Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 2.1 — Configure VLANs across switches

A VLAN defines a Layer 2 broadcast domain. Configuring one successfully requires consistent state from the endpoint access port through every required switch and up to a Layer 3 gateway when traffic must leave the subnet.

Create and name the VLAN

Normal-range VLANs use IDs in the ordinary campus range. Create the VLAN on each switch that must forward it and give it an operationally meaningful name. A name does not change forwarding, but it reduces errors during verification. Do not assume a VLAN automatically appears everywhere unless the design deliberately uses a supported distribution mechanism.

VLAN 1 is the default access VLAN on many switchports and carries several default behaviors. Leaving all users there provides no intentional segmentation. Changing an access port's VLAN does not delete VLAN 1; it changes that port's membership.

Configure data and voice access

An access port carries one ordinary data VLAN untagged toward an endpoint. A supported IP phone can receive a separate voice VLAN instruction and tag voice traffic while forwarding a workstation's data traffic through the data VLAN. The port remains an edge access design, not a generic interswitch trunk.

Set access mode explicitly where appropriate, assign the data VLAN, add a voice VLAN only when the endpoint design requires it, and apply edge security and spanning-tree policy. Confirm the VLANs exist before relying on the assignment.

Span multiple switches

For hosts in one VLAN on different switches, the interswitch path must carry that VLAN. On an 802.1Q trunk, verify operational trunking and the allowed VLAN list. Every intermediate trunk matters. A VLAN present on both access switches can still be isolated by one omitted allowed-list entry.

Layer 2 discovery can help identify the physical neighbor but does not prove the VLAN crosses the link.

Provide inter-VLAN connectivity

Different VLANs are different Layer 2 domains and normally use different IP subnets. A router-on-a-stick design can use tagged subinterfaces, while a Layer 3 switch can use switched virtual interfaces. Each host's default gateway must be a reachable Layer 3 interface in its own subnet. Routing must be enabled where the platform requires it, and security policy may deliberately restrict flows.

IOS command map

Create the local VLAN with vlan 20 and optionally name DATA. On an endpoint interface, use switchport mode access and switchport access vlan 20. For a supported phone-plus-workstation design, add switchport voice vlan 120 rather than turning the endpoint port into an unrestricted trunk.

For inter-VLAN routing on a Layer 3 switch, a typical SVI starts with interface Vlan20, ip address 192.0.2.1 255.255.255.0, and no shutdown; use ip routing when the platform requires it for Layer 3 forwarding. Use show vlan brief, show interfaces GigabitEthernet0/10 switchport, show interfaces trunk, and show ip interface brief to verify each boundary. A VLAN or SVI can be configured while its operational state remains down, so read state as well as intent.

Worked scenario

Users in VLAN 20 on Switch A cannot reach users in VLAN 20 on Switch B, but each can reach a local neighbor. Both access ports show VLAN 20. The next check is the interswitch trunk: if VLAN 20 is missing from its allowed and active set, adding it according to change control restores the Layer 2 path. Changing host masks would solve a different problem.

Verification stack

Inspect VLAN existence and access-port membership, switchport operational mode, voice VLAN, trunk allowance along the entire path, MAC learning in the correct VLAN, gateway interface state, and routed reachability. Test local same-VLAN behavior before inter-VLAN routing.

Common traps

• Creating a VLAN on one switch only.
• Treating a voice VLAN as a second arbitrary data VLAN.
• Assuming different VLANs communicate without routing.
• Blaming the gateway for a same-VLAN trunk omission.
• Using the default VLAN without making an intentional choice.

Readiness checklist

• I can configure and verify data and voice access ports.
• I can follow a VLAN over multiple trunks.
• I can identify the inter-VLAN gateway mechanism.
• I separate Layer 2 membership from Layer 3 addressing.