VLAN Explained: Access Ports, Trunk Ports, 802.1Q Tagging, Native VLAN and Inter-VLAN Routing
A single Ethernet switch can connect dozens or hundreds of devices, but connecting every device to the same physical switch does not mean every device must belong to the same Layer 2 network.
This is where VLANs become essential.
A Virtual Local Area Network (VLAN) creates a logical Layer 2 broadcast domain inside a switched network. Devices can share the same physical switching infrastructure while remaining separated into different logical Ethernet networks.
Consider an office with three groups:
Employees
192.168.10.0/24
Servers
192.168.20.0/24
Guest Wi-Fi
192.168.30.0/24Instead of building three completely separate physical switching systems, VLANs can provide logical separation:
Managed Switch
/ | \
/ | \
VLAN 10 VLAN 20 VLAN 30
Employees Servers GuestsAt Layer 2, these VLANs behave as separate broadcast domains.
A broadcast generated in VLAN 10 is not ordinarily flooded into VLAN 20 or VLAN 30.
But VLANs introduce several important questions:
- What is an access port?
- What is a trunk port?
- What does IEEE 802.1Q tagging actually do?
- What is a VLAN ID?
- What is a native VLAN?
- How do multiple VLANs cross the same physical link?
- Why can hosts in the same VLAN communicate directly while hosts in different VLANs need routing?
- What is router-on-a-stick?
- What is an SVI?
- How does a Layer 3 switch perform inter-VLAN routing?
- What causes VLAN mismatches and trunk problems?
- How do VLANs interact with MAC address tables, ARP, DHCP and STP?
This guide answers those questions from the Ethernet frame level through real network designs and troubleshooting.
For the underlying Layer 2 concepts, first see Routers, Switches and Network Devices, ARP Explained, and MAC Address Table Explained.
What Is a VLAN?
VLAN stands for:
Virtual Local Area Network
A VLAN creates a logical Layer 2 broadcast domain within a switched Ethernet infrastructure.
Instead of treating every switch port as part of one Layer 2 network, a managed switch can assign ports and traffic to different VLANs.
For example:
Switch
Port 1 → VLAN 10
Port 2 → VLAN 10
Port 3 → VLAN 20
Port 4 → VLAN 20
Port 5 → VLAN 30
Port 6 → VLAN 30Conceptually:
Physical Switch
|
+------ VLAN 10
|
+------ VLAN 20
|
+------ VLAN 30Even though the devices connect to the same physical switch, the VLANs create separate Layer 2 forwarding contexts.
A useful mental model is:
One physical switch
|
v
Multiple logical Layer 2 networksBut this does not mean VLANs create complete security boundaries by themselves or replace routers and firewalls.
VLANs primarily provide Layer 2 segmentation.
Why Do Networks Use VLANs?
Without VLANs, a simple Layer 2 network might look like:
Switch
/ / \ \
/ / \ \
Finance HR Servers GuestsAll devices may belong to the same broadcast domain.
That creates several problems.
Broadcast traffic reaches more devices.
Network organization becomes difficult.
Security policies become harder to apply cleanly.
Different departments cannot easily be assigned separate IP networks while sharing the same switching infrastructure.
VLANs allow the architecture to become:
Switch
|
+-------------+-------------+
| | |
VLAN 10 VLAN 20 VLAN 30
Finance Servers GuestsEach VLAN can correspond to a different IP subnet:
VLAN 10
192.168.10.0/24
VLAN 20
192.168.20.0/24
VLAN 30
192.168.30.0/24This provides a much cleaner network architecture.
VLANs and Broadcast Domains
One of the most important VLAN concepts is:
Each VLAN normally represents a separate Layer 2 broadcast domain.
Suppose PC-A in VLAN 10 sends an Ethernet broadcast:
Destination MAC:
FF:FF:FF:FF:FF:FFThe switch can flood that frame to appropriate VLAN 10 ports.
It does not ordinarily flood it into VLAN 20.
Conceptually:
Switch
VLAN 10 VLAN 20
/ \ / \
PC-A PC-B PC-C PC-D
|
| Broadcast
+-------> PC-B
X-------> PC-C
X-------> PC-DThis is one of the fundamental purposes of VLAN segmentation.
The physical switch is shared.
The Layer 2 broadcast domains are separated.
VLAN Does Not Mean Subnet
VLANs and IP subnets are strongly related in practical network design, but they are not the same concept.
A VLAN is primarily a:
Layer 2 constructAn IP subnet is a:
Layer 3 constructA common design is:
VLAN 10
|
v
192.168.10.0/24and:
VLAN 20
|
v
192.168.20.0/24This one-VLAN-per-IP-subnet model is common because it makes routing, troubleshooting, DHCP and security easier to understand.
But technically:
VLAN ID and IP subnet are different mechanisms.
The VLAN identifies the Layer 2 forwarding domain.
The IP prefix defines Layer 3 addressing and routing behavior.
For Layer 3 fundamentals, see TCP/IP Explained.
How VLANs Work Inside a Switch
Suppose a switch has:
Gi1/0/1 → VLAN 10
Gi1/0/2 → VLAN 10
Gi1/0/3 → VLAN 20
Gi1/0/4 → VLAN 20PC-A connects to Gi1/0/1.
PC-B connects to Gi1/0/2.
PC-C connects to Gi1/0/3.
When PC-A sends a frame toward PC-B, the switch processes it in the context of VLAN 10.
Conceptually:
Frame enters Gi1/0/1
|
v
Associated with VLAN 10
|
v
Destination MAC lookup
in VLAN 10 forwarding context
|
v
Forward toward Gi1/0/2PC-C belongs to VLAN 20 and is outside that Layer 2 forwarding domain.
This relationship becomes especially important when understanding the switch MAC address table.
VLAN IDs Explained
IEEE 802.1Q defines VLAN tagging for bridged Ethernet networks.
The VLAN identifier is carried in a field that provides 12 bits for the VLAN ID.
This produces values from:
0 through 4095However, the endpoint values have special meanings.
For ordinary configurable VLAN identification, the commonly usable VLAN IDs are:
1–4094VLAN IDs therefore provide the logical identity used to distinguish Layer 2 forwarding domains across VLAN-aware infrastructure.
Examples:
VLAN 10 → Employees
VLAN 20 → Servers
VLAN 30 → Voice
VLAN 40 → Guest Wi-Fi
VLAN 99 → ManagementThe VLAN number itself has no universal semantic meaning.
VLAN 20 is not inherently a “server VLAN.”
That meaning comes from your network design.
What Is an Access Port?
An access port is commonly used to connect an endpoint that participates in one VLAN without needing to understand 802.1Q VLAN tags.
Example:
PC
|
| ordinary Ethernet
|
Switch Port
Access VLAN 10The endpoint sends an ordinary Ethernet frame.
The switch associates traffic entering that access port with the configured VLAN.
Conceptually:
PC sends frame
|
v
Access port
|
| Port belongs to VLAN 10
v
Switch processes frame
inside VLAN 10The PC does not normally need to insert an 802.1Q VLAN tag.
This is why ordinary desktops, printers and many other endpoints can participate in VLANs without knowing that VLANs exist.
Access Port Example
Suppose:
Gi1/0/5
Access VLAN 10A workstation connected there has:
IP:
192.168.10.50/24
Gateway:
192.168.10.1The workstation sends ordinary Ethernet traffic.
The switch classifies ingress frames from that port into VLAN 10.
When appropriate traffic leaves an ordinary access port toward the workstation, it is generally sent without an 802.1Q VLAN tag.
The endpoint therefore sees conventional Ethernet frames.
What Is a Trunk Port?
An Ethernet trunk can carry traffic for multiple VLANs over the same physical link.
Consider two switches:
Switch A Switch B
VLAN 10 VLAN 10
VLAN 20 VLAN 20
VLAN 30 VLAN 30
\ /
\ /
+------ Trunk --------+Without a trunk, you might need separate physical links for separate VLANs.
802.1Q allows multiple VLANs to share one link by identifying frames with VLAN information.
Conceptually:
Physical trunk
|
+---- VLAN 10 traffic
|
+---- VLAN 20 traffic
|
+---- VLAN 30 trafficThis is one of the most important technologies in switched network design.
Access Port vs Trunk Port
| Feature | Access Port | Trunk Port |
|---|---|---|
| Typical purpose | Connect endpoint | Connect VLAN-aware infrastructure |
| VLANs carried | Usually one access VLAN | Multiple VLANs |
| 802.1Q tags toward ordinary endpoint | Usually untagged | Commonly tagged for multiple VLANs |
| Common connection | PC, printer | Switch, router, firewall, hypervisor, AP |
| VLAN awareness required on peer | Usually no | Usually yes |
A useful simplified model is:
Access
=
one ordinary endpoint VLANwhile:
Trunk
=
multiple VLANs across one linkReal platforms support additional modes and features, so do not treat this simplified model as every possible switch-port configuration.
How IEEE 802.1Q Tagging Works
An ordinary Ethernet frame includes fields conceptually like:
+----------------------+
| Destination MAC |
+----------------------+
| Source MAC |
+----------------------+
| EtherType / Length |
+----------------------+
| Payload |
+----------------------+
| FCS |
+----------------------+802.1Q introduces VLAN tagging information into the Ethernet frame.
Conceptually:
+----------------------+
| Destination MAC |
+----------------------+
| Source MAC |
+----------------------+
| 802.1Q Tag |
+----------------------+
| EtherType |
+----------------------+
| Payload |
+----------------------+
| FCS |
+----------------------+The 802.1Q tag is 4 bytes.
It contains information including:
- Tag Protocol Identifier;
- Priority Code Point;
- Drop Eligible Indicator;
- VLAN Identifier.
The VLAN ID tells VLAN-aware bridges which VLAN context applies to the frame.
What Does EtherType 0x8100 Mean?
A common IEEE 802.1Q tagged Ethernet frame uses a Tag Protocol Identifier value of:
0x8100This indicates the presence of an 802.1Q tag.
Packet-analysis tools such as Wireshark can display the VLAN information inside captured frames.
This can be extremely useful when troubleshooting:
Wrong VLAN tag
Missing tag
Unexpected VLAN
Native VLAN behavior
Trunk problemsTagged vs Untagged Frames
The words tagged and untagged describe whether VLAN identification information is explicitly carried in the Ethernet frame.
Tagged
Ethernet frame
|
+---- 802.1Q VLAN informationUntagged
Ethernet frame
|
+---- No 802.1Q VLAN tagOn an access port, ordinary endpoint traffic is commonly untagged on the wire.
The switch associates that traffic with a VLAN based on port configuration.
On a trunk, traffic for multiple VLANs is commonly distinguished using tags.
This gives us:
Access port:
Port configuration identifies VLAN
Trunk:
Frame tag commonly identifies VLANWhat Is the Native VLAN?
On common 802.1Q trunk implementations, a native VLAN is the VLAN associated with untagged traffic on the trunk.
For example:
Trunk
Allowed VLANs:
10,20,30
Native VLAN:
99Tagged traffic may appear as:
VLAN 10 → tagged
VLAN 20 → tagged
VLAN 30 → taggedwhile native-VLAN traffic may be transmitted untagged according to the platform configuration.
Native-VLAN behavior must match correctly between trunk peers.
A mismatch can create connectivity and security problems.
Native VLAN Mismatch
Suppose:
Switch A trunk
Native VLAN = 10while:
Switch B trunk
Native VLAN = 20An untagged frame sent by Switch A and interpreted as belonging to VLAN 10 may be classified by Switch B into VLAN 20.
Conceptually:
Switch A
Untagged = VLAN 10
|
v
Trunk
|
v
Switch B
Untagged = VLAN 20The two switches disagree about what untagged traffic means.
This can lead to:
- incorrect Layer 2 placement;
- connectivity failures;
- control-plane warnings on some platforms;
- potential security exposure.
Consistent trunk configuration is therefore critical.
Should You Use VLAN 1?
Many switches use VLAN 1 by default for various purposes.
However, enterprise design commonly avoids using the default VLAN as the normal user, management, or native VLAN where practical.
This is not because the number 1 is technically incapable of carrying traffic.
The goal is to avoid unnecessary reliance on default configurations and make segmentation intentional.
A stronger design might use:
VLAN 10 → Users
VLAN 20 → Servers
VLAN 30 → Voice
VLAN 40 → Guests
VLAN 99 → Managementwith explicit trunk policies.
The exact numbering should follow your organization’s design rather than an arbitrary universal template.
MAC Address Tables and VLANs
A VLAN-aware switch’s forwarding database is not merely:
MAC → PortVLAN context matters.
Conceptually:
VLAN + MAC → PortFor example:
| VLAN | MAC Address | Port |
|---|---|---|
| 10 | AA:AA:AA:AA:AA | Gi1/0/1 |
| 10 | BB:BB:BB:BB:BB | Gi1/0/2 |
| 20 | CC:CC:CC:CC:CC | Gi1/0/5 |
When a VLAN 10 frame arrives for:
BB:BB:BB:BB:BB:BBthe switch performs the forwarding decision in the VLAN 10 context.
This is why understanding VLANs is essential to interpreting a switch’s MAC address table correctly.
Unknown Unicast Flooding and VLANs
Suppose a frame arrives in VLAN 10 for an unknown destination MAC.
The switch does not simply flood it through every physical port on the device.
The flooding scope is constrained by the relevant Layer 2 forwarding domain.
Conceptually:
Switch
VLAN 10 VLAN 20
/ | \ / \
PC-A PC-B PC-C PC-D PC-E
Unknown unicast in VLAN 10
|
+----> PC-B
+----> PC-C
X----> PC-D
X----> PC-EThis is one reason VLANs reduce the size of Layer 2 broadcast and flooding domains.
ARP and VLANs
ARP broadcasts are also confined to the local Layer 2 broadcast domain.
Suppose:
VLAN 10
192.168.10.0/24PC-A:
192.168.10.10wants to find:
192.168.10.20It sends:
Who has 192.168.10.20?The ARP broadcast is flooded inside VLAN 10.
Hosts in VLAN 20 do not ordinarily receive that VLAN 10 broadcast.
For a packet-level explanation, see ARP Explained.
Why Hosts in Different VLANs Cannot Communicate Directly at Layer 2
Consider:
PC-A
VLAN 10
192.168.10.10and:
PC-B
VLAN 20
192.168.20.20PC-A evaluates the destination:
192.168.20.20against its own subnet:
192.168.10.0/24The destination is remote.
PC-A therefore does not normally ARP directly for PC-B.
Instead, it sends the packet toward its default gateway.
Conceptually:
PC-A
VLAN 10
|
| ARP for VLAN 10 gateway
v
Layer 3 Gateway
|
| Routing
v
VLAN 20
|
v
PC-BThis process is called:
Inter-VLAN Routing
Inter-VLAN Routing Explained
VLANs separate Layer 2 domains.
A Layer 3 device is required when traffic needs to move between those domains.
Suppose:
VLAN 10
192.168.10.0/24
Gateway:
192.168.10.1and:
VLAN 20
192.168.20.0/24
Gateway:
192.168.20.1Communication follows this model:
PC-A
192.168.10.10
|
v
Gateway
192.168.10.1
|
| Layer 3 routing
v
Gateway
192.168.20.1
|
v
PC-B
192.168.20.20The routing device can be:
- a router;
- a Layer 3 switch;
- a firewall;
- a virtual router;
- another system capable of Layer 3 forwarding.
VLANs provide the separation.
Routing reconnects the VLANs according to Layer 3 policy.
Router-on-a-Stick Explained
One classic inter-VLAN routing architecture is called:
Router-on-a-Stick
A router uses one physical Ethernet interface connected to a switch trunk.
Logical subinterfaces correspond to VLANs.
Conceptually:
Router
|
Physical Interface
|
+----------+----------+
| | |
VLAN 10 VLAN 20 VLAN 30
|
| 802.1Q trunk
|
SwitchThe router might conceptually provide:
VLAN 10 gateway:
192.168.10.1
VLAN 20 gateway:
192.168.20.1
VLAN 30 gateway:
192.168.30.1The switch sends tagged VLAN traffic across the trunk.
The router performs Layer 3 forwarding between the VLAN interfaces.
Router-on-a-Stick Packet Journey
Suppose PC-A in VLAN 10 wants to reach PC-B in VLAN 20.
PC-A
192.168.10.10
|
v
Access VLAN 10
|
v
Switch
|
| 802.1Q trunk
v
Router
|
| Route VLAN 10 → VLAN 20
v
Switch
|
v
Access VLAN 20
|
v
PC-B
192.168.20.20The same physical router link carries multiple VLANs.
The router distinguishes them through VLAN tagging and logical interfaces.
This design is useful for smaller networks and labs, although larger environments frequently use multilayer switches or firewalls for inter-VLAN forwarding.
What Is an SVI?
SVI stands for:
Switched Virtual Interface
On a Layer 3 switch, an SVI can provide a Layer 3 interface associated with a VLAN.
Conceptually:
interface VLAN 10
IP: 192.168.10.1and:
interface VLAN 20
IP: 192.168.20.1The Layer 3 switch can then route between:
192.168.10.0/24and:
192.168.20.0/24when routing is enabled and policy permits it.
The architecture becomes:
Layer 3 Switch
+---------+---------+
| |
VLAN 10 VLAN 20
192.168.10.0/24 192.168.20.0/24
| |
SVI 192.168.10.1 SVI 192.168.20.1
\ /
\ /
+---- Routing ---+This eliminates the need for every inter-VLAN packet to leave the switch for an external router.
Router-on-a-Stick vs Layer 3 Switch
| Feature | Router-on-a-Stick | Layer 3 Switch |
|---|---|---|
| Inter-VLAN routing | Router | Switch routing hardware/software |
| VLAN transport | Trunk to router | Internal switching/routing |
| Gateway interface | Router subinterface | SVI |
| Physical routing link | Shared trunk | Often internal |
| Typical use | Small networks/labs | Campus/enterprise networks |
| Scalability | Depends on router/link | Often higher for LAN routing |
Neither architecture is universally “better.”
The correct choice depends on:
- throughput;
- security policy;
- topology;
- redundancy;
- hardware capabilities;
- cost;
- operational requirements.
Layer 3 Switch vs Router
The distinction between a Layer 3 switch and a router is less absolute than introductory networking diagrams sometimes imply.
Both can perform IP routing.
A Layer 3 switch is typically optimized for high-speed routing and switching inside LAN environments.
Routers may provide broader WAN, VPN, NAT, advanced routing, security, and service capabilities depending on the platform.
Do not use the simplistic rule:
Switch = Layer 2 only
Router = Layer 3 onlyModern multilayer switches can perform substantial Layer 3 forwarding.
For a broader device comparison, see Routers, Switches and Network Devices.
VLANs and DHCP
Each client VLAN commonly requires appropriate DHCP service.
Suppose:
VLAN 10
192.168.10.0/24and:
VLAN 20
192.168.20.0/24If the DHCP server is located in VLAN 100:
DHCP Server
192.168.100.50clients in VLAN 10 cannot simply rely on their initial Layer 2 DHCP broadcast crossing routers automatically.
A DHCP relay can forward relevant DHCP messages between networks.
Conceptually:
Client
VLAN 10
|
| DHCP broadcast
v
Gateway / Relay
|
| Relay to DHCP server
v
DHCP Server
VLAN 100This is why a VLAN migration can break DHCP even when switching itself appears correct.
The relay configuration must correspond to the new Layer 3 architecture.
VLANs Across Multiple Switches
Consider:
PC-A
VLAN 10
|
Switch A
|
| trunk
|
Switch B
|
PC-B
VLAN 10For PC-A and PC-B to remain in the same VLAN across the two switches:
- VLAN 10 must exist where required.
- The relevant access ports must belong to VLAN 10.
- The inter-switch link must carry VLAN 10.
- Trunk configuration must be compatible.
- STP and other Layer 2 controls must permit the path.
If VLAN 10 is not allowed across the trunk, PC-A and PC-B can fail to communicate despite both access ports appearing correctly configured.
Allowed VLANs on a Trunk
A trunk does not necessarily need to carry every VLAN.
A network might configure:
Trunk A
Allowed:
10,20,30while another trunk carries:
Allowed:
20,40,50Limiting VLANs to where they are actually needed can:
- reduce unnecessary Layer 2 propagation;
- simplify troubleshooting;
- reduce accidental exposure;
- make topology more intentional.
A useful design principle is:
Do not extend a VLAN everywhere merely because you can.
VLAN Pruning and Failure Symptoms
Suppose VLAN 30 exists on both switches:
Switch A
VLAN 30Switch B
VLAN 30but the trunk allows only:
10,20Then:
VLAN 30 traffic
|
v
Trunk
|
XPossible symptoms:
- local VLAN 30 devices communicate on Switch A;
- local VLAN 30 devices communicate on Switch B;
- VLAN 30 devices cannot communicate across the switches.
This pattern strongly suggests checking the trunk and allowed VLAN list.
VLANs and Spanning Tree
Redundant Layer 2 links create the possibility of switching loops.
VLAN-aware switched networks therefore interact closely with Spanning Tree Protocol (STP) implementations.
Conceptually:
Switch A
| \
| \
| \
Switch B--Switch CWithout loop prevention, broadcast, multicast, and unknown-unicast traffic can circulate through Layer 2 loops.
Potential results include:
Broadcast storm
MAC flapping
High link utilization
Packet loss
Network outageThe previous MAC Address Table Explained article showed how loops can cause MAC addresses to appear repeatedly on different ports.
STP exists to create a loop-free forwarding topology across redundant Layer 2 infrastructure.
We will cover STP in detail in the next dedicated article.
VLANs and Network Security
VLANs are useful for segmentation, but they should not be treated as a complete security system.
A common enterprise architecture might separate:
Employee VLAN
Server VLAN
Guest VLAN
Voice VLAN
Management VLAN
IoT VLANHowever, once Layer 3 routing exists between those VLANs, traffic may flow unless policy restricts it.
A stronger design combines:
VLAN segmentation
+
Layer 3 routing
+
ACLs / firewall policy
+
NAC
+
Endpoint securityFor broader segmentation controls, see Network Security Basics, Firewalls Explained, and Network Access Control (NAC).
VLAN Hopping
Poorly designed VLAN and trunk configurations can introduce security risks often grouped under the term VLAN hopping.
Rather than thinking of VLANs as inherently secure, administrators should explicitly control:
- which ports are trunks;
- which VLANs trunks carry;
- native VLAN behavior;
- dynamic trunk negotiation where applicable;
- unused switch ports;
- access-port assignments.
Security comes from correct configuration and enforcement—not merely from assigning VLAN numbers.
Do Not Configure User Ports as Trunks Without a Reason
A normal workstation port typically does not need to carry many VLANs.
If an endpoint requires only VLAN 10, use an appropriate access configuration rather than unnecessarily exposing multiple VLANs.
Exceptions exist, including:
- hypervisors;
- wireless access points;
- IP phones in certain designs;
- virtualization hosts;
- routers;
- firewalls;
- downstream switches.
The port mode should match the device’s actual function.
Common VLAN Problem: Wrong Access VLAN
Suppose a PC should be in:
VLAN 10
192.168.10.0/24but the switch port belongs to:
VLAN 20The PC may have:
192.168.10.50/24
Gateway 192.168.10.1yet its Layer 2 traffic is placed into VLAN 20.
Symptoms can include:
Gateway unreachable
ARP requests unanswered
DHCP failure
Local subnet unreachableThis is a classic example of a configuration that looks correct on the endpoint but fails because the Layer 2 domain is wrong.
Common VLAN Problem: VLAN Not Allowed on Trunk
Topology:
PC-A
VLAN 30
|
Switch A
|
Trunk
|
Switch B
|
PC-B
VLAN 30If the trunk does not carry VLAN 30:
PC-A → Switch A → X → Switch Bboth access ports can be correctly assigned while end-to-end communication still fails.
Always inspect the entire path.
Common VLAN Problem: Native VLAN Mismatch
If two trunk peers disagree about their native VLAN, untagged traffic can be classified differently on each side.
Check both ends of the trunk.
Do not troubleshoot only the switch closest to the failing endpoint.
Common VLAN Problem: VLAN Exists on One Switch but Not Another
A VLAN may be locally defined on Switch A but absent or inactive where required on Switch B.
The existence of a VLAN on one device does not guarantee end-to-end VLAN continuity.
Check:
VLAN database
Access port
Trunk
Allowed VLANs
STP state
Remote switchCommon VLAN Problem: Same VLAN Number, Different Layer 2 Domain
Using the same VLAN ID in two disconnected environments does not magically connect them.
For example:
Site A
VLAN 10and:
Site B
VLAN 10do not form one broadcast domain merely because both use the number 10.
There must be an actual Layer 2 architecture connecting those forwarding domains if that is the design goal.
The VLAN ID is an identifier within the relevant bridging context—not a globally routed identifier like an Internet address.
Common VLAN Problem: Same VLAN, Wrong IP Subnet
Suppose two hosts are both in VLAN 10:
PC-A
192.168.10.10/24and:
PC-B
192.168.20.20/24They share a Layer 2 broadcast domain but have inconsistent Layer 3 addressing.
Depending on routing and host configuration, communication may fail or behave unexpectedly.
This demonstrates again:
VLAN
≠
IP subnetBoth Layer 2 and Layer 3 must be designed correctly.
Common VLAN Problem: Different VLANs, Same IP Subnet
Another problematic design is:
VLAN 10
192.168.1.0/24and:
VLAN 20
192.168.1.0/24without an architecture specifically designed to handle overlapping addressing.
Hosts may believe destinations are directly on-link and issue ARP requests that cannot cross the VLAN boundary.
Example:
PC-A
VLAN 10
192.168.1.10/24wants:
PC-B
VLAN 20
192.168.1.20/24PC-A thinks:
192.168.1.20 is localand sends an ARP request.
But the ARP broadcast remains in VLAN 10.
PC-B is in VLAN 20 and never receives it.
This creates a particularly confusing failure.
VLAN Troubleshooting Workflow
A disciplined workflow is much faster than randomly changing switch configuration.
Step 1: Identify the Expected VLAN
Document:
Device:
PC-A
Port:
Gi1/0/10
Expected VLAN:
10
Expected subnet:
192.168.10.0/24
Expected gateway:
192.168.10.1Step 2: Verify Endpoint Configuration
On Windows:
ipconfig /allOn Linux:
ip addr
ip routeConfirm:
IP address
Subnet/prefix
Gateway
InterfaceIf DHCP failed and the host has an unexpected address, investigate DHCP and VLAN connectivity together.
Step 3: Verify the Switch Port
Check:
Port operational?
Correct access VLAN?
Expected port mode?
Security violation?
STP forwarding?Do not assume that because the cable is connected, the Layer 2 configuration is correct.
Step 4: Check MAC Learning
Determine whether the switch learns the endpoint MAC on the expected port and VLAN.
Conceptually:
VLAN 10
AA:AA:AA:AA:AA:AA
→ Gi1/0/10If the MAC is absent, generate traffic from the endpoint and check again.
If it appears on another port, trace it.
Step 5: Test the Default Gateway
If the gateway should be:
192.168.10.1check whether the host can resolve its MAC.
Linux:
ip neighWindows:
arp -aIf ARP for the gateway fails, investigate the Layer 2 path before troubleshooting Internet routing.
Step 6: Check the Trunk
If traffic must cross another switch, verify:
Is the link actually a trunk?
Is the VLAN allowed?
Does the VLAN exist?
Do native VLAN settings agree?
Is STP forwarding?Step 7: Verify Inter-VLAN Routing
If communication crosses VLANs, check:
Source gateway
Destination gateway
SVIs/subinterfaces
Routing table
ACL
Firewall policy
Return routeA VLAN problem and a routing problem can produce similar user symptoms.
Determine exactly where the packet stops.
Packet-Level VLAN Troubleshooting
Packet capture can reveal whether 802.1Q tags are present and which VLAN ID is carried.
A tagged frame may show information equivalent to:
802.1Q
VLAN ID: 10If you expected:
VLAN 20you immediately have evidence of incorrect Layer 2 classification.
However, capture location matters.
A packet captured on an endpoint access link may be untagged even though the network internally associates it with VLAN 10.
A packet captured on a trunk may include the 802.1Q tag.
Therefore:
Never interpret VLAN tags without knowing where the capture was taken.
VLAN Troubleshooting Decision Tree
Network connectivity failure
|
v
Physical link up?
/ \
NO YES
| |
v v
Fix Layer 1 Correct access VLAN?
/ \
NO YES
| |
v v
Fix VLAN MAC learned?
/ \
NO YES
| |
v v
Check port Same VLAN
and traffic destination?
/ \
YES NO
| |
v v
Check ARP Check gateway
and FDB and routing
|
v
Path crosses trunk?
|
YES
|
v
VLAN allowed/tagged?
/ \
NO YES
| |
v v
Fix trunk Check STP,
ACL/firewall,
destinationPractical VLAN Design Example
Consider a small business network.
Requirements:
Employees
Servers
Guest Wi-Fi
Network ManagementA reasonable logical design might be:
| VLAN | Purpose | Subnet | Gateway |
|---|---|---|---|
| 10 | Employees | 192.168.10.0/24 | 192.168.10.1 |
| 20 | Servers | 192.168.20.0/24 | 192.168.20.1 |
| 30 | Guests | 192.168.30.0/24 | 192.168.30.1 |
| 99 | Management | 192.168.99.0/24 | 192.168.99.1 |
Topology:
Firewall/Router
|
|
Layer 3 Switch
|
+------------+------------+
| | |
VLAN 10 VLAN 20 VLAN 30
Employees Servers Guests
|
VLAN 99
ManagementSecurity policy might allow:
Employees → selected server serviceswhile denying:
Guests → internal networksand tightly restricting:
Management VLAN accessThe VLANs create Layer 2 separation.
Routing and firewall policy determine what happens between them.
VLAN Best Practices
A reliable VLAN design should be intentional rather than complicated.
Useful principles include:
- use clear VLAN naming;
- document VLAN IDs and associated IP subnets;
- avoid unnecessarily extending VLANs across the entire network;
- explicitly configure trunks;
- restrict allowed VLANs where practical;
- keep native-VLAN configuration consistent;
- avoid unnecessary reliance on default VLAN configuration;
- disable or isolate unused switch ports according to policy;
- separate guest and management traffic;
- use routing and firewalls for security enforcement;
- monitor trunk and STP changes;
- investigate MAC flapping;
- keep DHCP scopes aligned with VLAN subnets;
- document gateway addresses;
- validate both ends of every trunk.
A simple VLAN matrix can help:
| VLAN | Name | Subnet | Gateway | DHCP | Security Zone |
|---|---|---|---|---|---|
| 10 | USERS | 192.168.10.0/24 | 192.168.10.1 | Yes | Internal |
| 20 | SERVERS | 192.168.20.0/24 | 192.168.20.1 | Optional | Server |
| 30 | GUEST | 192.168.30.0/24 | 192.168.30.1 | Yes | Untrusted |
| 99 | MGMT | 192.168.99.0/24 | 192.168.99.1 | No/Controlled | Management |
This is far easier to operate than undocumented VLAN numbers scattered across switches.
Frequently Asked Questions
What does VLAN stand for?
VLAN stands for Virtual Local Area Network.
What is a VLAN?
A VLAN is a logical Layer 2 broadcast domain created within VLAN-aware switching infrastructure.
Why are VLANs used?
VLANs provide logical Layer 2 segmentation, reduce broadcast-domain scope, organize networks and support security architectures when combined with Layer 3 policy.
Is a VLAN the same as a subnet?
No. A VLAN is primarily a Layer 2 concept, while an IP subnet is a Layer 3 addressing concept. They are commonly mapped one-to-one in practical designs.
Can two VLANs use the same subnet?
Overlapping addressing is possible in specialized architectures, but placing the same ordinary subnet across isolated VLANs can cause serious reachability problems because hosts may incorrectly treat remote devices as directly on-link.
What is an access port?
An access port commonly connects an ordinary endpoint to one VLAN and sends/receives endpoint traffic without requiring that endpoint to handle normal 802.1Q tagging.
What is a trunk port?
A trunk carries traffic for multiple VLANs over a shared physical link, commonly using IEEE 802.1Q tagging.
What is 802.1Q?
IEEE 802.1Q is the standard family defining VLAN-aware bridging and VLAN tagging in Ethernet networks.
How large is an 802.1Q tag?
The conventional 802.1Q tag adds four bytes of VLAN-related information to the Ethernet frame.
What is VLAN ID?
The VLAN Identifier identifies the VLAN context associated with tagged traffic.
What VLAN IDs can I use?
The VLAN ID field is 12 bits. Values 1 through 4094 are commonly available for ordinary VLAN identification, while 0 and 4095 have reserved/special meanings.
What is VLAN tagging?
VLAN tagging adds VLAN information to an Ethernet frame so VLAN-aware infrastructure can distinguish traffic belonging to different VLANs over shared links.
Are access-port frames tagged?
Traffic between an ordinary endpoint and a conventional access port is normally untagged on the wire, while the switch internally associates it with the configured VLAN.
Are trunk frames always tagged?
Not necessarily. Common 802.1Q trunk configurations can carry a native VLAN untagged, depending on platform and configuration.
What is a native VLAN?
In common 802.1Q trunk implementations, the native VLAN is associated with untagged traffic on the trunk.
What is a native VLAN mismatch?
It occurs when trunk peers interpret untagged traffic as belonging to different VLANs.
Can a VLAN cross multiple switches?
Yes. The VLAN must be carried through the required Layer 2 path, typically across appropriately configured trunks.
Why is my VLAN working on one switch but not another?
Check VLAN existence, trunk state, allowed VLANs, native VLAN configuration, STP state and access-port configuration on the entire path.
Can devices in different VLANs communicate?
Yes, but they require Layer 3 forwarding between the VLANs and any applicable security policy must permit the traffic.
What is inter-VLAN routing?
Inter-VLAN routing is Layer 3 forwarding between IP networks associated with different VLANs.
What is router-on-a-stick?
Router-on-a-stick uses a trunk between a switch and router, with logical router interfaces/subinterfaces handling multiple VLANs.
What is an SVI?
An SVI is a Switched Virtual Interface that provides Layer 3 functionality associated with a VLAN on a multilayer switch.
Does a VLAN improve security?
VLANs provide segmentation but should not be treated as a complete security control. Firewalls, ACLs, NAC and other controls determine which cross-segment traffic is permitted.
Does ARP cross VLANs?
Ordinary ARP broadcasts do not cross Layer 3 VLAN boundaries. Hosts normally ARP for their local gateway when communicating with another subnet.
Does DHCP cross VLANs?
Initial DHCP client broadcasts do not normally cross routers automatically. DHCP relay is commonly used when the DHCP server is on another IP network.
Does each VLAN need a default gateway?
A VLAN does not inherently require a gateway merely to support Layer 2 communication. Hosts need an appropriate Layer 3 gateway when they must communicate outside their local IP subnet.
Can multiple VLANs share one physical link?
Yes. That is a central use case for an 802.1Q trunk.
Conclusion
VLANs allow one physical Ethernet infrastructure to support multiple logical Layer 2 networks.
The basic concept is:
Physical Switch
|
+---- VLAN 10
|
+---- VLAN 20
|
+---- VLAN 30An access port typically connects an endpoint to one VLAN:
PC
|
| untagged Ethernet
v
Access Port
|
v
VLAN 10A trunk carries multiple VLANs:
VLAN 10 --\
VLAN 20 ----> 802.1Q Trunk
VLAN 30 --/802.1Q tagging allows the receiving VLAN-aware device to determine which VLAN context applies to tagged frames.
Inside the switching system:
VLAN
+
Destination MAC
|
v
Forwarding Database
|
v
Output PortBroadcasts, ARP requests and unknown unicast flooding remain constrained by the relevant Layer 2 domain.
When traffic must move between VLANs:
VLAN 10
|
v
Layer 3 Gateway
|
| Routing
v
VLAN 20This can be implemented using:
Router-on-a-stick
Layer 3 switch + SVI
Firewall interfaces
Virtual routing infrastructureThe complete troubleshooting model therefore becomes:
Physical Link
|
v
Switch Port
|
v
VLAN
|
v
MAC Address Table
|
v
ARP
|
v
Default Gateway
|
v
Inter-VLAN Routing
|
v
ACL / Firewall
|
v
DestinationUnderstanding this sequence is far more useful than memorizing VLAN commands.
When a device cannot communicate, ask:
Is it connected to the correct VLAN?
Is its MAC learned in that VLAN?
Can it resolve its gateway with ARP?
Does the VLAN cross every required trunk?
Is the VLAN allowed on those trunks?
Does inter-VLAN routing exist?
Does security policy permit the traffic?Those questions isolate most VLAN problems quickly.
Continue with ARP Explained to understand neighbor resolution, Routers, Switches and Network Devices for switching and routing fundamentals, TCP/IP Explained for Layer 3 forwarding, and Network Security Basics for segmentation and access-control concepts.
For the underlying standard, consult the IEEE 802.1 Working Group, which develops the standards governing bridged networks, VLANs and related LAN technologies.