show vlan brief
Quickly verify which VLANs exist on the switch and which ports belong to each VLAN.
Definition: show vlan brief is a Cisco IOS privileged exec command. Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.
Overview
The 'show vlan brief' command is a fundamental tool in Cisco IOS for displaying a concise summary of all VLANs configured on a switch. It provides a quick snapshot of VLAN IDs, names, statuses, and associated ports, making it indispensable for verifying VLAN configuration and port assignments. This command is typically the first step in troubleshooting Layer 2 connectivity issues, as it confirms whether VLANs exist and are active, and which ports are assigned to them.
Unlike 'show vlan' (which shows detailed VLAN information including MTU and SAID) or 'show interfaces status' (which focuses on port states), 'show vlan brief' offers a compact view ideal for initial assessment. It fits into the broader workflow of VLAN creation, port assignment, and trunk configuration, often used after 'vlan' commands or before 'show interfaces trunk'. The command runs in privileged EXEC mode (enable) and does not affect the running configuration.
Output is buffered, so on switches with many VLANs, the output may be truncated if the terminal length is not set appropriately (use 'terminal length 0' to disable paging). Understanding this command is critical for CCNA and CCNP candidates, as VLAN configuration is a core networking concept that enables network segmentation, improves security, and reduces broadcast domains. Without proper VLAN verification, issues like missing VLANs, incorrect port assignments, or inactive VLANs can lead to connectivity failures.
The command also helps in documenting the network and auditing changes.
show vlan briefWhen to Use This Command
- Confirm a VLAN was created successfully after vlan <id> in global config
- See which ports are assigned to each VLAN for troubleshooting connectivity
- Verify VLAN is in active state (not suspended or shutdown)
- Identify unconfigured ports sitting in the default VLAN 1
Command Examples
Typical VLAN brief output
Switch# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi1/0/3, Gi1/0/4, Gi1/0/5 10 SALES active Gi1/0/1, Gi1/0/2 20 ENGINEERING active Gi1/0/6, Gi1/0/7 1002 fddi-default act/unsup 1003 token-ring-default act/unsup
Understanding the Output
Ports column shows only access ports assigned to that VLAN. Trunk ports do NOT appear in show vlan brief — use show interfaces trunk to see which VLANs are carried on trunk links. VLANs 1002-1005 are legacy VLANs (FDDI, Token Ring) that cannot be deleted.
'act/unsup' = active but unsupported on this hardware.
Configuration Scenarios
Verify VLAN Configuration After Creating New VLANs
A network engineer has created several new VLANs (10, 20, 30) for different departments and assigned ports to them. They need to verify that the VLANs are active and ports are correctly assigned.
Topology
Switch1(Gi0/1)---PC1 (VLAN10)
Switch1(Gi0/2)---PC2 (VLAN20)
Switch1(Gi0/3)---PC3 (VLAN30)Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Run the command: Switch# show vlan brief
- 3.Step 3: Examine the output to confirm VLANs 10, 20, 30 are listed with status 'active' and ports Gi0/1, Gi0/2, Gi0/3 are in the correct VLANs.
! VLANs already created via: Switch(config)# vlan 10 Switch(config-vlan)# name Engineering Switch(config-vlan)# exit Switch(config)# vlan 20 Switch(config-vlan)# name Marketing Switch(config-vlan)# exit Switch(config)# vlan 30 Switch(config-vlan)# name Sales Switch(config-vlan)# exit ! Port assignments: Switch(config)# interface gigabitEthernet 0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# exit Switch(config)# interface gigabitEthernet 0/2 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 20 Switch(config-if)# exit Switch(config)# interface gigabitEthernet 0/3 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 30 Switch(config-if)# end
Verify: Switch# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/0, Gi0/4, Gi0/5, Gi0/6, Gi0/7 10 Engineering active Gi0/1 20 Marketing active Gi0/2 30 Sales active Gi0/3 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup Expected: VLANs 10,20,30 appear with status 'active' and correct ports.
Watch out: Forgetting to assign ports to the correct VLAN or using 'switchport mode trunk' instead of 'access' can cause ports to appear in the wrong VLAN or not appear at all.
Troubleshoot Missing VLAN on Trunk Link
A switch is configured with VLANs 10 and 20, but a downstream switch cannot communicate over VLAN 20. The engineer suspects VLAN 20 is not allowed on the trunk link.
Topology
SwitchA(Gi0/1)---Trunk---(Gi0/1)SwitchB
SwitchA has VLANs 10,20; SwitchB has VLANs 10,20Steps
- 1.Step 1: On SwitchA, enter privileged EXEC mode: SwitchA> enable
- 2.Step 2: Run 'show vlan brief' to confirm VLAN 20 exists and is active on SwitchA.
- 3.Step 3: Check trunk allowed VLANs: SwitchA# show interfaces trunk
- 4.Step 4: If VLAN 20 is not listed, add it to the trunk: SwitchA(config)# interface gigabitEthernet 0/1 SwitchA(config-if)# switchport trunk allowed vlan add 20
! Initial trunk configuration (missing VLAN 20): SwitchA(config)# interface gigabitEthernet 0/1 SwitchA(config-if)# switchport mode trunk SwitchA(config-if)# switchport trunk allowed vlan 10 ! After correction: SwitchA(config-if)# switchport trunk allowed vlan add 20
Verify: SwitchA# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/0, Gi0/2, Gi0/3 10 Engineering active Gi0/1 20 Marketing active Gi0/1 Also verify trunk: SwitchA# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 10,20 Expected: VLAN 20 appears in 'show vlan brief' and is allowed on the trunk.
Watch out: Using 'switchport trunk allowed vlan' without 'add' will replace the existing list, potentially removing other VLANs. Always use 'add' to append.
Troubleshooting with This Command
When troubleshooting VLAN-related issues, 'show vlan brief' is often the first command to run. Healthy output shows all configured VLANs with status 'active' and ports correctly assigned. Problem indicators include: missing VLANs (not listed), status 'suspended' or 'act/unsup' (indicating VLAN is not operational, often due to incompatible media types), or ports listed under the wrong VLAN.
Common symptoms: a host cannot ping its default gateway – check if the access port is in the correct VLAN; inter-VLAN routing fails – verify VLANs exist on both switches and are allowed on trunks; broadcast storms – look for unexpected ports in the same VLAN. Step-by-step diagnostic flow: 1) Run 'show vlan brief' to confirm VLANs exist and ports are assigned. 2) If a VLAN is missing, create it with 'vlan <id>'. 3) If a port is missing, check interface configuration with 'show running-config interface <int>'. 4) If status is not 'active', check for native VLAN mismatch or VTP issues. 5) For trunk-related problems, use 'show interfaces trunk' to see allowed VLANs. Correlate with 'show mac address-table' to see MAC addresses learned on each VLAN, and 'show interfaces status' to check port duplex/ speed.
In larger networks, use 'show vlan id <vlan>' for detailed info on a specific VLAN. Remember that 'show vlan brief' only shows access ports; trunk ports are not listed under VLANs (they appear as 'trunk' in 'show interfaces trunk'). Also, VLAN 1 is always present and cannot be deleted.
If a VLAN is in 'act/unsup' state, it may be due to a mismatch in VLAN type (e.g., FDDI) – this is normal for reserved VLANs (1002-1005). For user-created VLANs, ensure they are not suspended by VTP or due to lack of active ports. Finally, always check the switch's VTP mode; in transparent mode, VLANs are local; in server/client mode, VLANs may be propagated or pruned.
CCNA Exam Tips
CCNA exam: note that trunk ports are NOT listed in show vlan brief
A port assigned to VLAN 10 only appears here if it is an access port
VLAN 1 is the default and cannot be deleted
VLANs created in global config mode are active immediately; VLANs not created but referenced by switchport access vlan show as undefined or cause VLAN mismatch
Common Mistakes
Expecting trunk ports to appear in show vlan brief — they do not
Creating a VLAN with vtp transparent mode not understanding that VTP does not propagate the VLAN
Forgetting that VLAN 1 is the default native VLAN for trunk ports — change it for security
show vlan brief vs show interfaces trunk
Both 'show vlan brief' and 'show interfaces trunk' provide Layer 2 VLAN information, but they differ in scope: the former shows VLAN-to-port assignments for access ports, while the latter focuses on trunk port properties and allowed VLANs. Network engineers often compare them when troubleshooting VLAN mismatches or verifying trunk configurations.
| Aspect | show vlan brief | show interfaces trunk |
|---|---|---|
| Scope | All VLANs in the VLAN database | Only trunk interfaces |
| Output focus | VLAN ID, name, status, and access ports | Trunk encapsulation, native VLAN, allowed VLANs, STP state |
| Key fields | VLAN, Name, Status, Ports | Port, Encapsulation, Native VLAN, Allowed VLANs, Active VLANs |
| Typical context | Verifying VLAN existence and access port assignments | Checking trunk pruning, native VLAN mismatch, or allowed VLAN list |
| VLAN display | All VLANs including default and user-created | Only VLANs active on trunks (forwarding in STP) |
| Port type | Access ports assigned to each VLAN | Trunk ports only |
Use show vlan brief when you need a quick overview of VLANs and which access ports belong to each VLAN.
Use show interfaces trunk when you need to verify trunk encapsulation, native VLAN, and which VLANs are allowed or blocked on trunk links.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the 'show vlan brief' command syntax and output are identical to classic IOS. However, IOS-XE may display additional fields like 'VLAN Type' (Ethernet, FDDI, etc.) and 'SAID' in the full 'show vlan' output, but 'brief' remains consistent. On NX-OS (e.g., Nexus 9000), the equivalent command is 'show vlan brief' as well, but output format differs slightly: it shows 'VLAN Name', 'Status', 'Ports', and also includes 'VLAN Type' and 'Mode'.
NX-OS also supports 'show vlan' for detailed view. For ASA firewalls, VLANs are configured differently (subinterfaces) and 'show vlan' is not applicable; instead, use 'show interface' or 'show running-config interface' to verify VLAN assignments. In IOS-XR (e.g., ASR 9000), VLAN configuration is done via L2VPN and bridge domains; the command 'show vlan' is not available; use 'show l2vpn bridge-domain' or 'show ethernet service instance' instead.
Between IOS versions (12.x, 15.x, 16.x), the output of 'show vlan brief' is largely unchanged, but newer versions may include additional VLANs (e.g., internal VLANs) or show port-channel members. Always ensure the switch is in the correct mode (privileged EXEC) and that the terminal length is set appropriately to avoid truncated output. On some platforms, the command may require 'terminal monitor' if debugging is active.
Overall, 'show vlan brief' is a universal command across Cisco switching platforms, with minor variations in output formatting.
Related Commands
show interfaces trunk
Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.
switchport mode access
Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.
state active
Sets the operational state of a VLAN to active (forwarding traffic) or suspend (VLAN exists in database but no traffic is forwarded). Active is the default state for all new VLANs.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions