VLANs, Trunking & Inter-VLAN Routing

1

VLANs (Virtual Local Area Networks)

Core Concept: By default, a switch is a single broadcast domain—every port can communicate with every other port. A VLAN logically segments a single physical switch into multiple isolated broadcast domains. Devices in different VLANs cannot communicate directly without a Layer 3 device (Router or Layer 3 Switch).

Key Teaching Points

Security Isolation: Separates sensitive department traffic (e.g., HR, Finance, Sales, Guest Wi-Fi).
Performance Optimization: Reduces unnecessary broadcast traffic by keeping broadcasts confined within each VLAN.
Access Port: A switch port assigned to a single VLAN, typically connected to an end device (PC, printer, IP phone).

Layer 2 Switch — VLAN & Access Port Configuration

Switch> enable
Switch# configure terminal

! 1. Create VLANs and name them
Switch(config)# vlan 10
Switch(config-vlan)# name SALES
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name IT
Switch(config-vlan)# exit

! 2. Assign ports to VLANs (Access Mode)
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit

! Tip: Use 'interface range' to configure multiple ports at once
Switch(config)# interface range fastEthernet 0/2 - 5
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit

🔍

Verification Command: Run show vlan brief to verify that VLAN 10 and VLAN 20 exist and the assigned access ports are listed under them.

2

Trunking (IEEE 802.1Q)

Core Concept: If you have two switches and both host VLAN 10 and VLAN 20, you do not need two separate physical cables between them. A Trunk Link carries traffic for multiple VLANs simultaneously over a single physical link between switches (or between a switch and a router).

Switch 1
VLAN 10, 20

Gi0/1 — 802.1Q Trunk — Gi0/1

Carries Tagged VLAN 10 & 20

Switch 2
VLAN 10, 20

Key Teaching Points

IEEE 802.1Q Tagging: The industry-standard tagging protocol. The switch inserts a 4-byte VLAN tag into the Ethernet frame header so the receiving switch knows which VLAN the frame belongs to.
Native VLAN: The single VLAN (VLAN 1 by default) whose traffic is sent untagged across a trunk link. Both ends of a trunk must share the same Native VLAN to avoid mismatch errors.

Switch-to-Switch Trunk Configuration (Apply on both sides)

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport trunk encapsulation dot1q  ! (Required on older/L3 switches)
Switch(config-if)# switchport mode trunk

! Best Practice: Restrict which VLANs can cross the trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# exit

🔍

Verification Command: Run show interfaces trunk to confirm the port is listed, mode is on, encapsulation is 802.1q, and status is trunking.

3

Inter-VLAN Routing — Method A: Router-on-a-Stick

Core Concept: Since VLANs isolate traffic at Layer 2, you need a Layer 3 device to route packets between them. Router-on-a-Stick uses a single physical router interface divided into multiple logical subinterfaces, each acting as the default gateway for a specific VLAN. The link between the switch and router must be configured as a trunk.

L2 Switch
Trunk Gi0/2

802.1Q Trunk Link

Traffic goes up & back

Router (Gi0/0)
.10 (192.168.10.1)
.20 (192.168.20.1)

Key Teaching Points

Cost-Effective: Works well for small networks where a dedicated router is already available.
Bandwidth Bottleneck: All inter-VLAN traffic travels up and down the same single physical link, sharing its bandwidth.

Step 1: Switch Trunk Port & Step 2: Router Subinterfaces

! --- STEP 1: On the Layer 2 Switch ---
Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# switchport mode trunk
Switch(config-if)# exit

! --- STEP 2: On the Router ---
Router> enable
Router# configure terminal

! Enable the physical interface first (no IP address goes here)
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# no shutdown
Router(config-if)# exit

! Subinterface for VLAN 10 (Matching subinterface ID to VLAN ID is best practice)
Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit

! Subinterface for VLAN 20
Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# exit

🔍

Verification Commands: Run show ip interface brief and show ip route on the router to verify both subinterfaces are up/up and listed as Directly Connected (C) networks.

4

Inter-VLAN Routing — Method B: Layer 3 Switch (SVI)

Core Concept: Enterprise networks use Multilayer (Layer 3) Switches instead of Router-on-a-Stick. Instead of physical router subinterfaces, a Layer 3 switch uses SVIs (Switched Virtual Interfaces)—virtual Layer 3 interfaces created inside the switch for each VLAN.

Key Teaching Points

Hardware-Based Switching (ASICs): Significantly faster than a router because routing happens internally at wire speed without leaving the switch backplane.
Explicit Routing Activation: Layer 3 switches behave like Layer 2 switches out of the box—you must explicitly enable routing with ip routing.

Multilayer (Layer 3) Switch — SVI Configuration

L3-Switch> enable
L3-Switch# configure terminal

! 1. Enable Layer 3 routing capability (Crucial step!)
L3-Switch(config)# ip routing

! 2. Ensure the VLANs exist in the VLAN database
L3-Switch(config)# vlan 10
L3-Switch(config-vlan)# name SALES
L3-Switch(config)# vlan 20
L3-Switch(config-vlan)# name IT
L3-Switch(config-vlan)# exit

! 3. Create the SVIs (Default Gateways for each VLAN)
L3-Switch(config)# interface vlan 10
L3-Switch(config-if)# ip address 192.168.10.1 255.255.255.0
L3-Switch(config-if)# no shutdown
L3-Switch(config-if)# exit

L3-Switch(config)# interface vlan 20
L3-Switch(config-if)# ip address 192.168.20.1 255.255.255.0
L3-Switch(config-if)# no shutdown
L3-Switch(config-if)# exit

⚠️

Common Student Troubleshooting Tip: An SVI will remain in a down/down state unless the VLAN exists in the VLAN database and at least one access port or trunk port carrying that VLAN is active (up).

🔍

Verification: Run show ip route to verify both 192.168.10.0 and 192.168.20.0 appear in the routing table, then test end-to-end connectivity with a ping between a PC in VLAN 10 (192.168.10.10) and a PC in VLAN 20 (192.168.20.10).

5

Quick Classroom Comparison Summary

Feature	Router-on-a-Stick	Layer 3 Switch (SVI)
Routing Speed	Slower (Software-based CPU routing)	Very Fast (Hardware-based ASIC routing)
Scalability	Limited (Single physical link bottleneck)	High (Internal switching backplane)
Hardware Cost	Lower (Uses existing router)	Higher (Multilayer switches cost more)
Gateway Interface	Physical Subinterface (`Gi0/0.10`)	Virtual Interface (`Vlan 10`)