How to Configure VLANs on a Cisco Switch (Step by Step)

Step 1 — Create the VLAN and name it

Enter global configuration mode, then create the VLAN by its ID. Typing `vlan 10` both creates VLAN 10 in the switch's VLAN database and drops you into VLAN configuration mode, where `name SALES` gives it a human-readable label. The name is cosmetic — the switch forwards frames by VLAN ID, not by name — but it is invaluable when you or the next engineer runs `show vlan brief` six months from now. Names are case-sensitive, up to 32 characters, and cannot contain spaces (use one word or an underscore).

A quick note on numbering: every switch ships with VLAN 1 already present as the default. You cannot delete or rename VLAN 1, and by default every access port belongs to it. That is exactly why you create a fresh VLAN (10 here) for user traffic instead of leaving everything in VLAN 1. VLAN IDs 2–1001 are the normal range you'll use day to day; 1 and 1002–1005 are reserved.

Creating the VLAN is a prerequisite, not a formality. A port assigned to a VLAN that doesn't exist has nowhere to forward frames — so do this step before you touch any interface.

SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name SALES
SW1(config-vlan)# exit

Step 2 — Assign an access port to the VLAN

Select the port a device plugs into, then give it two commands. `switchport mode access` forces the port into access mode (it belongs to exactly one VLAN and sends untagged frames to the host). `switchport access vlan 10` places it in VLAN 10. Order doesn't strictly matter, but setting the mode first is the habit that avoids surprises.

Do not skip `switchport mode access` — this is the command most people leave out, and it is doing real work. By default a Catalyst port is in a dynamic mode (commonly `dynamic auto`) and speaks DTP, the Dynamic Trunking Protocol. That means a neighboring switch — or an attacker plugged into the port — can negotiate the link into a trunk and gain reach into every VLAN on the switch (the classic switch-spoofing / VLAN-hopping attack). `switchport mode access` hard-pins the port to access mode and disables DTP on it, so the port will never become a trunk no matter what the far end says. That is a security control, not just tidiness.

To configure several identical ports at once, use an interface range. Every port in the range inherits the same two commands.

SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit

! Multiple ports at once:
SW1(config)# interface range GigabitEthernet0/1 - 4
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# exit

Step 3 — Verify with show vlan brief and show interfaces status

`show vlan brief` is your first check: VLAN 10 should appear as SALES, status active, with Gi0/1 listed under its Ports column. Any port you didn't touch still sits under VLAN 1 (default) — that's normal and expected.

`show interfaces status` gives you the per-port view. The Vlan column for Gi0/1 should read 10, and Status should be connected once a device is attached. If that column still shows 1, the assignment didn't take on the port you think it did.

For proof that the DTP lockdown from Step 2 worked, run `show interfaces GigabitEthernet0/1 switchport`. You want to see Administrative Mode: static access, Operational Mode: static access, Access Mode VLAN: 10 (SALES), and Negotiation of Trunking: Off — that last line confirms DTP is disabled on the port. Finally, save so the running config survives a reload; VLAN definitions live in vlan.dat, but the port-to-VLAN assignments live in the running config.

SW1# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/0, Gi0/2, Gi0/3
10   SALES                            active    Gi0/1
                                                (output trimmed)

SW1# show interfaces status
Port      Name    Status       Vlan    Duplex  Speed Type
Gi0/1             connected    10        full   1000  (output trimmed)

SW1# show interfaces GigabitEthernet0/1 switchport
Name: Gi0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (SALES)
Negotiation of Trunking: Off

SW1# write memory

Step 4 — Extend the VLAN to a second switch

VLAN membership is local to the switch. A host in VLAN 10 on SW1 and a host in VLAN 10 on SW2 still cannot talk to each other just because both ports say vlan 10 — the switches don't share VLANs automatically. Two things must be true: VLAN 10 has to exist on both switches (create it on SW2 exactly as you did on SW1), and the link between the switches has to be a trunk that carries VLAN 10 so frames stay tagged as they cross.

The access-port commands from Step 2 stop at the switch edge; carrying VLAN traffic between switches with 802.1Q tagging is a trunk's job, not an access port's. Configure the inter-switch uplink as a trunk — that's covered in the trunk guide, so it isn't repeated here. Create the VLAN on the second switch now, and treat the uplink as a separate trunking task.

SW2> enable
SW2# configure terminal
SW2(config)# vlan 10
SW2(config-vlan)# name SALES
SW2(config-vlan)# exit

! The SW1<->SW2 uplink must be a TRUNK carrying VLAN 10.
! Configure trunking on that link (see the trunk guide).

Common problems (and the fix)

Port still shows VLAN 1. The most common cause is configuring the wrong interface or forgetting `switchport access vlan 10` entirely — so the port never left the default VLAN. Fix: run `show interfaces status` to find the real port the device is on, then apply `switchport mode access` and `switchport access vlan 10` to that exact interface and re-verify the Vlan column reads 10.

You set the access VLAN but never pinned the port to access mode. The port is in VLAN 10 but still in a dynamic mode, still speaking DTP — so it can silently negotiate itself into a trunk if the neighbor initiates, and your 'access' host starts seeing behavior it shouldn't. Fix: add `switchport mode access` and confirm 'Negotiation of Trunking: Off' in `show interfaces <port> switchport`.

VLAN 10 doesn't exist, was deleted, or is suspended, so the port goes inactive. An access port assigned to a missing or suspended VLAN cannot forward and the host goes dark. Modern IOS will often auto-create the access VLAN when you assign it, but don't rely on that — behavior varies by VTP mode and by simulator/older images. Fix: create VLAN 10 explicitly and confirm it shows 'active' in `show vlan brief`; if it's suspended, re-enter `vlan 10` and set `state active`.

The VLAN exists on one switch but not the other (or the trunk doesn't carry it). Two hosts in 'the same' VLAN on different switches can't reach each other because SW2 never had VLAN 10, or the uplink between them isn't trunking it. Fix: create VLAN 10 on both switches and make sure the inter-switch link is a trunk that allows VLAN 10 (see the trunk guide).

! Un-suspend a VLAN whose access ports have gone inactive:
SW1(config)# vlan 10
SW1(config-vlan)# state active
SW1(config-vlan)# end
SW1# show vlan brief

! Recheck a port that's still stuck in VLAN 1:
SW1# show interfaces status
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10