How to Configure VLAN on a Cisco Switch: Step-by-Step Guide

Reviewed by Elong Ben - CCIE #33355 Hours Posted on

Configuring a VLAN on a Cisco switch means more than just creating a VLAN ID. In a real network, you also need to assign access ports, configure trunk links, verify forwarding behavior, and avoid common mistakes such as native VLAN mismatches, overwritten trunk VLAN lists, or inactive SVIs. On modern Cisco Catalyst switches, especially IOS-XE platforms such as the Catalyst 9200 and 9300, the safest approach is to use explicit access and trunk configuration, verify every step with show commands, and follow a clean deployment workflow.

In enterprise networks, VLAN configuration is part of daily operations. It affects broadcast containment, access-layer segmentation, voice deployments, management traffic, and day-two troubleshooting. This guide focuses on modern Cisco Catalyst switch behavior and shows the practical workflow used in production networks, not just lab-style commands.

VLAN configuration is one of the most important steps in Cisco switch setup, but it is only one part of the overall deployment process. If you also need to configure the management IP, trunk links, and secure remote access, see our complete guide on How to Configure a Cisco Switch: Initial Setup.

Configure VLAN on a Cisco Switch

Quick VLAN Configuration Workflow

When you need a clean and reliable workflow, follow this order:

  1. Create the VLAN.
  2. Assign the VLAN to access ports.
  3. Configure the trunk uplink.
  4. Set the native VLAN if needed.
  5. Configure voice VLAN only if IP phones are used.
  6. Verify the result with show commands.
  7. Test endpoint connectivity and Layer 3 reachability if an SVI is involved.

What Is a VLAN on a Cisco Switch?

A VLAN is a Layer 2 broadcast domain. It allows you to divide one physical switch into multiple logical networks. Devices in different VLANs are isolated at Layer 2 unless routing is introduced.

In enterprise network design, VLANs are commonly used for:

  • Corporate user data
  • Voice traffic
  • Wireless access points
  • Cameras and IoT devices
  • Guest access
  • Switch management

Without VLANs, all devices on the same switch would share the same broadcast domain. That increases unnecessary broadcasts, weakens segmentation, and makes policy enforcement harder.

On Cisco switches, VLANs are usually created locally and then carried across trunk links with 802.1Q tagging.

What Do You Need Before Configuring VLANs?

Before entering commands, confirm the following:

  • You are using a Cisco switch running IOS or IOS-XE.
  • You know which VLAN IDs are required.
  • You know which interfaces are end-user access ports and which are infrastructure trunk links.
  • You know whether the switch is only doing Layer 2 switching or also providing Layer 3 gateway functions through SVIs.

If you are working on modern Catalyst access switches such as the 9200 or 9300, assume 802.1Q trunking by default. Many older guides still mention switchport trunk encapsulation dot1q, but that command is not used on most modern Catalyst access platforms.

How to Create a VLAN on a Cisco Switch

Use global configuration mode to create the VLAN and assign it a meaningful name.

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name CORPORATE-DATA
Switch(config-vlan)# exit

You can also create several VLANs in one session:

Switch# configure terminal
Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit
Switch(config)# vlan 30
Switch(config-vlan)# name GUEST
Switch(config-vlan)# exit
Switch(config)# vlan 99
Switch(config-vlan)# name NATIVE
Switch(config-vlan)# exit

This does three things:

  • creates the VLAN
  • stores a readable name for operations
  • makes the VLAN available for interface assignment

Use names that reflect function rather than location. Good examples include:

  • CORPORATE-DATA
  • VOICE
  • GUEST
  • MGMT
  • CAMERA

Important note about vlan.dat

On some platforms, VLAN information is stored in the VLAN database file (vlan.dat). This matters during cleanup and troubleshooting. Engineers sometimes erase the startup configuration and expect the switch to return to a blank state, but VLAN entries may remain if vlan.dat is still present. That is why old VLANs can appear to “survive” a reset.

How to Assign a VLAN to an Access Port

Access ports are used for endpoints such as desktops, printers, and single-purpose devices. An access port belongs to one VLAN only.

Example: assign GigabitEthernet1/0/10 to VLAN 10.

Switch# configure terminal
Switch(config)# interface GigabitEthernet1/0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# spanning-tree portfast
Switch(config-if)# exit

To configure a range of user-facing ports:

Switch# configure terminal
Switch(config)# interface range GigabitEthernet1/0/1-24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# exit

Why explicit access mode matters

Do not rely on dynamic negotiation. Explicitly setting switchport mode access makes the interface behavior predictable and reduces the chance of misconfiguration.

Typical access-port use cases

  • PCs and laptops
  • Printers
  • Badge readers
  • Cameras in dedicated VLANs
  • Any endpoint that should not receive multiple tagged VLANs

Access Port vs Trunk Port on a Cisco Switch

This is one of the most important concepts in Cisco VLAN configuration.

Port TypePurposeVLAN HandlingTypical Use
Access PortConnects one endpoint networkCarries one untagged VLANPC, printer, camera
Trunk PortConnects network devices that need multiple VLANsCarries multiple tagged VLANsSwitch uplink, firewall, access point, phone uplink scenarios

Use an access port when a device belongs to one VLAN only. Use a trunk port when the link must carry multiple VLANs between network devices. This becomes especially important when you move from basic VLAN creation to real switch uplinks and inter-switch design. We cover that in more detail in our Access Port vs Trunk Port guide.

How to Configure a Trunk Port on a Cisco Switch

A trunk port carries multiple VLANs over a single physical link. This is commonly used between switches, between a switch and a firewall, or between a switch and other infrastructure devices.

Example:

Switch# configure terminal
Switch(config)# interface TenGigabitEthernet1/1/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99
Switch(config-if)# exit

This does two key things:

  • enables trunking on the interface
  • defines which VLANs are allowed across the link

Important note for modern Cisco Catalyst switches

On Catalyst 9200 and 9300 platforms, you usually do not need to configure trunk encapsulation. 802.1Q is the standard behavior.

How to Configure Allowed VLANs on a Trunk

Allowed VLAN control is a production best practice. It reduces unnecessary traffic and helps prevent accidental forwarding of unwanted VLANs.

To add a VLAN to an existing allowed list without replacing the current configuration:

Switch# configure terminal
Switch(config)# interface TenGigabitEthernet1/1/1
Switch(config-if)# switchport trunk allowed vlan add 40
Switch(config-if)# exit

Why add matters

This is one of the most common production mistakes:

Switch(config-if)# switchport trunk allowed vlan 40

That command replaces the entire allowed VLAN list. If the trunk was already carrying VLANs 10,20,30,99, they will be removed unless you re-enter them manually.

Safer change:

Switch(config-if)# switchport trunk allowed vlan add 40

In real environments, this single detail can be the difference between a safe change and a service outage.

How to Configure a Native VLAN on a Trunk

The native VLAN is the untagged VLAN on an 802.1Q trunk.

Example:

Switch# configure terminal
Switch(config)# interface TenGigabitEthernet1/1/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99
Switch(config-if)# exit

Why native VLAN matters

If the two ends of a trunk use different native VLANs, you create a native VLAN mismatch. That can lead to traffic leakage, management confusion, STP warnings, and security problems.

Best practice

Do not leave the native VLAN as VLAN 1 in enterprise deployments. Use a dedicated native VLAN and document it clearly.

How to Configure a Voice VLAN on a Cisco Switch

Cisco IP phone deployments often use one VLAN for user data and another for voice traffic. The port remains an access port for the PC network, while the switch signals a separate voice VLAN to the phone.

Example:

Switch# configure terminal
Switch(config)# interface GigabitEthernet1/0/15
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# spanning-tree portfast
Switch(config-if)# power inline auto
Switch(config-if)# exit

How this works

  • Data traffic from the attached PC remains in VLAN 10
  • Voice traffic from the Cisco phone uses VLAN 20
  • Cisco Discovery Protocol can help the phone learn the voice VLAN automatically

Typical use case

  • Access-layer desk port
  • Cisco IP phone
  • PC connected through the phone

This is a high-value enterprise feature because it keeps voice traffic logically separate while still supporting a simple desk deployment.

Example: Basic VLAN Configuration on a Cisco Access Switch

If you want one complete, continuous example, use the following as a reference:

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name CORPORATE-DATA
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name VOICE
Switch(config-vlan)# exit
Switch(config)# vlan 99
Switch(config-vlan)# name NATIVE
Switch(config-vlan)# exit
Switch(config)# interface range GigabitEthernet1/0/1-24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# exitSwitch(config)# interface GigabitEthernet1/0/10
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# switchport voice vlan 20
Switch(config-if)# spanning-tree portfast
Switch(config-if)# power inline auto
Switch(config-if)# exitSwitch(config)# interface GigabitEthernet1/1/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,99
Switch(config-if)# exitSwitch(config)# end
Switch# write memory

This example shows the full deployment order:

  • create the VLANs
  • assign user ports
  • configure a voice port
  • build the trunk uplink
  • save the configuration

How to Verify VLAN Configuration on a Cisco Switch

Verification is where most real-world problems are discovered. Do not stop after entering commands.

CommandWhat It Verifies
show vlan briefVLAN exists and access ports are assigned correctly
show interfaces trunkTrunk state, native VLAN, allowed VLANs, active VLANs
show interfaces switchportAdministrative and operational switchport mode details
show ip interface briefSVI status and Layer 3 interface state

1. Check whether the VLAN exists

Switch# show vlan brief

What to look for:

  • VLAN ID is present
  • VLAN name is correct
  • Access ports appear under the correct VLAN

2. Check trunk status

Switch# show interfaces trunk

What to look for:

  • The interface is trunking
  • The correct native VLAN is configured
  • Allowed VLANs are correct
  • Active VLANs appear as expected

3. Check interface switchport behavior

Switch# show interfaces GigabitEthernet1/0/10 switchport

What to look for:

  • Administrative Mode
  • Operational Mode
  • Access VLAN
  • Voice VLAN
  • Native VLAN on trunk interfaces

4. Check SVI status if Layer 3 is involved

Switch# show ip interface brief

What to look for:

  • VLAN interface exists
  • Interface state is up/up if it should be active and routed

Cisco Switch VLAN Not Working Fix

If your Cisco switch VLAN is not working, the issue usually stems from a missing database entry, an incorrect port assignment, or strict trunk pruning. Follow this step-by-step troubleshooting checklist to isolate and fix the problem:

  • 1. Verify the VLAN Exists: A physical port assigned to a non-existent VLAN will silently drop all traffic. Run show vlan brief to ensure the target VLAN is listed in the database and marked as “active”. If it is missing, recreate it in global configuration mode.
  • 2. Check the Trunk Allowed List: If endpoint devices can ping each other on the same switch but cannot reach devices on a different switch, your uplink trunk is likely blocking the traffic. Run show interfaces trunk and verify your VLAN ID appears under the “VLANs allowed and active in management domain” section.
  • 3. Inspect the Operational Port Mode: Relying on Dynamic Trunking Protocol (DTP) can cause access ports to misbehave. Run show interfaces [interface] switchport. Ensure the output confirms Administrative Mode: static access and Operational Mode: static access, mapped to the correct VLAN.
  • 4. Fix the “Down/Down” SVI: If your Layer 3 VLAN interface (SVI) is down, it means no physical ports assigned to that VLAN are currently forwarding traffic. You must plug an active device into an assigned access port or allow the VLAN on an active trunk link to bring the SVI up/up.
  • 5. Resolve Native VLAN Mismatches: If traffic is leaking or completely halted by Spanning Tree Protocol (STP) blocking, check your switch logs using show logging. Look for the %CDP-4-NATIVE_VLAN_MISMATCH error. Ensure both ends of your trunk link are configured with the exact same switchport trunk native vlan [ID].

Why Your SVI Is Down Even When the VLAN Exists

This is one of the most common Cisco VLAN troubleshooting problems.

You may configure an SVI like this:

Switch# configure terminal
Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

But the SVI can still stay down/down or up/down.

Common reasons

  1. No active access or trunk port is carrying that VLAN.
  2. All ports in that VLAN are physically down.
  3. The VLAN is not allowed on the upstream trunk.
  4. The VLAN exists, but there is no forwarding Layer 2 path.

Practical rule

For an SVI to come up on a Layer 3 switch, the VLAN must exist and at least one port in that VLAN must be operational and forwarding.

Common Cisco VLAN Configuration Mistakes

These are the mistakes that regularly break production networks.

Mistake 1: Creating the VLAN but not assigning any ports

The VLAN exists, but no endpoint or uplink is actually using it.

Mistake 2: Assigning the port to a VLAN without forcing access mode

The interface may behave unexpectedly if the mode is not explicit.

Mistake 3: Overwriting the trunk allowed VLAN list

Using:

Switch(config-if)# switchport trunk allowed vlan 30

instead of:

Switch(config-if)# switchport trunk allowed vlan add 30

Mistake 4: Native VLAN mismatch

Both ends of the trunk must use the same native VLAN.

Mistake 5: Clearing startup-config but forgetting vlan.dat

The switch may still retain old VLAN data.

Mistake 6: Leaving unused ports in VLAN 1

That weakens segmentation hygiene and expands the default broadcast domain unnecessarily.

VLAN Best Practices for Enterprise Networks

Good VLAN design is not just about syntax. It is about standardization, security, and operational clarity.

Recommended VLAN design example

VLAN IDPurpose
10Management
20Corporate Data
30Voice
40Guest
99Native
666Unused / Black-hole VLAN

Best-practice rules

  • Use clear naming standards.
  • Keep management traffic separate from user data.
  • Do not use VLAN 1 for normal production user traffic.
  • Put unused ports into a dead-end VLAN and shut them down where appropriate.
  • Use explicit trunk allowed VLAN lists.
  • In enterprise networks, many teams prefer VTP transparent mode for predictability and local control.

Cisco VLAN Configuration with Ansible

Modern enterprise operations increasingly move repetitive VLAN tasks into automation.

A minimal example for VLAN creation:

- name: Configure VLANs on Cisco switch
  hosts: access_switches
  gather_facts: no
  connection: network_cli  
  tasks:
    - name: Create VLANs
      cisco.ios.ios_vlans:
        config:
          - vlan_id: 10
            name: CORPORATE-DATA
          - vlan_id: 20
            name: VOICE
        state: merged

A minimal Layer 2 interface example:

- name: Configure access port
  hosts: access_switches
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Assign access VLAN
      cisco.ios.ios_l2_interfaces:
        config:
          - name: GigabitEthernet1/0/10
            mode: access
            access:
              vlan: 10
        state: merged

Why this matters

Manual CLI is still normal for one-off changes. But large campus environments benefit from automation because it improves repeatability, change control, and deployment speed.

FAQ About Cisco VLAN Configuration

How do I create a VLAN on a Cisco switch?

Enter global configuration mode, create the VLAN with vlan <id>, assign a name, then verify it with show vlan brief.

How do I assign a VLAN to a port on a Cisco switch?

Use switchport mode access and switchport access vlan <id> under the interface.

How do I configure a trunk port on a Cisco switch?

Use switchport mode trunk, then define allowed VLANs with switchport trunk allowed vlan ....

What is the difference between access VLAN and native VLAN?

An access VLAN is the VLAN assigned to an access port for endpoint traffic. A native VLAN is the untagged VLAN on a trunk link.

Why is my VLAN not working on a Cisco switch?

Common causes include wrong access-port assignment, trunk allowed VLAN mismatch, native VLAN mismatch, or an SVI that has no active forwarding ports in its VLAN.

Do I still need switchport trunk encapsulation dot1q on modern Cisco switches?

Usually no. On modern Cisco Catalyst IOS-XE access switches such as the 9200 and 9300, 802.1Q is standard and the encapsulation command is typically not used.

If your goal is to configure VLANs correctly on a Cisco switch, focus on the full workflow rather than just one command. Create the VLAN, assign the right access ports, build trunks carefully, verify every step, and understand the operational meaning of native VLANs, voice VLANs, and SVI state. That approach scales far better in real enterprise switching than a simple copy-paste lab configuration.

Latest Articles