VLAN Tagging on a Switch — How to Create and Assign VLANs

VLAN tagging inserts a 4-byte 802.1Q header into an Ethernet frame identifying which VLAN it belongs to. That tag is what lets one physical cable between two switches carry traffic for many separate VLANs without mixing them.

The rule that governs everything else:

• Access ports carry one VLAN and send frames untagged. End devices never see or understand tags.
• Trunk ports carry many VLANs and send frames tagged — except the native VLAN, which goes untagged.

The 802.1Q Tag

The tag sits between the source MAC address and the EtherType field, growing the maximum frame from 1518 to 1522 bytes:

That 12-bit VID field is where the 4,094 VLAN limit comes from — 4,096 values minus 0 and 4095, which are reserved.

Step 1 — Create the VLANs

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name USERS
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit
Switch(config)# vlan 30
Switch(config-vlan)# name GUEST
Switch(config-vlan)# exit
Switch(config)# vlan 999
Switch(config-vlan)# name NATIVE-UNUSED

Switch# show vlan brief

Name every VLAN. Six months later, “VLAN 47” tells nobody anything.

Step 2 — Assign Access Ports

Switch(config)# interface range GigabitEthernet0/1 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# switchport nonegotiate
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# spanning-tree bpduguard enable

An IP phone with a PC behind it

Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20

The phone tags its own traffic as VLAN 20; the PC’s untagged traffic lands in VLAN 10. One cable, two VLANs, no trunk configuration needed.

Step 3 — Configure the Trunk

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport nonegotiate

Note switchport trunk encapsulation dot1q — required on older platforms that also supported ISL, and rejected on newer ones that only do dot1q. If the command is not recognised, your switch only speaks 802.1Q and you can skip it.

Switch# show interfaces trunk
Switch# show interfaces GigabitEthernet0/24 switchport

The allowed-VLAN trap

This one takes networks down regularly:

! REPLACES the entire list with just VLAN 40
Switch(config-if)# switchport trunk allowed vlan 40

! ADDS VLAN 40 to the existing list — what you almost always want
Switch(config-if)# switchport trunk allowed vlan add 40

Forgetting add on a live trunk removes every other VLAN instantly. There are also remove and except keywords.

Step 4 — Inter-VLAN Routing

VLANs are separate broadcast domains and cannot reach each other without a Layer 3 device.

On a Layer 3 switch (SVIs)

Switch(config)# ip routing
Switch(config)# interface Vlan10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config)# interface Vlan20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0

Router-on-a-stick

Router(config)# interface GigabitEthernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface GigabitEthernet0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

The switch port facing the router must be a trunk. Router-on-a-stick works but all inter-VLAN traffic crosses one link twice — fine for a small site, a bottleneck beyond that. SVIs on a Layer 3 switch route in hardware and are the better answer wherever available.

Verification and Troubleshooting

Switch# show vlan brief
Switch# show interfaces trunk
Switch# show interfaces GigabitEthernet0/24 switchport
Switch# show mac address-table vlan 10
Switch# show interfaces status

That last one catches people: an SVI stays down until at least one access port in its VLAN is up and the VLAN exists in the database. A newly created VLAN 30 with nothing plugged in shows the SVI as down/down.

Practices Worth Following

1. Do not use VLAN 1 for user traffic, native VLAN or management. Move all three to different, dedicated VLANs.
2. Prune trunks to the VLANs actually needed. Fewer broadcast domains crossing a link means less wasted bandwidth and a smaller blast radius.
3. Disable DTP everywhere with switchport nonegotiate plus explicit mode configuration.
4. Match the native VLAN on both ends of every trunk, and use an unused VLAN for it.
5. Set VTP to transparent mode unless you are deliberately running VTP. A switch inserted with a higher revision number can wipe every VLAN on the network.
6. Align one VLAN to one subnet. Anything else is confusing to troubleshoot.
7. Shut down unused ports and put them in an unused VLAN.

Frequently Asked Questions

What is the difference between tagged and untagged?

A tagged frame carries an 802.1Q header naming its VLAN and is used on trunks. An untagged frame has none and is used on access ports, where the switch already knows which VLAN the port belongs to.

Do end devices need to understand VLAN tags?

Normally no — an access port strips the tag before the frame reaches the device. Exceptions are servers and hypervisors connected to trunks, which handle tags themselves.

How many VLANs can a switch support?

The 802.1Q standard allows 4,094. Individual switches often support fewer active VLANs than that, so check the platform limit before designing around a large number.

Why does my new VLAN not work across switches?

It must exist in the VLAN database on both switches and be present in the allowed list on every trunk between them. Missing either one is the usual cause.

What is the difference between an access port and a trunk port?

An access port belongs to a single VLAN and sends untagged frames to an end device. A trunk carries multiple VLANs between switches using tags. See access port vs trunk port.

Can I use VLAN 1?

Technically yes, and it is the default. But it is the default on every switch everywhere, which is exactly why attacks assume it. Move user traffic, management and the native VLAN off it — to three different VLANs.