VLAN Explained: Access vs Trunk, 802.1Q & Inter-VLAN Routing

Posted on October 5, 2026 By corginetwork Leave a comment Networking

 

Table of Contents

VLAN Explained: Access Ports, Trunk Ports, 802.1Q, Native VLAN and Inter-VLAN Routing

A modern Ethernet network can contain hundreds or thousands of connected devices without placing every endpoint inside one enormous Layer 2 broadcast domain. One of the technologies that makes this segmentation possible is the Virtual Local Area Network, or VLAN.

A VLAN creates a logical Layer 2 broadcast domain within switched infrastructure. Instead of requiring a completely separate physical switch for every group of devices, administrators can logically separate users, servers, phones, wireless clients, management systems, cameras, or other endpoints while still using shared switching hardware.

For example, one physical switch could support:

VLAN 10 → Corporate Users
VLAN 20 → Voice
VLAN 30 → Servers
VLAN 40 → Guest Wi-Fi
VLAN 99 → Network Management

Devices assigned to different VLANs are separated at Layer 2. If they need to communicate across VLAN boundaries, a Layer 3 function—such as a router, Layer 3 switch, or firewall—must route the traffic according to the network design and security policy.

Understanding VLANs therefore requires more than knowing how to create a VLAN ID. You need to understand access ports, trunk ports, IEEE 802.1Q tagging, native VLAN behavior, broadcast domains, MAC address tables, inter-VLAN routing, SVIs, DHCP relay, and common VLAN troubleshooting problems.

This guide explains all of those concepts from the packet level upward.

If you need the fundamentals first, read Computer Networking Explained, TCP/IP Explained, and Routers, Switches and Network Devices.

What Is a VLAN?

VLAN stands for:

Virtual Local Area Network

A VLAN logically separates a switched Ethernet infrastructure into different Layer 2 broadcast domains.

Imagine a physical switch with 24 ports.

Without VLAN segmentation, endpoints might all belong to the same Layer 2 network:

               SWITCH
      /    /    |    \    \
     /    /     |     \    \
   PC1  PC2    PC3    PC4   PC5

       One broadcast domain

With VLANs, the same physical switch can logically separate those ports:

                 SWITCH

      VLAN 10              VLAN 20
     /      \              /      \
   PC1      PC2          PC3      PC4

     Users                 Finance

Traffic belonging to VLAN 10 remains logically separated from VLAN 20 at Layer 2.

The physical hardware is shared.

The Layer 2 broadcast domains are not.

This is the core idea behind VLAN technology.

Why Do Networks Use VLANs?

Without VLANs, segmentation would require more physical separation.

For example, an organization might otherwise need separate switching infrastructure for:

Employees
Servers
VoIP phones
Security cameras
Guest Wi-Fi
Network management

VLANs allow these groups to coexist on shared switching infrastructure while maintaining logical Layer 2 separation.

A typical design might look like:

VLAN Purpose Example IP Subnet
10 Corporate Users 10.10.10.0/24
20 Finance 10.10.20.0/24
30 Servers 10.10.30.0/24
40 Voice 10.10.40.0/24
50 Guest Wi-Fi 10.10.50.0/24
99 Management 10.10.99.0/24

The VLAN numbers and IP ranges are administrative design choices.

VLAN 10 does not inherently require a subnet ending in .10.0/24; matching them simply makes many networks easier to understand.

VLANs Create Layer 2 Broadcast Domains

One of the most important VLAN concepts is the broadcast domain.

Suppose PC-A sends an Ethernet broadcast:

FF:FF:FF:FF:FF:FF

If PC-A belongs to VLAN 10, the switch can flood that broadcast to appropriate VLAN 10 ports.

It should not simply flood it into VLAN 20.

Conceptually:

               SWITCH

        VLAN 10          VLAN 20

PC-A ----+                    +---- PC-C
         |                    |
PC-B ----+                    +---- PC-D

Broadcast from PC-A
     |
     +----> PC-B
     |
     X----> PC-C
     X----> PC-D

The VLAN boundary separates the Layer 2 broadcast domains.

This becomes especially important for protocols such as ARP and DHCP, which rely on local Layer 2 behavior during important parts of their operation.

VLAN Is Not the Same as an IP Subnet

This distinction is essential.

A VLAN is primarily a:

Layer 2 construct

An IP subnet is a:

Layer 3 construct

For example:

VLAN 10

might be associated with:

192.168.10.0/24

while:

VLAN 20

might use:

192.168.20.0/24

This produces a clean design:

Layer 2             Layer 3

VLAN 10   <---->   192.168.10.0/24

VLAN 20   <---->   192.168.20.0/24

VLAN 30   <---->   192.168.30.0/24

But VLAN 10 is not itself 192.168.10.0/24.

The VLAN controls Layer 2 membership.

The subnet controls Layer 3 addressing and routing.

In most conventional enterprise designs, mapping one IP subnet to one VLAN makes troubleshooting and routing considerably easier.

VLAN IDs Explained

IEEE 802.1Q uses a VLAN Identifier field inside its tag.

The VLAN ID is 12 bits wide, giving values from 0 through 4095, although not every value represents an ordinary configurable VLAN.

In normal VLAN configuration, the commonly usable VLAN ID range is:

1–4094

Values 0 and 4095 have special/reserved meanings in 802.1Q rather than serving as ordinary VLAN IDs.

A switch might therefore have:

VLAN 10  → Users
VLAN 20  → Servers
VLAN 30  → Voice
VLAN 40  → Guest

The VLAN ID allows switching infrastructure to distinguish Layer 2 traffic belonging to different logical broadcast domains.

How Does a Switch Know Which VLAN a Frame Belongs To?

The answer depends on how the frame entered the switch.

If an endpoint connects through an access port, the switch associates incoming untagged traffic with the VLAN configured for that access port.

Example:

PC
 |
 | untagged Ethernet
 |
 v
Switch Port
Access VLAN 10

The switch internally treats that traffic as belonging to VLAN 10.

When VLAN traffic travels across a trunk, an IEEE 802.1Q tag can identify the VLAN.

This leads to the two most important VLAN port concepts:

access ports and trunk ports.

What Is an Access Port?

An access port normally carries traffic for a single access VLAN and is commonly used to connect an endpoint.

Examples include:

Desktop computer
Printer
Server
Camera
Workstation

Conceptually:

PC
 |
 | Normal Ethernet frame
 |
 v
+----------------+
| Switch Port 1  |
| Access VLAN 10 |
+----------------+

The endpoint typically does not need to understand 802.1Q tagging for a conventional access connection.

The switch associates the untagged frame with the configured VLAN.

Access Port Example

Consider:

Port Gi1/0/1 → VLAN 10
Port Gi1/0/2 → VLAN 10
Port Gi1/0/3 → VLAN 20
Port Gi1/0/4 → VLAN 20

Architecture:

       VLAN 10                VLAN 20

PC-A -------- Gi1/0/1    Gi1/0/3 -------- PC-C
PC-B -------- Gi1/0/2    Gi1/0/4 -------- PC-D

                  SWITCH

PC-A and PC-B share a Layer 2 VLAN.

PC-C and PC-D share another.

PC-A cannot reach PC-C merely through ordinary Layer 2 switching because they belong to different VLANs.

Communication between the two networks requires Layer 3 forwarding.

What Is a Trunk Port?

A trunk is commonly used to transport traffic for multiple VLANs over one physical link.

For example:

Switch A                         Switch B

VLAN 10 ---------------------- VLAN 10
VLAN 20 ===== 802.1Q TRUNK === VLAN 20
VLAN 30 ---------------------- VLAN 30

Without a trunk, maintaining multiple VLANs between switches could require separate physical links for each Layer 2 network.

With VLAN tagging, multiple VLANs can share the same link.

This is one of the primary purposes of IEEE 802.1Q.

How IEEE 802.1Q VLAN Tagging Works

An ordinary Ethernet frame does not inherently carry the same VLAN identification used by an 802.1Q trunk.

IEEE 802.1Q inserts tagging information into the Ethernet frame.

Simplified untagged frame:

+------------------+
| Destination MAC  |
+------------------+
| Source MAC       |
+------------------+
| EtherType/Length |
+------------------+
| Payload          |
+------------------+
| FCS              |
+------------------+

Simplified 802.1Q-tagged frame:

+------------------+
| Destination MAC  |
+------------------+
| Source MAC       |
+------------------+
| 802.1Q Tag       |
| - PCP            |
| - DEI            |
| - VLAN ID        |
+------------------+
| EtherType/Length |
+------------------+
| Payload          |
+------------------+
| FCS              |
+------------------+

The tag is four bytes long.

It includes information such as:

PCP → Priority Code Point
DEI → Drop Eligible Indicator
VID → VLAN Identifier

The VLAN Identifier is what allows a receiving VLAN-aware device to associate the frame with the appropriate VLAN.

802.1Q Tag Structure

At a simplified level:

Field Purpose
TPID Identifies 802.1Q tagging
PCP Layer 2 priority information
DEI Drop eligibility indication
VID VLAN identifier

The commonly recognized Tag Protocol Identifier for standard 802.1Q-tagged Ethernet is:

0x8100

The VLAN tag allows switches to preserve VLAN membership as traffic crosses VLAN-aware links.

What Is the Native VLAN?

On common 802.1Q trunk implementations, the native VLAN is associated with untagged traffic on the trunk.

A simplified Cisco-style conceptual model is:

802.1Q Trunk

VLAN 10 → tagged
VLAN 20 → tagged
VLAN 30 → tagged
Native VLAN → normally untagged

The exact behavior can depend on platform configuration.

The critical operational rule is that both ends of the trunk must agree on how untagged/native VLAN traffic is handled.

A native VLAN mismatch can create connectivity problems and potentially undesirable traffic placement.

Native VLAN Mismatch Example

Suppose:

Switch A
Native VLAN = 10

while:

Switch B
Native VLAN = 20

An untagged frame crossing the trunk can be interpreted differently at each end.

Conceptually:

Switch A                     Switch B

Native = 10                  Native = 20
    |                            |
    |------ untagged frame ----->|
    |                            |
 VLAN 10                      VLAN 20

This is clearly not the intended VLAN mapping.

Native VLAN consistency is therefore an important trunk troubleshooting check.

Access Port vs Trunk Port

The distinction can now be summarized clearly.

Feature Access Port Trunk Port
Typical purpose Endpoint connection VLAN-aware device interconnection
VLANs carried Usually one access VLAN Multiple VLANs
802.1Q tags Normally not exposed to ordinary endpoint Common
Typical connection PC, printer, endpoint Switch, router, firewall, AP, hypervisor
Native VLAN concept Not normally relevant in same way Yes
Allowed VLAN list Usually unnecessary Important

The simplest mental model is:

Access port
Endpoint ↔ One VLAN

Trunk port
Network device ↔ Multiple VLANs

There are advanced exceptions, such as voice VLAN configurations and VLAN-aware servers, so this should be treated as the standard model rather than an absolute limitation.

How VLANs Travel Between Two Switches

Consider:

PC-A
VLAN 10
 |
 v
Switch A
 |
 | trunk
 |
 v
Switch B
 |
 v
PC-B
VLAN 10

PC-A sends a normal Ethernet frame to Switch A.

Switch A knows the frame belongs to VLAN 10 because of the access port configuration.

When forwarding it over the trunk, the switch can add the appropriate 802.1Q VLAN tag.

Conceptually:

PC-A
 |
 | untagged
 v
Switch A
 |
 | VLAN 10 tagged
 v
========== TRUNK ==========
 |
 v
Switch B
 |
 | untagged toward access endpoint
 v
PC-B

The tag preserves the VLAN context between VLAN-aware network devices.

Allowed VLANs on a Trunk

A trunk does not necessarily need to transport every VLAN configured on a switch.

Administrators can restrict which VLANs are allowed across a trunk.

Example:

Trunk allows:

VLAN 10
VLAN 20
VLAN 30

but not:

VLAN 40

If VLAN 40 exists on both switches but is not permitted across the trunk:

Switch A                     Switch B

VLAN 40 ---- X TRUNK X ---- VLAN 40

endpoints in VLAN 40 on opposite switches may fail to communicate.

This is a common troubleshooting scenario.

VLAN Must Exist Where It Is Needed

Another common failure occurs when a VLAN exists on one switch but not on another relevant switch.

Example:

Switch A
VLAN 30 exists

but:

Switch B
VLAN 30 missing

Even if the trunk is physically operational, VLAN 30 connectivity may fail depending on the platform and configuration.

A useful VLAN troubleshooting rule is therefore:

Verify both the trunk and the VLAN database/configuration.

Do not check only whether the interface is physically up.

What Is Inter-VLAN Routing?

VLANs separate Layer 2 networks.

If devices in different VLANs need to communicate, Layer 3 routing is required.

Example:

VLAN 10
192.168.10.0/24

PC-A
192.168.10.10

needs to reach:

VLAN 20
192.168.20.0/24

Server
192.168.20.50

The traffic cannot cross the VLAN boundary through ordinary Layer 2 switching alone.

It needs:

Layer 3 routing

This is called:

inter-VLAN routing.

For a detailed comparison of the devices that can provide this function, see Router vs Switch: Layer 2 vs Layer 3 Explained.

Three Common Inter-VLAN Routing Designs

There are three useful conceptual models.

1. Traditional Physical Router Interfaces

VLAN 10
   |
   v
Router
   |
   v
VLAN 20

Separate Layer 3 interfaces connect the networks.

2. Router-on-a-Stick

VLAN 10 ---\
VLAN 20 ---- SWITCH ==== TRUNK ==== ROUTER
VLAN 30 ---/

The router uses VLAN-tagged subinterfaces.

3. Layer 3 Switch

VLAN 10 ---\
            \
             L3 SWITCH
            /
VLAN 20 ---/

SVIs or routed interfaces provide Layer 3 forwarding directly on the switch.

Modern enterprise networks frequently use the third model for internal VLAN routing.

SVI Explained

SVI stands for:

Switched Virtual Interface

An SVI is a logical Layer 3 interface associated with a VLAN on a routing-capable switch.

Example:

VLAN 10
Network: 192.168.10.0/24
SVI:     192.168.10.1

and:

VLAN 20
Network: 192.168.20.0/24
SVI:     192.168.20.1

Architecture:

             Layer 3 Switch

       +------------------------+
       | VLAN 10 SVI            |
       | 192.168.10.1           |
       |                        |
       |      Routing           |
       |                        |
       | VLAN 20 SVI            |
       | 192.168.20.1           |
       +------------------------+
          |                |
          v                v
       VLAN 10          VLAN 20

Clients can use the SVI address as their default gateway.

Inter-VLAN Routing Example

PC-A:

IP:      192.168.10.10
Mask:    255.255.255.0
Gateway: 192.168.10.1
VLAN:    10

Server:

IP:      192.168.20.50
Mask:    255.255.255.0
Gateway: 192.168.20.1
VLAN:    20

When PC-A sends traffic to 192.168.20.50, it determines that the destination is outside its local subnet.

It sends the frame toward:

192.168.10.1

The Layer 3 switch routes the IP packet toward VLAN 20.

Conceptually:

PC-A
192.168.10.10
     |
     v
VLAN 10
     |
     v
SVI 192.168.10.1
     |
     | routing
     v
SVI 192.168.20.1
     |
     v
VLAN 20
     |
     v
Server
192.168.20.50

This is inter-VLAN routing.

Router-on-a-Stick Explained

A smaller environment may use a router instead of a Layer 3 switch.

The switch-to-router link becomes an 802.1Q trunk:

PC-A VLAN10 ---\
                \
PC-B VLAN20 ----- SWITCH
                /
PC-C VLAN30 ---/
                  |
                  | 802.1Q trunk
                  |
                ROUTER

The router can create logical subinterfaces:

Interface
 |
 +---- VLAN 10 subinterface
 |
 +---- VLAN 20 subinterface
 |
 +---- VLAN 30 subinterface

Each subinterface provides Layer 3 connectivity for a VLAN.

This design is commonly called:

router-on-a-stick.

It is particularly useful for learning how VLAN tagging and Layer 3 routing interact.

VLANs and DHCP

DHCP is one of the most important protocols to understand when deploying multiple VLANs.

Suppose:

VLAN 10
192.168.10.0/24

and the DHCP server is located in:

VLAN 100
192.168.100.0/24

A new client in VLAN 10 sends a DHCPDISCOVER.

The initial DHCP process relies on local broadcast behavior.

But ordinary Layer 2 broadcasts do not simply cross the Layer 3 boundary between VLAN 10 and VLAN 100.

A DHCP relay can solve this problem.

Client VLAN 10
      |
      | DHCPDISCOVER
      v
Layer 3 Gateway
      |
      | DHCP Relay
      v
DHCP Server VLAN 100

This allows one centralized DHCP infrastructure to serve many VLANs.

One DHCP Scope per Client Subnet

A common architecture might use:

VLAN 10
192.168.10.0/24
DHCP Scope → 192.168.10.x
VLAN 20
192.168.20.0/24
DHCP Scope → 192.168.20.x
VLAN 30
192.168.30.0/24
DHCP Scope → 192.168.30.x

The DHCP server must be able to determine which client network requires an address.

DHCP relay information helps the server choose the correct scope.

This is why:

DHCP works in VLAN 10 but not VLAN 20

often points toward:

VLAN 20 configuration
DHCP relay
VLAN 20 DHCP scope
ACL/firewall
Routing

rather than a complete DHCP-server outage.

VLANs and the Default Gateway

Each routed VLAN normally has an appropriate Layer 3 gateway.

Example:

VLAN Network Gateway
10 192.168.10.0/24 192.168.10.1
20 192.168.20.0/24 192.168.20.1
30 192.168.30.0/24 192.168.30.1

If a VLAN 20 client receives:

IP:
192.168.20.50

but its gateway is incorrectly configured as:

192.168.10.1

local behavior may appear partially functional while routed connectivity fails.

This is why VLAN troubleshooting and DHCP troubleshooting frequently overlap.

VLANs and DNS

VLANs do not replace DNS.

A client may belong to:

VLAN 10

while using a DNS resolver located in:

VLAN 100

The path becomes:

Client
 |
VLAN 10
 |
Gateway
 |
Routing / Security Policy
 |
VLAN 100
 |
DNS Server

If routing or firewall policy between these VLANs blocks DNS, the client can have a perfectly valid DHCP lease but still fail to resolve domain names.

For the DNS layer itself, see DNS Explained.

Are VLANs a Security Feature?

VLANs provide useful Layer 2 segmentation, but a VLAN should not be treated as a complete security solution.

Suppose:

VLAN 10 → Users
VLAN 20 → Servers

If unrestricted Layer 3 routing exists:

Users VLAN
    |
    v
Router / L3 Switch
    |
    v
Server VLAN

users may still be able to reach server services.

Security policy may need to be enforced using:

ACLs
Firewalls
Network access controls
Microsegmentation
Identity-aware controls

depending on the environment.

A useful design principle is:

VLANs create segmentation boundaries; security policy determines what is allowed across those boundaries.

For more, see Network Security Basics and Firewalls Explained.

Common Enterprise VLAN Design

Consider an office with:

VLAN 10 → Employees
VLAN 20 → Finance
VLAN 30 → Servers
VLAN 40 → Voice
VLAN 50 → Guest
VLAN 99 → Management

A simplified architecture:

                         Internet
                            |
                            v
                         Firewall
                            |
                            v
                     Layer 3 Switch
                  /      /    \       \
                 /      /      \       \
                v      v        v       v
             VLAN10 VLAN20   VLAN30   VLAN50
             Users  Finance  Servers   Guest

Security policy might allow:

Users → Internet
Users → selected server services

Finance → Finance servers
Finance → Internet

Guest → Internet only

Management → network devices

The VLANs provide logical network boundaries.

The firewall/ACL policy controls permitted communication between them.

Voice VLANs

IP phones often introduce a useful access-port variation.

A physical port may support:

IP Phone
   |
   +---- PC

The network may separate:

Voice traffic → Voice VLAN
Data traffic  → Data VLAN

Conceptually:

Switch Port
    |
    v
IP Phone
    |
    v
PC

Voice → VLAN 40
PC    → VLAN 10

This is one example showing why “an access port always carries exactly one kind of traffic in every situation” is too simplistic.

Platform-specific voice VLAN mechanisms should be configured according to vendor documentation.

Wireless Networks and VLANs

Wireless networks frequently map SSIDs to VLANs.

For example:

SSID: Corporate
        |
        v
VLAN 10
SSID: Guest
        |
        v
VLAN 50
SSID: IoT
        |
        v
VLAN 60

The wireless access point or controller may connect to switching infrastructure through a VLAN-aware link.

Conceptually:

Corporate SSID --- VLAN 10 --\
Guest SSID ------- VLAN 50 ---- AP ==== trunk ==== Switch
IoT SSID --------- VLAN 60 --/

If one SSID suddenly stops receiving DHCP addresses, the problem could involve:

SSID-to-VLAN mapping
Allowed VLANs
Trunk configuration
VLAN existence
DHCP relay
DHCP scope

not necessarily Wi-Fi radio connectivity.

VLANs in Virtualization

Virtualization also relies heavily on VLAN concepts.

A hypervisor may host virtual machines belonging to different networks:

VM1 → VLAN 10
VM2 → VLAN 20
VM3 → VLAN 30

The physical server can connect to the network through VLAN-aware interfaces or virtual-switch configuration.

Conceptually:

VM1 VLAN10 ---\
VM2 VLAN20 ---- Virtual Switch ==== Physical NIC ==== Network Switch
VM3 VLAN30 ---/

A mismatch between:

Hypervisor VLAN configuration

and:

Physical switch trunk configuration

can cause difficult connectivity problems.

For the broader virtualization layer, see Virtualization Explained.

VLANs in Cloud Networking

Public cloud platforms generally expose higher-level constructs such as:

VPC
VNet
Subnet
Route table
Security group
Virtual NIC

rather than requiring users to configure physical switch VLANs directly.

However, the architectural concepts remain related:

Segmentation
Layer 3 boundaries
Subnets
Routing
Security policy

Cloud networking abstracts much of the underlying physical network.

For cloud-specific architecture, see Cloud Networking Explained.

Common VLAN Problem 1: Wrong Access VLAN

Suppose a user should belong to:

VLAN 10

but the switch port is configured for:

VLAN 20

The endpoint may receive:

Wrong DHCP subnet
Wrong gateway
Wrong security policy

or fail to receive DHCP entirely.

Expected:

192.168.10.x

Actual:

192.168.20.x

This is a strong clue that VLAN membership should be checked.

Common VLAN Problem 2: VLAN Missing from Trunk

Suppose:

Switch A

and:

Switch B

are connected by a trunk.

VLANs 10 and 20 work.

VLAN 30 fails.

Architecture:

VLAN 10 --------\
VLAN 20 ========= TRUNK ========= VLANs 10,20
VLAN 30 --------X

If VLAN 30 is not allowed on the trunk, VLAN 30 traffic cannot traverse that link as expected.

This is one of the first checks when:

One VLAN fails but all others work.

Common VLAN Problem 3: Native VLAN Mismatch

As discussed earlier:

Switch A
Native VLAN 10

and:

Switch B
Native VLAN 20

can cause untagged traffic to be classified differently at opposite ends.

Always verify the native VLAN configuration on both ends of the relevant trunk.

Common VLAN Problem 4: VLAN Does Not Exist

An interface might be configured with a VLAN that is not properly present/active on the switch.

Check both:

Port VLAN assignment

and:

VLAN existence/state

Do not assume the VLAN is operational simply because its number appears in part of the interface configuration.

Common VLAN Problem 5: Inter-VLAN Routing Disabled or Missing

Hosts inside VLAN 10 communicate correctly:

PC-A ↔ PC-B

Hosts inside VLAN 20 communicate correctly:

PC-C ↔ PC-D

but:

VLAN 10 X VLAN 20

fails.

That strongly suggests checking the Layer 3 path:

Gateway
SVI
Routing
ACL
Firewall

rather than Layer 2 switching alone.

Common VLAN Problem 6: SVI Down

A Layer 3 switch may have an SVI such as:

VLAN 20
192.168.20.1

but the SVI may not be operational depending on platform state and VLAN/interface conditions.

Symptoms can include:

Clients communicate locally
but
Default gateway unreachable

Investigate:

VLAN state
SVI state
IP configuration
Relevant active ports
Routing configuration

according to the platform.

Common VLAN Problem 7: DHCP Works in One VLAN but Not Another

Suppose:

VLAN 10 → DHCP works
VLAN 20 → DHCP fails
VLAN 30 → DHCP works

Because the same DHCP infrastructure serves other VLANs, prioritize what is unique to VLAN 20:

VLAN 20 access assignment
VLAN 20 trunk allowance
VLAN 20 SVI
VLAN 20 DHCP relay
VLAN 20 DHCP scope
VLAN 20 ACL

This is more efficient than restarting the DHCP server immediately.

Common VLAN Problem 8: Same VLAN on Different Switches Cannot Communicate

Example:

PC-A
VLAN 10
 |
Switch A
 |
TRUNK
 |
Switch B
 |
PC-B
VLAN 10

If communication fails, investigate:

VLAN exists on both switches
VLAN 10 allowed across trunk
Trunk operational
Native/tagging configuration
STP state
MAC learning
Endpoint configuration

The Layer 3 router may not be involved at all if both endpoints are truly in the same Layer 2 VLAN and subnet.

VLAN Troubleshooting: Start at Layer 1

Do not begin with complex VLAN configuration before checking physical connectivity.

Verify:

Interface up?
Cable connected?
NIC enabled?
Switch port active?
Errors?

Then move upward.

A useful troubleshooting model is:

Physical
   |
   v
Switch Port
   |
   v
VLAN
   |
   v
Trunk
   |
   v
MAC / ARP
   |
   v
IP Address
   |
   v
Gateway
   |
   v
Routing
   |
   v
Firewall
   |
   v
DNS/Application

This prevents troubleshooting Layer 3 when Layer 1 or Layer 2 is actually broken.

Step-by-Step VLAN Troubleshooting Workflow

Step 1: Identify the Expected VLAN

Do not start troubleshooting until you know:

Which VLAN should this endpoint use?

Record:

Expected VLAN ID
Expected IP subnet
Expected gateway
Expected DHCP scope

For example:

VLAN:    20
Network: 192.168.20.0/24
Gateway: 192.168.20.1

Step 2: Check the Endpoint Address

On Windows:

ipconfig /all

On Linux:

ip addr
ip route

If a VLAN 20 client receives:

192.168.30.50

you immediately have evidence that it may be connected to the wrong logical network.

Step 3: Check the Access Port

On a Cisco-like platform, commands such as:

show interfaces switchport

and:

show vlan brief

can help identify VLAN membership.

Exact commands vary by platform.

Confirm:

Port mode
Access VLAN
Operational VLAN

rather than relying only on documentation.

Step 4: Check MAC Address Learning

A switch should normally learn the endpoint MAC address on the expected port and VLAN.

Conceptually:

MAC Address           VLAN     Port
AA:AA:AA:AA:AA:AA     20      Gi1/0/5

If the MAC is missing, investigate:

Physical link
NIC
Port state
VLAN
Port security
STP

If the MAC appears on an unexpected port, investigate topology and endpoint location.

Step 5: Check the Trunk

If the traffic must cross another switch:

Switch A ==== trunk ==== Switch B

verify:

Trunk operational
VLAN allowed
VLAN exists
Native VLAN consistent
STP forwarding

A physically up trunk does not guarantee every VLAN can traverse it.

Step 6: Test Same-VLAN Communication

Try reaching another endpoint in the same VLAN/subnet.

If same-VLAN communication fails:

Focus on Layer 2 first.

If same-VLAN communication works but another subnet fails:

Move toward Layer 3.

This simple test dramatically narrows the troubleshooting scope.

Step 7: Check the Default Gateway

Verify the endpoint has the correct gateway.

Then test gateway reachability.

If:

Same VLAN communication works

but:

Gateway fails

investigate:

SVI/router interface
Gateway IP
VLAN association
ACL
Layer 3 state

Step 8: Check Inter-VLAN Routing

If the gateway works but another VLAN does not:

Client
  |
  v
Gateway ✓
  |
  X
Remote VLAN

check:

Routing table
SVIs
ACLs
Firewall
Return route
Destination host policy

Step 9: Check DHCP Relay

If the client receives:

169.254.x.x

on Windows when a normal DHCP lease is expected, and the DHCP server resides on another subnet, inspect the DHCP relay configuration.

The VLAN gateway is often the logical place where relay behavior is configured.

Step 10: Check DNS Last

If:

IP address ✓
Gateway ✓
Remote IP connectivity ✓
Domain names ✗

then investigate DNS.

Do not change VLAN configuration merely because a website name does not resolve.

Use DNS Explained to separate name-resolution failures from Layer 2/Layer 3 failures.

Useful Cisco-Style VLAN Commands

Exact syntax varies by operating system and platform, but commonly useful commands include:

show vlan brief

to inspect VLANs and access-port membership.

show interfaces trunk

to inspect trunking and allowed VLANs.

show interfaces switchport

to inspect switchport mode and VLAN behavior.

show mac address-table

to inspect learned Layer 2 addresses.

show spanning-tree

to inspect STP state.

For Layer 3 switching:

show ip interface brief

and:

show ip route

can help inspect SVIs and routing.

Always use documentation for the specific platform before making production changes.

VLAN Troubleshooting Decision Tree

Endpoint has connectivity problem
            |
            v
      Physical link up?
        /         \
      NO           YES
      |             |
      v             v
Fix Layer 1    Correct VLAN?
                  /     \
                NO       YES
                |         |
                v         v
          Fix access    Same-VLAN
          VLAN          connectivity?
                         /       \
                       NO         YES
                       |           |
                       v           v
                  Check trunk    Gateway
                  MAC/STP        reachable?
                                 /      \
                               NO        YES
                               |          |
                               v          v
                          Check SVI/    Remote subnet
                          gateway      reachable?
                                       /      \
                                     NO        YES
                                     |          |
                                     v          v
                                Routing/ACL   Test DNS/
                                Firewall      Application

The goal is to isolate the failing layer before changing configuration.

VLAN Troubleshooting Checklist

For an incident, collect:

Endpoint:
MAC address:
Switch:
Switch port:
Expected VLAN:
Actual VLAN:
Expected subnet:
Actual IP:
Subnet mask:
Default gateway:
DHCP server:
DNS server:
Access or trunk:
VLAN exists:
VLAN allowed on trunk:
Native VLAN:
MAC learned:
STP state:
Gateway reachable:
Same-VLAN host reachable:
Remote VLAN reachable:
DHCP relay configured:
Recent switch changes:
Recent VLAN changes:
Recent firewall changes:

This information turns:

“The network is down.”

into a diagnosable Layer 2/Layer 3 problem.

VLAN Best Practices

Good VLAN design is less about creating a large number of VLAN IDs and more about building understandable segmentation.

Useful principles include:

  • Keep VLAN and IP addressing plans documented.
  • Use descriptive VLAN names.
  • Avoid unnecessary Layer 2 extension.
  • Explicitly control VLANs allowed on trunks where appropriate.
  • Keep native VLAN configuration consistent across a trunk.
  • Separate network-management access appropriately.
  • Use Layer 3 boundaries intentionally.
  • Apply security policy between sensitive segments.
  • Monitor trunk and STP state.
  • Document DHCP scopes and relays alongside VLANs.
  • Remove obsolete VLANs carefully after verifying dependencies.

Do not create a new VLAN simply because “more VLANs means more security.”

Segmentation needs a clear architectural purpose.

VLANs and Spanning Tree

VLAN troubleshooting frequently intersects with the Spanning Tree Protocol.

Ethernet Layer 2 networks can develop loops when redundant links exist.

A loop can cause serious problems including:

Broadcast storms
MAC address instability
Duplicate frames
Network disruption

Spanning Tree helps create a loop-free forwarding topology while preserving redundancy.

Conceptually:

        Switch A
        /      \
       /        \
Switch B ------ Switch C

Redundant Layer 2 topology
          |
          v
Spanning Tree
          |
          v
Loop-free forwarding topology

If a VLAN cannot cross a particular path even though the trunk is configured correctly, STP state may be relevant.

This deserves its own dedicated article because STP introduces concepts such as root bridges, BPDUs, port roles, path cost, RSTP, and topology changes.

VLANs and Network Security

VLANs should be combined with an explicit security architecture.

For example:

Guest VLAN
    |
    v
Firewall
    |
    +----> Internet ✓
    |
    X----> Internal Servers

Similarly:

Management VLAN
      |
      v
Restricted policy
      |
      v
Switches / Routers / Servers

The VLAN provides segmentation.

The firewall or ACL provides policy.

This distinction is important because VLAN separation without appropriate Layer 3 policy may not deliver the security outcome administrators expect.

Frequently Asked Questions

What is a VLAN?

A VLAN is a logical Layer 2 broadcast domain implemented on VLAN-aware switching infrastructure.

What does VLAN stand for?

Virtual Local Area Network.

Why are VLANs used?

They allow administrators to segment devices into separate logical Layer 2 networks while sharing physical switching infrastructure.

Is a VLAN the same as a subnet?

No. A VLAN is primarily Layer 2, while an IP subnet is Layer 3. They are commonly mapped together.

What is a VLAN ID?

It is the VLAN identifier carried in the relevant field of an 802.1Q tag. Ordinary configurable VLANs commonly use IDs 1 through 4094.

What is an access port?

An access port commonly connects an endpoint to a single access VLAN.

What is a trunk port?

A trunk carries traffic for multiple VLANs over one physical link, typically using VLAN tagging.

What is 802.1Q?

IEEE 802.1Q defines VLAN tagging and related bridging behavior used to identify VLAN traffic across VLAN-aware Ethernet networks.

What is VLAN tagging?

VLAN tagging adds information to an Ethernet frame so VLAN-aware devices can identify its VLAN context.

How large is an 802.1Q tag?

The commonly described 802.1Q tag adds four bytes to the Ethernet frame.

What is the native VLAN?

In common 802.1Q trunk configurations, the native VLAN is associated with untagged traffic on the trunk.

What is a native VLAN mismatch?

It occurs when opposite ends of a trunk associate untagged traffic with different VLANs.

Can an access port carry multiple VLANs?

A conventional access port is associated with one access VLAN, although special configurations such as voice VLANs introduce additional behavior.

Can a trunk carry one VLAN?

It can be restricted to a specific set of allowed VLANs, potentially even one, although its usual purpose is transporting multiple VLANs.

Do VLANs need different IP subnets?

In standard routed enterprise design, different VLANs are normally associated with different IP subnets. VLANs and subnets remain separate concepts.

Can devices in different VLANs communicate?

Yes, if Layer 3 routing exists between their networks and security policy permits the traffic.

What is inter-VLAN routing?

It is routing between Layer 3 networks associated with different VLANs.

What device performs inter-VLAN routing?

A router, Layer 3 switch, firewall, or another Layer 3-capable system can provide it.

What is an SVI?

A Switched Virtual Interface is a logical Layer 3 interface associated with a VLAN on a capable switch.

Can an SVI be the default gateway?

Yes. This is common on Layer 3 switches.

What is router-on-a-stick?

It is an architecture where a router uses an 802.1Q trunk and logical subinterfaces to route multiple VLANs through one physical connection.

Why does DHCP fail after creating a VLAN?

Possible causes include missing DHCP scope, missing relay, incorrect access VLAN, VLAN not allowed across a trunk, SVI problems, routing, or ACL/firewall configuration.

Why can two computers in the same VLAN not communicate?

Investigate physical connectivity, access VLAN configuration, trunking, MAC learning, STP, port security, endpoint addressing, and host firewalls.

Why can devices in the same VLAN communicate but not across VLANs?

Investigate the default gateway, SVI/router interface, Layer 3 routing, ACLs, firewall rules and return path.

What happens if a VLAN is not allowed on a trunk?

Traffic for that VLAN cannot traverse the trunk as intended.

Are VLANs secure?

VLANs provide useful Layer 2 segmentation but should be combined with proper Layer 3 security controls and operational protections.

Do VLANs prevent broadcast traffic?

They limit ordinary Layer 2 broadcasts to the corresponding VLAN broadcast domain rather than forwarding them across every VLAN.

What is the difference between VLAN and VPN?

A VLAN provides Layer 2 network segmentation. A VPN provides a protected logical connection or overlay across another network. They solve very different problems.

Conclusion

A VLAN is much more than a number assigned to a switch port.

It is a fundamental mechanism for building logical Layer 2 network boundaries on shared Ethernet infrastructure.

The basic model is:

Physical Switch
      |
      +---- VLAN 10
      |
      +---- VLAN 20
      |
      +---- VLAN 30

Each VLAN represents a separate Layer 2 broadcast domain.

An access port typically connects an endpoint to one VLAN:

PC
 |
Access VLAN 10
 |
Switch

A trunk transports VLAN traffic between VLAN-aware devices:

Switch A
   |
   | VLAN 10
   | VLAN 20
   | VLAN 30
   |
802.1Q Trunk
   |
Switch B

IEEE 802.1Q provides the tagging mechanism that preserves VLAN context across these links.

When communication must cross VLAN boundaries:

VLAN 10
   |
   v
Layer 3 Routing
   |
   v
VLAN 20

a router, Layer 3 switch, firewall, or another routing-capable device must provide Layer 3 forwarding.

This creates one of the most important architectural relationships in networking:

VLAN
  |
  v
Layer 2 segmentation
  |
  v
IP subnet
  |
  v
Layer 3 gateway
  |
  v
Routing / Security Policy

Understanding that relationship makes many other networking technologies easier to understand—including DHCP relay, ARP, routing, ACLs, firewalls, wireless segmentation, virtualization and network troubleshooting.

Continue with Routers, Switches and Network Devices for the broader device architecture, TCP/IP Explained for Layer 3 behavior, Network Security Basics for segmentation strategy, Firewalls Explained for traffic policy, and DNS Explained for the name-resolution layer.

For standards-level background, IEEE maintains information about the IEEE 802.1 working group, while Cisco provides practical documentation covering VLAN configuration and inter-VLAN routing.

Leave a Reply

Your email address will not be published. Required fields are marked *