Cisco IOS VLAN Configuration
Generate VLAN configuration with access and trunk ports for Cisco IOS/IOS-XE switches. Includes VLAN database, SVI interfaces, access ports, and trunk links.
What is it?
A VLAN (Virtual LAN) is a logical network segment created on a switch. Without VLANs, every device on a switch is in the same broadcast domain — any broadcast (ARP, DHCP) reaches every device. VLANs divide the switch into isolated broadcast domains at Layer 2. Traffic between VLANs requires a Layer 3 device (router or L3 switch SVI). A trunk link carries multiple VLANs between switches using 802.1Q tags. An SVI (Switched Virtual Interface) is a virtual interface on a Layer 3 switch that acts as the default gateway for that VLAN.
✓ When to use
- ·Separating different departments (HR, Finance, Engineering) into isolated networks
- ·Creating a DMZ or guest network isolated from the corporate network
- ·Separating IP phones from data devices on the same physical switch (voice VLAN)
- ·Any time you have multiple network segments but limited physical switches
- ·Inter-VLAN routing when a Layer 3 switch is available (more efficient than router-on-a-stick)
✗ When NOT to use
- ·As the only security boundary between sensitive networks — VLANs prevent broadcast storms but a misconfigured trunk or VLAN hopping attack can bypass them. Use a firewall for security boundaries.
- ·When you need more than 4094 VLANs — use VXLAN (L2 overlay over L3) for data center scale
How it compares
Prerequisites
- →Layer 2 switch or Layer 3 switch (for SVI routing)
- →VLAN IDs planned and documented — VLAN 1 is the native/default VLAN (avoid using it for user traffic)
- →Trunk links configured between switches before VLANs propagate
- →Spanning tree mode selected — Rapid PVST+ is recommended for IOS switches
Config Generator
Verification commands
show vlan briefList all VLANs and which ports are assigned to each
Expected: Shows VLAN ID, name, status (active), and assigned ports. Ports not assigned to any VLAN show up in VLAN 1.
show interfaces trunkShow all trunk interfaces and which VLANs are allowed/active
Expected: Shows native VLAN, allowed VLANs, and VLANs in spanning tree forwarding state per trunk
show interfaces vlan <id>Verify SVI is up/up and has the correct IP address
Expected: Line protocol is up only when at least one access port in that VLAN is active
show spanning-tree vlan <id>Verify spanning tree status for a specific VLAN
Expected: Root bridge ID, port roles (Root/Designated/Alternate), and port states (Forwarding/Blocking)
Debug commands
show mac address-table vlan <id>Show MAC addresses learned on a specific VLAN
Common mistakes & fixes
⚡ VLAN not appearing on remote switch after trunk config
Cause: VLAN not created on the remote switch (VTP transparent mode) or trunk not allowing the VLAN
Fix: Create the VLAN on both switches. Verify trunk allows it: 'switchport trunk allowed vlan add <id>'. Check VTP mode with 'show vtp status'.
⚡ SVI (Vlan interface) is down/down
Cause: No active ports assigned to that VLAN, or VLAN doesn't exist in the VLAN database
Fix: Assign at least one access port to the VLAN and make sure it's connected/up. Verify 'show vlan brief' shows the VLAN as active.
⚡ Inter-VLAN traffic not routing
Cause: SVI has wrong IP/mask, 'ip routing' not enabled on L3 switch, or no default route
Fix: Enable L3 routing: 'ip routing'. Verify SVI IPs match the subnet plan. Check 'show ip route' for routes to each VLAN.
⚡ Native VLAN mismatch warning (CDP/STP logs)
Cause: Both sides of the trunk have different native VLAN configured
Fix: Match native VLAN on both ends: 'switchport trunk native vlan <id>'. Native VLAN 1 is the default — change to an unused VLAN as a security best practice.