Switching / VLANsCCNA 200-301

VLAN Port Inactive: Access Port Not Passing Traffic

Presenting Symptom

An access port is connected and shows 'up/up' in show ip interface brief, but the host connected to the port has no network connectivity. The host cannot ping its default gateway or any other device.

Network Context

A Cisco Catalyst 2960 switch with VLANs 10 (SALES) and 20 (ENGINEERING). Host PC1 is connected to GigabitEthernet1/0/5 and should be on VLAN 10. The switch uplink to a router is a trunk on GigabitEthernet1/0/24.

Diagnostic Steps

Root Cause

The most common causes of a VLAN port being inactive despite physical link up: 1. **VLAN not created** — The port is assigned to VLAN 10 (`switchport access vlan 10`) but VLAN 10 was never created on the switch. Show vlan brief will not list VLAN 10. This puts the port in an 'inactive' VLAN state. 2. **VLAN not allowed on trunk** — VLAN 10 exists on the access switch but is not in the `switchport trunk allowed vlan` list on the uplink trunk. Traffic cannot reach the router for inter-VLAN routing or reach other switches. 3. **Native VLAN mismatch** — If the port is on the native VLAN and the native VLAN does not match between the switch and router, frames are misclassified. 4. **STP blocking** — In rare topologies, STP may be blocking the port to prevent loops. Show spanning-tree will show 'BLK' or 'DIS' state. 5. **Port not configured as access** — Port defaults to dynamic auto, may have negotiated an unexpected state.

Resolution

Resolution depends on the root cause identified: **If VLAN doesn't exist:** ``` Switch(config)# vlan 10 Switch(config-vlan)# name SALES Switch(config-vlan)# exit ``` **If port not in correct VLAN:** ``` Switch(config)# interface GigabitEthernet1/0/5 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 10 Switch(config-if)# spanning-tree portfast ``` **If VLAN missing from trunk:** ``` Switch(config)# interface GigabitEthernet1/0/24 Switch(config-if)# switchport trunk allowed vlan add 10 ``` **If STP blocking (verify first — do not disable STP carelessly):** ``` Switch(config-if)# spanning-tree portfast ! Only on access ports, never on switch-to-switch links ```

Verification

After applying the fix: 1. `show vlan brief` — VLAN 10 appears as 'active' with Gi1/0/5 in its port list 2. `show interfaces trunk` — VLAN 10 appears in all four sections, especially 'Vlans in spanning tree forwarding state' 3. `show interfaces GigabitEthernet1/0/5 switchport` — Administrative Mode: static access, Operational Mode: static access, Access Mode VLAN: 10 4. Ping test — PC1 can now ping its default gateway (inter-VLAN router interface for VLAN 10) 5. `show spanning-tree vlan 10 interface GigabitEthernet1/0/5` — Port State: forwarding

Prevention

Best practices to prevent VLAN port inactive issues: 1. Always create VLANs on the switch BEFORE assigning ports to them 2. Use `interface range` to configure all access ports consistently: `switchport mode access`, `switchport access vlan <id>`, `spanning-tree portfast` 3. When adding a VLAN, update the trunk allowed list immediately: `switchport trunk allowed vlan add <id>` 4. Document your VLAN design and use a VLAN naming convention 5. Test connectivity immediately after VLAN configuration changes

CCNA Exam Relevance

VLAN port inactive scenarios are a high-frequency topic on the CCNA 200-301 exam, particularly in the Network Access domain. Exam questions typically present show command output and ask you to identify the fault. Key outputs to recognise: - `show vlan brief`: VLAN 10 missing = not created - `show interfaces trunk`: VLAN missing from section 4 = blocked by STP or pruned - `show interfaces switchport`: Access Mode VLAN: 10 (Inactive) = VLAN assigned but doesn't exist

Exam Tips

For the CCNA exam: when a host has no connectivity but the port is up/up, always check VLANs in this order: (1) does the VLAN exist? (2) is the port in the right VLAN? (3) is the VLAN allowed and forwarding on the trunk? Remember: show interfaces trunk has four distinct sections — a VLAN must appear in ALL four to pass traffic

Commands Used in This Scenario

show interfaces trunk

Displays all trunk ports including the trunking encapsulation (802.1Q or ISL), the native VLAN, VLANs allowed on the trunk, VLANs in the spanning tree forwarding state, and VLANs active in the management domain.

show vlan brief

Displays a summary of all VLANs in the switch database including VLAN ID, name, status, and the access ports assigned to each VLAN.

spanning-tree portfast

Bypasses the STP Listening and Learning states on a port, moving it directly to Forwarding after the link comes up. Eliminates the default 30-second STP convergence delay for ports connected to end hosts.

switchport mode access

Statically configures a switch port as an access port, disabling all DTP negotiation so the port permanently carries traffic for a single VLAN and can never negotiate to trunk mode.

state active

Sets the operational state of a VLAN to active (forwarding traffic) or suspend (VLAN exists in database but no traffic is forwarded). Active is the default state for all new VLANs.

Test Your CCNA Knowledge

Practice with scenario-based questions to prepare for the CCNA 200-301 exam.

Practice CCNA Questions