Last updated · reviewed for accuracy
Configuring VLANs in IOS
You know what VLANs are. Now make a switch actually do it: create two VLANs, put ports in them, trunk them to a second switch, and prove it worked.
Create the VLANs
VLANs are created in global configuration mode with the vlan command followed by a number; the optional name command labels them for humans. The VLAN exists as soon as you type it.
Switch(config)# vlan 10 Switch(config-vlan)# name STAFF Switch(config-vlan)# vlan 20 Switch(config-vlan)# name GUESTS Switch(config-vlan)# end
Names are optional but future-you will thank present-you: STAFF in a show command beats remembering what 10 meant.
Put ports into a VLAN
An access port carries exactly one VLAN, untagged. You configure it per interface: switchport mode access locks the port role, and switchport access vlan 10 assigns the VLAN. The range command configures many ports at once.
Switch(config)# interface range FastEthernet0/1 - 12 Switch(config-if-range)# switchport mode access Switch(config-if-range)# switchport access vlan 10
From this moment, devices on ports 1–12 can talk to each other but cannot reach VLAN 20. There is no path between VLANs inside a Layer 2 switch. (Crossing VLANs needs a router or L3 switch, which is exactly where the next lesson picks up.)
Trunk to the next switch
A trunk port carries many VLANs at once by tagging each frame with its VLAN ID (802.1Q). Between two switches you set the port to trunk mode; frames keep their VLAN membership across the link.
Switch(config)# interface GigabitEthernet0/1 Switch(config-if)# switchport mode trunk ! optional hygiene: only carry the VLANs you actually use Switch(config-if)# switchport trunk allowed vlan 10,20
A user device plugged into a trunk port will not work normally. It expects untagged frames. If “the port is up but nothing works,” check whether someone left it in trunk mode.
Verify or it did not happen
Two show commands prove a VLAN config: show vlan brief lists every VLAN and which ports are in it, and show interfaces trunk lists trunk links and the VLANs they carry.
Switch# show vlan brief VLAN Name Status Ports ---- ----------- --------- ------------------------- 1 default active Fa0/13, Fa0/14 ... 10 STAFF active Fa0/1 - Fa0/12 20 GUESTS active
If a port is missing from the VLAN you expected, it is either still in VLAN 1 (the default), in the wrong VLAN, or configured as a trunk. show interfaces trunk settles it.
The concept behind these commands
This lesson is the hands-on half of VLANs & trunking, which explains broadcast domains, tagging and why VLANs exist at all. Read them as a pair.
Frequently asked questions
What VLAN are switch ports in by default?
Every port starts in VLAN 1, the default. That is why two freshly connected PCs can always talk. They share VLAN 1 until you move them.
What is the difference between an access port and a trunk port?
An access port belongs to one VLAN and sends untagged frames, for end devices. A trunk carries many VLANs with 802.1Q tags, for switch-to-switch links.
Why can devices in different VLANs not ping each other?
VLANs are separate networks. Traffic between them must pass a Layer 3 device with a leg in both: a router or L3 switch. A plain switch never forwards between VLANs; the routing lesson shows the fix.