Switching & VLANs Complete Guide — STP, EtherChannel, Port Security

Switching is the process of forwarding Ethernet frames within a local area network (LAN) using MAC addresses. VLANs logically segment a physical network into separate broadcast domains. Together, switching and VLANs form the foundation of modern enterprise LAN design.

How Switches Work

A network switch operates at Layer 2 of the OSI model. When a frame arrives on a switch port, the switch:

1. Reads the source MAC address and records it in the MAC address table (with the port it arrived on)
2. Reads the destination MAC address
3. If destination MAC is in the table → forwards the frame out only that port (unicast)
4. If destination MAC is unknown → floods the frame out all ports except the one it came in (unknown unicast flood)
5. Broadcast frames → always flooded to all ports

Layer 2 vs Layer 3 Switches

VLANs — Virtual Local Area Networks

A VLAN (Virtual LAN) is a logical segmentation of a physical switch into multiple isolated broadcast domains. Devices in different VLANs cannot communicate with each other without a router or Layer 3 switch.

Why Use VLANs?

• Security: Isolate sensitive systems (e.g., finance, CCTV, IoT) from general user traffic
• Performance: Reduce broadcast domain size — fewer devices receive each broadcast
• Flexibility: Group users by function, not physical location
• Simplified management: One switch can serve multiple logical networks

Access Ports vs Trunk Ports

Two switch port modes handle VLAN traffic differently:

• Access port: Carries traffic for ONE VLAN. Connects end devices (PCs, printers, IP phones). No 802.1Q tags added.
• Trunk port: Carries traffic for MULTIPLE VLANs simultaneously. Uses IEEE 802.1Q tagging to identify each frame’s VLAN. Connects switches, routers, and WAPs.

Inter-VLAN Routing

Since VLANs are separate broadcast domains, a Layer 3 device is needed for inter-VLAN traffic. Two methods:

• Router on a Stick (ROAS): One physical router port, multiple subinterfaces — one per VLAN
• Layer 3 Switch SVIs: Create a Switched Virtual Interface (SVI) per VLAN — recommended for performance

Spanning Tree Protocol (STP)

STP (802.1D) prevents Layer 2 loops in networks with redundant switch connections. Without STP, broadcast storms would occur — looping frames consuming all bandwidth until devices crash.

STP Port States

• Blocking: Receives BPDUs but does not forward frames — preventing loops
• Listening: Processes BPDUs, not forwarding — transitional
• Learning: Building MAC table, not forwarding — transitional
• Forwarding: Fully operational — forwarding frames
• Disabled: Administratively shut down

STP Variants

EtherChannel — Link Aggregation

EtherChannel bundles multiple physical links between two switches into one logical link. Benefits:

• Combined bandwidth (2, 4, or 8 links)
• Redundancy — if one link fails, traffic moves to remaining links without STP reconvergence
• STP sees it as a single link — no blocked ports in the bundle

Two negotiation protocols: LACP (IEEE 802.3ad) — open standard, Active/Passive modes | PAgP (Cisco) — Desirable/Auto modes.

VTP — VLAN Trunking Protocol

VTP propagates VLAN configuration from a VTP server to VTP clients across trunk links. Three modes:

• Server: Creates/modifies VLANs — propagates to clients
• Client: Receives VLAN database from server — cannot create VLANs
• Transparent: Does not participate in VTP — forwards VTP advertisements but uses its own local VLAN database

Warning: VTP can wipe your entire VLAN database if a switch with a higher revision number is connected. Many engineers disable VTP and use Transparent mode.

Port Security

Port Security limits which MAC addresses can connect to a switch port — preventing rogue device connections and MAC flooding attacks.

• Protect: Drops frames from unauthorized MACs silently
• Restrict: Drops frames + logs violation (increments counter)
• Shutdown: Puts port in err-disabled state (default) — requires manual recovery

DHCP Snooping

DHCP Snooping prevents rogue DHCP servers from handing out fake IP addresses. It builds a binding table of legitimate DHCP assignments and drops DHCP offers from untrusted ports.

• Trusted ports: Uplinks to legitimate DHCP servers
• Untrusted ports: All access ports facing end users

Switch Configuration Quick Reference

Full Switching Cluster — All Articles

Spanning Tree

• STP Complete Guide
• RSTP vs STP — Key Differences

VLANs

• What is a VLAN?
• VLAN vs Subnet
• VTP Guide
• Access Port vs Trunk Port
• Inter-VLAN Routing

Switch Management

• Cisco Switch Virtualization
• Backup Switch Configuration
• DHCP Snooping

Frequently Asked Questions

How many VLANs can a switch support?

IEEE 802.1Q supports VLAN IDs from 1 to 4094. VLAN 1 is the default VLAN on Cisco switches and carries untagged management traffic. VLANs 1002–1005 are reserved for legacy Token Ring and FDDI. Most enterprise switches support 4094 active VLANs simultaneously.

What is the difference between RSTP and STP?

RSTP (802.1w) converges in 1–6 seconds compared to STP’s 30–50 seconds. RSTP introduced new port roles (Alternate and Backup) and states (Discarding, Learning, Forwarding) and uses proposal/agreement handshake instead of waiting through timer-based states.

What does err-disabled mean on a Cisco switch port?

An err-disabled port has been shut down automatically by the switch due to a policy violation — most commonly port security, BPDU guard, or DHCP snooping violation. To recover: shutdown then no shutdown on the interface, or configure errdisable recovery for automatic recovery.

When should I use EtherChannel vs STP?

Use EtherChannel when you need combined bandwidth and fast link-level failover between two switches that have multiple parallel links. STP handles network-wide loop prevention — EtherChannel and STP work together, not against each other. STP sees an EtherChannel as a single logical link.