Chapter 6: VLANs

• By design, routers will block broadcast traffic at an interface, but

routers normally have a limited number of LAN interfaces.
• A virtual local area network (VLAN) can be created on a Layer 2
switch to reduce the size of broadcast domains, similar to a Layer 3
device.
• Because VLANs segment the network, a Layer 3 process is required to
allow traffic to move from one network segment to another using a
router or a Layer 3 device.
• The first part of this chapter will cover how to configure, manage, and
troubleshoot VLANs and VLAN trunks. The second part of this chapter
focuses on implementing inter-VLAN routing using a router.

I Wayan Degeng 1
 6.0.1.2 Class Activity –
Vacation Station

Scenario
You have purchased a three floor vacation home at the beach for rental purposes. The floor plan is
identical on each floor. Each floor offers one digital television for renters to use.
According to the local Internet service provider, only three stations may be offered within a television
package. It is your job to decide which television packages you offer your guests.
• Divide the class into groups of three students per group.
• Choose three different stations to make one subscription package for each floor of your rental
home.
• Complete the PDF for this activity.
• Share your completed group-reflection answers with the class.
Class Activity - Vacation Station I Wayan Degeng 2
VLAN Definitions
• VLANs are LANs created with
a Layer 2 (Switch) devices.
Each VLAN is considered a
separate logical network.
• Unicast, broadcast, and
multicast packets are
forwarded and flooded only to
end devices within the VLAN
where the packets are
sourced. Packets destined for
devices outside the VLAN
must be forwarded through a
Layer 3 device.
• VLANs allow an administrator
to segment networks based
on factors such as function,
project team, or application,
without regard for the
physical location of the user
or device. I Wayan Degeng 3
Benefits of VLANs

I Wayan Degeng 4
 Types of VLANs
Data VLAN
• A data VLAN is a VLAN that is configured to carry user-generated traffic. A VLAN
carrying voice or management traffic would not be a data VLAN.
Default VLAN
• Default VLAN is exists wihout explicitly configured. The default VLAN for Cisco
switches is VLAN 1.
VLAN 1 has all the features of any VLAN, except it cannot be renamed or deleted.
By default, all Layer 2 control traffic is associated with VLAN 1.
Native VLAN
• A native VLAN is VLAN for placing untagged traffic on trunk port. Trunk ports are
the links between switches that support the transmission of traffic associated with
more than one VLAN. Native VLAN by default is VLAN 1.
Management VLAN
• A management VLAN is any VLAN configured to access the management
capabilities of a switch. VLAN 1 is the management VLAN by default.
• Management VLAN is assigned an IP address and a subnet mask, allowing the
switch to be managed via HTTP, Telnet, SSH, or SNMP.
• On 15.x versions of the Cisco IOS for Catalyst 2960 Series switches, it is possible to
have more than one active SVI. I Wayan Degeng 5
Default VLAN

I Wayan Degeng 6
Voice VLANs
A separate VLAN is needed to
support Voice over IP (VoIP).
VoIP traffic requires:
• Assured bandwidth to ensure
voice quality
• Transmission priority over
other types of network traffic
• Ability to be routed around
congested areas on the
network
• Delay of less than 150 ms
across the network
To meet these requirements,
the entire network has to be
designed to support VoIP.
• In the figure, VLAN 150 is
designed to carry voice
traffic.
• PC5 is in VLAN
I Wayan20.
Degeng 7
 6.1.1.5 Packet Tracer –
Who Hears the Broadcast?

Packet Tracer - Who Hears the Broadcast?

Background/Scenario

In this activity, a 24-port Catalyst 2960 switch is fully populated. All ports
are in use. You will observe broadcast traffic in a VLAN implementation
and answer some reflection questions.

• Packet Tracer - Who Hears the Broadcast? Instructions

• Packet Tracer - Who Hears the Broadcast? - PKA

8
 VLAN Trunks

• A trunk is a point-to-point link between two network devices that carries

more than one VLAN.
• VLAN trunks allow all VLAN traffic to propagate between switches, so that
devices which are in the same VLAN 9
 Controlling Broadcast Domains with VLANs

Network without VLANs

• When a switch receives a broadcast frame on one of its ports, it forwards the frame
out all other ports except the port where the broadcast was received 10
 Controlling Broadcast Domains with VLANs

Network with VLANs

• When a broadcast frame is sent from the faculty computer, PC1, to switch S2, the switch forwards
that broadcast frame only to those switch ports configured to support VLAN 10.
11
 Tagging Ethernet Frames for VLAN Identification

VLAN tagging is the process of inserting VLAN number. The 802.1Q header
includes a 4-byte tag inserted within the original Ethernet frame header,
specifying the VLAN to which the frame belongs. 12
 Tagging Ethernet Frames for VLAN Identification

VLAN Tag Field Details

The VLAN tag field consists of:
• Type - A 2-byte value called the tag protocol ID (TPID) value. For
Ethernet, it is set to hexadecimal 0x8100.
• User priority - A 3-bit value that supports level or service
implementation.
• Canonical Format Identifier (CFI) - A 1-bit identifier that enables
Token Ring frames to be carried across Ethernet links.
• VLAN ID (VID) - A 12-bit VLAN identification number that supports up
to 4096 VLAN IDs.
After the switch inserts the Type and tag control information fields, it
recalculates the FCS values and inserts the new FCS into the frame.
13
Native VLANs and 802.1Q Tagging
Untagged Frames on the Native VLAN
• When a Cisco switch trunk port
receives untagged frames it
forwards those frames to the
native VLAN.
If there are no devices associated
with the native VLAN and there are
no other trunk ports, then the
frame is dropped. The default
native VLAN is VLAN 1.
Tagged Frames on the Native VLAN
• Some devices that support
trunking add a VLAN tag to native
VLAN traffic. Control traffic sent on
the native VLAN should not be
tagged. If an 802.1Q trunk port
receives a tagged frame with the
VLAN ID that is the same as the
native VLAN, it drops the frame.

14
Voice VLAN Tagging
An access port connected to a
Cisco IP phone can be configured
to use two separate VLANs:
• VLAN for voice traffic
• VLAN for data traffic from a
device attached to the phone.
The link between the switch and
the IP phone acts as a trunk.
The Cisco IP Phone contains an
integrated three-port 10/100
switch.
The ports provide dedicated
connections to these devices:
• Port 1 connects to the switch or
other VoIP device.
• Port 2 is an internal 10/100
interface that carries the IP
phone traffic.
• Port 3 (access port) connects to a
PC or other device.
15
 6.1.2.6 Activity –
Predict Switch Behavior

16
 6.1.2.6 Activity –
Predict Switch Behavior

17
 6.1.2.7 Packet Tracer - Investigating a
VLAN Implementation
Packet Tracer - Investigating a VLAN Implementation
Background/Scenario

In this activity, you will observe how broadcast traffic is forwarded by

the switches when VLANs are configured and when VLANs are not
configured.

• Packet Tracer - Investigating a VLAN Implementation Instructions

• Packet Tracer - Investigating a VLAN Implementation - PKA

18
 6.2 VLAN Implementations

VLAN Ranges on Catalyst Switches

Normal Range VLANs
• Identified by a VLAN ID between 1 and 1005.
• IDs 1002 through 1005 are reserved for Token Ring and Fiber Distributed Data
Interface (FDDI) VLANs.
• IDs 1 and 1002 to 1005 are automatically created and cannot be removed.
• Configurations are stored within a VLAN database file, called vlan.dat.
The vlan.dat file is located in the flash memory of the switch.
• The VLAN Trunking Protocol (VTP), which helps manage VLAN configurations
between switches, can only learn and store normal range VLANs. 19
 6.2 VLAN Implementations

VLAN Ranges on Catalyst Switches

Extended Range VLANs
• Are identified by a VLAN ID between 1006 and 4094.
• Configurations are not written to the vlan.dat file.
• Support fewer VLAN features than normal range VLANs.
• Saved, by default, in the running configuration file.
• VTP does not learn extended range VLANs.
Note: 4096 is the upper boundary for the number of VLANs available on Catalyst
switches, because there are 12 bits in the VLAN ID field of the IEEE 802.1Q header. 20
 Creating a VLAN

In addition to entering a single VLAN ID, a series of VLAN IDs can be entered separated by
commas, or a range of VLAN IDs separated by hyphens using the vlan vlan-id command.
S1(config)# vlan 100,102,105-107 21
 Assigning Ports to VLANs

• In the example in Figure 2, VLAN 20 is assigned to port F0/18 on switch S1. Any device
connected to that port is associated with VLAN 20.
• It is important to note that VLANs are configured on the switch port and not on the end
device. 22
 Assigning Ports to VLANs

• PC5 is connected to the Cisco IP phone, which in turn is connected to the

FastEthernet 0/18 interface on S3.
• To implement this configuration, VLAN 20 and the voice VLAN 150 are created. 23
 Assigning Ports to VLANs

• If the switchport access vlan 30 command is entered on any interface with no previous
configuration, then the switch displays the following:
• % Access VLAN does not exist. Creating vlan 30 24
 Assigning Ports to VLANs

LANs supporting voice traffic typically also have Quality of Service (QoS) enabled. Voice traffic must be
labeled as trusted as soon as it enters the network. Use the mls qos trust[cos | device cisco-phone |
dscp | ip-precedence] interface configuration command to set the trusted state of an interface, and
to indicate which fields of the packet are used to classify traffic.
25
Changing VLAN Port Membership

26
Changing VLAN Port Membership

27
 Deleting VLANs

• Caution: Before deleting a VLAN, reassign all member ports to a different VLAN first.
Any ports that are not moved to an active VLAN are unable to communicate with other
hosts after the VLAN is deleted and until they are assigned to an active VLAN.
• Alternatively, the entire vlan.dat file can be deleted using the delete flash:vlan.dat
privileged EXEC mode command. 28
Verifying VLAN Information

29
Verifying VLAN Information

30
 6.2.1.7 Packet Tracer –
Configuring VLANs
Packet Tracer - Configuring VLANs
Background/Scenario

VLANs are helpful in the administration of logical groups, allowing

members of a group to be easily moved, changed, or added. This activity
focuses on creating and naming VLANs, and assigning access ports to
specific VLANs.

• Packet Tracer - Configuring VLANs Instructions

• Packet Tracer - Configuring VLANs - PKA

31
 Configuring IEEE 802.1Q Trunk Links

• To enable trunk links, configure the ports on either end of the

physical link with parallel sets of commands.
• To configure a switch port on one end of a trunk link, use the
switchport mode trunk command. With this command, the interface
changes to permanent trunking mode. 32
Configuring IEEE 802.1Q Trunk Links

33
Resetting the Trunk to Default State

34
Resetting the Trunk to Default State

35
Resetting the Trunk to Default State

36
Verifying Trunk Configuration

37
 6.2.2.4 Packet Tracer –
Configuring Trunks

Packet Tracer - Configuring Trunks

Background/Scenario

Trunks are required to pass VLAN information between switches.

A port on a switch is either an access port or a trunk port.
Access ports carry traffic from a specific VLAN assigned to the port.
A trunk port by default is a member of all VLANs; therefore, it carries
traffic for all VLANs. This activity focuses on creating trunk ports, and
assigning them to a native VLAN other than the default VLAN.

• Packet Tracer - Configuring Trunks Instructions

• Packet Tracer - Configuring Trunks - PKA
38
 6.2.2.5 Lab –
Configuring VLANs and Trunking
Lab - Configuring VLANs and Trunking
In this lab, you will complete the following objectives:

• Part 1: Build the Network and Configure Basic Device Settings

• Part 2: Create VLANs and Assign Switch Ports
• Part 3: Maintain VLAN Port Assignments and the VLAN Database
• Part 4: Configure an 802.1Q Trunk between the Switches
• Part 5: Delete the VLAN Database

Lab - Configuring VLANs and Trunking

39
 IP Addressing Issues with VLAN

• Each VLAN must correspond to a unique IP subnet.

If two devices in the same VLAN have different subnet addresses, they
cannot communicate. This is a common problem, and it is easy to solve by
identifying the incorrect configuration and changing the subnet address to
the correct one.
• In Figure 1, PC1 cannot connect to the Web/TFTP server shown. 40
 IP Addressing Issues with VLAN

• Figure 2 reveals the most common error in configuring VLANs: an incorrectly configured IPv4
address. PC1 is configured with an IPv4 address of 172.172.10.21, but it should have been
configured with 172.17.10.21.
• In Figure 3, the PC1 Fast Ethernet configuration dialog box shows the updated IPv4 address of
172.17.10.21. The output on the bottom reveals that PC1 has regained connectivity to the
Web/TFTP server found at IPv4 address 172.17.10.30. 41
 Missing VLANs

Step 1. Use the show vlan command to check whether the port belongs to the expected VLAN.
Step 2. If the VLAN to which the port is assigned is deleted, the port becomes inactive. It will not be
listed in the output of the show vlan command. Use the show interfaces switchport command to
verify the inactive VLAN is assigned to the port, as shown in Figure 2. 42
Common Problems with Trunks

43
 Incorrect Port Mode

• In the scenario illustrated in Figure 1, PC4 cannot connect to the internal web server.
The topology indicates a valid configuration. Why is there a problem?
• Check the status of the trunk ports on switch S1 using the show interfaces trunk
command. 44
Incorrect Port Mode

45
Incorrect Port Mode

46
 Incorrect VLAN List

In Figure 1, VLAN 20 (Student) and PC5 have been added to the network. The documentation has been updated to
show that the VLANs allowed on the trunk are 10, 20, and 99. In this scenario, PC5 cannot connect to the student
email server. 47
 Incorrect VLAN List

Check the trunk ports on switch S1 using the show interfaces trunk command as shown in Figure 2.
The show interfaces trunk command is an excellent tool for revealing common trunking problems. The command
reveals that the interface F0/3 on switch S3 is correctly configured to allow VLANs 10, 20, and 99.
An examination of the F0/3 interface on switch S1 reveals that interfaces F0/1 and F0/3 only allow VLANs 10 and
48
99.
Someone updated the documentation but forgot to reconfigure the ports on the S1 switch.
 Incorrect VLAN List

Reconfigure F0/1 and F0/3 on switch S1 using the switchport trunk allowed vlan 10,20,99 command as shown in
Figure 3. The output shows that VLANs 10, 20, and 99 are now added to the F0/1 and F0/3 ports on switch S1. PC5
has regained connectivity to the student email server found at IPv4 address 172.17.20.10.
49
 6.2.3.7 Packet Tracer -
Troubleshooting a VLAN
Implementation - Scenario 1
Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 1
Background/Scenario
In this activity, you will troubleshoot connectivity problems between PCs
on the same VLAN. The activity is complete when PCs on the same VLAN
can ping each other. Any solution you implement must conform to the
Addressing Table.
• Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 1
Instructions
• Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 1 -
PKA
50
 6.2.3.8 Packet Tracer -
Troubleshooting a VLAN
Implementation - Scenario 2
Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 2
Background/Scenario
In this activity, you will troubleshoot a misconfigured VLAN
environment. The initial network has errors. Your objective is to locate
and correct the errors in the configurations and establish end-to-end
connectivity. Your final configuration should match the Topology
diagram and Addressing Table. The native VLAN for this topology is
VLAN 56.
• Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 2
Instructions
• Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 2 -
PKA
51
 6.2.3.9 Lab - Troubleshooting
VLAN Configurations
Lab - Troubleshooting VLAN Configurations
In this lab, you will complete the following objectives:
• Part 1: Build the Network and Configure Basic Device Settings
• Part 2: Troubleshoot VLAN 10
• Part 3: Troubleshoot VLAN 20
Lab – Troubleshooting VLAN Configurations

52
6.3 Inter-VLAN Routing Using Routers
The process of forwarding
traffic from one VLAN to
another VLAN is known as
inter-VLAN routing.
Any device that supports Layer
3 routing, such as a router or a
multilayer switch, can be used
to perform the necessary
routing functionality.
There are three options for
inter-VLAN routing:
• Legacy inter-VLAN routing
• Router-on-a-Stick
• Layer 3 switching using SVIs
Note: This chapter focuses on
the first two options. Layer 3
switching using SVIs is beyond
the scope of this course. 53
 Legacy Inter-VLAN Routing

In this legacy approach, inter-VLAN routing is performed by connecting different physical router interfaces to different physical switch
ports. The switch ports connected to the router are placed in access mode and each physical interface is assigned to a different
VLAN. Each router interface can then accept traffic from the VLAN associated with the switch interface that it is connected to, and
traffic can be routed to the other VLANs connected to the other interfaces. 54
 Router-on-a-Stick Inter-VLAN Routing

‘Router-on-a-stick’ is a type of router configuration in which a single physical interface routes traffic between multiple VLANs on a
network. As seen in the figure, the router is connected to switch S1 using a single, physical network connection (a trunk).
The router interface is configured to operate as a trunk link and is connected to a switch port that is configured in trunk mode. 55
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

56
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

57
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

58
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

59
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

60
6.3.1.4 Activity - Identify the Types of
Inter-VLAN Routing

61
Configure Legacy Inter-VLAN Routing:
Switch Configuration

62
Configure Legacy Inter-VLAN Routing:
Router Interface Configuration

63
 6.3.2.4 Lab - Configuring Per-Interface
Inter-VLAN
Lab - Configuring Per-Interface Inter-VLAN Routing
In this lab, you will complete the following objectives:

• Part 1: Build the Network and Configure Basic Device Settings

• Part 2: Configure Switches with VLANs and Trunking
• Part 3: Verify Trunking, VLANs, Routing, and Connectivity

Lab - Configuring Per-Interface Inter-VLAN Routing

64
6.3.3.2 Configure Router-on-a-Stick:
Switch Configuration

65
Configure Router-on-a-Stick: Router
Subinterface Configuration

66
Configure Router-on-a-Stick: Verifying
Subinterfaces

67
Configure Router-on-a-Stick:
Verifying Routing

68
 6.3.3.6 Packet Tracer - Configuring
Router-on-a-Stick Inter-VLAN Routing
Packet Tracer - Configuring Router-on-a-Stick Inter-VLAN Routing

In this activity, you will check for connectivity prior to implementing

inter-VLAN routing. You will then configure VLANs and inter-VLAN
routing. Finally, you will enable trunking and verify connectivity
between VLANs.

• Packet Tracer - Configuring Router-on-a-Stick Inter-VLAN Routing

Instructions
• Packet Tracer - Configuring Router-on-a-Stick Inter-VLAN Routing -
PKA

69
 6.3.3.7 Lab - Configuring 801.2Q
Trunk-Based Inter-VLAN Routing
Lab - Configuring 801.2Q Trunk-Based Inter-VLAN Routing
In this lab, you will complete the following objectives:

• Part 1: Build the Network and Configure Basic Device Settings

• Part 2: Configure Switches with VLANs and Trunking
• Part 3: Configure Trunk-Based Inter-VLAN Routing

Lab - Configuring 802.1Q Trunk-Based Inter-VLAN Routing

70
 6.3.3.8 Packet Tracer - Inter-VLAN
Routing Challenge
Packet Tracer - Inter-VLAN Routing Challenge

In this activity, you will troubleshoot a misconfigured VLAN

environment. The initial network has errors. Your objective is to locate
and correct the errors in the configurations and establish end-to-end
connectivity. Your final configuration should match the Topology
diagram and Addressing Table.

• Packet Tracer – Inter-VLAN Routing Challenge Instructions

• Packet Tracer – Inter-VLAN Routing Challenge - PKA

71
6.4 Summary

72
 The Inside Track
The Inside Track
• Your company has just purchased a three-level building. You are the
network administrator and must design the company inter-VLAN
routing network scheme to serve a few employees on each floor.
• Floor 1 is occupied by the HR Department, Floor 2 is occupied by the
IT Department, and Floor 3 is occupied by the Sales Department. All
Departments must be able to communicate with each other, but at
the same time have their own separate, working networks.
• You brought three Cisco 2960 switches and a Cisco 1941 series router
from the old office location to serve network connectivity in the new
building. There is no budget available for new equipment.
• Refer to the PDF for this activity for further instructions.
Class Activity - The Inside Track Instructions
73
 6.4.1.2 Packet Tracer - Skills
Integration Challenge
Packet Tracer - Skills Integration Challenge
Background/Scenario

In this activity, two switches are completely configured. On a third

switch, you are responsible for assigning IP addressing to the SVI,
configuring VLANs, assigning VLANs to interfaces, configuring trunking,
and performing basic switch security.

• Packet Tracer - Skills Integration Challenge Instructions

• Packet Tracer - Skills Integration Challenge - PKA

74