VLAN & Trunking Cheat Sheet
Exact Catalyst IOS commands to create VLANs, assign access/voice ports, build 802.1Q trunks, and route between VLANs — for CCNA/CCNP learners to bookmark and print. All commands are entered from the indicated mode; replace <angle-bracket> values with your own.
Part of the VLANs, Trunking & Inter-VLAN Routing learning hub
1. Create & Name VLANs
From global config. VLANs 1002-1005 are reserved; 1 is the default and cannot be renamed/deleted.
| Command | What it does |
|---|---|
vlan <id> | Create VLAN (1-4094) and enter VLAN config mode |
name <vlan-name> | Assign a text name to the VLAN (VLAN config mode) |
no vlan <id> | Delete the VLAN from the switch database |
show vlan brief | List VLANs, IDs, names, and assigned access ports |
2. Access Ports
Enter the port first: interface <type/num> (or interface range <range> for several).
| Command | What it does |
|---|---|
switchport mode access | Hard-set the port to access mode (disables DTP negotiation) |
switchport access vlan <id> | Assign the data VLAN carried on the port |
switchport voice vlan <id> | Add a tagged voice VLAN for an IP phone on the same port |
spanning-tree portfast | Skip listening/learning so an end-host port forwards immediately |
3. Trunk Ports
802.1Q tags all VLANs except the native VLAN, which is sent untagged.
| Command | What it does |
|---|---|
switchport trunk encapsulation dot1q | Select 802.1Q (only on switches that also support ISL; omit where dot1q-only) |
switchport mode trunk | Hard-set the port to trunk mode |
switchport trunk allowed vlan <list> | Restrict which VLANs cross the trunk (use add/remove/all/none to edit) |
switchport trunk native vlan <id> | Set the untagged native VLAN (must match on both ends) |
switchport nonegotiate | Disable DTP frames on a manually configured trunk |
4. Inter-VLAN Routing
Router-on-a-stick uses one tagged router link; SVIs run on a Layer 3 (multilayer) switch.
| Command | What it does |
|---|---|
interface <type/num>.<subif> | Router-on-a-stick: create a subinterface (e.g. interface g0/0.10) |
encapsulation dot1q <vlan-id> | Tag the subinterface for its VLAN (add native to carry it untagged) |
ip address <address> <mask> | Set the VLAN gateway IP on the subinterface (physical int must be no shutdown) |
ip routing | Global: enable Layer 3 routing on a multilayer switch (SVI method) |
interface vlan <id> | Create/enter the SVI; give it ip address <address> <mask> and no shutdown |
5. Verification
show interfaces <if> switchport is the fastest way to confirm mode and native/access VLAN.
| Command | What it does |
|---|---|
show vlan brief | Confirm VLANs exist and which access ports belong to each |
show interfaces trunk | List trunk ports, mode, native VLAN, and allowed/forwarding VLANs |
show interfaces <if> switchport | Show operational mode, access VLAN, voice VLAN, and native VLAN for one port |
show mac address-table | Verify learned MACs mapped to VLANs and ports |
Frequently asked questions
What's the difference between an access port and a trunk port?
An access port belongs to a single VLAN and sends/receives untagged frames — it connects end devices like PCs, printers, or servers. A trunk port carries many VLANs between switches (or to a router) by 802.1Q-tagging each frame with its VLAN ID; the one native VLAN is the exception and travels untagged.
How do I choose router-on-a-stick vs. SVIs for inter-VLAN routing?
Use router-on-a-stick when a plain router does the routing: one physical link is trunked and each VLAN gets a dot1q subinterface acting as its gateway — simple but the single link can bottleneck. Use SVIs (interface vlan <id>) on a multilayer switch after enabling 'ip routing'; routing happens in hardware at wire speed, which scales far better for more VLANs and higher traffic.
Why do some switches reject 'switchport trunk encapsulation dot1q'?
That command only appears on switches that support both ISL and 802.1Q and therefore need you to pick one (older platforms like the 3560/3750). Many current Catalyst switches support 802.1Q only, so there is nothing to select — just enter 'switchport mode trunk' directly. Also note the native VLAN must match on both trunk ends or CDP/STP will flag a native VLAN mismatch.
Stop memorizing — practice on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Start with the free sample.