show vlan
Displays the current VLAN configuration on the switch, including VLAN IDs, names, status, and ports assigned to each VLAN, used to verify VLAN creation and port assignments.
Definition: show vlan is a Cisco IOS privileged exec command. Displays the current VLAN configuration on the switch, including VLAN IDs, names, status, and ports assigned to each VLAN, used to verify VLAN creation and port assignments.
Overview
The `show vlan` command is a fundamental diagnostic and verification tool on Cisco switches, used to display the current VLAN configuration. VLANs (Virtual Local Area Networks) logically segment a physical network into multiple broadcast domains, improving security, performance, and manageability. This command is essential for network engineers to verify VLAN creation, port assignments, and operational status.
It is typically used after configuring VLANs or when troubleshooting connectivity issues related to Layer 2 segmentation. Unlike `show running-config | include vlan`, which only shows configuration lines, `show vlan` provides a concise, tabular view of all VLANs, their names, status, and associated ports. It is often the first command used to confirm that VLANs exist and are active.
The command is available in privileged EXEC mode (enable mode) and does not require additional privileges. Its output is buffered, meaning it may not reflect real-time changes if the switch is under heavy load; use `show vlan brief` for a quicker summary. The command does not modify the running configuration; it only displays information.
Understanding its output is critical for CCNA and CCNP candidates, as VLAN misconfigurations are a common source of network issues. The command also helps in verifying trunk port configurations, as it shows which VLANs are allowed on trunk links when combined with `show interfaces trunk`. In summary, `show vlan` is a go-to command for any Layer 2 verification task, from initial setup to advanced troubleshooting.
show vlanWhen to Use This Command
- Verify that VLANs have been created and are active after initial configuration.
- Check which ports are assigned to which VLAN when troubleshooting connectivity issues.
- Review the default VLANs (1, 1002-1005) and ensure no unauthorized VLANs exist.
- Confirm VLAN port membership before implementing VLAN-based security policies.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| brief | brief | Displays a condensed version of the VLAN table, showing only VLAN ID, name, and status. Useful for a quick overview without port assignments. |
| id | id <vlan-id> | Displays detailed information for a specific VLAN identified by its VLAN ID (1-4094). Common mistake: using a VLAN ID that does not exist results in no output. |
| name | name <vlan-name> | Displays detailed information for a VLAN with a specific name. The name is case-sensitive. Common mistake: misspelling the name yields no output. |
| summary | summary | Displays a summary of VLAN counts, including the number of VLANs existing, active, and suspended. Useful for a high-level view. |
| group | group [group-name] | Displays VLAN group information. If a group name is specified, shows details for that group. Used in some advanced configurations. |
| internal | internal [usage] | Displays internal VLANs used by the switch for features like routing or management. The 'usage' keyword shows the purpose of each internal VLAN. |
| dot1q | dot1q [tag native] | Displays 802.1Q VLAN information. The 'tag native' option shows whether native VLAN tagging is enabled on trunk ports. |
| access-map | access-map [map-name] | Displays VLAN access-map configuration. If a map name is specified, shows details for that map. Used for VLAN-based access control. |
| filter | filter [access-map] | Displays VLAN filter information. If an access-map name is specified, shows which VLANs are filtered by that map. |
| mtu | mtu [vlan-id] | Displays the MTU size configured for a specific VLAN or all VLANs. If no VLAN ID is given, shows MTU for all VLANs. |
| remote-span | remote-span | Displays Remote SPAN (RSPAN) VLAN information. RSPAN VLANs are used to mirror traffic across switches. |
Command Examples
Basic show vlan output
show vlanVLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
10 Sales active Fa0/9, Fa0/10, Fa0/11, Fa0/12
20 Engineering active Fa0/13, Fa0/14, Fa0/15, Fa0/16
1002 fddi-default act/unsup
1003 token-ring-default act/unsup
1004 fddinet-default act/unsup
1005 trnet-default act/unsupVLAN: VLAN ID number. Name: VLAN name (default names for default VLANs). Status: 'active' means VLAN is operational; 'act/unsup' means VLAN exists but is not supported on this platform. Ports: Interfaces assigned to the VLAN (trunk ports not shown).
Show VLAN summary
show vlan summaryNumber of existing VLANs : 4 Number of existing VTP VLANs : 4 Number of existing extended VLANs : 0
Shows count of VLANs. 'Number of existing VLANs' includes all VLANs. 'VTP VLANs' are those learned via VTP. 'Extended VLANs' are VLANs 1006-4094.
Understanding the Output
The 'show vlan' command output lists all VLANs configured on the switch. The 'VLAN' column shows the VLAN ID (1-4094). The 'Name' column displays the VLAN name; default VLANs have names like 'default', 'fddi-default', etc. The 'Status' column indicates whether the VLAN is active ('active') or not supported ('act/unsup').
The 'Ports' column lists access ports assigned to that VLAN; trunk ports are not listed. If a VLAN is not active, ports assigned to it will not function. In a production network, you should see only the VLANs you created plus the default VLAN 1.
The presence of unexpected VLANs may indicate misconfiguration or security issues. The 'act/unsup' status for VLANs 1002-1005 is normal on Ethernet switches.
Configuration Scenarios
Verify VLAN Creation and Port Assignments on a New Switch
A network engineer has just configured VLANs 10, 20, and 30 on a new switch and assigned ports to them. They need to verify that the VLANs exist and that the correct ports are in the right VLANs.
Topology
Switch1 (Gi0/1-10) --- VLAN 10
Switch1 (Gi0/11-20) --- VLAN 20
Switch1 (Gi0/21-24) --- VLAN 30Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Run the show vlan command: Switch# show vlan
- 3.Step 3: Review the output to confirm VLANs 10, 20, and 30 are listed with status 'active'.
- 4.Step 4: Check that ports Gi0/1-10 are in VLAN 10, Gi0/11-20 in VLAN 20, and Gi0/21-24 in VLAN 30.
! VLAN configuration (already applied) Switch(config)# vlan 10 Switch(config-vlan)# name Sales Switch(config-vlan)# exit Switch(config)# vlan 20 Switch(config-vlan)# name Engineering Switch(config-vlan)# exit Switch(config)# vlan 30 Switch(config-vlan)# name Management Switch(config-vlan)# exit Switch(config)# interface range gi0/1-10 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10 Switch(config-if-range)# exit Switch(config)# interface range gi0/11-20 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 20 Switch(config-if-range)# exit Switch(config)# interface range gi0/21-24 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 30 Switch(config-if-range)# end
Verify: Switch# show vlan VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/0, Gi0/25, Gi0/26, Gi0/27, Gi0/28 10 Sales active Gi0/1, Gi0/2, Gi0/3, Gi0/4, Gi0/5, Gi0/6, Gi0/7, Gi0/8, Gi0/9, Gi0/10 20 Engineering active Gi0/11, Gi0/12, Gi0/13, Gi0/14, Gi0/15, Gi0/16, Gi0/17, Gi0/18, Gi0/19, Gi0/20 30 Management active Gi0/21, Gi0/22, Gi0/23, Gi0/24 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup
Watch out: If a port is not listed under any VLAN, it may be in shutdown state or not configured as an access port. Also, VLANs 1002-1005 are default and cannot be deleted.
Troubleshoot Missing VLAN on Trunk Link
A user in VLAN 20 cannot reach a server in VLAN 20 on another switch. The trunk link between the switches may not be allowing VLAN 20. The engineer uses show vlan to verify local VLAN existence and then checks trunking.
Topology
SwitchA (Gi0/1)---trunk---(Gi0/1)SwitchB
SwitchA has VLAN 20 on Gi0/2; SwitchB has VLAN 20 on Gi0/2Steps
- 1.Step 1: On SwitchA, verify VLAN 20 exists: SwitchA# show vlan id 20
- 2.Step 2: Check that the trunk port is up and allowing VLAN 20: SwitchA# show interfaces trunk
- 3.Step 3: If VLAN 20 is not in the allowed list, add it on the trunk interface.
- 4.Step 4: Repeat on SwitchB to ensure consistency.
! On SwitchA, if VLAN 20 is missing from trunk allowed list: SwitchA(config)# interface gi0/1 SwitchA(config-if)# switchport trunk allowed vlan add 20 SwitchA(config-if)# end
Verify: SwitchA# show vlan id 20 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 20 Engineering active Gi0/2 SwitchA# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 1-1005 Port Vlans allowed and active in management domain Gi0/1 1,10,20,30
Watch out: If the VLAN is not created on the remote switch, it will not be forwarded even if allowed on the trunk. Always create the VLAN on both switches.
Troubleshooting with This Command
The `show vlan` command is invaluable for troubleshooting Layer 2 connectivity issues. Healthy output shows all configured VLANs with status 'active' and the correct ports assigned. Problem indicators include: missing VLANs (not listed), VLAN status 'suspended' or 'shutdown', ports not appearing under the expected VLAN, or unexpected ports in a VLAN.
Key fields to focus on are the 'Status' column (active, suspend, or shutdown) and the 'Ports' column. Common symptoms: a host cannot communicate with others in the same VLAN – check if the VLAN is active and the port is in the correct VLAN. If a VLAN is missing, it may not have been created or may have been deleted.
If a VLAN is suspended, it may have been manually suspended or due to a configuration conflict. If ports are missing, they may be in trunk mode or administratively down. A step-by-step diagnostic flow: 1) Use `show vlan brief` to quickly see all VLANs and their status. 2) If a VLAN is missing, create it with `vlan <id>`. 3) If a VLAN is suspended, check for misconfigurations like incompatible media types. 4) Verify port assignments with `show vlan id <vlan-id>`. 5) If a port is not listed, check its mode with `show interfaces <interface> switchport`. 6) For trunk-related issues, use `show interfaces trunk` to see allowed VLANs.
Correlate with `show running-config | section interface` to see port configurations. Also, `show mac address-table vlan <vlan-id>` can help verify MAC learning. If a VLAN is not forwarding traffic, check for spanning-tree blocking with `show spanning-tree vlan <vlan-id>`.
The `show vlan` command is often the starting point for any Layer 2 troubleshooting, as it provides a clear picture of the VLAN topology.
CCNA Exam Tips
CCNA exam tip: The default VLAN 1 cannot be deleted, but you can rename it.
CCNA exam tip: VLANs 1002-1005 are reserved for Token Ring and FDDI; they appear with 'act/unsup' status on Ethernet switches.
CCNA exam tip: 'show vlan' only shows access ports; to see trunk ports, use 'show interfaces trunk'.
CCNA exam tip: If a VLAN is missing from the output, it may not have been created or may be in the shutdown state.
Common Mistakes
Mistake: Assuming 'show vlan' shows all ports including trunks. Trunk ports are not displayed; use 'show interfaces trunk' instead.
Mistake: Forgetting that VLAN 1 is always present and cannot be deleted; attempting to delete it will fail.
Mistake: Misinterpreting 'act/unsup' as an error; it is normal for reserved VLANs on Ethernet switches.
show vlan vs show interfaces trunk
Both 'show vlan' and 'show interfaces trunk' are commonly used together when troubleshooting VLAN and trunking configurations, as they provide complementary information. 'show vlan' focuses on VLAN membership per port, while 'show interfaces trunk' details trunk-specific parameters like allowed VLANs and native VLAN. They are often confused because both relate to VLANs, but their scopes differ significantly.
| Aspect | show vlan | show interfaces trunk |
|---|---|---|
| Scope | All VLANs and port membership | Trunk ports only |
| Output Detail | VLAN IDs, names, status, ports | Encapsulation, native VLAN, allowed VLAN list, STP state |
| Key Information | VLAN existence and port assignments | Trunking configuration and active VLANs |
| Typical Use | Verify VLAN creation and port membership | Verify trunk settings and allowed VLANs |
| Configuration Dependency | Displays VLAN database | Displays interface trunk state |
Use show vlan when you need to verify which ports are assigned to which VLANs or confirm VLAN creation.
Use show interfaces trunk when you need to check trunk parameters such as encapsulation, native VLAN, and which VLANs are allowed or active on trunk links.
Platform Notes
On IOS-XE (e.g., Catalyst 3650, 9300), the `show vlan` command syntax and output are nearly identical to classic IOS. However, IOS-XE may include additional fields like 'VLAN Type' (Ethernet, FDDI, etc.) and 'SAID' values. The command `show vlan brief` is commonly used for a quick view.
On NX-OS (e.g., Nexus 9000), the equivalent command is `show vlan` or `show vlan brief`. NX-OS output includes VLAN state (active, suspended) and ports, but the format is slightly different, with ports listed under 'Ports' column. NX-OS also supports `show vlan id <vlan-id>` and `show vlan name <name>`.
On ASA firewalls, VLANs are configured differently (subinterfaces), and the command `show vlan` is not available; instead, use `show interface` or `show running-config` to see VLAN assignments. For IOS-XR (e.g., ASR 9000), the command `show vlan` exists but is used in a different context (L2VPN). In IOS versions 12.x, 15.x, and 16.x, the output is consistent, but newer versions may show additional details like 'VLAN Mode' (CE, PE).
Always check the specific platform documentation for exact syntax. For example, on Catalyst 2960-X (IOS 15.x), `show vlan summary` provides a count of VLANs. On Catalyst 3850 (IOS-XE 16.x), `show vlan group` is available for VLAN group configurations.
In summary, while the core functionality remains, always verify the exact syntax for your platform.
Related Commands
show interfaces trunk
Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.
show vlan brief
Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.
show vtp status
Displays VTP (VLAN Trunking Protocol) configuration and status, including the VTP mode, domain name, version, configuration revision number, number of VLANs, and last update information. Essential for verifying VTP configuration and troubleshooting VLAN synchronization issues.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions