switchport access vlan [vlan-id]
Assigns a specific VLAN to an access port, placing the port in that VLAN for untagged traffic.
Definition: switchport access vlan [vlan-id] is a Cisco IOS interface config command. Assigns a specific VLAN to an access port, placing the port in that VLAN for untagged traffic.
Overview
The `switchport access vlan [vlan-id]` command is a fundamental interface configuration command on Cisco switches that assigns a specific VLAN to an access port. An access port carries traffic for only one VLAN, and all frames sent or received on that port are untagged (i.e., they do not contain a VLAN ID header). This command is essential for segmenting a local area network into multiple broadcast domains, improving security, reducing congestion, and simplifying network management.
The concept behind VLANs is to logically group devices regardless of their physical location, allowing broadcast traffic to be contained within the VLAN. When you assign a VLAN to an access port, you are essentially telling the switch to treat all traffic from that port as belonging to that VLAN. This command is typically used when connecting end devices such as PCs, printers, or servers that are not VLAN-aware.
In contrast, trunk ports carry multiple VLANs and use tagging (802.1Q) to distinguish traffic. You would reach for this command when you need to place a device into a specific VLAN, for example, when adding a new workstation to the accounting VLAN. It fits into the broader configuration workflow after creating the VLAN (using `vlan [vlan-id]` in global config) and before verifying connectivity.
Important IOS behaviors: the command takes effect immediately and is written to the running configuration. The VLAN must exist in the VLAN database; if it does not, the switch will automatically create it (in some IOS versions) or the command will be rejected. The port must be in access mode (set by `switchport mode access`) before this command can be applied.
If the port is in trunk mode, this command is ignored. The privilege level required is 15 (enable mode). The command is available in interface configuration mode.
A common mistake is forgetting to set the port to access mode first, which results in an error message like "Command rejected: An interface whose trunk encapsulation is "802.1q" can not be configured as an access port." Another mistake is using a VLAN ID that does not exist, which may cause the switch to automatically create the VLAN (depending on the IOS version) or reject the command. The command does not affect the port's operational state; it only changes the VLAN assignment. To verify, use `show vlan brief` or `show interfaces [interface] switchport`.
switchport access vlan [vlan-id]When to Use This Command
- Assigning a desktop user to VLAN 10 on a switch port
- Configuring a port for a printer in a separate VLAN
- Setting up a VoIP phone port with a data VLAN
- Reassigning a port from default VLAN 1 to a user VLAN
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| vlan-id | <1-4094> | Specifies the VLAN number to assign to the access port. Valid values are from 1 to 4094, excluding reserved VLANs (1002-1005). Common mistakes include using VLAN 0 or VLANs outside the range, or using a VLAN that has not been created in the VLAN database. The VLAN must exist for the command to succeed, though some IOS versions auto-create VLANs. |
Command Examples
Assign port to VLAN 10
Switch(config-if)# switchport access vlan 10No output is generated on success. Use 'show interfaces status' or 'show vlan brief' to verify.
Verify VLAN assignment
show interfaces statusPort Name Status Vlan Duplex Speed Type Gi0/1 Desktop-PC connected 10 a-full a-100 10/100/1000BaseTX Gi0/2 Printer connected 20 a-full a-100 10/100/1000BaseTX
The 'Vlan' column shows the access VLAN assigned to each port. Gi0/1 is in VLAN 10, Gi0/2 in VLAN 20.
Understanding the Output
The command itself produces no output on success. To verify, use 'show interfaces status' or 'show vlan brief'. In 'show interfaces status', the 'Vlan' column indicates the access VLAN for ports in access mode.
A value of '1' is default; any other number indicates a configured access VLAN. In 'show vlan brief', the port appears under the assigned VLAN's list. Ensure the VLAN exists in the VLAN database; otherwise, the port will be inactive until the VLAN is created.
Configuration Scenarios
Assign a PC to VLAN 10 on a switch port
A new employee in the Engineering department needs network access. The Engineering VLAN is VLAN 10. The switch port Gi0/1 is currently in the default VLAN 1 and needs to be reconfigured.
Topology
PC1---(Gi0/1)SW1Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the interface: SW1(config)# interface gigabitEthernet 0/1
- 4.Step 4: Set the port mode to access: SW1(config-if)# switchport mode access
- 5.Step 5: Assign VLAN 10: SW1(config-if)# switchport access vlan 10
- 6.Step 6: Exit and verify: SW1(config-if)# end
! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10 !
Verify: Use `show vlan brief` to see VLAN 10 and the associated port. Expected output includes VLAN10 with Gi0/1 listed. Also use `show interfaces gigabitEthernet 0/1 switchport` to confirm Access Mode VLAN is 10.
Watch out: If the port was previously a trunk, you must first remove trunking with `switchport mode access` before assigning the access VLAN. Otherwise, the command will be rejected.
Move a server from VLAN 20 to VLAN 30 on a switch port
A server originally in the Sales VLAN (20) is being reassigned to the Marketing VLAN (30). The switch port Gi0/5 needs to be updated without disrupting other ports.
Topology
Server---(Gi0/5)SW1Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter interface configuration mode: SW1# configure terminal
- 3.Step 3: Select the interface: SW1(config)# interface gigabitEthernet 0/5
- 4.Step 4: Assign the new VLAN (the port is already in access mode): SW1(config-if)# switchport access vlan 30
- 5.Step 5: Exit and verify: SW1(config-if)# end
! interface GigabitEthernet0/5 switchport access vlan 30 !
Verify: Use `show interfaces gigabitEthernet 0/5 switchport` to confirm Access Mode VLAN is now 30. Also check `show vlan brief` to see that Gi0/5 is no longer in VLAN 20.
Watch out: If the VLAN 30 does not exist, the command will fail. Ensure the VLAN is created first with `vlan 30` in global config. Also, if the port is in trunk mode, the command will be ignored; verify the port mode.
Troubleshooting with This Command
When troubleshooting VLAN assignment issues on access ports, the `switchport access vlan` command is often the first place to look. Healthy output from `show interfaces [interface] switchport` will show "Access Mode VLAN: 10" (or the desired VLAN) and "Trunking Native Mode VLAN: 1 (default)" for access ports. Problem indicators include "Access Mode VLAN: 1" when you expected a different VLAN, or "Trunking Native Mode VLAN: 1 (Inactive)" if the VLAN is not present in the VLAN database.
Common symptoms this command helps diagnose include: a device cannot communicate with other devices in the same VLAN, or it can communicate but is in the wrong broadcast domain. For example, if a PC is assigned to VLAN 10 but cannot ping the default gateway, check the access VLAN assignment. A step-by-step diagnostic flow: 1) Verify the port is in access mode: `show interfaces [interface] switchport | include Mode`.
If it shows "Trunk", change it with `switchport mode access`. 2) Verify the assigned VLAN: `show interfaces [interface] switchport | include Access Mode VLAN`. If it shows the wrong VLAN, reapply `switchport access vlan [correct-vlan]`. 3) Verify the VLAN exists: `show vlan brief | include [vlan-id]`. If the VLAN is missing, create it with `vlan [vlan-id]`. 4) Check if the port is err-disabled: `show interfaces [interface] status`.
If err-disabled, troubleshoot further (e.g., spanning-tree BPDU guard). 5) Use `show mac address-table interface [interface]` to see if the device's MAC address is learned in the correct VLAN. Correlate this command's output with `show vlan` to ensure the port is listed under the correct VLAN. Also, `debug switchport` can be used to monitor VLAN assignment changes, but use with caution in production.
A common issue is that after changing the access VLAN, the port may briefly go down/up, causing a temporary disruption. Also, if the port is connected to a VoIP phone, the access VLAN is for the PC behind the phone, and the voice VLAN is configured separately with `switchport voice vlan`. Misconfiguration here can lead to both data and voice traffic being in the wrong VLAN.
CCNA Exam Tips
Remember that 'switchport access vlan' only works on ports in access mode; trunk ports use 'switchport trunk allowed vlan'.
If the VLAN does not exist, the port will not forward traffic until the VLAN is created.
The default access VLAN is 1; changing it to another VLAN removes the port from VLAN 1.
CCNA 200-301 may test the difference between access and trunk ports and the commands to configure each.
Common Mistakes
Forgetting to set the port to access mode with 'switchport mode access' before assigning a VLAN.
Assigning a VLAN that hasn't been created yet, causing the port to be in an inactive state.
Using 'switchport access vlan' on a trunk port, which is ignored for trunking.
switchport access vlan [vlan-id] vs switchport mode access
These two commands are often used together but serve distinct purposes. switchport access vlan assigns a specific VLAN to a port, while switchport mode access sets the port to access mode, disabling trunk negotiation. They are commonly confused because both are required to configure an access port properly.
| Aspect | switchport access vlan [vlan-id] | switchport mode access |
|---|---|---|
| Scope | Assigns VLAN to access port | Sets port operational mode to access |
| Effect | Port becomes member of VLAN, accepts untagged frames | Port becomes access port, disables trunk negotiation |
| DTP Status | Does not affect DTP; port may still negotiate if mode not set | Disables DTP; port permanently access |
| VLAN Dependency | Requires port to be in access mode to take effect | Does not assign VLAN; must be paired with access vlan |
| Typical Use | Specifies which VLAN for access traffic | Prevents trunk misconfiguration, ensures port is access |
Use switchport access vlan [vlan-id] when you need to assign a specific VLAN to an access port for untagged traffic, typically after setting the port to access mode.
Use switchport mode access when you want to statically configure a port as access-only, disabling any potential trunk negotiation.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850/9300), the syntax and behavior are identical to classic IOS. The command `switchport access vlan [vlan-id]` works the same way. However, on some IOS-XE platforms, the VLAN must be created in the VLAN database before assignment, or the command will be rejected.
In NX-OS (e.g., Nexus 9000), the equivalent command is `switchport access vlan [vlan-id]` as well, but the interface must be in access mode using `switchport mode access`. NX-OS also requires the VLAN to exist; if not, you must create it with `vlan [vlan-id]`. There is no direct ASA equivalent because ASAs are firewalls, not switches; they use subinterfaces for VLAN tagging.
For IOS-XR, this command does not exist because IOS-XR is used on routers, not switches. In older IOS versions (12.x), the command `switchport access vlan` automatically creates the VLAN if it does not exist, but in newer versions (15.x, 16.x), the VLAN must be explicitly created. Also, in some platforms, the range of VLAN IDs may be limited to 1-1005 for standard VLANs, with extended VLANs (1006-4094) requiring the VLAN database to be in transparent mode.
Always check the specific platform documentation. The output of `show interfaces switchport` may vary slightly between IOS and IOS-XE, but the key fields remain the same. On NX-OS, the output is more verbose and includes fields like "Operational Mode" and "Access VLAN".
Related Commands
show interfaces status
Displays a summary of all switch interfaces including their status, VLAN, duplex, speed, and type, used to quickly verify interface connectivity and configuration.
show vlan brief
Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.
switchport mode access
Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions