In which configuration mode is vlan [vlan-id] used?

The vlan [vlan-id] command is entered in Global Config mode on Cisco IOS devices.

VLANGlobal Config

vlan [vlan-id]

Creates a VLAN on a Cisco switch and enters VLAN configuration mode to assign a name or other parameters.

Definition: vlan [vlan-id] is a Cisco IOS global config command. Creates a VLAN on a Cisco switch and enters VLAN configuration mode to assign a name or other parameters.

Overview

The `vlan` command in global configuration mode is the primary method for creating and configuring VLANs on Cisco switches. VLANs (Virtual Local Area Networks) logically segment a physical network into multiple broadcast domains, improving security, reducing broadcast traffic, and simplifying network management. This command is essential for any network engineer working with switched networks, as VLANs form the foundation for inter-VLAN routing, access control, and network segmentation.

When you issue `vlan [vlan-id]`, the switch creates the VLAN if it does not exist and enters VLAN configuration mode, where you can assign a name, configure MTU, or set other parameters. The command is typically used during initial switch deployment, when adding new user groups, or when re-architecting a network. Alternatives include using the VLAN database mode (vlan database) on older IOS versions, but global config mode is the modern standard.

In the broader workflow, VLAN creation is often followed by assigning switch ports to the VLAN via `switchport access vlan` or `switchport trunk allowed vlan`. The command requires privilege level 15 (enable mode) and immediately updates the running configuration. Note that VLANs 1, 1002-1005 are reserved and cannot be deleted; VLAN 1 is the default VLAN.

The command does not produce buffered output; it directly modifies the config. Understanding VLANs is critical for CCNA and CCNP candidates as it underpins topics like trunking, VTP, and STP.

Syntax·Global Config

vlan [vlan-id]

When to Use This Command

Segmenting a network into separate broadcast domains for security or traffic management.
Creating a native VLAN for trunk ports to carry untagged traffic.
Setting up a management VLAN for remote switch administration.
Isolating guest Wi-Fi traffic from corporate data traffic.

Parameters

Parameter	Syntax	Required	Description
vlan-id	<1-4095>	Required	The VLAN number to create or modify. Valid range is 1 to 4095, but VLANs 1002-1005 are reserved for Token Ring and FDDI. Common practice uses VLANs 2-1001 for normal range and 1006-4095 for extended range (requires VTP transparent mode or no VTP). Mistake: using VLAN 0 or exceeding 4095.

Command Examples

Create VLAN 10 and assign a name

Switch(config)# vlan 10
Switch(config-vlan)# name Sales

Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# end
Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
10   Sales                            active    
1002 fddi-default                     act/unsup 
1003 token-ring-default               act/unsup 
1004 fddinet-default                  act/unsup 
1005 trnet-default                    act/unsup

The 'vlan 10' command creates VLAN 10 and enters VLAN configuration mode. 'name Sales' assigns a descriptive name. 'end' returns to privileged EXEC mode. 'show vlan brief' displays all VLANs; VLAN 10 now appears with name 'Sales' and status 'active' (no ports assigned yet).

Create VLAN 20 without a name

Switch(config)# vlan 20

Switch(config)# vlan 20
Switch(config-vlan)# end
Switch# show vlan id 20

VLAN ID: 20
VLAN Name: VLAN0020
VLAN Type: Ethernet
VLAN State: active
MTU: 1500
...

Creating VLAN 20 without a name results in a default name 'VLAN0020'. The 'show vlan id 20' command displays details: VLAN ID, name, type, state, and MTU.

Understanding the Output

The 'show vlan brief' output lists all VLANs with their ID, name, status, and assigned ports. 'Status' shows 'active' for operational VLANs; 'act/unsup' for default VLANs that are active but unsupported on the platform. Ports column lists interfaces in that VLAN; empty means no ports assigned.

'show vlan id X' gives detailed info: VLAN ID, name, type (Ethernet, FDDI, etc.), state (active or suspended), MTU, and other parameters. A healthy VLAN has 'active' state and correct MTU (1500 for Ethernet). Watch for 'suspended' state if VLAN is shut down or misconfigured.

Configuration Scenarios

Create a VLAN for the Engineering Department

A company wants to isolate the Engineering department traffic from other departments for security and broadcast control. The switch is a new Catalyst 2960 running IOS 15.x.

Topology

Switch1 (Gi0/1)---Engineering PCs
Switch1 (Gi0/2)---Trunk to Core

Steps

1.Step 1: Enter global configuration mode: Switch> enable
2.Step 2: Switch# configure terminal
3.Step 3: Create VLAN 10: Switch(config)# vlan 10
4.Step 4: Name the VLAN: Switch(config-vlan)# name Engineering
5.Step 5: Exit VLAN config: Switch(config-vlan)# exit
6.Step 6: Assign interface Gi0/1 to VLAN 10: Switch(config)# interface gigabitEthernet 0/1
7.Step 7: Switch(config-if)# switchport mode access
8.Step 8: Switch(config-if)# switchport access vlan 10
9.Step 9: End: Switch(config-if)# end

Configuration

!
Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# end

Verify: Use `show vlan brief` to verify VLAN 10 exists and Gi0/1 is in VLAN 10. Expected output includes VLAN10 with name Engineering and interface Gi0/1 listed.

Watch out: If the switch is in VTP server mode and the VLAN already exists in the VTP domain, creating it locally may cause inconsistencies. Ensure VTP mode is transparent or client if you want local control.

Create an Extended Range VLAN for a DMZ Network

A data center switch needs to create a VLAN in the extended range (1006-4095) for a DMZ segment. The switch is in VTP transparent mode to support extended VLANs.

Topology

Switch2 (Gi0/1)---DMZ Servers
Switch2 (Gi0/2)---Trunk to Firewall

Steps

1.Step 1: Enter global config: Switch> enable
2.Step 2: Switch# configure terminal
3.Step 3: Set VTP mode to transparent: Switch(config)# vtp mode transparent
4.Step 4: Create VLAN 2000: Switch(config)# vlan 2000
5.Step 5: Name the VLAN: Switch(config-vlan)# name DMZ
6.Step 6: Exit: Switch(config-vlan)# exit
7.Step 7: Assign interface Gi0/1: Switch(config)# interface gigabitEthernet 0/1
8.Step 8: Switch(config-if)# switchport mode access
9.Step 9: Switch(config-if)# switchport access vlan 2000
10.Step 10: End: Switch(config-if)# end

Configuration

!
Switch# configure terminal
Switch(config)# vtp mode transparent
Switch(config)# vlan 2000
Switch(config-vlan)# name DMZ
Switch(config-vlan)# exit
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 2000
Switch(config-if)# end

Verify: Use `show vlan id 2000` to see details. Also `show vtp status` to confirm transparent mode. Expected: VLAN2000 exists with name DMZ.

Watch out: Extended range VLANs are not saved in the VLAN database file (vlan.dat) by default; they are stored in the running config. Ensure you save the config with `copy running-config startup-config`.

Troubleshooting with This Command

When troubleshooting VLAN creation issues, the first step is to verify the VLAN exists using `show vlan brief` or `show vlan id [vlan-id]`. Healthy output shows the VLAN in the list with an active status. If the VLAN is missing, check if the switch is in VTP server mode and the VLAN might be pruned or not propagated.

Use `show vtp status` to confirm VTP mode and domain. If the VLAN is present but ports are not working, verify port assignment with `show interfaces [interface] switchport`. Look for the 'Access Mode VLAN' field; it should match the intended VLAN.

Common symptoms include: (1) VLAN not appearing after creation – ensure you are in global config mode and the VLAN ID is within range (1-4095). (2) VLAN appears but ports remain in VLAN 1 – check that the port is in access mode and the access VLAN is set. (3) Extended VLAN not saved after reload – ensure VTP mode is transparent and config is saved. (4) VLAN cannot be deleted – reserved VLANs (1,1002-1005) cannot be deleted. For inter-VLAN routing issues, verify the SVI (interface vlan) is created and has an IP address. Use `show ip interface brief` to see if the VLAN interface is up/up.

If the VLAN interface is down/down, the VLAN may not exist or there are no active ports in that VLAN. Also check trunk links: `show interfaces trunk` to ensure the VLAN is allowed on the trunk. Correlate with `show spanning-tree vlan [vlan-id]` to check for STP issues.

Debug commands like `debug vlan configuration` can be used but are rarely needed. Always start with `show vlan` and `show interfaces switchport`.

CCNA Exam Tips

CCNA exam tip: VLANs must be created before assigning them to switch ports; otherwise, the port will be in an error-disabled state.

CCNA exam tip: The 'vlan' command is executed in global config mode, not interface mode.

CCNA exam tip: VLAN 1 is the default VLAN and cannot be deleted; it is used for management by default.

CCNA exam tip: To delete a VLAN, use 'no vlan <vlan-id>'; this removes the VLAN and all ports assigned to it become inactive.

Common Mistakes

Mistake 1: Forgetting to create the VLAN before assigning it to a port, causing the port to be in an error-disabled state.

Mistake 2: Using 'vlan' in interface configuration mode instead of global config mode.

Mistake 3: Deleting a VLAN that has active ports, which shuts down those ports and can cause network outages.

vlan [vlan-id] vs switchport access vlan [vlan-id]

Both 'vlan [vlan-id]' and 'switchport access vlan [vlan-id]' deal with VLANs but operate at different layers: the first creates or modifies the VLAN itself in the global VLAN database, while the second assigns an interface to an existing VLAN as an access port. They are commonly confused because both include the VLAN ID and are essential for VLAN configuration, yet their scope and effects are distinct.

Aspect	vlan [vlan-id]	switchport access vlan [vlan-id]
Scope	Global VLAN database	Interface-specific
Configuration mode	Global configuration mode	Interface configuration mode
Effect on VLAN database	Creates VLAN if not exists	No effect on VLAN existence
Effect on traffic	No direct interface assignment	Assigns port to VLAN for untagged traffic
Persistence	VLAN persists in running config	Port assignment persists in running config
Typical use	Before assigning ports	After VLAN is created

Use vlan [vlan-id] when you need to create a new VLAN or modify its properties (e.g., name) before any port assignment.

Use switchport access vlan [vlan-id] when you want to assign a specific access port to an existing VLAN for untagged traffic.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/3850), the `vlan` command syntax is identical to classic IOS. However, IOS-XE uses a different configuration database; VLANs are stored in the running config and can be saved to startup config. NX-OS (e.g., Nexus switches) uses the `vlan [vlan-id]` command in global config mode as well, but the VLAN configuration mode is entered with `vlan [vlan-id]` and then you can set name, state, etc. The NX-OS equivalent is exactly the same command.

For ASA firewalls, VLANs are not created with this command; instead, you create subinterfaces with `interface gigabitethernet0/1.10 vlan 10`. IOS-XR does not support the `vlan` command in the same way; VLAN configuration is done under the interface using `vlan` subcommands. In older IOS 12.x, the VLAN database mode (`vlan database`) was an alternative, but it is deprecated.

In IOS 15.x and later, global config mode is the only method. There are no significant output differences between versions for this command. On some platforms, extended VLANs (1006-4095) require VTP transparent mode; this is consistent across IOS versions.

Always verify with `show vlan` after creation.

Related Commands

interface vlan [id]

Creates a Switch Virtual Interface (SVI) for a VLAN. An SVI is a Layer 3 virtual interface on a multilayer switch that provides IP connectivity for devices in that VLAN. Used for inter-VLAN routing and switch management IP.

show vlan brief

Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.

switchport access vlan [vlan-id]

Assigns a specific VLAN to an access port, placing the port in that VLAN for untagged traffic.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions