# Junos VLAN and Layer 2 Switching

> Chapter 11 of the Courseiva JUNIPER-JNCIA-JUNOS curriculum — https://courseiva.com/learn/juniper-jncia-junos/junos-vlan-and-layer-2-switching

**Official objective:** 4.1 — Configure VLANs, trunking, and basic layer 2 switching on Junos devices.

## Introduction

VLANs (Virtual Local Area Networks) solve a simple but huge problem: how to split a single physical network into multiple separate, isolated mini-networks without buying extra cables and switches. This matters for JNCIA-JUNOS because you will be tested on configuring these virtual splits and the connections (trunks) that carry traffic between switches — a foundational skill for any network engineer.

## The Apartment Building Mail Room Analogy

A busy apartment building with hundreds of residents. Each resident has a specific mailbox, numbered like 'Apt 101' or 'Apt 202'. The mail room is a single room with rows of these numbered mailboxes. When a letter arrives for 'Apt 101', the postie (the switch) doesn't open the letter (the data packet) to read its contents — that would be inefficient and a privacy breach. Instead, the postie simply looks at the apartment number on the envelope (the VLAN tag) and drops it into the correct slot.

Now imagine the building manager wants to create separate 'neighbourhoods' for different types of post — personal letters, packages, and official documents. They colour-code the mailboxes: blue labels for personal mail, red for packages, green for official documents. These colour groups are exactly like VLANs — they logically separate traffic without needing a separate physical mail room for each type. A package for 'Apt 101' with a red tag goes into a red-marked slot even though the apartment number is the same as the blue slot next to it.

Trunking is like a mega-mail-sorting conveyor belt that connects two mail rooms in different wings of the building. This one conveyor belt carries letters of all colours at once, because each envelope is already tagged with its colour. Without trunking, you'd need a separate conveyor for each colour — expensive and wasteful. The switch (the postie) at each end reads the colour tag and places the letter into the correct mailbox for that apartment.

## Core explanation

A switch is a network device that connects devices on the same local network — think of it as a smart distribution board that sends data only to the right device, rather than blasting it to everyone (like an old hub did). By default, all devices plugged into the same switch belong to the same single broadcast domain. A broadcast domain means that when one device shouts out a message (a broadcast frame) asking 'Who has this address?', every other device on that switch hears it. This is fine for a few devices, but in a large network, it creates noise and security risks — anyone could listen in.

VLANs solve this by carving the switch into multiple virtual mini-switches. Each VLAN is its own isolated broadcast domain. Devices in VLAN 10 never hear broadcasts from devices in VLAN 20, even though they share the same physical switch. This gives you:

- Security: sensitive finance department traffic is invisible to the marketing team's devices.
- Performance: fewer devices per broadcast domain means less unnecessary traffic.
- Flexibility: you can group devices by function (engineering, sales, HR) regardless of where they are physically plugged in.

To make VLANs work, every frame (a unit of data at Layer 2) must carry a tag identifying which VLAN it belongs to. This is defined by the IEEE 802.1Q standard. The tag is a 4-byte field inserted into the Ethernet frame header. It contains a 12-bit VLAN ID, allowing for up to 4,096 VLANs (IDs 0 and 4095 are reserved). On Junos, you configure a VLAN by creating a VLAN interface (often called an IRB — Integrated Routing and Bridging interface) and assigning it an IP address if you want devices in different VLANs to communicate (that requires routing, which is Layer 3).

Now, trunking. A trunk port is a switch port that carries traffic for multiple VLANs simultaneously. On a standard access port, the switch strips off the VLAN tag before sending the frame to a device (like a PC or printer) because the device doesn't understand tags. On a trunk port, the switch keeps the tag intact so that another switch (or a router) can read it and forward the frame to the correct VLAN. Trunks are typically used between switches, or between a switch and a router that supports VLAN tagging (a 'router-on-a-stick').

On Junos, configuring VLANs and trunking involves three main steps: first, define the VLANs under the 'vlans' hierarchy in configuration (e.g., 'set vlans Sales vlan-id 10'). Second, configure an interface as a trunk port by setting the port mode to trunk and specifying which VLANs are allowed (e.g., 'set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk' and 'set vlans Sales interface ge-0/0/1.0'). Third, if you need inter-VLAN routing, configure an IRB interface and assign an IP address to it, then associate the IRB with the VLAN.

Junos uses an implicit (automatic) IRB interface called 'vlan.0' for management, but for real routing you create explicit IRB interfaces like 'irb.10' for VLAN 10. The switch uses MAC address tables (also called CAM tables) to learn which MAC addresses are on which ports and VLANs, making forwarding decisions without flooding the network.

A common beginner error is forgetting that untagged traffic from a device on an access port is automatically placed into the native VLAN (usually VLAN 1). To avoid confusion, Juniper recommends never using VLAN 1 for user traffic — change the native VLAN to something else. Also, you must ensure that both ends of a trunk link agree which VLANs are allowed and that the native VLAN matches, otherwise traffic will not pass correctly.

## Real-world context

Imagine you are the sole IT person for a growing company with 50 employees in a single office. The CEO asks you to secure the network so the finance team's data cannot be accessed by anyone else, and so the guest Wi-Fi cannot see internal servers. You have one physical switch, a Juniper EX2300. You cannot buy extra hardware, so VLANs are your tool.

First, you define three VLANs:

- VLAN 10 — Finance (tag 10)
- VLAN 20 — Internal Staff (tag 20)
- VLAN 30 — Guests (tag 30)

You connect the finance team's computers to ports ge-0/0/1 through ge-0/0/5. For each of these ports, you configure the port as an access port in VLAN 10. That means any device plugged into these ports is automatically placed into the Finance VLAN, and the switch removes the tag before sending data to the computer (the computer doesn't know or care about VLANs).

Next, the internal staff are connected to ports ge-0/0/6 through ge-0/0/20, access ports in VLAN 20. Guest Wi-Fi access points are connected to ports ge-0/0/21-22, access ports in VLAN 30.

Now, you need the staff to access a central file server. The file server is connected to port ge-0/0/24. That server must be reachable from all three VLANs. You configure ge-0/0/24 as a trunk port because it needs to carry traffic for VLANs 10, 20, and 30. The server's network interface card (NIC) must support tagging — if it does not, you configure the server to use a sub-interface per VLAN or use a router-on-a-stick.

Next, you configure a router interface (on the same switch or a separate router) to route between VLANs. On Junos, you create an IRB interface for each VLAN: irb.10 with IP 192.168.10.1/24, irb.20 with 192.168.20.1/24, irb.30 with 192.168.30.1/24. You set the default gateway on each device to these IPs. Now, traffic from a finance PC (VLAN 10) destined for the file server in VLAN 20 goes to the switch, which sees the destination MAC is on a different VLAN, so it sends the frame to the IRB interface, which routes it to the correct VLAN.

A real problem you will face: a user plugs a personal laptop into a guest port and complains they cannot see the printer. You double-check that the printer is on VLAN 20 and the guest port is on VLAN 30 — that is working as designed. You explain to the user that guests intentionally cannot access internal resources.

You also need to test your configuration. On Junos, use 'show vlans' to see the list of VLANs and their port membership. Use 'show ethernet-switching table' to see which MAC addresses the switch has learned on which VLAN and port. If a device is unreachable, check if the port is up ('show interfaces terse'), and if the VLAN is correctly configured on that interface.

## Exam focus

The JNCIA-JUNOS exam tests VLAN and Layer 2 switching in several ways. You must be prepared for multiple-choice questions, drag-and-drop ordering tasks, and configuration scenario questions. The exam loves to test your understanding of the difference between an access port and a trunk port. A typical trap question gives you a scenario: 'An interface is configured as an access port in VLAN 10. A trunk port is connected to this switch. What happens when a frame tagged for VLAN 20 arrives on the trunk?' The correct answer: the switch drops the frame because the access port does not accept tagged traffic (unless it is the native VLAN).

Another common exam topic is the native VLAN. The exam assumes you know that on a trunk port, untagged frames are sent to the native VLAN (usually VLAN 1 by default). If you configure the native VLAN differently on each end of a trunk, traffic will be misdelivered. They will test you with a scenario where a trunk between two switches works except for one VLAN, and you must identify the native VLAN mismatch.

Key concepts to memorise:

- VLAN ID range: 1 to 4094 (0 and 4095 reserved).
- Default VLAN: VLAN 1 for all ports, untagged.
- Port modes: access (one VLAN, untagged) vs. trunk (many VLANs, tagged + optional native untagged).
- On Junos, a trunk port is configured under 'ethernet-switching' with 'port-mode trunk' and 'vlan members'. The native VLAN is set with 'native-vlan-id' under the trunk configuration.
- IRB interfaces are used for inter-VLAN routing; they require a VLAN association and an IP address.

A typical exam question asks: 'How many broadcast domains exist in a switch with 3 VLANs?' Answer: 3 — each VLAN creates a separate broadcast domain.

They also test Layer 2 switching fundamentals: the switch learns MAC addresses by examining the source MAC of incoming frames and builds a MAC address table. Flooding occurs when the destination MAC is unknown (not in the table) or is a broadcast address. They might ask: 'What happens when a switch receives a frame destined for an unknown unicast MAC?' The switch floods the frame out of all ports in the same VLAN except the incoming port.

Traps to avoid:

- Do not confuse VLANs with subnets. VLANs are Layer 2 concepts; subnets are Layer 3 (IP). They often map one-to-one, but they are not the same thing.
- Do not forget that a trunk port can carry multiple VLANs, but the switch's management interface (typically vlan.0) is on VLAN 1 by default. If you change VLAN 1, the management interface might stop working unless you reconfigure it.
- The exam might show you a configuration snippet with 'unit 0 family inet address' on an IRB interface — they expect you to know that IRB interfaces are Layer 3 interfaces for VLAN routing.

Finally, practise the 'show' commands because the exam tests your ability to interpret output. For example, 'show ethernet-switching interface' displays which VLANs are on which ports. 'show vlans extensive' gives detailed information including IRB association.

## Step by step

1. **Define the VLAN** — In Junos configuration mode, use 'set vlans <name> vlan-id <id>' to create a VLAN. For example, 'set vlans Sales vlan-id 10'. This creates a container for that VLAN but does not yet assign any ports. The VLAN name is local to the switch and does not need to match across switches, but it is good practise to keep names consistent.
2. **Configure an interface as an access port** — Select an interface (e.g., ge-0/0/1) and set its port mode to access. Then assign it to the VLAN you just created: 'set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access' and 'set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members Sales'. This tells the switch to assign all untagged traffic on that port to VLAN 10.
3. **Configure an interface as a trunk port** — For a link connecting two switches, set the port mode to trunk and specify which VLANs are allowed: 'set interfaces ge-0/0/24 unit 0 family ethernet-switching port-mode trunk' and 'set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members [Sales Engineering]'. You can also set a native VLAN with 'native-vlan-id'.
4. **Create an IRB interface for inter-VLAN routing** — If you need devices in different VLANs to talk, create an IRB interface: 'set interfaces irb unit 10 family inet address 192.168.10.1/24'. Then associate the VLAN with the IRB: 'set vlans Sales l3-interface irb.10'. This enables the switch to route traffic between VLANs as a Layer 3 device.
5. **Commit and verify the configuration** — Run 'commit' to apply the changes. Then use 'show vlans' to see the VLANs and their port members, 'show ethernet-switching table' to see MAC addresses learned, and 'show interfaces terse' to confirm the interface status. If something is wrong, use 'show configuration' to review your config and 'monitor traffic interface' to debug.

## Comparisons

### Access Port vs Trunk Port

**Access Port:**
- Belongs to a single VLAN only.
- Strips the 802.1Q tag before sending frames to the connected device.
- Used to connect end devices like PCs, printers, and IP phones that do not understand VLAN tags.

**Trunk Port:**
- Can carry traffic for multiple VLANs simultaneously.
- Preserves the 802.1Q tag so that other switches or routers can read the VLAN ID.
- Used to connect switches to each other, or to connect a switch to a router that supports VLAN tagging.

### Default VLAN (VLAN 1) vs Native VLAN

**Default VLAN (VLAN 1):**
- Pre-existing VLAN on all ports by default, with VLAN ID 1.
- Cannot be deleted on most Junos switches; used for management traffic if not changed.
- All untagged traffic defaults to VLAN 1 unless reassigned.

**Native VLAN:**
- The VLAN assigned to untagged frames on a trunk port.
- Configurable to any VLAN ID (commonly changed to an unused ID for security).
- If both ends of a trunk have mismatched native VLANs, untagged traffic is misrouted.

### Layer 2 Switch vs Layer 3 Switch (with IRB)

**Layer 2 Switch:**
- Forwards frames based on MAC addresses only.
- Does not perform routing; all VLANs are isolated from each other.
- Cannot provide inter-VLAN communication without an external router.

**Layer 3 Switch (with IRB):**
- Can also forward packets based on IP addresses (routing).
- Uses IRB interfaces to route between VLANs natively.
- Can replace both a switch and a separate router in a small network.

### Broadcast Domain vs Subnet (IP Network)

**Broadcast Domain:**
- A Layer 2 concept: all devices in the same VLAN hear each other's broadcasts.
- Defined by VLAN ID (e.g., VLAN 10).
- Cannot cross a router or a Layer 3 boundary without routing.

**Subnet (IP Network):**
- A Layer 3 concept: a range of IP addresses (e.g., 192.168.10.0/24).
- Defined by IP address and subnet mask.
- Devices in different subnets can communicate only through a router.

### Static VLAN vs Dynamic VLAN (VMPS)

**Static VLAN:**
- Port membership assigned manually per port.
- Simple to configure and troubleshoot.
- Does not change unless the administrator reconfigures the port.

**Dynamic VLAN (VMPS):**
- Port membership determined automatically based on device’s MAC address.
- Requires a VMPS (VLAN Membership Policy Server) database.
- Less common in modern networks; not typically tested on JNCIA.

## Diagram

_Two switches connected via a trunk port carrying VLAN 10 and VLAN 20 traffic, with IRB interfaces on Switch 1 enabling inter-VLAN routing._

```mermaid
flowchart TD
    A[Access Port<br>PC in VLAN 10] --> B[Switch 1]
    C[Access Port<br>PC in VLAN 20] --> B
    B -- Trunk carrying<br>VLAN 10 & 20 --> D[Switch 2]
    D --> E[Access Port<br>Server in VLAN 10]
    D --> F[Access Port<br>Printer in VLAN 20]
    B -- IRB.10 (192.168.10.1) routes<br>between VLANs --> B
    B -- IRB.20 (192.168.20.1) routes<br>between VLANs --> B
```

## Common misconceptions

- **Misconception:** A VLAN is the same as a subnet, and you must assign an IP address to the VLAN itself, not the interface. **Reality:** A VLAN is a Layer 2 broadcast domain; a subnet is a Layer 3 (IP) network. You assign an IP address to the IRB interface that is associated with the VLAN, not to the VLAN directly. (Beginners often see VLANs and subnets used together in network diagrams and assume they are interchangeable terms. They also see 'ip address' commands in router configuration and mistakenly apply them to VLANs instead of IRBs.)
- **Misconception:** Trunk ports are only used between switches, never for connecting end devices like servers. **Reality:** Trunk ports can connect any device that supports 802.1Q tagging, including servers, routers, and even some hypervisors and access points that understand VLAN tags. (Textbooks often illustrate trunking only between switches, leading beginners to think it's exclusive to that scenario. In reality, any device that can handle tagged frames can use a trunk port.)
- **Misconception:** A switch in a VLAN configuration automatically routes traffic between VLANs without any additional setup. **Reality:** Switches are Layer 2 devices and do not route. To route between VLANs, you need a Layer 3 interface (like an IRB on a switch, or a separate router). Without routing, devices in different VLANs cannot communicate. (Many entry-level networking students assume that 'VLAN' implies routing capability, because in small labs they often configure a switch that also has routing features (a Layer 3 switch) and assume all switches route.)
- **Misconception:** If you configure a port as an access port in VLAN 10, any device plugged into that port will automatically be in VLAN 10 regardless of what the device sends. **Reality:** While the switch does assign the port to VLAN 10, the device must still have its IP configuration (subnet, gateway) consistent with VLAN 10. If the device has a static IP from a different subnet, it cannot communicate within VLAN 10 without a router. (Beginners often confuse VLAN assignment with IP addressing, thinking that plugging into the right port is enough to ensure connectivity, when the device's own IP settings must match the VLAN's subnet.)
- **Misconception:** The native VLAN should always be VLAN 1 because that is the default and it works out of the box. **Reality:** Security best practice is to change the native VLAN to an unused VLAN ID (e.g., VLAN 999) to prevent VLAN hopping attacks, where an attacker can send untagged frames to reach a management interface on VLAN 1. (Since VLAN 1 is the default, new users often avoid changing it because they fear breaking something. They are unaware of the security risk and that many exam questions test this best practice.)
- **Misconception:** The number of VLANs you can create is exactly 4096, and all those IDs are available for use. **Reality:** The 12-bit VLAN ID field allows 4096 values (0-4095), but IDs 0 and 4095 are reserved, so only 4094 usable VLAN IDs exist (1-4094). (The '4096' figure is commonly quoted without the 'reserved' caveat, leading to off-by-one errors in exam answers and real-world configurations.)

## Key takeaways

- A VLAN creates a single broadcast domain at Layer 2, isolating traffic from other VLANs on the same switch.
- An access port belongs to exactly one VLAN and strips the 802.1Q tag before sending frames to the end device.
- A trunk port carries frames for multiple VLANs and preserves the 802.1Q tag between switches or between a switch and a router.
- Inter-VLAN routing requires a Layer 3 interface — either an IRB on the switch itself or an external router — not just VLAN configuration.
- The native VLAN on a trunk is the VLAN that carries untagged frames; both ends of a trunk must agree on the native VLAN ID.
- The switch learns MAC addresses from incoming frames and builds a MAC address table per VLAN, flooding frames only when the destination MAC is unknown.
- VLAN IDs range from 1 to 4094, with IDs 0 and 4095 reserved; VLAN 1 is the default native VLAN and should be changed for security best practice.
- On Junos, you define VLANs under the 'vlans' configuration hierarchy and assign ports using 'vlan members' or 'access vlan' statements.

## FAQ

**How many VLANs can I create on a Juniper EX2300 switch?**

The Juniper EX2300 supports up to 512 VLANs (depending on model and Junos version) out of the total 4094 possible VLAN IDs. The number is limited by hardware resources, not just the VLAN ID range.

**What is the difference between a native VLAN and the default VLAN?**

The default VLAN is VLAN 1, which all ports belong to by default. The native VLAN is the VLAN assigned to untagged frames on a trunk port — by default, it is also VLAN 1, but you can change it with 'native-vlan-id' to a different ID.

**Do I need a router to connect VLANs together?**

Yes, because switches operate at Layer 2 and cannot route between VLANs. You need a Layer 3 device — a router, or a Layer 3 switch with an IRB interface — to forward traffic between VLANs.

**What happens if I forget to set the native VLAN on both ends of a trunk?**

If both ends default to VLAN 1 as the native VLAN, it still works. But the problem arises if one end is changed to a different native VLAN (e.g., VLAN 999) and the other remains VLAN 1 — then untagged frames will be interpreted as belonging to different VLANs at each end, causing miscommunication or complete loss of connectivity.

**Can a port be both an access port and a trunk port?**

No, a physical port can only operate in one mode at a time. You can configure it as an access port (one untagged VLAN) or as a trunk port (multiple tagged VLANs optionally with a native untagged VLAN).

**How do I check which VLANs are active on a Junos switch?**

Use the command 'show vlans' to list all configured VLANs, their tag numbers, and which interfaces are part of them. For detailed information including IRB association, use 'show vlans extensive'.

## Check your understanding

1. **What command would you use on a Junos switch to see which VLANs exist and which interfaces are members of each VLAN?**

   Answer: Use 'show vlans' to display a list of VLANs with their IDs and associated interfaces.

2. **What is the purpose of an IRB interface in a VLAN configuration?**

   Answer: The IRB (Integrated Routing and Bridging) interface provides a Layer 3 gateway for the VLAN, enabling inter-VLAN routing by assigning an IP address to it and associating it with the VLAN.

3. **A trunk port on Switch A carries VLANs 10, 20, and 30. The native VLAN is set to 10. An untagged frame enters the trunk from Switch A. Which VLAN does that frame belong to?**

   Answer: The frame belongs to the native VLAN, which is VLAN 10, because untagged frames on a trunk are assigned to the native VLAN.

4. **True or false: A switch with three VLANs configured has a single broadcast domain that includes all devices in all VLANs.**

   Answer: False. Each VLAN creates its own separate broadcast domain, so three VLANs mean three broadcast domains that do not overlap.

5. **How does a switch handle a frame destined for an unknown unicast MAC address?**

   Answer: The switch floods the frame out of all ports in the same VLAN (except the port where it was received) to find the destination device.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/juniper-jncia-junos/junos-vlan-and-layer-2-switching