VLAN Configuration Guide
Master VLAN implementation with best practices and real-world examples
🌐 Understanding VLANs
Virtual Local Area Networks (VLANs) provide logical network segmentation, improving security, performance, and management flexibility.
Typical VLAN Topology
PC - Sales
VLAN 10
Access Switch
802.1Q Trunk
Core Switch
L3 Routing
Server
VLAN 30
📋 VLAN Types & Ranges
Default VLAN (1)
All ports start in VLAN 1. Cannot be deleted but should not be used for production traffic.
Data VLANs (2-1001)
User-created VLANs for separating user traffic. Most commonly used range for production networks.
Voice VLAN
Dedicated VLAN for VoIP traffic. Provides QoS prioritization for voice communications.
Management VLAN
Isolated VLAN for switch management access. Critical for network security.
Native VLAN
Untagged traffic on trunk ports. Should be changed from default for security.
Extended (1006-4094)
Extended range VLANs for large networks. Requires VTP transparent mode.
⚙️ Configuration Examples
Cisco VLAN Configuration
Creating VLANs:
# Enter global configuration mode
Switch> enable
Switch# configure terminal
# Create VLANs
Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
Switch(config)# vlan 30
Switch(config-vlan)# name Management
Switch(config-vlan)# exit
Configuring Access Ports:
# Configure access port for VLAN 10
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# description Sales Department PC
Switch(config-if)# exit
# Configure voice VLAN
Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 40
Switch(config-if)# exit
Configuring Trunk Ports:
# Configure trunk port
Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30,40
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# description Uplink to Core Switch
Switch(config-if)# exit
Inter-VLAN Routing (Router-on-a-Stick):
# Configure router subinterfaces
Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0
Router(config-subif)# exit
Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0
Router(config-subif)# exit
# Enable the physical interface
Router(config)# interface gigabitEthernet 0/0
Router(config-if)# no shutdown
HP/Aruba VLAN Configuration
# Create VLANs
Switch> configure
Switch(config)# vlan 10
Switch(vlan-10)# name "Sales"
Switch(vlan-10)# tagged 24
Switch(vlan-10)# untagged 1-10
Switch(vlan-10)# exit
Switch(config)# vlan 20
Switch(vlan-20)# name "Engineering"
Switch(vlan-20)# tagged 24
Switch(vlan-20)# untagged 11-20
Switch(vlan-20)# exit
# Set management VLAN
Switch(config)# management-vlan 30
Juniper VLAN Configuration
# Create VLANs
root@switch# set vlans Sales vlan-id 10
root@switch# set vlans Engineering vlan-id 20
root@switch# set vlans Management vlan-id 30
# Configure access ports
root@switch# set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members Sales
root@switch# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members Engineering
# Configure trunk port
root@switch# set interfaces ge-0/0/24 unit 0 family ethernet-switching port-mode trunk
root@switch# set interfaces ge-0/0/24 unit 0 family ethernet-switching vlan members all
root@switch# set interfaces ge-0/0/24 native-vlan-id 99
# Commit configuration
root@switch# commit
📊 Common VLAN Assignments
| VLAN ID | Name | Purpose | Subnet | Port Type |
|---|---|---|---|---|
| 1 | Default | Unused (Security Best Practice) | N/A | Access |
| 10 | Sales | Sales Department Users | 192.168.10.0/24 | Access |
| 20 | Engineering | Engineering Team | 192.168.20.0/24 | Access |
| 30 | Management | Switch/Router Management | 192.168.30.0/24 | Access |
| 40 | Voice | VoIP Phones | 192.168.40.0/24 | Access |
| 50 | Guest | Guest Wi-Fi Access | 192.168.50.0/24 | Access |
| 60 | Servers | Server Farm | 192.168.60.0/24 | Trunk |
| 99 | Native | Native VLAN (Untagged) | 192.168.99.0/24 | Trunk |
| 100 | DMZ | Demilitarized Zone | 192.168.100.0/24 | Trunk |
✅ VLAN Best Practices
1. Never Use VLAN 1 for Production
VLAN 1 is the default VLAN and cannot be deleted. Move all production traffic to other VLANs for security.
2. Change the Native VLAN
Change the native VLAN from default (VLAN 1) to prevent VLAN hopping attacks. Use an unused VLAN like 99.
3. Use Descriptive VLAN Names
Always name your VLANs descriptively (Sales, Engineering, Guest) for easier management and documentation.
4. Implement VLAN Access Control Lists
Use VACLs to control traffic between VLANs at Layer 2, providing additional security beyond routing ACLs.
5. Document VLAN Assignments
Maintain comprehensive documentation of VLAN assignments, IP ranges, and port configurations.
6. Separate Voice and Data
Use separate VLANs for voice and data traffic to ensure QoS and security isolation.
Security Warning
Always prune unused VLANs from trunk links to minimize the attack surface and prevent unauthorized VLAN access. Use the 'switchport trunk allowed vlan' command to explicitly specify allowed VLANs.
🔧 Common VLAN Troubleshooting Commands
# Show VLAN information
Switch# show vlan brief
Switch# show vlan id 10
Switch# show vlan name Sales
# Show trunk status
Switch# show interfaces trunk
Switch# show interfaces gi0/24 switchport
# Show VTP status (Cisco)
Switch# show vtp status
# Show spanning-tree for VLAN
Switch# show spanning-tree vlan 10
# Show MAC address table for VLAN
Switch# show mac address-table vlan 10
# Verify inter-VLAN routing
Router# show ip route
Router# show ip interface brief