What VLANs do and why they matter
A broadcast domain is a group of devices that receive each other's broadcast frames. On a flat network with no VLANs, every switch port is in the same broadcast domain — every broadcast reaches every device. As networks grow, this creates performance problems and security risks.
VLANs solve this by logically grouping ports into separate broadcast domains on the same physical switch. Ports in VLAN 10 only receive broadcasts from other VLAN 10 ports. Traffic between VLANs requires a router or Layer 3 switch — the VLAN boundary acts exactly like a router interface boundary.
Common VLAN designs: data VLAN for user workstations, voice VLAN for IP phones, management VLAN for switch management, native VLAN for untagged trunk traffic. Separating these prevents voice traffic from competing with data traffic, and keeps management access separate from user traffic.
Access ports and trunk ports
An access port belongs to exactly one VLAN and carries untagged frames. End devices (PCs, printers, IP phones in data mode) connect to access ports. The switch assigns all frames arriving on that port to the configured VLAN without adding any VLAN tag. When the switch sends frames out an access port, it strips the VLAN tag before forwarding.
A trunk port carries traffic from multiple VLANs simultaneously. Frames are tagged with an 802.1Q tag — a 4-byte header inserted into the Ethernet frame that identifies the VLAN (the 12-bit VLAN ID). Trunk ports connect switches to other switches, switches to routers (for router-on-a-stick), and switches to Layer 3 switches for inter-VLAN routing.
802.1Q trunk configuration on Cisco: `switchport mode trunk` sets the port to trunk mode. `switchport trunk allowed vlan` controls which VLANs are permitted on the trunk. Restricting allowed VLANs is a best practice — there's no reason for every VLAN to traverse every trunk.
DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol that can automatically negotiate trunk formation between switches. For security, disable DTP on ports connecting to end devices: `switchport nonegotiate` or `switchport mode access` prevents a rogue device from negotiating a trunk.
Native VLAN
The native VLAN is the VLAN assigned to untagged frames arriving on a trunk port. By default, the native VLAN is VLAN 1 on Cisco switches. If a switch receives an untagged frame on a trunk port, it assigns it to the native VLAN. When a switch sends frames from the native VLAN out a trunk port, it sends them untagged.
Native VLAN mismatch is a common misconfiguration: if one end of a trunk is configured with native VLAN 1 and the other end uses native VLAN 10, traffic gets placed in the wrong VLAN. CDP warnings about native VLAN mismatch appear in `show interfaces trunk` output and Syslog.
Security best practice: change the native VLAN from the default VLAN 1 to an unused VLAN, and avoid using that VLAN for any real traffic. This prevents VLAN hopping attacks where a crafted double-tagged frame can be forwarded into another VLAN via the native VLAN.
Voice VLAN and the default VLAN
IP phones require special treatment: they need to be in a separate VLAN for QoS (voice traffic must be prioritized over data) and they connect to the same switch port as a PC (the phone has a built-in 3-port switch). Cisco switch ports solve this with a voice VLAN configuration.
When you configure `switchport voice vlan 10` on an access port, the port carries two VLANs: the access VLAN (for the PC connected through the phone) and the voice VLAN (for the phone itself). The phone tags its own voice traffic with VLAN 10; the PC's traffic remains untagged (access VLAN). The switch handles both simultaneously on one physical port.
The default VLAN is VLAN 1, which exists on all Cisco switches and cannot be deleted. All switch ports are in VLAN 1 by default. Best practice is to move all active devices off VLAN 1 and disable unused ports, leaving VLAN 1 as an empty administrative VLAN — this reduces attack surface.
VLAN normal range is 1–1005; extended range is 1006–4094. Extended VLANs are stored in the VLAN database in flash (vlan.dat) and require VTP version 3 or VTP transparent mode to use.