VLANs Explained

A VLAN (Virtual Local Area Network) is a logical grouping of devices within the same broadcast domain, regardless of their physical location on the network. By default, all ports on a Cisco switch belong to VLAN 1, the default VLAN. The primary reason VLANs exist is to segment a LAN into multiple isolated broadcast domains without requiring separate physical switches. Without VLANs, every frame sent as a broadcast would reach every port on the switch, consuming bandwidth and CPU cycles on every connected device. VLANs confine broadcasts to only those ports that belong to the same VLAN, improving performance and security.

When a switch receives a frame on a port, it associates that frame with the VLAN configured on that port (the access VLAN). For frames destined to another switch over a trunk link, the switch inserts a 4-byte 802.1Q tag into the Ethernet frame header. This tag contains a 12-bit VLAN ID (VID), allowing up to 4094 VLANs (1-4094, with 0 and 4095 reserved). The tag is inserted between the Source MAC Address and the EtherType/Length fields. On the receiving switch, the tag is examined, and the frame is forwarded only to ports in that same VLAN. The original frame is restored (tag removed) before being sent out an access port.

To configure a VLAN on a Cisco IOS switch, you first create the VLAN in global configuration mode, then assign ports to it. Example:

Switch(config)# vlan 10
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# end

To verify VLAN configuration:

Switch# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/2, Gi0/3, Gi0/4, Gi0/5
10   Engineering                      active    Gi0/1

To verify trunk configuration:

Switch# show interfaces trunk

Port        Mode         Encapsulation  Status        Native vlan
Gi0/1       on           802.1q         trunking      1

Port        Vlans allowed on trunk
Gi0/1       1-4094

Port        Vlans active and in local forwarding table
Gi0/1       1,10

In a typical enterprise campus network, VLANs are used to segregate departments, functions, or security zones. For example, a hospital might have VLAN 10 for patient records (HIPAA-compliant), VLAN 20 for guest Wi-Fi (internet-only), and VLAN 30 for IP phones (VoQoS). Each VLAN is mapped to a separate IP subnet, and routing between VLANs is done via a Layer 3 switch (using SVIs) or a router-on-a-stick. A network engineer would design the VLAN numbering scheme to be consistent across all switches, often using a standard like 'VLAN X = subnet 10.X.0.0/24'. Trunk links between access switches and distribution switches carry multiple VLANs. A common scale consideration is the number of VLANs: while 4094 are theoretically possible, most switches support around 1000-2000 VLANs in hardware forwarding tables. Performance-wise, each VLAN runs its own STP instance (PVST+), so too many VLANs can overload the CPU. In production, engineers often use MSTP (Multiple Spanning Tree Protocol) to map multiple VLANs to fewer STP instances. A classic misconfiguration nightmare is the 'VLAN ACL' or 'VACL' (beyond CCNA) but the simplest mistake is forgetting to create the VLAN before assigning ports. I once spent two hours troubleshooting a 'dead' port on a floor switch, only to find the VLAN was never created—the port was in err-disabled state because it was assigned to a non-existent VLAN. Another common issue is trunk allowed VLAN lists: if you accidentally remove a VLAN from the allowed list on a trunk, that VLAN goes dark across the link. Always verify with show interfaces trunk after changes.