk Link solves this by carrying traffic for multiple VLANs over a single physical connection, using 802.1Q Tagging to mark each frame with the VLAN it belongs to as it crosses the trunk.

802.1Q tag added to an Ethernet frame:

| Dest MAC | Src MAC | 802.1Q Tag | Type | Data | FCS |
                        (4 bytes, includes
                         12-bit VLAN ID)

This tag is added only while the frame traverses
the trunk link, and removed before delivery to
the destination access port

The receiving switch reads the VLAN tag to determine which VLAN's broadcast domain the frame belongs to, then forwards it accordingly — this is what allows a single cable to correctly carry traffic for dozens of separate VLANs simultaneously.

Configuring a Trunk Link

Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30

-- Restricting allowed VLANs limits which VLANs'
-- traffic is permitted to cross this specific trunk,
-- a common security and traffic-management practice

The switchport trunk allowed vlan command is optional but strongly recommended in production networks — without it, a trunk carries every VLAN configured on the switch by default, which can unintentionally expose traffic across links that should be more restricted.

The Native VLAN

Every trunk has a Native VLAN (VLAN 1 by default), which carries traffic without an 802.1Q tag at all, preserved for compatibility with older equipment that does not understand tagging.

Switch(config-if)# switchport trunk native vlan 99

-- Changing the native VLAN away from the default
-- VLAN 1 is a common security best practice, since
-- VLAN 1 is a well-known default target for certain
-- Layer 2 attacks

Both ends of a trunk must agree on which VLAN is native — a mismatch causes untagged traffic to be incorrectly associated with the wrong VLAN on one side of the link, a subtle misconfiguration that can be difficult to diagnose without specifically checking this setting.

Essential VLAN Verification Commands

Switch# show vlan brief

VLAN Name       Status    Ports
---- ---------- --------- -----------------------
1    default    active    Gi1/0/1, Gi1/0/2
10   Sales      active    Gi1/0/3
20   Engineering active   Gi1/0/9, Gi1/0/10

Switch# show interfaces trunk

Port      Mode   Encapsulation  Status    Native vlan
Gi1/0/24  on     802.1q         trunking  99

show vlan brief confirms which ports belong to which VLAN, and show interfaces trunk confirms trunk status, allowed VLANs, and native VLAN — these two commands together resolve the vast majority of VLAN-related connectivity problems by directly revealing whether the configuration matches what was actually intended.

Why VLANs Are Foundational to Modern Switch Design

Virtually every enterprise network uses VLANs to separate traffic by department, function, or security requirement, and trunk links are the standard mechanism connecting the switches that make up that segmented topology. Understanding exactly how access ports, trunk ports, and 802.1Q tagging work together is essential before moving to inter-VLAN routing, Spanning Tree Protocol, and the more advanced Layer 2 topics covered later in this series, since all of them build directly on the VLAN segmentation introduced here.