VLANs, Trunking & Inter-VLAN Routing
VLANs let one switch host many separate networks, and inter-VLAN routing reconnects them — the core of Layer 2 campus design. This hub gathers the step-by-step guides, a command cheat sheet, and graded hands-on labs that take you from creating a VLAN to routing between them.
New to this? Start with the explainer: What Is a VLAN? VLANs Explained for Beginners
A VLAN (virtual LAN) splits a single physical switch into several independent broadcast domains, so one access switch can serve multiple logical networks — say, staff, voice, and guests — without extra hardware. Because devices in different VLANs cannot reach each other at Layer 2, you need trunks to carry those VLANs between switches and inter-VLAN routing to reconnect them at Layer 3. This cluster of skills lives in the Network Access portion of the CCNA 200-301 blueprint (a substantial share of the exam, though Cisco adjusts exact weightings over time) and underpins almost every real campus design.
Start with the VLANs themselves. A switch ships with every port in VLAN 1, the default VLAN; you create additional VLANs (the normal range is 1–1005, with 1002–1005 reserved for legacy media, and an extended range up to 4094) and pin each access port to exactly one of them with 'switchport mode access' and 'switchport access vlan'. The VLANs guide walks this end to end — creating VLANs, naming them, assigning ports, and confirming membership with 'show vlan brief'.
Trunks are the next layer. An 802.1Q trunk (the modern standard; Cisco's old ISL is deprecated) inserts a 4-byte tag so a single link can carry many VLANs between switches, or up to a router. One VLAN per trunk — the native VLAN, VLAN 1 by default — travels untagged, which is exactly why a native VLAN mismatch is dangerous: if the two ends disagree, traffic can leak between VLANs, and CDP will log the mismatch. The trunking guide and the dedicated native-VLAN guide cover setup, allowed-VLAN pruning, and how to keep both ends consistent.
Once VLANs are trunked, something must route between them, and the hub covers the two classic approaches. Router-on-a-stick uses one physical router interface divided into subinterfaces, one per VLAN, each with 'encapsulation dot1q' and an IP that becomes that VLAN's default gateway (the subinterface for the native VLAN adds the 'native' keyword) — simple, but the single link can bottleneck. On a Layer 3 switch you instead enable 'ip routing' and create a switched virtual interface ('interface vlan X') per VLAN, so routing happens in hardware with no trunk chokepoint. The router-on-a-stick and SVI guides build each design so you can compare them directly.
Finally, even a pure Layer 2 switch needs an identity on the network. You give it a management SVI (an 'interface vlan' address) plus an 'ip default-gateway' so you can reach it remotely — note that 'ip default-gateway' applies only when the switch is not routing; enable 'ip routing' and it is ignored. The management-IP guide covers that. To master the whole topic, understand each piece here, keep the VLAN & Trunking cheat sheet open while you work, then build and grade the hands-on labs until the commands are automatic.
Step-by-step guides
Follow these to configure it yourself, command by command.
- How to Configure VLANs on a Cisco Switch (Step by Step)Create, name, and assign a VLAN to an access port on a Cisco IOS switch — with the show commands to verify it and the exact fixes for ports stuck in VLAN 1.
- How to Configure an 802.1Q Trunk Between Cisco Switches (Step by Step)Configure an 802.1Q trunk between Cisco switches: set trunk mode, restrict the allowed VLANs, match the native VLAN, and verify with show interfaces trunk.
- How to Configure the Native VLAN on a Cisco Trunk (and Avoid Mismatches)Set the 802.1Q native VLAN on a Cisco trunk, match it on both switch ends, verify with show interfaces trunk, and harden against VLAN-hopping attacks.
- Router-on-a-Stick: Inter-VLAN Routing on Cisco (Step by Step)Configure inter-VLAN routing with router-on-a-stick on Cisco IOS: an 802.1Q trunk to the switch and a router subinterface per VLAN, with verification.
- How to Configure Inter-VLAN Routing with SVIs on a Layer 3 Switch (Step by Step)Configure inter-VLAN routing on a Layer 3 switch using SVIs: enable ip routing, build VLAN gateways, verify with show ip route, and fix common gotchas.
- How to Give a Cisco Switch a Management IP (SVI + Default Gateway)Give a Layer 2 Cisco switch a management IP: build a management-VLAN SVI, add a default gateway for cross-subnet replies, then verify and fix the common failures.
Command cheat sheet
Practice on real Cisco IOS
Build and grade hands-on Cisco Modeling Labs — the only way it sticks.
Frequently asked questions
Do I need a separate router to route between VLANs?
Not necessarily. You have two options. Router-on-a-stick uses one router interface split into 802.1Q subinterfaces (one per VLAN), each acting as that VLAN's default gateway over a single trunk link. Alternatively, a Layer 3 (multilayer) switch can route internally: enable 'ip routing' and create a switched virtual interface (SVI) per VLAN. The SVI approach routes in hardware with no trunk bottleneck and is the norm in modern campus networks, while router-on-a-stick is common in labs and small sites.
In what order should I learn VLANs, trunking, and inter-VLAN routing?
Build up in dependency order. First create VLANs and assign access ports, so you understand what a broadcast domain is. Next configure an 802.1Q trunk between switches, then study the native VLAN and how mismatches cause problems. Only then add inter-VLAN routing — router-on-a-stick first because it makes the tagging explicit, then SVIs on a Layer 3 switch. Learn the switch management IP (SVI plus default gateway) alongside these so you can reach your devices remotely. The guides in this hub are arranged to follow that path.
What is the native VLAN, and why do mismatches matter?
On an 802.1Q trunk, every VLAN is tagged except one — the native VLAN, which is VLAN 1 by default — whose frames are sent untagged. Both ends of a trunk must agree on which VLAN is native. If they disagree, a device places untagged frames into different VLANs on each side, so traffic can cross between VLANs unintentionally (a security and reliability risk). Cisco switches detect this and log a native VLAN mismatch via CDP. Best practice is to set the native VLAN explicitly and identically on both ends, and often to use an unused VLAN rather than VLAN 1.
Study every CCNA topic this way
The CCNA Complete Path sequences all 17 lab bundles into one graded progression you own forever.