Back to Cisco & Networking CyberPatriot Hub

Cisco & Networking · Lesson 07

VLANs & Access Ports

Learn how VLANs separate Layer 2 broadcast domains, how access ports place endpoints into those VLANs, and how to verify segmentation without breaking required connectivity.

This lesson focuses on endpoint-facing switchports. Trunks, native VLANs, and 802.1Q tagging are covered in the next lesson.

Lesson Snapshot

Core concepts6

Example VLANs4

Inspection commands8

Main goalCorrect Layer 2 segmentation

Learning objectives

Place endpoints into the right broadcast domain

Explain why VLANs separate Layer 2 broadcast domains on a switched network.

Distinguish VLAN membership, access ports, trunks, and routed communication between VLANs.

Configure and verify access ports using a safe inspection-first workflow.

Recognize common VLAN and access-port mistakes that break connectivity or weaken segmentation.

Use Cisco IOS show commands to compare the intended VLAN plan with actual switch state.

Troubleshoot same-VLAN and wrong-VLAN symptoms before making unnecessary routing changes.

Core idea

One switch can contain many logical LANs

VLANs let a switch separate endpoints into distinct broadcast domains even when those devices connect to the same physical hardware.

Competition warning

A wrong access VLAN can look like an IP problem

If a host is placed into the wrong broadcast domain, ARP, DHCP, gateway access, and local communication can all fail even when the IP address itself looks reasonable.

Core concepts

Six ideas behind VLAN access design

VLAN

A Virtual LAN creates a logical Layer 2 broadcast domain on a switch. Devices in different VLANs are separated at Layer 2 even if they are connected to the same physical switch.

Access port

A switchport assigned to one access VLAN for ordinary endpoint traffic. The endpoint generally sends and receives normal untagged Ethernet frames.

Broadcast domain

The group of devices that receive a Layer 2 broadcast. Each VLAN forms a separate broadcast domain.

VLAN ID

A numeric identifier used by switches to distinguish VLANs. Common user-created VLANs typically use IDs within the normal supported range of the platform.

VLAN database

The switch maintains VLAN definitions separately from individual switchport assignments. A port can reference a VLAN only if the switch supports and knows that VLAN.

Inter-VLAN routing

Communication between different VLANs requires Layer 3 forwarding through a router or multilayer switch.

Why VLANs matter

Logical segmentation changes how traffic spreads

Segmentation

VLANs divide one physical switching environment into smaller logical networks.

Broadcast control

Broadcast traffic stays inside its VLAN instead of reaching every endpoint on the switch.

Security boundaries

VLAN separation supports policy decisions by keeping groups in distinct Layer 2 domains.

Organization

Devices can be grouped by role, department, sensitivity, or function instead of physical location alone.

Troubleshooting clarity

A documented VLAN plan makes it easier to understand which hosts should communicate locally and which traffic must be routed.

Scalability

Logical segmentation allows networks to grow without placing every endpoint into one giant broadcast domain.

Access-port behavior

How an endpoint frame enters a VLAN

Endpoint sends an untagged Ethernet frame

An ordinary workstation typically does not insert an 802.1Q VLAN tag on a basic access connection.

Switch receives the frame on an access port

The switch associates the frame with the VLAN configured on that interface.

Switch learns the source MAC in that VLAN

The MAC address table records the source MAC, incoming interface, and VLAN context.

Switch forwards only inside the same VLAN

Known unicast, unknown unicast, and broadcast behavior remains bounded by the VLAN.

Traffic to another VLAN requires Layer 3 forwarding

A router or Layer 3 switch function must move packets between separate VLAN broadcast domains.

Example design

One switch, four logical networks

VLAN	Name	Subnet	Example ports	Role
VLAN 10	STAFF	192.168.10.0/24	Gi0/1 - Gi0/8	Staff workstations
VLAN 20	STUDENTS	192.168.20.0/24	Gi0/9 - Gi0/16	Student workstations
VLAN 30	SERVERS	192.168.30.0/24	Gi0/17 - Gi0/20	Internal servers
VLAN 99	MANAGEMENT	192.168.99.0/24	Restricted management ports	Authorized administration

This is a fictional training plan. In a real CyberPatriot image or Packet Tracer activity, the scenario and existing topology determine which VLANs and ports are actually required.

Cisco inspection

Verify the VLAN plan before configuring ports

show vlan brief

Display VLAN IDs, VLAN names, status, and access-port membership.

show interfaces status

Summarize port status, access VLAN, duplex, speed, and interface type on supported switches.

show interfaces switchport

Review administrative and operational switchport mode, access VLAN, native VLAN, and trunk-related details.

show interfaces <interface> switchport

Inspect one switchport in detail instead of reading every port.

show running-config interface <interface>

Review the actual configuration applied to one switchport where supported.

show mac address-table

Compare learned MAC addresses to VLAN membership and physical interfaces.

show mac address-table vlan <vlan-id>

Display learned MAC addresses within one VLAN where supported.

show spanning-tree vlan <vlan-id>

Review spanning-tree state for one VLAN on platforms that support per-VLAN inspection.

Access-port configuration

Inspect, assign, and verify one port

Inspect the interface

show interfaces GigabitEthernet0/5 switchport

Confirm the current mode, access VLAN, and operational state before changing anything.

Confirm the VLAN exists

show vlan brief

Verify the intended VLAN is present and active on the switch.

Enter the interface

interface GigabitEthernet0/5

Work only on the specific port supported by the topology and scenario.

Force access behavior

switchport mode access

Configure the interface as a static access port instead of relying on negotiation.

Assign the access VLAN

switchport access vlan 10

Place ordinary endpoint traffic from that interface into VLAN 10.

Verify

show interfaces GigabitEthernet0/5 switchport

Confirm operational mode and access VLAN match the intended design.

VLAN creation

Define the VLAN before depending on it

configure terminal

Enter global configuration mode.

vlan 10

Create or enter VLAN 10 configuration context.

name STAFF

Assign a descriptive name that helps document the VLAN's purpose.

end

Return to privileged EXEC mode.

show vlan brief

Verify VLAN 10 exists, is active, and displays the intended name.

Creating a VLAN does not create routing

A VLAN is a Layer 2 broadcast domain. Communication with another VLAN requires a Layer 3 gateway and routing design, which is covered later in this pathway.

Controlled examples

Configure only confirmed endpoint ports

Assign one workstation port to VLAN 10

Commands

configure terminalinterface GigabitEthernet0/5switchport mode accessswitchport access vlan 10description Staff workstationend

Verify

show interfaces GigabitEthernet0/5 switchport

Additional note

show vlan brief

Assign a range of known student ports to VLAN 20

Commands

configure terminalinterface range GigabitEthernet0/9 - 16switchport mode accessswitchport access vlan 20end

Verify

show vlan brief

Additional note

Inspect individual ports if any endpoint behaves unexpectedly.

Create VLAN 30 with a descriptive name

Commands

configure terminalvlan 30name SERVERSend

Verify

show vlan brief

Additional note

Creating the VLAN does not automatically assign ports or create Layer 3 routing.

Interface range is powerful

Only use interface range when every interface in the range has the same confirmed role. Accidentally including a trunk, uplink, server, or management port can create a much larger outage.

Access vs trunk

Know which type of link you are touching

Typical connected device

Access

Ordinary endpoint such as workstation, printer, camera, or server.

Trunk

Another switch, router-on-a-stick link, access point, hypervisor, or other VLAN-aware infrastructure.

Number of VLANs carried

Access

Normally one data VLAN for standard endpoint traffic.

Trunk

Multiple VLANs can cross the same physical link.

Frame tagging

Access

Endpoint-facing frames are usually untagged.

Trunk

802.1Q tags identify VLAN membership for most carried VLANs.

Primary competition risk

Access

Wrong access VLAN isolates or misplaces an endpoint.

Trunk

Wrong allowed/native VLAN settings can affect many VLANs at once.

VLAN database reasoning

Existing VLANs need context before removal

Creating a VLAN is not the same as assigning a port

A VLAN can exist with no access ports, and a port configuration can reference a VLAN that still needs to be created depending on platform behavior.

Names improve readability

Names such as STAFF or SERVERS do not create security by themselves, but they reduce ambiguity during review.

Unused VLAN does not automatically mean malicious

A VLAN may be reserved, temporarily unused, used only on trunks, or part of an incomplete lab design.

Default VLAN behavior matters

Many Cisco switches place access ports in VLAN 1 by default. Do not assume that default membership matches the intended scenario.

Interface state

Port state changes the next troubleshooting step

Connected

Physical and data-link state indicate an active link. Continue checking VLAN, addressing, and policy.

Notconnect

No active endpoint link is detected. Check cabling, endpoint power/NIC, and whether the port should be used.

Disabled

The interface may be administratively shut down. Confirm whether that is intentional before enabling it.

Err-disabled

The switch may have disabled the port because of a protection feature or detected condition. Investigate the cause before recovery.

VLAN mismatch

Layer 2 and Layer 3 must agree

PC-A is 192.168.10.20/24 on VLAN 10. PC-B is 192.168.10.30/24 but its port is VLAN 20.

The hosts believe they are local IP peers, but Layer 2 places them in different broadcast domains.

ARP resolution fails across the VLAN boundary unless unusual bridging is present.

PC-A is physically connected to a VLAN 10 port but configured with 192.168.20.50/24.

The endpoint's Layer 3 identity does not match the Layer 2 segment.

Local and gateway behavior becomes inconsistent or fails.

Two hosts are both in VLAN 20 but use different /24 subnets.

Layer 2 connectivity exists, but Layer 3 addressing does not agree.

They may try to route traffic that should have been local or fail due to missing gateway/routing design.

A server is accidentally placed in VLAN 10 instead of VLAN 30.

The server joins the wrong broadcast domain.

Security policy, DHCP, gateway reachability, and service access can all be affected.

Segmentation reasoning

Five questions to test your VLAN model

Should Staff and Students receive each other's Layer 2 broadcasts?

Usually no in a segmented design. Separate VLANs keep their broadcast domains distinct.

Can VLAN 10 talk to VLAN 20 automatically because they are on the same switch?

No. Different VLANs require Layer 3 routing to communicate.

Does changing the access VLAN automatically change the host's IP address?

No. The endpoint must still have addressing appropriate for the new subnet, whether static or DHCP-based.

Can a VLAN exist only for infrastructure or management?

Yes. A VLAN may serve management, voice, servers, wireless, or another specialized role.

Does VLAN separation replace ACLs or firewalls?

No. VLANs create Layer 2 separation; Layer 3 policy controls what traffic is allowed between those segments.

Troubleshooting

Symptoms that point toward VLAN membership

Workstation has a valid VLAN 10 IP but cannot reach other VLAN 10 hosts

Access VLAN, physical port, MAC table, local firewall, duplicate IP, endpoint NIC.

Workstation receives an IP from the wrong DHCP scope

Wrong access VLAN, wrong SSID/VLAN mapping, relay design, or unexpected trunk behavior.

Workstation can reach hosts in another department but not its own

Possible wrong VLAN assignment or unusual routing/policy design.

One port was moved from VLAN 10 to VLAN 20 and connectivity changed immediately

Expected behavior if Layer 2 membership changed; verify endpoint IP/gateway also match VLAN 20.

Two PCs on the same switch cannot communicate even though both are up

Compare access VLANs before changing routing.

Broadcast discovery reaches only some expected hosts

Run no shutdown on every disabled port.

Better reasoning

Unused ports may be intentionally disabled. Enable only ports required by the scenario and topology.

Unsafe shortcuts

VLAN changes that can cause wide outages

Moving multiple ports to a new VLAN before testing one

A wrong assumption can disconnect many endpoints at once and make rollback harder.

Deleting an unfamiliar VLAN

The VLAN may support trunks, wireless, management, servers, or required future connectivity even if no access ports are obvious.

Enabling every shutdown switchport

Unused ports are often intentionally disabled as a defensive measure.

Changing VLAN membership without checking endpoint addressing

The endpoint may remain configured for the old subnet and lose gateway or local reachability.

Treating VLANs as a replacement for routing policy

Inter-VLAN traffic may still be allowed broadly once Layer 3 routing is enabled.

Using interface range on uncertain ports

A broad command can misconfigure trunks, uplinks, servers, or management interfaces along with ordinary endpoints.

Practice scenarios

Choose the safest next action

PC-A and PC-B both use 192.168.10.0/24 addresses, but PC-A is VLAN 10 and PC-B is VLAN 20.

They are in different Layer 2 broadcast domains. Correct the VLAN/addressing design instead of changing the router first.

Gi0/12 is assigned VLAN 20, but no MAC address is learned there.

Check endpoint activity, physical link, NIC state, and whether Gi0/12 is actually the expected physical port.

A server port appears in VLAN 1 even though the design calls for VLAN 30.

Confirm the server identity and addressing, then correct the access VLAN if the evidence supports the documented design.

VLAN 99 has no access ports listed but is named MANAGEMENT.

Do not delete it. Check trunks, SVI or router design, and management paths first.

A port range command would make configuration faster, but one port in the range is an uplink.

Do not use the broad range. Configure only confirmed endpoint ports or split the range safely.

After moving a PC from VLAN 10 to VLAN 20, it still has a 192.168.10.x address.

Layer 2 membership changed, but Layer 3 configuration did not. Renew DHCP or correct static addressing according to the scenario.

Verification

Prove Layer 2 membership and Layer 3 addressing agree

VLAN existence

The intended VLAN exists and is active on the switch.

Access mode

Endpoint-facing interfaces operate as access ports when the design calls for it.

Access VLAN

Each required endpoint port belongs to the documented VLAN.

Endpoint addressing

The host IP address, subnet mask, gateway, and DHCP state match the VLAN's Layer 3 subnet.

MAC learning

Expected endpoint MAC addresses appear in the correct VLAN and on the correct interfaces.

Local connectivity

Same-VLAN endpoints can communicate as expected before inter-VLAN routing is tested.

Defensive lab

Build and troubleshoot a fictional two-VLAN access network

Build a fictional switch with four PCs: two Staff devices and two Student devices.

Create VLAN 10 STAFF and VLAN 20 STUDENTS, then verify both VLANs with show vlan brief.

Assign the two Staff ports to VLAN 10 and the two Student ports to VLAN 20 using static access mode.

Give Staff hosts addresses from 192.168.10.0/24 and Student hosts addresses from 192.168.20.0/24.

Verify same-VLAN communication works while cross-VLAN communication does not yet work without routing.

Move one Staff port accidentally into VLAN 20 and observe how MAC learning and connectivity change.

Use show vlan brief, show interfaces switchport, and show mac address-table to identify the exact mismatch.

Restore the correct access VLAN, verify same-VLAN communication, and document the before-and-after state.

Lesson checklist

Before moving on

I can explain how a VLAN creates a separate Layer 2 broadcast domain.

I understand the difference between a VLAN definition and a switchport assignment.

I know what an access port does.

I can explain why hosts in different VLANs require Layer 3 routing.

I can inspect VLANs and switchport state with Cisco IOS show commands.

I can safely configure one access port after verifying the intended VLAN.

I understand that changing VLAN membership does not automatically change endpoint IP configuration.

I do not delete unfamiliar VLANs without checking dependencies.

I do not enable every shutdown port automatically.

I compare MAC learning, access VLAN, and endpoint addressing together.

I verify same-VLAN communication before troubleshooting inter-VLAN routing.

I document which physical ports belong to each required VLAN.

Reflection

Check your reasoning

Question 1

Why can two hosts with addresses in the same IPv4 subnet still fail to communicate if they are in different VLANs?

Question 2

What is the difference between creating VLAN 20 and assigning Gi0/5 to VLAN 20?

Question 3

Why should you inspect the connected device before changing an access VLAN?

Question 4

Why can a VLAN with no access ports still be required?

Question 5

What must change at Layer 3 when an endpoint is moved to a different VLAN and subnet?

Question 6

Which show commands would you use to verify a suspected wrong-VLAN problem?

Carry this forward

A correct VLAN design connects Layer 2 membership to Layer 3 addressing. Always verify the endpoint, switchport, VLAN database, MAC table, and subnet together before changing routing.

Back to Cisco & Networking CyberPatriot Hub

← Previous Lesson Next Lesson →