state active
Control whether a VLAN forwards traffic — used for maintenance or to temporarily disable a VLAN without deleting it.
Definition: state active is a Cisco IOS vlan config command. Sets the operational state of a VLAN to active (forwarding traffic) or suspend (VLAN exists in database but no traffic is forwarded). Active is the default state for all new VLANs.
Overview
The 'state active' command in VLAN configuration mode is used to activate a VLAN that has been suspended or is administratively down. VLANs are logical groupings of devices within a Layer 2 network, allowing broadcast domains to be segmented without physical separation. By default, VLANs are created in an active state, but an administrator may suspend a VLAN for maintenance, security, or troubleshooting purposes.
When a VLAN is suspended, it does not forward traffic, and any ports assigned to it become inactive. The 'state active' command reverses this, enabling the VLAN to resume normal operation. This command is essential for network engineers managing VLAN lifecycles, especially in environments with dynamic VLAN changes or during planned outages.
It is typically used after resolving issues that caused the VLAN to be suspended, such as STP topology changes, security incidents, or configuration errors. Alternatives include deleting and recreating the VLAN, but that would remove all associated configurations (e.g., VLAN interfaces, VTP settings). The 'state active' command preserves the VLAN configuration while simply toggling its operational state.
In the broader workflow, this command is often part of a recovery procedure: after identifying a suspended VLAN via 'show vlan' or 'show vlan brief', the engineer enters VLAN configuration mode and issues 'state active'. The change takes immediate effect and is written to the running configuration. Privilege level 15 (privileged EXEC) is required to enter global configuration mode and then VLAN configuration mode.
The command does not generate buffered output; it silently updates the VLAN state. It is important to note that the VLAN must exist in the VLAN database; if the VLAN does not exist, the command will be rejected. Also, the VLAN must not be a reserved VLAN (e.g., VLAN 1, 1002-1005) as these cannot be suspended or activated using this command.
Understanding the 'state active' command is fundamental for CCNA and CCNP candidates, as VLAN management is a core topic in switching technologies.
state {active | suspend}When to Use This Command
- Verify a newly created VLAN is in active state (state active is the default)
- Temporarily suspend a VLAN during maintenance without losing its configuration
- Re-activate a VLAN that was suspended for troubleshooting
- Check VLAN state when show vlan brief shows unexpected status
Command Examples
Create VLAN and verify active state
Switch(config)# vlan 10 Switch(config-vlan)# name SALES Switch(config-vlan)# state active Switch(config-vlan)# end Switch# show vlan id 10 VLAN Name Status Ports ---- -------------------------------- --------- ---------- 10 SALES active
Suspend a VLAN for maintenance
Switch(config)# vlan 20 Switch(config-vlan)# state suspend Switch(config-vlan)# end Switch# show vlan id 20 20 ENGINEERING suspended
Understanding the Output
show vlan brief Status column: 'active' = forwarding. 'suspended' = VLAN exists but not forwarding. 'act/unsup' = active but hardware does not support this VLAN type (legacy).
A suspended VLAN still appears in the VLAN database and can be re-activated with state active.
Configuration Scenarios
Reactivate a Suspended VLAN for a Guest Network
A company's guest VLAN (VLAN 100) was suspended during a security audit. After the audit, the network administrator needs to reactivate it to restore guest Wi-Fi access.
Topology
Switch1---Access Point (Guest SSID on VLAN 100)Steps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enter global configuration mode: configure terminal
- 3.Step 3: Enter VLAN configuration mode for VLAN 100: vlan 100
- 4.Step 4: Activate the VLAN: state active
- 5.Step 5: Exit VLAN configuration mode: exit
- 6.Step 6: Exit global configuration mode: exit
- 7.Step 7: Verify the VLAN state: show vlan id 100
! Full IOS config block Switch> enable Switch# configure terminal Switch(config)# vlan 100 Switch(config-vlan)# state active Switch(config-vlan)# exit Switch(config)# exit Switch#
Verify: Use 'show vlan id 100' to confirm the VLAN is active. Expected output shows VLAN 100 with status 'active'.
Watch out: If the VLAN is still suspended after the command, ensure the VLAN exists and is not a reserved VLAN (1, 1002-1005). Also, check if the VLAN is part of a VTP domain; VTP may override the state.
Activate a VLAN After STP Troubleshooting
During a network upgrade, VLAN 200 was suspended to prevent loops. After STP convergence, the engineer needs to reactivate VLAN 200 to restore connectivity for the sales department.
Topology
SwitchA(Gi0/1)---Trunk---(Gi0/1)SwitchB (VLAN 200 on both)Steps
- 1.Step 1: Enter privileged EXEC mode: enable
- 2.Step 2: Enter global configuration mode: configure terminal
- 3.Step 3: Enter VLAN configuration mode: vlan 200
- 4.Step 4: Activate the VLAN: state active
- 5.Step 5: Exit and verify: end
- 6.Step 6: Check VLAN status: show vlan brief | include 200
! Full IOS config block SwitchA> enable SwitchA# configure terminal SwitchA(config)# vlan 200 SwitchA(config-vlan)# state active SwitchA(config-vlan)# end SwitchA#
Verify: The output of 'show vlan brief' should show VLAN 200 with status 'active'. Also, 'show interfaces trunk' should show VLAN 200 in the allowed list.
Watch out: If the VLAN remains suspended, verify that the VLAN is not administratively down due to a shutdown command on the VLAN interface (if configured). The 'state active' command only affects the VLAN itself, not the SVI.
Troubleshooting with This Command
When troubleshooting a VLAN that is not forwarding traffic, the 'state active' command is often used after identifying a suspended VLAN. Healthy output from 'show vlan' shows the VLAN status as 'active'. Problem indicators include 'suspend' or 'act/lshut' (if the VLAN is suspended due to a link-state issue).
Focus on the 'Status' column in 'show vlan' output. Common symptoms: ports assigned to the VLAN are down/down, trunk links do not carry the VLAN, or hosts cannot ping the default gateway. The diagnostic flow: 1) Use 'show vlan brief' to list all VLANs and their status. 2) If the target VLAN is suspended, enter VLAN configuration mode and issue 'state active'. 3) Verify the change with 'show vlan id <vlan>'. 4) If the VLAN remains suspended, check for VTP pruning or VTP domain mismatches using 'show vtp status'. 5) Also check if the VLAN is shutdown at the SVI level with 'show interfaces vlan <vlan>'.
If the SVI is administratively down, use 'no shutdown' in interface configuration mode. 6) For trunk issues, use 'show interfaces trunk' to see if the VLAN is allowed and active. Correlate with 'show spanning-tree vlan <vlan>' to ensure STP is not blocking ports. The 'state active' command does not affect STP; it only changes the VLAN's administrative state.
If the VLAN is suspended due to a VTP pruning event, you may need to adjust VTP pruning settings. In rare cases, the VLAN database may be corrupted; use 'delete vlan.dat' and reload as a last resort. Always document the reason for suspension before reactivating to avoid repeating the issue.
CCNA Exam Tips
CCNA exam: VLANs default to active state
You rarely need to manually set state active — it is the default
Know that suspend preserves the VLAN configuration (name, etc.) but stops it from forwarding
The VLAN must exist and be active for show vlan brief to show traffic passing through access ports assigned to that VLAN
Common Mistakes
Creating a VLAN in global config (vlan 10) and forgetting to verify its state
Confusing VLAN state with STP port state — a VLAN can be active while STP is blocking specific ports in that VLAN
Not realising that VTP transparent mode VLANs are local-only and not propagated to other switches
state active vs show vlan brief
These commands are commonly considered together because both relate to VLAN operational status. 'state active' is used to configure a VLAN to forward traffic, while 'show vlan brief' displays the current status of all VLANs, helping to verify configuration changes.
| Aspect | state active | show vlan brief |
|---|---|---|
| Mode state | VLAN Config mode | Privileged EXEC mode |
| Action | Set VLAN state | Display VLAN summary |
| Persistence | Saved to running-config | Not configurable, read-only |
| Effect | Activates or suspends VLAN traffic | No effect on operation |
| Typical use | Enabling a suspended VLAN | Checking VLAN assignment |
Use state active when you need to change a VLAN's operational state from suspend to active to allow traffic forwarding.
Use show vlan brief when you need to quickly verify VLAN IDs, names, statuses, and assigned ports.
Platform Notes
In IOS-XE, the 'state active' command syntax and behavior are identical to classic IOS. The command is available in VLAN configuration mode. For NX-OS, the equivalent command is 'no shutdown' under the VLAN configuration mode (e.g., 'vlan 100', then 'no shutdown').
NX-OS uses 'shutdown' to suspend a VLAN and 'no shutdown' to activate it. There is no 'state active' command in NX-OS. For ASA devices, VLANs are configured differently; the ASA does not have a direct equivalent for VLAN state activation; VLANs are typically tied to interfaces and are active by default.
In IOS-XR, VLAN configuration is not supported in the same way; VLANs are managed via the L2VPN or bridge domain constructs, and there is no 'state active' command. For IOS versions, the command has been consistent from 12.x through 16.x. In older IOS (12.x), the VLAN database mode (vlan database) was used, but the 'state active' command existed in VLAN configuration mode as well.
In newer IOS (15.x and later), the VLAN configuration mode is the standard. There are no syntax differences between versions. Always ensure the VLAN is not a reserved VLAN (1, 1002-1005) as these cannot be suspended or activated.
The command is available on Catalyst switches running IOS or IOS-XE.
Related Commands
show interfaces trunk
Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.
show vlan brief
Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions