VLANs (Virtual Local Area Networks) solve a simple but huge problem: how to split a single physical network into multiple separate, isolated mini-networks without buying extra cables and switches. This matters for JNCIA-JUNOS because you will be tested on configuring these virtual splits and the connections (trunks) that carry traffic between switches — a foundational skill for any network engineer.
Jump to a section
A simple way to picture Junos VLAN and Layer 2 Switching
A busy apartment building with hundreds of residents. Each resident has a specific mailbox, numbered like 'Apt 101' or 'Apt 202'. The mail room is a single room with rows of these numbered mailboxes. When a letter arrives for 'Apt 101', the postie (the switch) doesn't open the letter (the data packet) to read its contents — that would be inefficient and a privacy breach. Instead, the postie simply looks at the apartment number on the envelope (the VLAN tag) and drops it into the correct slot.
Now imagine the building manager wants to create separate 'neighbourhoods' for different types of post — personal letters, packages, and official documents. They colour-code the mailboxes: blue labels for personal mail, red for packages, green for official documents. These colour groups are exactly like VLANs — they logically separate traffic without needing a separate physical mail room for each type. A package for 'Apt 101' with a red tag goes into a red-marked slot even though the apartment number is the same as the blue slot next to it.
Trunking is like a mega-mail-sorting conveyor belt that connects two mail rooms in different wings of the building. This one conveyor belt carries letters of all colours at once, because each envelope is already tagged with its colour. Without trunking, you'd need a separate conveyor for each colour — expensive and wasteful. The switch (the postie) at each end reads the colour tag and places the letter into the correct mailbox for that apartment.
A switch is a network device that connects devices on the same local network — think of it as a smart distribution board that sends data only to the right device, rather than blasting it to everyone (like an old hub did). By default, all devices plugged into the same switch belong to the same single broadcast domain. A broadcast domain means that when one device shouts out a message (a broadcast frame) asking 'Who has this address?', every other device on that switch hears it. This is fine for a few devices, but in a large network, it creates noise and security risks — anyone could listen in.
VLANs solve this by carving the switch into multiple virtual mini-switches. Each VLAN is its own isolated broadcast domain. Devices in VLAN 10 never hear broadcasts from devices in VLAN 20, even though they share the same physical switch. This gives you:
Security: sensitive finance department traffic is invisible to the marketing team's devices.
Performance: fewer devices per broadcast domain means less unnecessary traffic.
Flexibility: you can group devices by function (engineering, sales, HR) regardless of where they are physically plugged in.
To make VLANs work, every frame (a unit of data at Layer 2) must carry a tag identifying which VLAN it belongs to. This is defined by the IEEE 802.1Q standard. The tag is a 4-byte field inserted into the Ethernet frame header. It contains a 12-bit VLAN ID, allowing for up to 4,096 VLANs (IDs 0 and 4095 are reserved). On Junos, you configure a VLAN by creating a VLAN interface (often called an IRB — Integrated Routing and Bridging interface) and assigning it an IP address if you want devices in different VLANs to communicate (that requires routing, which is Layer 3).
Now, trunking. A trunk port is a switch port that carries traffic for multiple VLANs simultaneously. On a standard access port, the switch strips off the VLAN tag before sending the frame to a device (like a PC or printer) because the device doesn't understand tags. On a trunk port, the switch keeps the tag intact so that another switch (or a router) can read it and forward the frame to the correct VLAN. Trunks are typically used between switches, or between a switch and a router that supports VLAN tagging (a 'router-on-a-stick').
On Junos, configuring VLANs and trunking involves three main steps: first, define the VLANs under the 'vlans' hierarchy in configuration (e.g., 'set vlans Sales vlan-id 10'). Second, configure an interface as a trunk port by setting the port mode to trunk and specifying which VLANs are allowed (e.g., 'set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk' and 'set vlans Sales interface ge-0/0/1.0'). Third, if you need inter-VLAN routing, configure an IRB interface and assign an IP address to it, then associate the IRB with the VLAN.
Junos uses an implicit (automatic) IRB interface called 'vlan.0' for management, but for real routing you create explicit IRB interfaces like 'irb.10' for VLAN 10. The switch uses MAC address tables (also called CAM tables) to learn which MAC addresses are on which ports and VLANs, making forwarding decisions without flooding the network.
A common beginner error is forgetting that untagged traffic from a device on an access port is automatically placed into the native VLAN (usually VLAN 1). To avoid confusion, Juniper recommends never using VLAN 1 for user traffic — change the native VLAN to something else. Also, you must ensure that both ends of a trunk link agree which VLANs are allowed and that the native VLAN matches, otherwise traffic will not pass correctly.
Define the VLAN
In Junos configuration mode, use 'set vlans <name> vlan-id <id>' to create a VLAN. For example, 'set vlans Sales vlan-id 10'. This creates a container for that VLAN but does not yet assign any ports. The VLAN name is local to the switch and does not need to match across switches, but it is good practise to keep names consistent.
Configure an interface as an access port
Select an interface (e.g., ge-0/0/1) and set its port mode to access. Then assign it to the VLAN you just created: 'set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access' and 'set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members Sales'. This tells the switch to assign all untagged traffic on that port to VLAN 10.
Configure an interface as a trunk port
For a link connecting two switches, set the port mode to trunk and specify which VLANs are allowed: 'set interfaces ge-0/0/24 unit 0 family ethernet-switching port-mode trunk' and 'set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members [Sales Engineering]'. You can also set a native VLAN with 'native-vlan-id'.
Create an IRB interface for inter-VLAN routing
If you need devices in different VLANs to talk, create an IRB interface: 'set interfaces irb unit 10 family inet address 192.168.10.1/24'. Then associate the VLAN with the IRB: 'set vlans Sales l3-interface irb.10'. This enables the switch to route traffic between VLANs as a Layer 3 device.
Commit and verify the configuration
Run 'commit' to apply the changes. Then use 'show vlans' to see the VLANs and their port members, 'show ethernet-switching table' to see MAC addresses learned, and 'show interfaces terse' to confirm the interface status. If something is wrong, use 'show configuration' to review your config and 'monitor traffic interface' to debug.
Imagine you are the sole IT person for a growing company with 50 employees in a single office. The CEO asks you to secure the network so the finance team's data cannot be accessed by anyone else, and so the guest Wi-Fi cannot see internal servers. You have one physical switch, a Juniper EX2300. You cannot buy extra hardware, so VLANs are your tool.
First, you define three VLANs:
VLAN 10 — Finance (tag 10)
VLAN 20 — Internal Staff (tag 20)
VLAN 30 — Guests (tag 30)
You connect the finance team's computers to ports ge-0/0/1 through ge-0/0/5. For each of these ports, you configure the port as an access port in VLAN 10. That means any device plugged into these ports is automatically placed into the Finance VLAN, and the switch removes the tag before sending data to the computer (the computer doesn't know or care about VLANs).
Next, the internal staff are connected to ports ge-0/0/6 through ge-0/0/20, access ports in VLAN 20. Guest Wi-Fi access points are connected to ports ge-0/0/21-22, access ports in VLAN 30.
Now, you need the staff to access a central file server. The file server is connected to port ge-0/0/24. That server must be reachable from all three VLANs. You configure ge-0/0/24 as a trunk port because it needs to carry traffic for VLANs 10, 20, and 30. The server's network interface card (NIC) must support tagging — if it does not, you configure the server to use a sub-interface per VLAN or use a router-on-a-stick.
Next, you configure a router interface (on the same switch or a separate router) to route between VLANs. On Junos, you create an IRB interface for each VLAN: irb.10 with IP 192.168.10.1/24, irb.20 with 192.168.20.1/24, irb.30 with 192.168.30.1/24. You set the default gateway on each device to these IPs. Now, traffic from a finance PC (VLAN 10) destined for the file server in VLAN 20 goes to the switch, which sees the destination MAC is on a different VLAN, so it sends the frame to the IRB interface, which routes it to the correct VLAN.
A real problem you will face: a user plugs a personal laptop into a guest port and complains they cannot see the printer. You double-check that the printer is on VLAN 20 and the guest port is on VLAN 30 — that is working as designed. You explain to the user that guests intentionally cannot access internal resources.
You also need to test your configuration. On Junos, use 'show vlans' to see the list of VLANs and their port membership. Use 'show ethernet-switching table' to see which MAC addresses the switch has learned on which VLAN and port. If a device is unreachable, check if the port is up ('show interfaces terse'), and if the VLAN is correctly configured on that interface.
The JNCIA-JUNOS exam tests VLAN and Layer 2 switching in several ways. You must be prepared for multiple-choice questions, drag-and-drop ordering tasks, and configuration scenario questions. The exam loves to test your understanding of the difference between an access port and a trunk port. A typical trap question gives you a scenario: 'An interface is configured as an access port in VLAN 10. A trunk port is connected to this switch. What happens when a frame tagged for VLAN 20 arrives on the trunk?' The correct answer: the switch drops the frame because the access port does not accept tagged traffic (unless it is the native VLAN).
Another common exam topic is the native VLAN. The exam assumes you know that on a trunk port, untagged frames are sent to the native VLAN (usually VLAN 1 by default). If you configure the native VLAN differently on each end of a trunk, traffic will be misdelivered. They will test you with a scenario where a trunk between two switches works except for one VLAN, and you must identify the native VLAN mismatch.
Key concepts to memorise:
VLAN ID range: 1 to 4094 (0 and 4095 reserved).
Default VLAN: VLAN 1 for all ports, untagged.
Port modes: access (one VLAN, untagged) vs. trunk (many VLANs, tagged + optional native untagged).
On Junos, a trunk port is configured under 'ethernet-switching' with 'port-mode trunk' and 'vlan members'. The native VLAN is set with 'native-vlan-id' under the trunk configuration.
IRB interfaces are used for inter-VLAN routing; they require a VLAN association and an IP address.
A typical exam question asks: 'How many broadcast domains exist in a switch with 3 VLANs?' Answer: 3 — each VLAN creates a separate broadcast domain.
They also test Layer 2 switching fundamentals: the switch learns MAC addresses by examining the source MAC of incoming frames and builds a MAC address table. Flooding occurs when the destination MAC is unknown (not in the table) or is a broadcast address. They might ask: 'What happens when a switch receives a frame destined for an unknown unicast MAC?' The switch floods the frame out of all ports in the same VLAN except the incoming port.
Traps to avoid:
Do not confuse VLANs with subnets. VLANs are Layer 2 concepts; subnets are Layer 3 (IP). They often map one-to-one, but they are not the same thing.
Do not forget that a trunk port can carry multiple VLANs, but the switch's management interface (typically vlan.0) is on VLAN 1 by default. If you change VLAN 1, the management interface might stop working unless you reconfigure it.
The exam might show you a configuration snippet with 'unit 0 family inet address' on an IRB interface — they expect you to know that IRB interfaces are Layer 3 interfaces for VLAN routing.
Finally, practise the 'show' commands because the exam tests your ability to interpret output. For example, 'show ethernet-switching interface' displays which VLANs are on which ports. 'show vlans extensive' gives detailed information including IRB association.
A VLAN creates a single broadcast domain at Layer 2, isolating traffic from other VLANs on the same switch.
An access port belongs to exactly one VLAN and strips the 802.1Q tag before sending frames to the end device.
A trunk port carries frames for multiple VLANs and preserves the 802.1Q tag between switches or between a switch and a router.
Inter-VLAN routing requires a Layer 3 interface — either an IRB on the switch itself or an external router — not just VLAN configuration.
The native VLAN on a trunk is the VLAN that carries untagged frames; both ends of a trunk must agree on the native VLAN ID.
The switch learns MAC addresses from incoming frames and builds a MAC address table per VLAN, flooding frames only when the destination MAC is unknown.
VLAN IDs range from 1 to 4094, with IDs 0 and 4095 reserved; VLAN 1 is the default native VLAN and should be changed for security best practice.
On Junos, you define VLANs under the 'vlans' configuration hierarchy and assign ports using 'vlan members' or 'access vlan' statements.
These come up on the exam all the time. Here's how to tell them apart.
Access Port
Belongs to a single VLAN only.
Strips the 802.1Q tag before sending frames to the connected device.
Used to connect end devices like PCs, printers, and IP phones that do not understand VLAN tags.
Trunk Port
Can carry traffic for multiple VLANs simultaneously.
Preserves the 802.1Q tag so that other switches or routers can read the VLAN ID.
Used to connect switches to each other, or to connect a switch to a router that supports VLAN tagging.
Default VLAN (VLAN 1)
Pre-existing VLAN on all ports by default, with VLAN ID 1.
Cannot be deleted on most Junos switches; used for management traffic if not changed.
All untagged traffic defaults to VLAN 1 unless reassigned.
Native VLAN
The VLAN assigned to untagged frames on a trunk port.
Configurable to any VLAN ID (commonly changed to an unused ID for security).
If both ends of a trunk have mismatched native VLANs, untagged traffic is misrouted.
Layer 2 Switch
Forwards frames based on MAC addresses only.
Does not perform routing; all VLANs are isolated from each other.
Cannot provide inter-VLAN communication without an external router.
Layer 3 Switch (with IRB)
Can also forward packets based on IP addresses (routing).
Uses IRB interfaces to route between VLANs natively.
Can replace both a switch and a separate router in a small network.
Broadcast Domain
A Layer 2 concept: all devices in the same VLAN hear each other's broadcasts.
Defined by VLAN ID (e.g., VLAN 10).
Cannot cross a router or a Layer 3 boundary without routing.
Subnet (IP Network)
A Layer 3 concept: a range of IP addresses (e.g., 192.168.10.0/24).
Defined by IP address and subnet mask.
Devices in different subnets can communicate only through a router.
Static VLAN
Port membership assigned manually per port.
Simple to configure and troubleshoot.
Does not change unless the administrator reconfigures the port.
Dynamic VLAN (VMPS)
Port membership determined automatically based on device’s MAC address.
Requires a VMPS (VLAN Membership Policy Server) database.
Less common in modern networks; not typically tested on JNCIA.
Mistake
A VLAN is the same as a subnet, and you must assign an IP address to the VLAN itself, not the interface.
Correct
A VLAN is a Layer 2 broadcast domain; a subnet is a Layer 3 (IP) network. You assign an IP address to the IRB interface that is associated with the VLAN, not to the VLAN directly.
Beginners often see VLANs and subnets used together in network diagrams and assume they are interchangeable terms. They also see 'ip address' commands in router configuration and mistakenly apply them to VLANs instead of IRBs.
Mistake
Trunk ports are only used between switches, never for connecting end devices like servers.
Correct
Trunk ports can connect any device that supports 802.1Q tagging, including servers, routers, and even some hypervisors and access points that understand VLAN tags.
Textbooks often illustrate trunking only between switches, leading beginners to think it's exclusive to that scenario. In reality, any device that can handle tagged frames can use a trunk port.
Mistake
A switch in a VLAN configuration automatically routes traffic between VLANs without any additional setup.
Correct
Switches are Layer 2 devices and do not route. To route between VLANs, you need a Layer 3 interface (like an IRB on a switch, or a separate router). Without routing, devices in different VLANs cannot communicate.
Many entry-level networking students assume that 'VLAN' implies routing capability, because in small labs they often configure a switch that also has routing features (a Layer 3 switch) and assume all switches route.
Mistake
If you configure a port as an access port in VLAN 10, any device plugged into that port will automatically be in VLAN 10 regardless of what the device sends.
Correct
While the switch does assign the port to VLAN 10, the device must still have its IP configuration (subnet, gateway) consistent with VLAN 10. If the device has a static IP from a different subnet, it cannot communicate within VLAN 10 without a router.
Beginners often confuse VLAN assignment with IP addressing, thinking that plugging into the right port is enough to ensure connectivity, when the device's own IP settings must match the VLAN's subnet.
Mistake
The native VLAN should always be VLAN 1 because that is the default and it works out of the box.
Correct
Security best practice is to change the native VLAN to an unused VLAN ID (e.g., VLAN 999) to prevent VLAN hopping attacks, where an attacker can send untagged frames to reach a management interface on VLAN 1.
Since VLAN 1 is the default, new users often avoid changing it because they fear breaking something. They are unaware of the security risk and that many exam questions test this best practice.
Mistake
The number of VLANs you can create is exactly 4096, and all those IDs are available for use.
Correct
The 12-bit VLAN ID field allows 4096 values (0-4095), but IDs 0 and 4095 are reserved, so only 4094 usable VLAN IDs exist (1-4094).
The '4096' figure is commonly quoted without the 'reserved' caveat, leading to off-by-one errors in exam answers and real-world configurations.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The Juniper EX2300 supports up to 512 VLANs (depending on model and Junos version) out of the total 4094 possible VLAN IDs. The number is limited by hardware resources, not just the VLAN ID range.
The default VLAN is VLAN 1, which all ports belong to by default. The native VLAN is the VLAN assigned to untagged frames on a trunk port — by default, it is also VLAN 1, but you can change it with 'native-vlan-id' to a different ID.
Yes, because switches operate at Layer 2 and cannot route between VLANs. You need a Layer 3 device — a router, or a Layer 3 switch with an IRB interface — to forward traffic between VLANs.
If both ends default to VLAN 1 as the native VLAN, it still works. But the problem arises if one end is changed to a different native VLAN (e.g., VLAN 999) and the other remains VLAN 1 — then untagged frames will be interpreted as belonging to different VLANs at each end, causing miscommunication or complete loss of connectivity.
No, a physical port can only operate in one mode at a time. You can configure it as an access port (one untagged VLAN) or as a trunk port (multiple tagged VLANs optionally with a native untagged VLAN).
Use the command 'show vlans' to list all configured VLANs, their tag numbers, and which interfaces are part of them. For detailed information including IRB association, use 'show vlans extensive'.
You've finished Junos VLAN and Layer 2 Switching. Continue through the JNCIA-JUNOS study guide to build a complete picture of the exam.
Done with this chapter?