Network Security Tutorials

VLANs and Trunks

Michael Keenan · Written companion · October 31, 2026

Current vendor guidance supplements the original video. Examples are illustrative; adapt them to your software version and network.

VLANs divide an Ethernet network into separate Layer 2 broadcast domains. Trunks carry traffic for several VLANs over a shared link. Understanding the difference helps you extend a network without accidentally joining groups of devices that should remain separate.

Access ports, trunks and routing

An ordinary access port places its endpoint's untagged traffic into one data VLAN. Devices in the same VLAN can communicate across connected switches when that VLAN is carried end to end. An 802.1Q trunk identifies VLAN traffic with a tag so several VLANs can share the connection. The native VLAN normally handles untagged traffic on an 802.1Q trunk; its configuration must agree at both ends. See Cisco's trunking guide.

A VLAN is not an IP subnet, although deployments commonly allocate a distinct subnet to each VLAN. Traffic between VLANs needs a Layer 3 gateway, such as a router, routing switch or firewall. Creating VLANs alone does not configure that gateway or an access-control policy. Cisco explains the additional routing role in its inter-VLAN routing guide.

A two-switch lab

This original example supplements the video rather than reproducing its configuration. It uses Cisco IOS-style commands on two isolated switches, SW1 and SW2. Interface names and supported features vary by model. The example has not been tested on physical switches.

Example ports on both switches
Port	Role	VLANs
GigabitEthernet1/0/1	User endpoint	Access VLAN 10
GigabitEthernet1/0/2	Service endpoint	Access VLAN 20
GigabitEthernet1/0/24	SW1–SW2 link	Trunk carrying 10 and 20

Use manually created VLANs in a lab where VTP will not overwrite the local VLAN database. Keep the native VLAN consistent on both switches; this example does not change its value. No gateway, DHCP service or inter-VLAN routing is configured here.

Create the VLANs and assign the ports

On each switch, create the two VLANs and assign the endpoint ports. This follows the command structure in Cisco's VLAN configuration guide, with lab-specific names and numbers.

configure terminal
vlan 10
 name USERS
vlan 20
 name SERVICES
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 20
end

Connect the two GigabitEthernet1/0/24 ports and configure them as static trunks. Allow only the two lab VLANs. The following allowed-list command replaces the port's current list; it is not an instruction for an existing production uplink.

configure terminal
interface GigabitEthernet1/0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20
end

Verify the whole forwarding path

Check VLAN membership, port mode and operational trunk state on both switches. Cisco's interface command reference explains how to inspect the administrative and operational switchport settings.

show vlan brief
show interfaces GigabitEthernet1/0/1 switchport
show interfaces GigabitEthernet1/0/24 switchport
show interfaces trunk

Expect VLANs 10 and 20 to exist, the access ports to belong to their intended VLANs, and the trunk to carry both. An allowed VLAN also needs to be active and forwarding; inspect all relevant sections of the trunk output. With compatible endpoint IP addresses in the same subnet, test a VLAN 10 endpoint on SW1 against a VLAN 10 endpoint on SW2. Repeat for VLAN 20. Cross-VLAN communication needs the separate gateway design described above.

When a VLAN does not pass traffic

Work from the endpoints toward the uplink: check cable/link state, access membership, VLAN existence, the trunk's allowed list and spanning-tree state. Also check endpoint addressing and host firewall behavior. A native-VLAN mismatch can cause spanning-tree consistency problems; Cisco's PVID troubleshooting guide explains the mismatch checks. Correct the cause rather than disabling spanning tree to force traffic through.