Switching & VLAN Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

VLANs, trunks, and what a switch forwards

A switch forwards frames inside a VLAN. Two access ports in VLAN 10 share broadcasts. Two access ports in different VLANs do not, even on the same switch, until a router or a layer-3 switch routes between them. The VLAN tag on a trunk is how several VLANs share one uplink without becoming one broadcast domain. If the tag is missing, the frame is in the native VLAN, which is why the native VLAN should be boring and empty.

Inter-VLAN routing is a gateway on each VLAN, usually an SVI on a core switch or a subinterface on a router. The closet switch does not need an IP address in the user VLAN to forward frames. It needs an IP address in the management VLAN so you can reach it. Mixing those two jobs onto VLAN 1 is the design this guide is trying to retire.

Spanning tree blocks a loop so a broadcast does not circulate forever. It is not a routing protocol and it is not optional on a network that can be cabled into a loop. Someone will patch a loop. RSTP or the platform's rapid mode converges faster than the original protocol. Use one mode everywhere. A closet still running the old mode next to a core running rapid mode is a long outage waiting for a cable.

The generators linked here build a VLAN list or a trunk allowed list from numbers you type. They do not log into a switch. Review the list. A trunk that allows all VLANs is easy and it carries guest and management into a closet that had no need of them.

A small campus VLAN plan

VLAN 10 is Users. The addressing note is: 198.51.100.0/24. It exists for desktops. Access ports only. The gateway is 198.51.100.1 on the core, not on the closet switch. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 10 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 20 is Voice. The addressing note is: 198.51.100.0/24 is the wrong idea. It exists for phones. Give voice its own prefix, 198.51.101.0/24, gateway 198.51.101.1. Do not pile phones onto the user subnet because the closet was rushed. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 20 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 30 is Devices. The addressing note is: 198.51.102.0/27. It exists for printers and badges. A /27 holds 30 usable addresses. Printers are static. Write the reservation before the port goes live. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 30 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 40 is Guests. The addressing note is: 198.51.103.0/24. It exists for untrusted wireless. Guest does not trunk into the server room except toward the firewall. No route to users. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 40 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 50 is Servers. The addressing note is: 203.0.113.0/24 in the lab notes. It exists for servers. Replace 203.0.113.0/24 before production. Servers do not sit on an access closet VLAN that also has desktops. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 50 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 99 is Management. The addressing note is: 192.0.2.0/24 in the lab notes. It exists for switch management. Only admin hosts. No user port is an access port in VLAN 99. The SVI, if you need one in the closet, is shut on user switches and lives on the management switch. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 99 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 100 is Native unused. The addressing note is: no subnet. It exists for nothing. If a trunk needs a native VLAN, use an unused VLAN with no SVI. Do not use VLAN 1 and do not use the user VLAN. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 100 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

VLAN 4094 is Blackhole. The addressing note is: no subnet. It exists for unused ports. Park unused access ports here, shut them, and do not give the VLAN a gateway. The VLAN id is not an address. Repeating the id in the gateway octet is a memory aid only when you documented it. Spanning tree still runs. A loop in VLAN 4094 does not care that your IP plan was neat. Name the root bridge for this VLAN, or accept the platform default and write that down. An accidental root in a closet makes every frame for this VLAN hairpin through that closet. Set the root where the gateway already is, with a priority you chose, and set the other switches so they cannot win by accident. Portfast, or the platform's edge mode, belongs on the access port in this VLAN and never on the trunk. Portfast on a trunk is how a loop becomes instant.

Trunks and access ports

An access port has one VLAN and should not accept tags from a user. A trunk has an allowed list. The allowed list on both ends must match. If one end allows VLAN 10 and 20 and the other allows 10, 20, and 40, VLAN 40 dies in one direction or is dropped, depending on the platform, and the symptom looks like a random wireless problem because the guest SSID was VLAN 40.

Write the allowed list in the ticket as numbers, not as the word all. For this plan a closet uplink allows 10, 20, 30, and 40. It does not allow 50, 99, or 4094. Management of the closet switch uses VLAN 99 on a different port, or on a management uplink, not on the user trunk. If your platform forces management onto the same physical uplink, tag VLAN 99 and do not make it native.

Native VLAN mismatch is a classic. One end native 100, the other native 1, and CDP or LLDP may shout about it while user traffic for the native VLAN leaks into the wrong place. Set both ends to the unused native VLAN, or tag the native VLAN if the platform and the other end agree. Do not leave the default and hope.

LACP bundles two links so one patch is not the whole closet. Both members must be the same speed and the same trunk list. A bundle with one member in access mode and one in trunk mode is not a bundle you should leave up. Test by shutting one member. If the closet dies, the second member was never in the bundle.

vlan 10
 name Users
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
interface GigabitEthernet1/0/48
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40
 switchport trunk native vlan 100
# Review this IOS-like starter. It is a lab shape, not a paste for every vendor.

Where the root should sit

Put the spanning-tree root on the core that already holds the gateways, for every VLAN that matters. A priority of 4096 on the core and 32768 everywhere else is a common pattern. The numbers are less important than the gap. A closet at the default priority must not be able to win because its MAC address happens to be lower. Set the core on purpose.

Edge ports face users and phones. They can transition quickly. Network ports face switches and must not use portfast. BPDU guard on an edge port shuts the port if a switch appears, which is what you want when a user patches two jacks together. BPDU guard on a trunk will shut the uplink the first time the other switch speaks. Place the feature on the edge only.

After a change, look at which bridge is root and which ports are blocking. A blocking port on the core and a forwarding port in a closet means the root moved. That is the bug. Fix the priority before you add more links. Adding links to a network whose root is in the wrong building copies more frames through that building.

A closet change

Build the VLANs on the core first, with gateways, then on the closet, then allow them on the trunk, then move one access port, then test a host. The reverse order creates a VLAN with no gateway and a ticket about DHCP. One test host is enough to prove the path. Twenty test hosts prove you were impatient.

Rollback is the previous trunk list and the previous access VLAN, written in the ticket before you start. A reboot of the closet is not the rollback. It drops the phones and it may even come back on the new config if you saved.

Unused ports go to the blackhole VLAN and are shut. A live port in VLAN 10 with no label is a port someone will use. Labels and the blackhole VLAN are the same control.

Name the VLAN, the prefix, and the gateway in the ticket.
Create the VLAN and the gateway on the core.
Create the VLAN on the closet.
Allow it on both ends of the trunk.
Move one access port and test gateway, DHCP or static address, and one application.
Then move the rest of the ports.
Confirm the spanning-tree root did not move.

Mistakes that become loops or leaks

Using VLAN 1 for users because it is the default.

Allowing all VLANs on every trunk.

Making the user VLAN the native VLAN.

Putting portfast on a trunk.

Leaving an SVI on a closet switch in the user VLAN so the closet becomes a second gateway.

Mismatched allowed lists so one VLAN works in one direction.

A root bridge that lives on a cheap switch because nobody set the priority.

Parking unused ports in the user VLAN and leaving them up.

Closet checks before you save

Confirm this before you call the change done: The core gateway for VLAN 10 answers from a test host in VLAN 10, and it does not answer from a guest host. The trunk allowed list is identical on both ends and does not say all. The native VLAN is the unused VLAN you chose, on both ends. The spanning-tree root for VLAN 10 is the core, not the closet you just installed. Portfast or edge mode is on the access port and absent from the uplink. Unused ports are shut and in the blackhole VLAN. The closet management address is in VLAN 99, not in the user prefix. One phone, if you have a voice VLAN, gets a voice address and still passes data on the user VLAN. You saved the previous trunk list in the ticket before you changed it. And a second person read the allowed list aloud against the VLAN plan. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.