Last updated 1 October 2026 · reviewed for accuracy

VLANs & trunking

One switch, one broadcast domain: every device hears every other. VLANs split a switch into several separate networks, and a trunk carries all of them between switches, with an 802.1Q tag on each frame saying which network it belongs to.

One switch, one broadcast domain

Broadcasts are not a fault: ARP and DHCP depend on them. The problem is reach. On an unconfigured switch everyone hears everyone, which gets noisy as a network grows. It also means anything that announces itself (a file server, a printer) is visible from every port, a visitor’s laptop included.

A VLAN is a switch inside the switch

A VLAN (virtual LAN) is a group of switch ports that behaves like a separate switch. Put the finance desks in VLAN 10 and the meeting room in VLAN 20, and one physical switch becomes two broadcast domains: a broadcast that arrives in VLAN 10 is flooded only to VLAN 10 ports.

• Each VLAN is normally its own IP subnet, for example 192.168.10.0/24 for finance and 192.168.20.0/24 for visitors.
• Traffic between VLANs needs a router or a Layer 3 switch. A switch on its own never forwards a frame from one VLAN into another, so the router is also where you decide what may cross.
• Every port starts in VLAN 1, the default VLAN. Until you move it, a port shares one broadcast domain with every other port still in VLAN 1.

Access ports and trunk ports

An access port belongs to one VLAN and carries ordinary, untagged frames. It is what you give a PC, a printer or a camera: the device never knows a VLAN exists.

A trunk port carries many VLANs over one link: between two switches, and also to routers, wireless access points and virtualisation hosts. So that the far end knows which VLAN each frame belongs to, the sending switch adds a tag; the receiving switch reads it and removes it before the frame reaches an access port.

Inside the 802.1Q tag

The tag is 4 bytes, inserted between the source MAC address and the EtherType field of the frame:

Twelve bits give 4,096 values. 0 and 4095 are reserved, so usable VLAN IDs run from 1 to 4094. Cisco switches also reserve 1002–1005 (for the old FDDI and Token Ring networks) and call 1006–4094 the extended range. The tag makes the largest Ethernet frame 4 bytes longer: 1,522 bytes instead of 1,518.

The native VLAN

One VLAN on an 802.1Q trunk travels untagged: the native VLAN. On Cisco switches it is VLAN 1 unless you change it, and any untagged frame that arrives on a trunk is put into it.

Both ends must agree. If SW1’s native VLAN is 99 and SW2’s is 1, untagged frames from SW1’s VLAN 99 land in SW2’s VLAN 1: two VLANs quietly merge. Cisco switches spot this through CDP and log %CDP-4-NATIVE_VLAN_MISMATCH.

Common practice is to make the native VLAN an unused VLAN on every trunk, so no user traffic crosses untagged. That also blocks the double-tagging “VLAN hopping” attack, which only works when the attacker’s access VLAN is the trunk’s native VLAN.

The classic traps

Most VLAN outages are one of these. Each is quick to spot with show vlan brief and show interfaces trunk:

• A port left in VLAN 1. A new port is in VLAN 1 until someone moves it, so a forgotten port lands in the wrong network.
• A VLAN missing from the trunk. switchport trunk allowed vlan limits which VLANs may cross. A VLAN left off the list stops at the trunk.
• Replacing the allowed list by accident. On a working trunk, switchport trunk allowed vlan 30 replaces the whole list: every other VLAN stops crossing. switchport trunk allowed vlan add 30 adds to it.
• A VLAN that does not exist on the far switch. A switch only forwards VLANs it knows about. In show interfaces trunk such a VLAN is allowed but missing from “allowed and active”.
• Two ends that never form a trunk. Cisco access-layer switch ports often default to dynamic auto, and two auto ends never become a trunk. Set switchport mode trunk on purpose.
• A native VLAN mismatch, as above: two VLANs merge without any error a user would see.

Try it yourself: split the switch

The console below behaves like a Cisco Catalyst 2960 for the VLAN and trunk commands. Type ? whenever you are unsure what comes next; the task list ticks itself off as the switch’s configuration changes.