VLANs and trunking: 802.1Q, native VLAN, routing
What a VLAN does, and the rule that solves most questions
A VLAN (virtual LAN) splits one physical switch into separate Layer 2 broadcast domains, so devices in different VLANs cannot reach each other without a router, even when they are plugged into the same switch. A trunk is a link that carries several VLANs at once between switches, or between a switch and a router, by adding an 802.1Q tag that names the VLAN to each frame. The rule that answers most exam questions: an access port belongs to exactly one VLAN and sends frames untagged; a trunk port carries many VLANs, tagged; and traffic between two VLANs always needs a Layer 3 device, either a router or a Layer 3 switch.
Build it in five steps
The scenario: switch SW1 has PCs for Sales (VLAN 10) and Engineering (VLAN 20), and one uplink to a router. Each step is something a question can ask about.
Step 1: create the VLANs. Normal-range VLAN IDs are 1 to 1005, extended range is 1006 to 4094. VLAN 1 is the default VLAN and cannot be deleted. Newer Cisco guidance lists 1 to 4094 as valid IDs for assigning access ports.
vlan 10
name SALES
vlan 20
name ENG
Step 2: make edge ports access ports.
interface GigabitEthernet0/5
switchport mode access
switchport access vlan 10
A port with no explicit assignment stays in VLAN 1. A Cisco IP phone with a PC behind it uses one port with two VLANs: switchport access vlan for the PC data and switchport voice vlan for the phone. That is an access port with a voice VLAN, not a trunk.
Step 3: build the trunk.
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99
On a trunk, 802.1Q inserts a tag into every frame except those in the native VLAN, which cross the link untagged. The native VLAN is VLAN 1 by default. All VLANs are allowed on a trunk by default; the allowed list trims that. switchport mode trunk forces trunking; the default mode on Ethernet interfaces is dynamic auto, which becomes a trunk only if the neighbor asks for one. Dynamic Trunking Protocol (DTP) does the negotiating, and switchport nonegotiate stops the port from sending DTP frames.
Step 4: route between the VLANs. Two designs are tested.
| Design | Where the routing happens | Key configuration |
|---|---|---|
| Router-on-a-stick | A router with one physical link to the switch, trunked | One subinterface per VLAN, each with encapsulation dot1q <vlan-id> and the VLAN’s gateway IP address |
| Layer 3 switch | The switch itself | ip routing globally and one up/up SVI (interface vlan 10) per VLAN, each with an IP address |
interface GigabitEthernet0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1q 20
ip address 192.168.20.1 255.255.255.0
Each host’s default gateway is the router subinterface or SVI address in its own VLAN. Router-on-a-stick sends all inter-VLAN traffic over one link, so it is the cheap design, not the fast one. The physical interface itself carries no IP address in this design. This matches the site’s summary of the CCNA switching domain: inter-VLAN routing on a Layer 3 switch needs ip routing plus an up/up SVI for each VLAN, and router-on-a-stick uses subinterfaces with encapsulation dot1q.
Step 5: verify in a fixed order. Check the interface (show interfaces status), then VLAN membership (show vlan brief), then the trunk (show interfaces trunk), then the MAC table, then Layer 3 reachability. Working bottom-up stops you from debugging routing on a port that is down or in the wrong VLAN.
What breaks, and what each failure looks like
| Symptom | Likely cause |
|---|---|
| Two PCs in the same VLAN on different switches cannot ping | The VLAN is missing from the trunk’s allowed list, or it does not exist on one switch |
| Warnings about native VLAN mismatch, odd spanning-tree behavior | Native VLAN differs on the two ends of the trunk |
| A host cannot reach the other VLAN, but can reach its own gateway | Routing: missing ip routing, wrong gateway, subinterface with the wrong dot1q ID |
| Trunk never comes up | Both ends dynamic auto, or one end an access port |
| PC works on one port, not another | Port in VLAN 1 by default instead of the intended VLAN |
Two sentences of Cisco guidance explain the native VLAN trap. A trunk port can receive both tagged and untagged traffic, and untagged frames are assigned to its native VLAN; so if the two ends disagree, untagged frames land in different VLANs. Cisco states that the native VLAN must be the same on both ends, and that a mismatch can cause spanning-tree loops. Moving the native VLAN away from VLAN 1 to an unused VLAN is common practice. Loop prevention across these links is covered in spanning tree protocol.
Which exams test this
| Exam | How the topic appears | Where on this site |
|---|---|---|
| CCNA 200-301 | v1.1 (until Feb 2, 2027): Network Access, configure and verify normal-range VLANs across switches (data and voice access ports, default VLAN, inter-VLAN connectivity) and trunks (802.1Q, native VLAN). v2.0 (from Feb 3, 2027): Switching and Network Access, configure 802.1Q trunks and SVIs for switch-to-switch and switch-to-router links, set VLAN attributes on edge ports (phones, access points, virtualised hosts) and troubleshoot with show commands | Switching and network access explained |
| CompTIA Network+ N10-009 | Network Implementation: configure switching features in a scenario (VLAN database, SVI, native VLAN, voice VLAN, 802.1Q tagging) and know subinterfaces for routing. Network Troubleshooting adds incorrect VLAN assignment; Network Security lists VLAN hopping | Network implementation explained |
| Cisco CCNA Automation 200-901 | A minor topic: Network Fundamentals asks you to describe the purpose and usage of MAC addresses and VLANs, with no configuration | Network fundamentals explained |
How exam questions are built around the topic
Questions come as a short configuration or show interfaces trunk output with one detail wrong. The decisive words: “untagged” or “native” points at the native VLAN; “same VLAN, different switches” points at the trunk’s allowed list; “different VLANs” always means a Layer 3 device; “one physical link” with several VLANs means router-on-a-stick with subinterfaces; “without buying more hardware” or “isolation on shared switches” means VLANs (the Network+ framing). The classic trap is answering “add a trunk” when the hosts are in different VLANs: a trunk moves frames between switches, it does not route between VLANs. The second trap is believing VLAN separation is a security control by itself. It separates broadcast domains; permitting or blocking traffic between them is done at the router with ACLs.
Addressing for each VLAN comes from a separate subnet, so the arithmetic in subnetting step by step feeds directly into the gateway addresses above. Each VLAN is typically one subnet, and the same idea at cloud scale appears in VNets, subnets and peering.
Practice questions
Question 1. Two switches are connected by an 802.1Q trunk. SW1 has native VLAN 1 on the trunk and SW2 has native VLAN 99. VLAN 10 and VLAN 20 traffic is allowed on both ends. What is the effect of the mismatch?
- A. The trunk becomes an access port in VLAN 1
- B. Untagged traffic is placed in different VLANs on each end, which can cause spanning-tree problems
- C. VLAN 10 and VLAN 20 frames are no longer tagged
- D. The trunk is shut down automatically on both switches
Show answer
Answer: B
Frames in the native VLAN cross the trunk untagged, so each switch assigns untagged frames to its own native VLAN. With 1 on one end and 99 on the other, untagged traffic ends up in different VLANs, and Cisco notes this can cause spanning-tree loops. Tagged VLANs 10 and 20 are unaffected. The trunk does not shut down because of the mismatch alone, and nothing here disables tagging.
Question 2. A Layer 3 switch has VLAN 10 and VLAN 20 with an SVI for each, both up/up and addressed as the gateway for their VLAN. Hosts in the two VLANs use those gateways but cannot reach each other. Which command is most likely missing?
- A. switchport mode access on the SVIs
- B. encapsulation dot1q 10 on interface vlan 10
- C. switchport trunk native vlan 10 on the uplink
- D. ip routing in global configuration mode
Show answer
Answer: D
A Layer 3 switch routes between its SVIs only after IP routing is enabled with the global command ip routing. The SVIs being up/up and addressed rules out interface and addressing faults. switchport mode access is a Layer 2 port setting and does not enable routing. encapsulation dot1q belongs on router subinterfaces, not on SVIs. switchport trunk native vlan changes tagging on a trunk and has no effect on routing between SVIs.