Cisco: switching, VLANs, trunks and inter-VLAN routing

Example: Sales uses VLAN 10 and IT uses VLAN 20. Each department has a PC on each of two switches. First connect PCs within the same VLAN; then add routing between departments.

A switch learns source MAC addresses on its ports and uses destination MAC addresses to forward frames within a VLAN. Each VLAN is a separate broadcast domain. Communication between different VLANs needs a router or Layer 3 switch.

Use fresh IOS / IOS XE lab devices and adapt interface names to your model. Prompts identify the device and mode. Type only the text after the prompt; PC prompts identify the endpoint terminal. Packet Tracer and different switch models support different command subsets.

The main lab uses R1 for routing. Section 7 is a separate Layer 3 switch alternative; do not apply both gateway designs to the same lab.

Example: on both switches, Fa0/1 connects to a Sales PC and Fa0/2 connects to an IT PC. Configure each PC with the address, mask and gateway in the plan.

An access port carries one untagged data VLAN. The PC sends ordinary Ethernet frames; the switch associates them with the configured VLAN.

• vlan 10: create or select VLAN 10.
• name SALES: give the VLAN a readable label.
• switchport mode access: explicitly configure an access port.
• switchport access vlan 10: place the port in VLAN 10.
• no shutdown: enable the port.
• show vlan brief: check VLANs and access-port membership.

Create the VLANs on both switches. This lab uses manual VLAN configuration and does not depend on VTP. VTP distributes VLAN information; it does not provide inter-VLAN routing.

Example: PC1 and PC3 belong to VLAN 10 but are on different switches. The SW1–SW2 link must carry VLANs 10 and 20.

A trunk transports multiple VLANs. 802.1Q adds a VLAN tag to frames, except for native-VLAN traffic under the usual untagged-native configuration. Both ends must agree on the native VLAN.

• switchport mode trunk: explicitly make the link a trunk.
• switchport trunk allowed vlan 10,20: replace the allowed VLAN list with VLANs 10 and 20.
• switchport nonegotiate: disable DTP negotiation; configure the peer as a static trunk too.
• show interfaces trunk: display operational trunks and allowed/forwarding VLANs.

DTP (Dynamic Trunking Protocol) negotiates trunking on supporting Cisco ports. Static configuration makes the intended port role explicit. Some older switches require switchport trunk encapsulation dot1q before trunk mode; fixed-802.1Q models do not offer that command.

The main lab leaves native VLAN 1 unchanged on both ends and carries user traffic tagged in VLANs 10 and 20.

Example: test PC1 to PC3 before configuring R1. Both are in VLAN 10, so this traffic does not need a gateway.

• ping 192.168.10.30: test PC3 from PC1 across the trunk.
• show mac address-table dynamic vlan 10: inspect MAC addresses learned in VLAN 10.

Expected: PC1 reaches PC3, and PC2 reaches PC4. PC1 cannot yet reach PC2 because inter-VLAN routing is not configured.

On SW1, PC1's MAC should appear on Fa0/1 and PC3's MAC on Gi0/2 after traffic has passed. A trunk normally does not appear as an access member in show vlan brief; inspect show interfaces trunk instead.

Example: PC1 needs to reach PC2. Use one physical R1 interface with a logical subinterface for each VLAN. This design is called router-on-a-stick.

• interface GigabitEthernet0/0.10: create a logical subinterface; .10 is a naming convention, not the VLAN assignment itself.
• encapsulation dot1Q 10: associate the subinterface with tagged VLAN 10 traffic.
• ip address 192.168.10.1 255.255.255.0: make that subinterface the VLAN 10 gateway.
• no ip address: remove the parent interface's IPv4 address; this lab puts gateway addresses on subinterfaces.

Enable the physical parent interface and configure SW1's router-facing port as a trunk. R1 does not use switchport commands on its routed Ethernet interface.

Use the PC gateways in the plan. Routing connects the VLANs; restricting departmental access would require an ACL.

Example: optionally move the native VLAN of the SW1–SW2 trunk to unused VLAN 999. Apply the change to both ends. This example does not change the separate SW1–R1 trunk.

• switchport trunk native vlan 999: associate untagged data traffic on this trunk with VLAN 999 under the default native-tagging behavior.
• switchport trunk allowed vlan add 999: add VLAN 999 without replacing the existing list.
• switchport trunk allowed vlan remove 999: remove VLAN 999 from the allowed list when required; this does not change the native-VLAN setting.

Create VLAN 999 on both switches and leave it without user access ports. A native-VLAN mismatch can associate untagged traffic with the wrong VLAN and trigger spanning-tree consistency problems.

Using switchport trunk allowed vlan 999 without add would replace the list and remove VLANs 10 and 20.

Example: in a separate lab, connect PC1 to MLS1 Fa0/1 and PC2 to MLS1 Fa0/2. MLS1 replaces R1 as the gateway for VLANs 10 and 20. Do not retain another device with the same gateway addresses on those VLANs.

An SVI (Switch Virtual Interface) is a logical Layer 3 interface for a VLAN. A multilayer switch can route between SVIs when routing is enabled and supported by its image/model.

• ip routing: enable IPv4 routing on the multilayer switch.
• interface vlan 10: select VLAN 10's SVI.
• ip address: assign the SVI's gateway address and mask.
• show ip route connected: confirm the switch has connected routes for both VLANs.

Each SVI needs its VLAN to exist and an active member port forwarding traffic. ip default-gateway is not the routing configuration for a switch operating with IP routing enabled.

Example: extend the MLS1 alternative lab with a routed uplink to R2. Use 10.0.0.1/30 on MLS1 Gi0/1 and 10.0.0.2/30 on R2 Gi0/0.

• no switchport: convert a supported switch port into a routed Layer 3 interface.
• ip address: assign an address directly to that physical interface.

A routed port does not carry access VLANs or an 802.1Q trunk in this example. This block establishes only the connected uplink; reaching networks beyond it requires routes and a return path.

Example: return to the main SW1–SW2 lab. Make SW1 the preferred spanning-tree root for VLANs 10 and 20.

STP (Spanning Tree Protocol) prevents Layer 2 loops by keeping redundant paths from forwarding simultaneously. Rapid PVST+ provides a rapid spanning-tree instance per VLAN. The root is selected using the lowest bridge ID, including priority and MAC address.

• spanning-tree mode rapid-pvst: select Rapid PVST+ on a supporting switch.
• spanning-tree vlan 10,20 root primary: adjust priority to make this switch the intended root under the current topology.
• spanning-tree vlan 10,20 root secondary: set a backup-root priority; verify the actual election.
• show spanning-tree vlan 10: inspect the root, port roles and states.

The main lab has one inter-switch link, so no redundant path needs blocking. With additional independent links, an alternate/discarding port can be normal. Changing STP mode or priority can briefly reconverge the topology.

Example: PC ports should begin forwarding quickly, but an unexpected switch connection should not extend the spanning-tree topology through those ports.

BPDUs (Bridge Protocol Data Units) are spanning-tree control messages exchanged by switches.

• spanning-tree portfast: let an endpoint port enter forwarding immediately; STP is not disabled.
• spanning-tree bpduguard enable: place the port into err-disabled state if it receives a BPDU.
• show interfaces status: identify err-disabled or disconnected ports.

Apply this block only to the PC-facing ports in this lab, not the switch-to-switch links. If BPDU Guard triggers, remove the cause before re-enabling the port with shutdown followed by no shutdown.

Example: use a separate pair of fresh switches, EC1 and EC2, with Gi0/1 connected to Gi0/1 and Gi0/2 connected to Gi0/2. Bundle both links into one trunk for VLANs 10 and 20.

EtherChannel groups compatible physical links into a logical Port-channel. STP treats the bundle as one link. Traffic is distributed by a hash; one flow normally does not use the combined bandwidth of every member.

• interface range GigabitEthernet0/1 - 2: configure both member ports together.
• channel-group 1 mode active: use LACP to negotiate membership in local Port-channel1.
• interface Port-channel1: configure the logical bundle.
• show etherchannel summary: check bundle and member status.
• show lacp neighbor: inspect the peer's LACP information.

LACP forms with active/active or active/passive; passive/passive does not initiate negotiation. Cisco PAgP uses desirable/auto negotiation instead. Static mode on performs no negotiation. This lab uses LACP active at both ends.

Member speed, duplex and Layer 2 settings must be compatible; trunk/native/allowed VLAN settings must agree. Keep members shut while preparing both ends, then enable them. The group number is locally significant and need not match the peer's number.

Example: a VLAN works locally but fails across a switch link. Check VLAN membership and trunk state before changing routing.

• show interfaces trunk: confirm the VLAN is allowed, active and forwarding across the trunk.
• show interfaces GigabitEthernet0/1 switchport: inspect administrative and operational mode, native VLAN and allowed list.
• show spanning-tree vlan 10: check whether STP is blocking the path.
• show etherchannel summary: look for an operational Layer 2 bundle, commonly Po1(SU), and bundled members marked (P); read the output legend.
• copy running-config startup-config: save each device after verification.

Same VLAN fails across switches: check the VLAN exists on both ends and is permitted on the trunk.

Same VLAN works, inter-VLAN fails: check host gateways, router subinterface VLAN tags or SVI state and ip routing on the Layer 3 switch.

EtherChannel suspended or individual: compare member settings, LACP mode and peer cabling. Do not treat a configured Port-channel as proof of an operational bundle.

Native-VLAN mismatch: align both ends of the specific link. Err-disabled PC port: investigate BPDU Guard before re-enabling it.

Cisco — Configure Inter VLAN Routing with an External Router:
https://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/14976-50.html

Cisco — EtherChannel Configuration Guide:
https://www.cisco.com/c/en/us/td/docs/switches/lan/c9000/lyr2-fwd/etherchannel/etherchannel-configuration-guide/etherchannels.html

Cisco — Spanning Tree configuration model:
https://netascode.cisco.com/docs/data_models/iosxe/device/spanning_tree/