Questions? Call 1.800.716.8955

Chapter 12

VLANs and Trunking

Exam topics covered

2.1 Configure and verify VLANs (normal range) spanning multiple switches: 2.1.a Access

ports (data and voice); 2.1.b Default VLAN; 2.1.c InterVLAN connectivity

2.2 Configure and verify interswitch connectivity: 2.2.a Trunk ports; 2.2.b 802.1Q; 2.2.c Native VLAN

Foundation. A switch fresh out of the box puts every port into one big Layer 2 network: every broadcast reaches every device, and anyone plugged into any port can talk directly to anyone else. That is fine for a home office, but not for a building with hundreds of users, IP phones, printers, cameras and servers. Virtual LANs (VLANs) let you carve one physical switched network into several logical ones, each its own broadcast domain and, normally, its own IP subnet. Trunks then carry many VLANs across a single link between switches, using the IEEE 802.1Q tag to keep frames separated. This chapter covers creating VLANs, access and voice ports, 802.1Q trunks and the native VLAN, DTP and VTP, and verification and troubleshooting: the foundation for everything else in Part II.

12.1 Why VLANs?

Recall from Chapter 4 that a switch floods broadcast frames (destination FFFF.FFFF.FFFF ) and unknown unicast frames out of every port except the one the frame arrived on. The set of devices that receive one another's broadcasts is a broadcast domain. Without VLANs, a switch, and every switch connected to it, forms a single broadcast domain. Routers do not forward broadcasts, so each router interface ends a broadcast domain.

A VLAN is a group of switch ports (and the devices attached to them) that the switch treats as a separate broadcast domain. The switch keeps a separate MAC address table per VLAN and never forwards a frame received in one VLAN out of a port in another VLAN. To the attached hosts, a VLAN behaves exactly like an independent physical switch.

  • Without VLANs With VLANs 10 and 20
  • SW1 SW1
  • A B C D A B C D

One broadcast domain: A's broadcast reaches B, C and D VLAN 10 (Sales) VLAN 20 (Eng) Blue lines = ports that receive A's broadcast A's broadcast reaches only B; C and D never see it

Figure 12-1 One switch, one broadcast domain (left) versus the same switch divided into two VLANs (right).

Dividing a LAN into VLANs gives several concrete benefits:

Smaller broadcast domains. ARP requests, DHCP discovers and other broadcasts reach only the hosts in the same VLAN, reducing wasted bandwidth and host CPU.

Security and segmentation. Hosts in different VLANs cannot exchange frames directly. Traffic between VLANs must pass through a router or Layer 3 switch, where you can filter it with ACLs or a firewall.

Separation of traffic types. Voice, data, wireless guests, management and IoT devices can each live in their own VLAN with its own QoS and security policy.

Because each VLAN is a separate broadcast domain, the design rule is simple: one VLAN = one IP subnet. Hosts in VLAN 10 might use 10.1.10.0/24 and hosts in VLAN 20 might use 10.1.20.0/24, each with its own default gateway.

VLANs are not limited to one switch. In a real campus a VLAN spans many access switches, connected by trunk links that carry traffic for all VLANs. Figure 12-2 shows the idea: PCs in VLAN 10 on two different switches are in the same broadcast domain and subnet, even though their traffic crosses an inter-switch link that also carries VLAN 20.

  • 802.1Q trunk (VLANs 10, 20)
  • Gi0/1 Gi0/1
  • VLAN 10 VLAN 10 VLAN 20 VLAN 10 VLAN 20 VLAN 20

10.1.10.11 10.1.10.12 10.1.20.11 10.1.10.13 10.1.20.12 10.1.20.13 VLAN 10 access port VLAN 20 access port

Figure 12-2 VLANs 10 and 20 span two switches; the trunk between them carries both.

12.2 VLAN IDs, Ranges and the Default VLAN

A VLAN is identified by a 12-bit VLAN ID (VID), giving values 0 through 4095. Two values are reserved by the 802.1Q standard, and Cisco further divides the usable IDs into ranges with different behaviour, as Table 12-1 shows.

Table 12-1 VLAN ID ranges on Cisco Catalyst switches

VLAN ID Range Notes

0, 4095 Reserved Reserved by 802.1Q; never usable. A VID of 0 in a tag means "priority tag only, no VLAN".

1 Normal

(default)

The default VLAN. All ports belong to it out of the box. Cannot be renamed or deleted. Default native VLAN on trunks.

2–1001 Normal Freely created, named and deleted. Stored in vlan.dat in flash. Propagated by VTP versions 1, 2 and 3.

  • 1002–
  • 1005
  • Normal
  • (reserved)

Created automatically for legacy Token Ring and FDDI ( fddi-default , token-ring-default , fddinet-default , trnet-default ). Cannot be deleted.

1006–

4094

Extended Supported on modern switches. Historically required VTP transparent mode (or VTP off/v3); stored in the running/startup config rather than only in vlan.dat .

VLAN 1 deserves special attention. It is the default VLAN: every switch port is an access port in VLAN 1 until you change it. It is also the default native VLAN on trunks (Section 12.5.2), and on older switches control-plane protocols such as CDP, VTP, PAgP and DTP are sent in VLAN 1. You cannot delete VLAN 1, but you can, and should, stop using it for user traffic. Best practice is to move every in-use port into a purpose-built VLAN, put unused ports in an otherwise unused "parking" VLAN and shut them down, and choose a dedicated, unused VLAN as the native VLAN on trunks.

Know the numbers: 12-bit VID, 4094 usable VLANs (1–4094), normal range 1–1005, extended range 1006–4094, VLANs 1 and 1002–1005 cannot be deleted. The CCNA blueprint specifically says normal range VLANs, and it calls VLAN 1 the default VLAN. Do not confuse the default VLAN (where ports start, always VLAN 1) with the native VLAN (sent untagged on a trunk, configurable) or the management VLAN (whichever VLAN holds the switch's own SVI address, such as interface vlan 99 ).

12.3 Creating VLANs and Assigning Access Ports

An access port belongs to exactly one data VLAN. It sends and receives normal, untagged Ethernet frames, so the attached PC, printer or server has no idea VLANs exist. Configuring access VLANs is a two-step job: create the VLAN (optionally naming it), then assign ports to it.

12.3.1 Creating and naming VLANs

Use the global vlan command to create a VLAN and enter VLAN configuration mode, where you can give it a name. Names are optional but make show output much easier to read; if you skip the name, IOS uses VLAN0010 -style names.

SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name ENGINEERING
SW1(config-vlan)# vlan 30
SW1(config-vlan)# name VOICE
SW1(config-vlan)# vlan 99
SW1(config-vlan)# name NATIVE-UNUSED
SW1(config-vlan)# vlan 999
SW1(config-vlan)# name PARKING

Note that the VLAN is created as soon as you press Enter on vlan 10 ; on most current IOS releases the change is committed when you leave VLAN configuration mode. Deleting a VLAN uses no vlan 10 . Be careful: ports assigned to a deleted VLAN stay assigned to it and become inactive (they stop forwarding), and they disappear from the show vlan brief output until you either re-create the VLAN or move the ports.

12.3.2 Assigning access ports

On the interface, two commands do the work: switchport mode access hard-codes the port as an access port (disabling trunk negotiation), and switchport access vlan chooses the VLAN. You can use interface range to configure several ports at once.

SW1(config)# interface range gigabitethernet0/2 - 6
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config)# interface range gigabitethernet0/7 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 20
SW1(config)# interface range gigabitethernet0/13 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 999 ! park unused ports
SW1(config-if-range)# shutdown

12.3.3 Verifying VLANs with show vlan brief

The most-used verification command is show vlan brief . It lists every VLAN the switch knows, its name, its status, and the access ports assigned to it. Figure 12-3 shows SW1 after the configuration above. (All terminal output in this chapter is illustrative of Cisco IOS 15.x / IOS XE; minor formatting differs between platforms and releases.)

SW1 — console

SW1# show vlan brief

VLAN Name Status Ports

---- -------------------------------- --------- ------------------------------- 1 default active

Figure 12-3 show vlan brief lists VLANs and their access ports. Gi0/1 is missing because it is a trunk.

Three details in Figure 12-3 trip up many candidates. First, trunk ports are not listed: Gi0/1 is a trunk to SW2, so it appears in show interfaces trunk instead. Second, VLAN 1 now has no ports, but it still exists and still shows active . Third, VLAN 30 shows no ports even though we will soon use it as a voice VLAN; voice VLAN ports appear in show vlan brief only on some platforms, so always verify voice with show interfaces switchport .

12.4 Voice VLANs and IP Phones

Most enterprise desks have an IP phone with a built-in three-port switch: one port uplinks to the access switch, one connects to the phone's own electronics, and one (labelled PC) connects the user's computer. Voice traffic should still be separated from data so it gets its own subnet, policy and QoS priority.

The solution is the voice VLAN (Cisco also calls it the auxiliary VLAN). The switch port stays an access port for the PC's data VLAN, but you also configure a second VLAN for voice. The switch tells the phone which VLAN to use for voice through CDP (or LLDP-MED, Chapter 14). The phone then sends its voice frames tagged with an 802.1Q header carrying the voice VLAN ID and a CoS priority value, while it passes the PC's frames through untagged in the data

Vlan.

Figure 12-4 A voice VLAN: the phone tags voice frames (VLAN 30) and forwards PC frames untagged (VLAN 10).

The configuration adds a single command to the access port. Many designs also trust the phone's QoS markings (Chapter 27) and enable PortFast; those commands are shown for completeness.

SW1(config)# interface gigabitethernet0/5
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10 ! data VLAN for the PC
SW1(config-if)# switchport voice vlan 30 ! voice VLAN for the phone
SW1(config-if)# spanning-tree portfast ! optional; covered in Chapter 16

Cisco calls this a multi-VLAN access port: it is still an access port, carrying only the access VLAN untagged plus the voice VLAN tagged. Figure 12-5 shows how to verify it.

SW1# show interfaces gigabitethernet0/5 switchport
  • Name: Gi0/5
  • Switchport: Enabled
  • Administrative Mode: static access
  • Operational Mode: static access
  • Administrative Trunking Encapsulation: dot1q
  • Operational Trunking Encapsulation: native
  • Negotiation of Trunking: Off
  • Access Mode VLAN: 10 (SALES)
  • Trunking Native Mode VLAN: 1 (default)
  • Administrative Native VLAN tagging: enabled
  • Voice VLAN: 30 (VOICE)

... output truncated ...

Figure 12-5 An access port with data VLAN 10 and voice VLAN 30.

Exam alert

Blueprint item 2.1.a says "access ports (data and voice)". Expect a question showing switchport access vlan plus switchport voice vlan and asking which frames are tagged. Answer: only the voice frames from the phone, using the voice VLAN ID; the PC's data frames are untagged in the access VLAN.

12.5 Trunking and IEEE 802.1Q

When VLANs span multiple switches, the switches must exchange frames from several VLANs. One option is a separate link per VLAN, which scales terribly: ten VLANs would need ten cables and twenty switch ports between each pair of switches. Instead, switches use a trunk: a single link that carries frames from many VLANs, with each frame marked to show which VLAN it belongs to. Marking a frame this way is called VLAN tagging; on an 802.1Q trunk every VLAN is tagged except one, the native VLAN.

Cisco's proprietary ISL (Inter-Switch Link) encapsulated the whole frame in a 26-byte header plus 4-byte trailer; it is obsolete. The IEEE standard 802.1Q (dot1q) inserts a small tag into the existing frame and is what you will configure.

12.5.1 The 802.1Q tag

802.1Q inserts a 4-byte (32-bit) tag into the Ethernet header, between the source MAC address and the original EtherType/Length field. Because the frame contents change, the sending switch recalculates the frame check sequence (FCS). A maximum-size tagged frame is therefore 1522 bytes rather than 1518. The receiving switch reads the VLAN ID, removes the tag, and forwards the original frame in that VLAN. End hosts on access ports therefore never see tags. Figure 12-6 shows the fields.

Pcp

3 bits

Dei

1 bit

Vid

12 bits (0–4095)

Tag Protocol Identifier: "this frame is tagged" Tag Control Information (TCI) = PCP + DEI + VID

Figure 12-6 The 802.1Q tag is inserted after the source MAC address; the FCS is recalculated.

The TPID (Tag Protocol Identifier) is always 0x8100 ; it sits where the EtherType normally is, so a receiver immediately knows the frame is tagged. The remaining 16 bits, the Tag Control Information, hold the 3-bit PCP (Priority Code Point, the 802.1p Class of Service value 0–7; IP phones mark voice CoS 5), the 1-bit DEI (Drop Eligible Indicator, formerly CFI) and the 12-bit

Vid.

12.5.2 The native VLAN

802.1Q defines one VLAN per trunk whose frames are sent untagged: the native VLAN. When a switch receives an untagged frame on a trunk, it assigns the frame to the trunk's native VLAN. The native VLAN existed so that 802.1Q trunks could interoperate with devices that did not understand tags (for example, a hub in the middle of a link). On Cisco switches the native VLAN is VLAN 1 by default and is configured per trunk with switchport trunk native vlan .

The native VLAN must match on both ends of a trunk. If SW1 uses native VLAN 99 and SW2 uses native VLAN 1, an untagged frame that SW1 sends from VLAN 99 is placed into VLAN 1 by SW2: traffic silently leaks between VLANs. Section 12.9 shows how to detect this. Security best practice is to set the native VLAN to an unused VLAN that carries no user traffic (VLAN 99 in this chapter), which also helps defend against VLAN-hopping "double-tagging" attacks (Chapter 31). Some platforms can even tag native VLAN traffic with the global command vlan dot1q tag native .

12.6 Configuring Trunks and DTP

12.6.1 Static trunk configuration

Best practice is to configure trunks statically on both ends and disable negotiation. Switches that support both ISL and 802.1Q (such as the Catalyst 3560) need switchport trunk encapsulation dot1q before they accept switchport mode trunk ; dot1q-only switches (2960, 9200, 9300) do not have that command.

SW1(config)# interface gigabitethernet0/1
SW1(config-if)# description Trunk to SW2 Gi0/1
SW1(config-if)# switchport trunk encapsulation dot1q ! only on ISL-capable switches
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99
SW1(config-if)# switchport nonegotiate ! stop sending DTP

By default a trunk allows all VLANs, 1–4094. The switchport trunk allowed vlan command restricts that list, which limits where broadcasts travel and reduces the scope of a misconfiguration. It has several forms, and the difference between them is a classic exam and real-world trap:

Table 12-2 Forms of the switchport trunk allowed vlan command

Command Effect

switchport trunk allowed vlan 10,20 Replaces the entire list with exactly 10 and 20. switchport trunk allowed vlan add 30 Adds VLAN 30 to the existing list.

switchport trunk allowed vlan remove

Removes VLAN 20 from the existing list.

switchport trunk allowed vlan except

1002-1005

Allows all VLANs except those listed.

switchport trunk allowed vlan all Restores the default (all VLANs).

switchport trunk allowed vlan none Allows no VLANs; the link stays a trunk but carries no VLAN traffic.

Watch out

Forgetting the keyword add is one of the most common outage-causing mistakes in campus networks. If a trunk allows 10,20,30,99 and you type switchport trunk allowed vlan 40 , the trunk now carries only VLAN 40, and every user in VLANs 10, 20 and 30 on the far switch loses connectivity.

12.6.2 Dynamic Trunking Protocol (DTP)

Cisco switches can negotiate whether a link becomes a trunk using the proprietary Dynamic Trunking Protocol. DTP messages are sent every 30 seconds on ports in the dynamic modes and on static trunks unless nonegotiate is configured. The administrative mode of a port is set with switchport mode :

Table 12-3 Switchport administrative modes

Mode Behaviour

access Always an access port. Does not negotiate (does not send DTP) and will not become a trunk.

trunk Always a trunk. Sends DTP to encourage the neighbor to trunk, unless switchport nonegotiate is configured.

dynamic desirable Actively tries to trunk: sends DTP and becomes a trunk if the neighbor is trunk , desirable or auto .

dynamic auto Passive: becomes a trunk only if the neighbor actively asks ( trunk or desirable ). Default on most current Catalyst switches.

switchport

nonegotiate

Not a mode but an option for access or trunk ports: suppresses DTP frames entirely.

Table 12-4 is the outcome matrix. Memorize it: the key insight is that two passive ( auto ) ports

never form a trunk, and that a static trunk facing a static access port produces a broken, mismatched link.

Table 12-4 DTP outcome matrix (operational mode of the link)

  • SW1 \ SW2 access dynamic auto dynamic desirable trunk
  • access Access Access Access Mismatch (avoid)
  • dynamic auto Access Access Trunk Trunk
  • dynamic desirable Access Trunk Trunk Trunk
  • trunk Mismatch (avoid) Trunk Trunk Trunk

Remember also that trunk with nonegotiate sends no DTP, so it forms a working trunk only if the other side is also statically trunk . A dynamic auto or dynamic desirable neighbor never hears a DTP message and stays an access port, leaving a mismatch.

Exam alert

Classic question: "Two new switches are connected with default settings. Will a trunk form?" On switches whose ports default to dynamic auto , the answer is no: auto + auto = access. Security guidance (and the exam) recommends disabling DTP: use switchport mode access on edge ports and switchport mode trunk plus switchport nonegotiate on trunks, because an attacker who plugs in a device that speaks DTP could otherwise negotiate a trunk and reach every VLAN.

12.6.3 Verifying trunks

The primary command is show interfaces trunk . It lists only ports that are currently operating as trunks, in four sections that each narrow the VLAN list further. Figure 12-7 shows SW1's output.

SW1# show interfaces trunk
  • Port Mode Encapsulation Status Native vlan
  • Gi0/1 on 802.1q trunking 99
  • Port Vlans allowed on trunk
  • Gi0/1 10,20,30,99
  • Port Vlans allowed and active in management domain
  • Gi0/1 10,20,30,99
  • Port Vlans in spanning tree forwarding state and not pruned
  • Gi0/1 10,20,30,99

Figure 12-7 show interfaces trunk : mode, encapsulation, status, native VLAN and three VLAN lists.

Read the sections in order. Mode is on for a static trunk (or desirable / auto if negotiated). The three VLAN lists narrow progressively: the configured allowed list; those that also exist and are active on this switch; and those not blocked by STP or pruned by VTP. A VLAN must appear in the last list for traffic to flow.

For a per-port view, show interfaces gigabitethernet0/1 switchport shows both the configured (administrative) and actual (operational) modes, the negotiation state and the native VLAN, as in Figure 12-8.

SW1 — console

SW1# show interfaces g0/1 switchport

... private-vlan lines omitted ...

Figure 12-8 Per-port detail: administrative versus operational mode, negotiation off, native VLAN 99.

Two lines matter most. Administrative Mode is what you configured ( static access , trunk , dynamic auto or dynamic desirable ). Operational Mode is what the port is actually doing right now ( static access , trunk , or down if the link is down). Administrative dynamic auto with operational static access is the tell-tale sign that an expected trunk never formed. Negotiation of Trunking: Off confirms that nonegotiate is in effect.

12.7 VLAN Trunking Protocol (VTP) in Brief

Creating the same VLANs on fifty switches is tedious, so Cisco created VTP, a proprietary protocol that advertises the VLAN database (VLAN IDs and names) over trunk links to every switch in the same VTP domain. VTP is no longer an explicit CCNA exam topic, but you will meet it in the field and in show output, so you should know the basics and why most engineers disable it.

A server (the default mode) can create and change VLANs and originates advertisements; a client cannot change VLANs but learns them from advertisements; a transparent switch keeps its own local VLANs and only relays advertisements; VTPv3 adds an off mode that neither uses nor relays them.

Every change on a server increments the domain's configuration revision number, and switches adopt any advertisement with a higher revision than their own. That is the root of VTP's danger: if someone connects a lab switch that has the same domain name, a higher revision number and a nearly empty VLAN database, it can overwrite the VLAN database of every server and client in the domain, deleting production VLANs and leaving thousands of access ports inactive. VTP version 3 adds protections (a single primary server that must be explicitly promoted), and VTP pruning can stop flooding of unneeded VLANs over trunks, but many organizations simply run vtp mode transparent (or vtp mode off ) everywhere and manage VLANs through automation instead. Check the settings with show vtp status . Before connecting a used switch to production, set it to transparent mode (which resets its revision to

  • 0) or change its domain name.

12.8 InterVLAN Connectivity Overview

Because each VLAN is a separate broadcast domain and subnet, a PC in VLAN 10 cannot reach a PC in VLAN 20 through the switch alone, even if both are plugged into the same switch. A Layer 3 device must route between them, and each host must use that device's address in its VLAN as its default gateway. Figure 12-9 shows the logical picture; Chapter 13 covers the three ways to build it in detail.

  • R1
  • G0/0.10 = 10.1.10.1
  • G0/0.20 = 10.1.20.1
  • 802.1Q trunk

Sw1 vlan 10 pc

10.1.10.11

GW 10.1.10.1

Vlan 20 pc

10.1.20.11

GW 10.1.20.1

Figure 12-9 Traffic between VLANs goes up to a router (here on a trunk) and back down. The three options you need to know are:

Router on a stick (ROAS): one router interface, configured as an 802.1Q trunk with one subinterface per VLAN.

Layer 3 switch with SVIs: the switch itself routes, using a switched virtual interface ( interface vlan 10 ) per VLAN as the gateway. This is the standard design in modern campuses.

Routed ports: a Layer 3 switch port configured with no switchport , used for point-to-point links to routers or other Layer 3 switches.

12.9 Troubleshooting VLANs and Trunks

When two hosts in the same VLAN on different switches cannot communicate, work from the access ports to the trunk: is each port in the right VLAN ( show vlan brief , show interfaces switchport )? Does the VLAN exist on every switch (ports in a missing VLAN are inactive)? Is the link actually trunking ( show interfaces trunk )? Is the VLAN allowed, active and forwarding on both ends? Do the native VLANs match? The two trunk problems the exam likes best follow.

12.9.1 Native VLAN mismatch

Suppose SW1's trunk uses native VLAN 99 but SW2 was left at the default, VLAN 1. The trunk still comes up, and tagged VLANs work normally, so the problem is easy to miss. However, untagged frames that SW1 sends from VLAN 99 arrive at SW2 in VLAN 1, and vice versa. Two Cisco mechanisms detect this. CDP advertises the native VLAN in every message and logs a mismatch, and per-VLAN spanning tree (PVST+) detects the inconsistency and blocks the port for the affected VLANs, as Figure 12-10 shows.

SW1 — console

*Mar 1 00:12:41.512: %CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/1 (99), with SW2 GigabitEthernet0/1 (1).

*Mar 1 00:12:43.118: %SPANTREE-2-RECV_PVID_ERR: Received BPDU with inconsistent peer vlan id 1 on GigabitEthernet0/1 VLAN99.

*Mar 1 00:12:43.118: %SPANTREE-2-BLOCK_PVID_PEER: Blocking GigabitEthernet0/1 on VLAN0001. Inconsistent peer vlan.

*Mar 1 00:12:43.118: %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0099. Inconsistent local vlan.

SW1# show interfaces trunk | include Gi0/1
  • Gi0/1 on 802.1q trunking 99
  • Gi0/1 10,20,30,99
  • Gi0/1 10,20,30,99
  • Gi0/1 10,20,30
SW2# show interfaces trunk | include Gi0/1

Gi0/1 on 802.1q trunking 1

Figure 12-10 Detecting a native VLAN mismatch: CDP and STP log messages, then comparing both ends.

The fix is to make the native VLAN identical on both ends, normally by configuring switchport trunk native vlan 99 on SW2's Gi0/1. Note that the native VLAN does not even need to be in the allowed list for the trunk to function, but it must be consistent.

12.9.2 Allowed-list problems

The second classic problem is a VLAN missing from the trunk on one side. In Figure 12-11, every user on SW2 lost connectivity to SW1 the moment an engineer tried to add VLAN 40 to the trunk.

Figure 12-11 An allowed-list mismatch: a missing add keyword replaced SW2's list.

The diagnosis is straightforward with show interfaces trunk on both switches: compare the "Vlans allowed on trunk" lines. A trunk forwards a VLAN only if both ends allow it. Then look at the last section ("forwarding state and not pruned") to confirm the VLAN is actually flowing. Fix the list with the add keyword:

SW2(config)# interface gigabitethernet0/1
SW2(config-if)# switchport trunk allowed vlan 10,20,30,99 ! restore the full list
SW2(config-if)# switchport trunk allowed vlan add 40 ! then add the new VLAN correctly

Other trunk faults: access facing trunk (link up, but tagged frames are mishandled), dynamic auto on both ends (silently an access link), and a VLAN allowed but never created on the far switch (absent from the "allowed and active" list).

LAB Build VLANs and an 802.1Q trunk between two switches

Goal: Create VLANs 10 (SALES), 20 (ENGINEERING), 30 (VOICE) and 99 (NATIVE-UNUSED) on two switches, assign access and voice ports, build a static 802.1Q trunk with native VLAN 99 and DTP disabled, and verify that hosts in the same VLAN can reach each other across the trunk while hosts in different VLANs cannot.

  • Gi0/1 — trunk, native 99 — Gi0/1
  • Gi0/2 Gi0/5
  • Gi0/2
  • Gi0/7

Pc1 vlan 10

  • 10.1.10.11/24
  • Phone V30 PC2 V10
  • 10.1.10.12/24

Pc3 vlan 10

10.1.10.13/24

Pc4 vlan 20

10.1.20.14/24

Figure 12-12 Lab topology: two switches, one trunk, data and voice access ports. Steps:

  • 1. On both switches, create and name the VLANs: the same vlan / name commands shown in Section 12.3.1 (VLAN 999 is optional).
  • 2. On SW1, make Gi0/2 a VLAN 10 access port, and Gi0/5 an access port in VLAN 10 with switchport voice vlan 30 .
  • 3. On SW2, put Gi0/2 in VLAN 10 and Gi0/7 in VLAN 20 with switchport mode access and switchport access vlan .
  • 4. On both switches, configure Gi0/1 identically with switchport mode trunk , switchport trunk native vlan 99 , switchport trunk allowed vlan 10,20,30,99 and switchport nonegotiate (add switchport trunk encapsulation dot1q first if the switch requires it).
  • 5. Configure IP addresses on the PCs as shown in Figure 12-12 (no default gateway is needed for this lab).

Verify: Run show interfaces trunk on both switches (expect status trunking , native VLAN 99, and VLANs 10,20,30,99 in all three lists), show vlan brief (expect Gi0/2 in VLAN 10, and no Gi0/1 listed), and show interfaces g0/5 switchport on SW1 (expect Access Mode VLAN 10 and Voice VLAN 30). Then test from PC1:

PC1 — command prompt

C:\> ping 10.1.10.13
  • Pinging 10.1.10.13 with 32 bytes of data:
  • Reply from 10.1.10.13: bytes=32 time=1ms TTL=128
  • Reply from 10.1.10.13: bytes=32 time<1ms TTL=128
  • Ping statistics for 10.1.10.13:
  • Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
C:\> ping 10.1.20.14

PING: transmit failed. General failure.

Figure 12-13 Same-VLAN ping across the trunk succeeds; the VLAN 20 host is unreachable without a router.

Expected results: PC1 reaches PC2 (same switch, same VLAN) and PC3 (different switch, same VLAN, across the trunk). PC1 cannot reach PC4 because it is in a different VLAN and subnet with no router; you will fix that in the Chapter 13 lab. Optionally, set SW2's native VLAN to 1 and watch for %CDP-4-NATIVE_VLAN_MISMATCH , then restore it. Chapter review

Key terms

Vlan

Ieee 802.1q

Isl

  • PCP / CoS
  • VLAN ID (VID)
  • allowed VLAN list

Dtp

  • dynamic auto
  • dynamic desirable
  • nonegotiate

Vtp

native VLAN mismatch

Review questions

  • 1. How many bits are in the 802.1Q VLAN ID field?
  • A. 8
  • B. 10
  • C. 12
  • D. 16
  • 2. Which VLAN IDs make up the normal range on a Cisco Catalyst switch?
  • A. 0–1023
  • B. 1–1005
  • C. 1–4094
  • D. 1006–4094
  • 3. An engineer configures switchport mode access , switchport access vlan 10 and switchport voice vlan 30 on a port connected to an IP phone with a PC behind it. Which statement is true?
  • A. All frames on the link are tagged.
  • B. The PC's frames are tagged with VLAN 10.
  • C. The phone's voice frames are tagged with VLAN 30 and the PC's frames are untagged.
  • D. The port operates as an 802.1Q trunk allowing all VLANs.
  • 4. Two switches are connected. SW1's port is dynamic auto and SW2's port is dynamic auto . What is the result?
  • A. The link becomes a trunk.
  • B. The link becomes an access link.
  • C. The link is err-disabled.
  • D. The link negotiates ISL.
  • 5. Which two combinations of switchport modes result in a working trunk? (Choose two.)
  • A. dynamic auto and dynamic auto
  • B. dynamic desirable and dynamic auto
  • C. access and trunk
  • D. trunk and dynamic auto
  • E. trunk with nonegotiate and dynamic desirable
  • 6. A trunk currently allows VLANs 10, 20 and 30. An engineer enters switchport trunk allowed vlan 40 . Which VLANs does the trunk now allow?
  • A. 10, 20, 30, 40
  • B. 40 only
  • C. 10, 20, 30
  • D. All VLANs
  • 7. What happens to an untagged frame received on an 802.1Q trunk port?
  • A. It is dropped.
  • B. It is assigned to VLAN 1 regardless of configuration.
  • C. It is assigned to the trunk's native VLAN.
  • D. It is flooded to all VLANs.
  • 8. Why does port Gi0/1 not appear in show vlan brief output on a switch?
  • A. It is administratively down.
  • B. It is operating as a trunk.
  • C. It is in VLAN 1.
  • D. It is assigned to a voice VLAN.
  • 9. Which two actions are recommended security practices for trunks? (Choose two.)
  • A. Use VLAN 1 as the native VLAN.
  • B. Set the native VLAN to an unused VLAN.
  • C. Configure ports as dynamic desirable.
  • D. Disable DTP with switchport nonegotiate .
  • E. Allow all VLANs on every trunk.
  • 10. In show interfaces g0/3 switchport output, Administrative Mode is dynamic auto and Operational Mode is static access . What does this indicate?
  • A. The port is err-disabled.
  • B. The port is a working trunk.
  • C. The neighbor did not actively request a trunk, so the port is acting as an access port.
  • D. The port is configured with a voice VLAN.
  • 11. Hosts in VLAN 10 and VLAN 20 are connected to the same switch. What is required for them to communicate?
  • A. A trunk between the two access ports
  • B. The same native VLAN on both ports
  • C. A router or Layer 3 switch routing between the VLANs
  • D. VTP server mode on the switch
  • 12. An engineer sees %CDP-4-NATIVE_VLAN_MISMATCH on a switch. What should be done?
  • A. Change the trunk encapsulation to ISL.
  • B. Configure the same switchport trunk native vlan on both ends.
  • C. Disable CDP on the trunk.
  • D. Add the native VLAN to the allowed list on one side.

Answers

  • 1. C. The VID is 12 bits, giving IDs 0–4095.
  • 2. B. Normal range is 1–1005.
  • 3. C. The phone tags voice frames with the voice VLAN ID; PC traffic passes untagged in the access (data) VLAN. The port remains an access port.
  • 4. B. Both sides are passive; neither sends a request to trunk, so the link stays access.
  • 5. B and D. Desirable actively requests and auto agrees; a static trunk's DTP messages convert an auto neighbor. Nonegotiate sends no DTP, so a dynamic neighbor stays access.
  • 6. B. Without add , the command replaces the whole list.
  • 7. C. Untagged frames on a trunk belong to the native VLAN, which is VLAN 1 only by default.
  • 8. B. show vlan brief lists access ports only; trunks appear in show interfaces trunk .
  • 9. B and D. Use an unused native VLAN and disable DTP.
  • 10. C. Auto waits for the neighbor to ask; it never did.
  • 11. C. Different VLANs are different subnets and broadcast domains; inter-VLAN routing is required (Chapter 13).
  • 12. B. The native VLAN must match on both ends. Disabling CDP only hides the message.
Use ← → to move between sections