CCNA VLANs and Trunking: Complete Study Guide 2026
VLANs and trunking are foundational CCNA topics that appear in 10-15% of exam questions. This guide covers everything from basic VLAN concepts through to trunking verification and inter-VLAN routing.
What is a VLAN?
A VLAN (Virtual LAN) is a logical broadcast domain created within a physical switch. Without VLANs, all devices connected to a switch share a single broadcast domain — every ARP request, DHCP discovery, and broadcast frame reaches every connected device.
VLANs solve this by segmenting the switch into multiple isolated Layer 2 domains. A device in VLAN 10 cannot communicate with a device in VLAN 20 without passing through a router (or Layer 3 switch) — even if both are connected to the same physical switch.
VLAN benefits:
- Security — Traffic is isolated between departments (Sales VLAN cannot reach HR VLAN)
- Performance — Smaller broadcast domains mean less broadcast noise
- Flexibility — Devices in the same VLAN can span multiple physical switches
- Simplified management — Move users between VLANs without recabling
Creating VLANs
VLANs are created in global configuration mode:
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name ENGINEERING
Switch(config-vlan)# exit
Verify:
Switch# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Gi1/0/3, Gi1/0/4
10 SALES active Gi1/0/1, Gi1/0/2
20 ENGINEERING active Gi1/0/5, Gi1/0/6
CCNA exam note: VLANs 1002-1005 are legacy (FDDI, Token Ring) and cannot be deleted. VLAN 1 is the default VLAN and cannot be deleted. VLANs 1006-4094 are extended range VLANs.
Assigning Ports to VLANs (Access Ports)
An access port carries traffic for a single VLAN:
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# exit
Always apply both commands:
switchport mode access— forces access mode, disables DTP negotiationswitchport access vlan 10— assigns to VLAN 10
Without switchport mode access, the port defaults to dynamic auto and may negotiate trunk mode.
Trunk Ports: Carrying Multiple VLANs
A trunk port carries traffic for multiple VLANs between switches, or from a switch to a router for inter-VLAN routing. Trunks use IEEE 802.1Q (dot1q) encapsulation to tag frames with a VLAN ID.
Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99
Switch(config-if)# exit
Key trunk commands:
switchport mode trunk— forces trunk modeswitchport trunk native vlan 99— untagged VLAN on the trunk (must match both ends)switchport trunk allowed vlan 10,20,30— restrict which VLANs cross the trunk
DTP (Dynamic Trunking Protocol)
DTP automatically negotiates trunk formation between Cisco switches. Default modes:
| Mode | Behaviour |
|---|---|
| dynamic auto | Becomes trunk if far end is desirable or on |
| dynamic desirable | Actively tries to form trunk |
| trunk (on) | Always trunk, sends DTP frames |
| access | Always access, ignores DTP |
| nonegotiate | Disables DTP (use with trunk or access) |
Security risk: DTP on access ports enables VLAN hopping attacks. Best practice: switchport mode access + switchport nonegotiate on all host-facing ports.
Verifying Trunks
Switch# show interfaces trunk
Port Mode Encapsulation Status Native vlan
Gi1/0/24 on 802.1q trunking 99
Port Vlans allowed on trunk
Gi1/0/24 10,20,30,99
Port Vlans allowed and active in management domain
Gi1/0/24 10,20,30,99
Port Vlans in spanning tree forwarding state and not pruned
Gi1/0/24 10,20,30,99
Read the four sections:
- Basic trunk info (mode, encapsulation, status, native VLAN)
- VLANs permitted by configuration
- VLANs that actually exist on this switch
- VLANs STP is forwarding (not blocked, not pruned) — this is what traffic actually flows through
A VLAN missing from section 4 is not passing traffic even if it appears in sections 2 and 3.
Inter-VLAN Routing
Devices in different VLANs cannot communicate without Layer 3 routing. Two common approaches:
Option 1: Router-on-a-Stick (ROAS)
Connect a router to a trunk port and create subinterfaces for each VLAN:
Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
CCNA exam note: The physical interface (GigabitEthernet0/0) must be up with no IP address, and no shutdown.
Option 2: Layer 3 Switch (SVI)
A Layer 3 switch handles inter-VLAN routing internally:
Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
SVIs (Switched Virtual Interfaces) are more efficient than ROAS — no single link bottleneck.
Native VLAN Security
The native VLAN sends frames untagged on 802.1Q trunks. VLAN 1 is the default native VLAN. This creates a VLAN hopping vulnerability.
Best practice: Change the native VLAN to an unused VLAN (e.g., VLAN 999) on all trunks:
Switch(config-if)# switchport trunk native vlan 999
Both ends of the trunk must use the same native VLAN. Native VLAN mismatch generates CDP error messages but does not shut the trunk down.
Common CCNA Exam Questions on VLANs
Q: A PC in VLAN 10 cannot ping a PC in VLAN 20. Both are connected to the same switch. What is most likely missing? A: Inter-VLAN routing (router-on-a-stick or Layer 3 switch SVI). VLANs do not route between each other at Layer 2.
Q: A VLAN appears in show vlan brief but traffic does not pass across the trunk. What should you check?
A: show interfaces trunk — check the fourth section "VLANs in spanning tree forwarding state and not pruned".
Q: After adding VLAN 30, hosts in VLAN 30 cannot reach the default gateway. What is the likely cause? A: The router-on-a-stick subinterface for VLAN 30 was not created, or the Layer 3 switch SVI interface vlan 30 is not configured.