Switching and VLANs

Virtual LANs are one of the most useful tools in Ethernet networking. At the basic level, a VLAN divides one physical switch into multiple isolated Layer 2 networks. In production environments, VLANs are also used to deliver ISP circuits, separate tenants in a data center, carry wireless networks through access points, isolate management interfaces, prioritize voice traffic, and connect virtual machines to different security zones.

How Ethernet Switching Works

An Ethernet switch forwards frames based on destination MAC addresses. As frames enter a port, the switch learns the source MAC address and records the port where it was seen. This creates a MAC address table, sometimes called a CAM table.

MAC address learning happens independently inside each VLAN. The same MAC address may appear in different VLANs because each VLAN is treated as its own Layer 2 network.

Switching Methods

• Store-and-forward: Receives the complete frame and checks it for errors before forwarding. This is the normal behavior on modern enterprise switches.
• Cut-through: Begins forwarding after reading enough of the frame to determine the destination. It reduces latency but can forward damaged frames.
• Fragment-free: Waits for the first 64 bytes before forwarding, avoiding many collision-related fragments found in older Ethernet networks.

VLAN Fundamentals

A VLAN creates a logical Layer 2 network independent of the physical switch layout. Two ports assigned to VLAN 20 can communicate as though they were connected to the same standalone switch, while a device in VLAN 30 remains isolated unless a router or Layer 3 switch permits communication.

Without VLANs, an organization might need separate physical switches for users, servers, phones, security cameras, guests, and management devices:

With VLANs, one managed switch can provide the same logical separation:

VLAN Identifier Range

The IEEE 802.1Q VLAN identifier is 12 bits long. This creates 4,096 possible values:

• VLAN 0: Reserved for priority-tagged frames and not used as a normal VLAN.
• VLANs 1 through 4094: Available VLAN identifiers, subject to platform-specific restrictions.
• VLAN 4095: Reserved.

Many networks avoid using VLAN 1 for production traffic because it is the default on many switch platforms. It is better to create explicitly named VLANs and assign every active port intentionally.

Benefits of VLANs

• Isolation: Devices remain in separate Layer 2 broadcast domains.
• Security control: Inter-VLAN traffic can be inspected and filtered at a gateway.
• Broadcast containment: Broadcast and unknown-unicast traffic remains inside its VLAN.
• Operational flexibility: Devices can be grouped by role instead of physical location.
• Shared infrastructure: Multiple customers, departments, or services can use the same physical switching platform.

802.1Q Tagging and Trunk Links

An access port normally carries traffic for one VLAN and sends ordinary untagged Ethernet frames to the connected device. A trunk carries traffic for multiple VLANs by inserting an IEEE 802.1Q tag into each frame.

Access port                         802.1Q trunk
+----------+      untagged      +--------+  VLAN 10 tagged
| Computer |---------------------| Switch |=================
+----------+                     +--------+  VLAN 20 tagged
                                               VLAN 30 tagged

The 802.1Q tag includes the VLAN ID and traffic-priority information. When a tagged frame reaches another switch, firewall, router, hypervisor, or wireless access point, that device uses the tag to place the frame into the correct logical network.

Common Port Types

Basic Cisco VLAN Configuration

! Create and name VLANs
vlan 10
 name USERS
vlan 20
 name VOICE
vlan 30
 name SERVERS
vlan 999
 name UNUSED-NATIVE

! Configure a user access port
interface GigabitEthernet1/0/10
 description Accounting workstation
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable

! Configure a switch uplink
interface TenGigabitEthernet1/1/1
 description Trunk to distribution switch
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30,999
 switchport nonegotiate

The Native VLAN

On an 802.1Q trunk, the native VLAN is normally sent without a tag. Both sides of the link must agree on the native VLAN. A mismatch can cause traffic leakage, confusing spanning-tree behavior, and security problems.

Allowed VLAN Lists

A trunk should carry only the VLANs needed on that link. Allowing every VLAN everywhere increases failure scope, extends broadcast domains farther than necessary, and makes accidental Layer 2 loops more damaging.

interface TenGigabitEthernet1/1/1
 switchport trunk allowed vlan 10,20,30

! Later add VLAN 40 without replacing the existing list
 switchport trunk allowed vlan add 40

Link Aggregation and Trunks

Multiple physical links can be bundled into a logical port channel using LACP. The VLAN trunk configuration should normally be applied to the port-channel interface so all member links remain consistent.

interface range TenGigabitEthernet1/1/1-2
 channel-group 10 mode active

interface Port-channel10
 description LACP trunk to distribution pair
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40

Inter-VLAN Routing

Devices in separate VLANs need a Layer 3 gateway to communicate. The gateway may be a router, firewall, Layer 3 switch, virtual router, or distributed gateway in a data-center fabric.

Router-on-a-Stick

A router-on-a-stick design uses one physical router interface with one tagged subinterface per VLAN. It is useful in small networks but can become a bandwidth bottleneck.

interface GigabitEthernet0/0
 no shutdown

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Switched Virtual Interfaces

A Layer 3 switch can create a switched virtual interface, or SVI, for each VLAN. The SVI becomes the default gateway for devices in that VLAN.

ip routing

interface Vlan10
 description User gateway
 ip address 192.168.10.1 255.255.255.0
 no shutdown

interface Vlan30
 description Server gateway
 ip address 192.168.30.1 255.255.255.0
 no shutdown

Routing Does Not Automatically Mean Access

Once routing is enabled, VLANs can potentially communicate. Apply access control lists or firewall policy according to the business need.

ip access-list extended USERS-TO-SERVERS
 permit tcp 192.168.10.0 0.0.0.255 host 192.168.30.20 eq 443
 permit udp 192.168.10.0 0.0.0.255 host 192.168.30.10 eq domain
 deny   ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 log
 permit ip any any

interface Vlan10
 ip access-group USERS-TO-SERVERS in

Redundant Gateways

In networks with two Layer 3 switches or routers, a first-hop redundancy protocol such as HSRP or VRRP can provide a shared virtual default gateway. The spanning-tree root and active gateway should be intentionally aligned so traffic does not take an unnecessary path across the switch pair.

Real-World Enterprise VLAN Examples

Example Enterprise VLAN Plan

Wireless Access Point Trunk Example

interface GigabitEthernet1/0/24
 description Wireless access point
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 20,80,99
 spanning-tree portfast trunk

In this example, VLAN 99 can be used for access-point management, VLAN 20 for the employee SSID, and VLAN 80 for the guest SSID. The exact native and tagged behavior must match the access-point configuration.

Dynamic VLAN Assignment

802.1X authentication and network access control platforms can assign VLANs dynamically. A switch may place an employee laptop into the user VLAN, a phone into the voice VLAN, an unknown device into a registration VLAN, and a failed-compliance device into a quarantine VLAN. Modern deployments may use downloadable ACLs or policy groups instead of relying only on VLAN changes, but dynamic VLAN assignment remains common.

How ISPs and Carriers Use VLANs

For a service provider, a VLAN is often not just a department boundary. It may represent a customer circuit, an internet service, a Layer 2 transport service, a connection to an upstream carrier, or a handoff between routers and switches.

1. Customer Internet Handoff

An ISP may deliver internet service to a customer as a tagged VLAN on a shared fiber or Ethernet handoff. The customer firewall configures a matching VLAN subinterface and receives public or private addressing on that logical circuit.

ISP aggregation switch                         Customer firewall
+----------------------+                        +------------------+
| Port to customer     |==== VLAN 1201 tagged ==| WAN subinterface |
| Port to ISP router   |==== VLAN 1201 tagged ==| VLAN ID 1201     |
+----------------------+                        +------------------+

The VLAN separates this customer from other customers using the same aggregation infrastructure. The service provider must still apply source validation, rate limits, routing policy, and operational controls at the Layer 3 edge.

2. Multiple Services on One Handoff

A business may receive several services over one physical interface:

3. QinQ: VLAN Stacking

QinQ, also called 802.1ad or VLAN stacking, adds a provider service tag around a customer's existing 802.1Q frame. The customer's VLAN is often called the C-VLAN, while the outer provider VLAN is called the S-VLAN.

Original customer frame:
[ Ethernet ][ C-VLAN 20 ][ Payload ]

Across the provider network:
[ Ethernet ][ S-VLAN 3000 ][ C-VLAN 20 ][ Payload ]

This allows two customers to use the same internal VLAN numbers without colliding. Customer A and Customer B may both use VLAN 20, while the provider places them into separate service VLANs.

! Simplified Cisco-style QinQ edge example
interface GigabitEthernet0/1
 description Customer-facing UNI
 switchport mode dot1q-tunnel
 switchport access vlan 3000
 l2protocol-tunnel cdp stp vtp

4. VLAN Translation

Sometimes the VLAN requested by a customer conflicts with a provider or facility VLAN. VLAN translation rewrites one tag to another at the network edge. For example, a customer can present VLAN 100 while the provider transports it internally as VLAN 2307.

5. Broadband Access Networks

Residential and business broadband platforms may use VLANs between access equipment and subscriber gateways. A VLAN can represent an access node, service type, wholesale partner, or subscriber group. DHCP relay information, PPPoE, subscriber authentication, and policy systems are often combined with VLAN identification.

6. Internet Exchange and Peering Fabrics

An internet exchange is typically a shared Layer 2 Ethernet fabric. Members connect routers to a peering VLAN and exchange traffic directly. Separate VLANs may be used for route servers, private interconnections, management, or special services. Strong controls such as MAC filtering, port security, storm control, and route-policy enforcement are important because many independent networks share the fabric.

7. Network-to-Network and User-to-Network Interfaces

• UNI: A user-to-network interface is the customer-facing service handoff.
• NNI: A network-to-network interface carries services between carriers, facilities, or network domains.

An NNI often carries many tagged VLANs and therefore requires especially careful allowed-VLAN lists, documentation, capacity planning, and change control.

VLANs in Data Centers and Hosting Networks

Data centers use VLANs to separate tenants, servers, storage, management, live migration, backup systems, public internet traffic, and out-of-band interfaces. A single rack switch may connect servers belonging to many customers and many internal service zones.

Example Hosting Provider VLAN Plan

Hypervisor Trunks

A hypervisor host often connects to a switch using a trunk. Virtual switches or Linux bridges assign individual virtual-machine interfaces to different VLANs. The physical switch sees one server port carrying many tenant or service networks.

Physical switch trunk
        |
        | VLANs 110,120,210,211,212
        |
+----------------------------+
| Hypervisor                  |
|                            |
| vmbr0 / vSwitch            |
|  + VM-A on VLAN 210        |
|  + VM-B on VLAN 211        |
|  + VM-C on VLAN 212        |
|                            |
| Management on VLAN 110     |
+----------------------------+

Only required VLANs should be permitted to each host. A provisioning system should update the switch, hypervisor, IP address management platform, and customer records together to avoid configuration drift.

Linux VLAN Subinterfaces

# Create VLAN 210 on interface eno1
ip link add link eno1 name eno1.210 type vlan id 210
ip address add 192.0.2.10/24 dev eno1.210
ip link set eno1 up
ip link set eno1.210 up

# Verify the VLAN interface
ip -d link show eno1.210

Private VLANs in Shared Server Networks

A private VLAN divides one primary VLAN into secondary VLANs:

• Promiscuous port: Can communicate with all ports, commonly used for a gateway, firewall, or shared service.
• Isolated port: Can communicate with promiscuous ports but not other isolated ports.
• Community port: Can communicate with members of the same community and promiscuous ports.

This is useful when many servers share one IP subnet but should not communicate directly. Private VLANs are not a replacement for host firewalls, hypervisor security, or routed tenant isolation, but they provide an additional Layer 2 control.

VLANs, MLAG, and Dual-Homed Servers

Servers are often connected to two top-of-rack switches using LACP and a multi-chassis link aggregation technology such as MLAG or vPC. The required VLANs must exist and be permitted consistently across both switches, the peer link, and the server-facing port channel.

Why Data Centers Move Beyond Traditional VLANs

A traditional VLAN identifier supports only about four thousand Layer 2 segments and often depends on spanning tree. Large multi-tenant environments may instead use a routed leaf-spine underlay with VXLAN and EVPN. VLANs can still exist at the server edge, but they are mapped to larger VXLAN Network Identifiers for transport across the fabric.

Advanced VLAN Technologies

VXLAN

VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets so the logical network can cross a routed Layer 3 fabric. A VXLAN Network Identifier, or VNI, is 24 bits and supports far more segments than the 12-bit VLAN field.

Server VLAN 210     Leaf switch       Routed IP fabric       Leaf switch     Server VLAN 210
+------------+      +----------+      +--------------+       +----------+    +------------+
| Workload A |------| VLAN 210 |=====>| VXLAN VNI    |======>| VLAN 210 |----| Workload B |
+------------+      | VNI 10210|      | 10210        |       | VNI 10210|    +------------+
                    +----------+      +--------------+       +----------+

EVPN is commonly used as the control plane to advertise MAC addresses, IP addresses, and reachability between VXLAN tunnel endpoints. This reduces dependence on flood-and-learn behavior and supports distributed anycast gateways.

VLAN-to-VNI Mapping

Local VLAN numbers may be reused in different racks or sites as long as the fabric maps them to the correct VNI and tenant routing instance.

VRFs and VLANs

A VLAN separates Layer 2 traffic, while a Virtual Routing and Forwarding instance separates Layer 3 routing tables. Providers and data centers commonly combine the two:

• VLAN 210 is attached to Customer A's VRF.
• VLAN 310 is attached to Customer B's VRF.
• Both customers may use overlapping private IP space because their routing tables are separate.

Stretched VLANs

A stretched VLAN exists across multiple switches, rooms, buildings, or data centers. It may be needed for a legacy clustering requirement or live migration, but it extends the Layer 2 failure domain.

Before stretching a VLAN, ask:

• Does the application truly require Layer 2 adjacency?
• How will loops and broadcast storms be contained?
• Where is the default gateway?
• What happens when the inter-site link fails?
• Will traffic take an inefficient path to reach the active gateway or firewall?
• Can the application use Layer 3 redundancy instead?

VLAN Translation and Rewriting

Advanced switches can translate one VLAN ID to another, add or remove outer tags, and selectively rewrite tags based on an interface or service instance. These functions are common at provider demarcation points and when joining independently managed networks.

Protocol-Based and MAC-Based Assignment

Some platforms can classify frames into VLANs using protocol, MAC address, authentication result, or policy. These features are useful in specialized environments but should be automated and documented carefully because the VLAN is no longer obvious from the physical port configuration alone.

VLAN Security and Layer 2 Protections

VLAN segmentation helps create control points, but Layer 2 attacks and configuration mistakes can bypass the intended design. Security must be applied to switch ports, trunks, gateways, and endpoints.

Common Risks

Secure Access Port Template

interface GigabitEthernet1/0/10
 description User access port
 switchport mode access
 switchport access vlan 10
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
 storm-control broadcast level 1.00 0.50
 storm-control multicast level 1.00 0.50
 ip dhcp snooping limit rate 20

DHCP Snooping and Dynamic ARP Inspection

ip dhcp snooping
ip dhcp snooping vlan 10,20,30
ip arp inspection vlan 10,20,30

interface TenGigabitEthernet1/1/1
 description Trusted uplink toward DHCP server
 ip dhcp snooping trust
 ip arp inspection trust

These features depend on correct trusted-port design and platform behavior. Test them before broad deployment, especially in networks using static addresses, DHCP relays, virtualization, or unusual Layer 2 paths.

Unused Ports

Move unused ports to a dedicated unused VLAN, configure them as access ports, disable negotiation, and administratively shut them down.

vlan 998
 name PARKING-LOT

interface range GigabitEthernet1/0/20-48
 switchport mode access
 switchport access vlan 998
 switchport nonegotiate
 shutdown

VLAN Design, Naming, and Documentation

Good VLAN design is predictable. A VLAN should exist because it represents a meaningful security boundary, operational function, tenant, service, or failure domain—not simply because another VLAN number is available.

Design Questions

• What devices belong in the VLAN?
• Which locations and trunks must carry it?
• What IPv4 and IPv6 prefixes are assigned?
• Where is the default gateway?
• Which firewall zone or VRF contains it?
• Which systems may initiate connections into or out of it?
• Which DHCP, DNS, NTP, logging, and authentication services are required?
• Who owns the VLAN and approves changes?
• What monitoring and capacity thresholds apply?
• When should it be retired?

Numbering Strategies

A consistent numbering strategy can make troubleshooting easier. Examples include:

• By function: 100-series for users, 200-series for servers, 300-series for storage, and 900-series for management.
• By site: The first digit or digits identify the facility, and the remaining digits identify the purpose.
• By customer: Allocate a documented range to each tenant or customer.
• By service: Assign VLANs from controlled pools for transit, internet, private WAN, management, and transport services.

Do not encode so much information into the VLAN number that renumbering becomes unavoidable whenever the network changes. The authoritative source should be an IP address management or source-of-truth system, not human memory.

Minimum Documentation Record

Keep Layer 2 Boundaries Intentional

• Keep VLANs local to the switches and locations that need them.
• Prefer routing over unnecessarily large Layer 2 domains.
• Use explicit allowed-VLAN lists on trunks.
• Do not reuse a VLAN number for unrelated purposes inside the same operational domain.
• Remove old VLANs from access ports, trunks, gateways, DHCP, monitoring, and documentation.
• Automate repetitive provisioning and validate the final state.

Troubleshooting VLAN Problems

VLAN failures often come from an incomplete configuration. A VLAN may exist on one switch but not another, be missing from an allowed list, use the wrong native VLAN, have no active gateway, or be mapped incorrectly on a hypervisor.

Recommended Troubleshooting Order

1. Identify the source device, destination device, VLAN, subnet, and expected path.
2. Verify physical link state, speed, duplex, errors, and port-channel membership.
3. Confirm the access port is assigned to the intended VLAN.
4. Confirm the VLAN exists and is active on every required switch.
5. Verify each trunk allows the VLAN and uses the expected tagging and native VLAN.
6. Check the MAC address table to see where the source and destination are learned.
7. Check spanning-tree state for blocked, inconsistent, or unstable ports.
8. Verify the SVI or routed subinterface is up and has the correct address.
9. Check ARP or neighbor-discovery entries at the gateway.
10. Review ACLs, firewall rules, DHCP snooping, DAI, port security, and host firewalls.
11. Capture traffic at the source, trunk, gateway, or destination when the path remains unclear.

Useful Cisco Commands

show vlan brief
show interfaces switchport
show interfaces trunk
show interfaces status
show interfaces counters errors
show etherchannel summary
show mac address-table vlan 210
show spanning-tree vlan 210
show ip interface brief | include Vlan
show ip arp vlan 210
show ip route 192.0.2.0
show access-lists
show ip dhcp snooping
show ip arp inspection
show port-security interface GigabitEthernet1/0/10

Useful Linux Commands

ip -d link show
ip address show
bridge vlan show
bridge link show
bridge fdb show
ip route show
ip neigh show
ethtool eno1
tcpdump -eni eno1 vlan 210

Common Symptoms

Check the Entire Service, Not Just the VLAN

In a production environment, a VLAN is usually one part of a larger service. A complete validation should include:

• Physical interface and optics
• Access or trunk configuration
• VLAN existence and propagation
• Port channel and spanning tree
• Gateway, VRF, and routing
• DHCP, DNS, and address management
• Firewall and anti-spoofing policy
• Monitoring, logging, and documentation

Practice Lab: Build a Small Multi-VLAN Network

This lab can be built in Cisco Packet Tracer, GNS3, EVE-NG, or with two managed switches and a router or Layer 3 switch.

Goal

• VLAN 10 for users
• VLAN 20 for servers
• VLAN 30 for guests
• A trunk between two switches
• Inter-VLAN routing
• A policy that allows users to reach one web server but prevents guests from reaching internal networks

Suggested Addressing

Validation Tests

1. Confirm devices in the same VLAN communicate across both switches.
2. Confirm each device receives the correct address and default gateway.
3. Verify the switch MAC tables learn endpoints in the correct VLAN.
4. Confirm users can reach the approved server service.
5. Confirm guests can reach the internet simulation but not VLANs 10 or 20.
6. Remove VLAN 20 from the trunk, observe the failure, and restore it.
7. Create a native-VLAN mismatch, review switch warnings, and correct it.
8. Shut one port-channel member and confirm traffic remains available.

Final Perspective

VLANs begin as a simple method of dividing a switch, but their real value appears when they are combined with routing, security policy, redundancy, automation, and accurate documentation. An enterprise uses VLANs to separate users, phones, guests, and infrastructure. An ISP uses them to deliver and transport customer services. A data center uses them to isolate tenants, connect hypervisors, separate storage and management, and map local Ethernet segments into larger VXLAN and EVPN fabrics.

The goal is not to create as many VLANs as possible. The goal is to create clear, intentional boundaries that make the network safer, easier to operate, and easier to troubleshoot.