network.dev

VLAN Configuration Guide

Essential VLAN commands and concepts for network engineers

Basic VLAN Configuration

vlan [vlan-id]

Create or enter VLAN configuration mode

Example:vlan 10
name [vlan-name]

Assign a name to the VLAN

Example:name SALES
switchport mode access

Set port to access mode

Example:switchport mode access
switchport access vlan [vlan-id]

Assign port to specific VLAN

Example:switchport access vlan 10

Trunk Port Configuration

switchport mode trunk

Set port to trunk mode

Example:switchport mode trunk
switchport trunk allowed vlan [vlan-list]

Specify allowed VLANs on trunk

Example:switchport trunk allowed vlan 10,20,30
switchport trunk native vlan [vlan-id]

Set native VLAN for trunk

Example:switchport trunk native vlan 1
switchport trunk encapsulation dot1q

Set trunk encapsulation to 802.1Q

Example:switchport trunk encapsulation dot1q

VLAN Verification Commands

show vlan brief

Display VLAN summary information

Example:show vlan brief
show interfaces trunk

Display trunk port information

Example:show interfaces trunk
show interfaces switchport

Display switchport configuration

Example:show interfaces fa0/1 switchport
show vlan id [vlan-id]

Display specific VLAN information

Example:show vlan id 10

VLAN ID Ranges

VLAN 1

Default VLAN (cannot be deleted)

System
VLAN 2-1001

Normal range VLANs

Normal
VLAN 1002-1005

Default VLANs for FDDI and Token Ring

System
VLAN 1006-4094

Extended range VLANs

Extended

VLAN Best Practices

Design Guidelines

  • • Plan VLAN numbering scheme
  • • Use descriptive VLAN names
  • • Document VLAN assignments
  • • Implement VLAN security policies
  • • Consider VLAN scalability

Security Considerations

  • • Change default VLAN 1 usage
  • • Disable unused ports
  • • Implement port security
  • • Use private VLANs when needed
  • • Monitor VLAN hopping attacks