3.4 6 Lab Configure Vlans And Trunking

Of course. Here is a complete pillar blog post on configuring VLANs and trunking in a lab environment, written in a genuine, human voice.

Why Your Network Feels Slow (And How VLANs Fix It)

You’re sitting at your desk, trying to open a file on the server, and it’s crawling. Meanwhile, the office printer seems to be running a marathon from across the room. Plus, everything is plugged into the same switch, but it feels like one big, chaotic party where no one can hear themselves think. Sound familiar?

We're talking about the classic problem of a flat network. Which means if you’ve ever wondered how to organize a network so it’s faster, more secure, and actually manageable, you’re in the right place. And the solution, the superpower that network engineers use to tame this chaos, is VLANs. Let’s get into it.

It sounds simple, but the gap is usually here.

What Are VLANs, Really?

Forget the textbook definition for a second. Think of a VLAN (Virtual Local Area Network) as a way to create separate, virtual switches inside one physical switch Easy to understand, harder to ignore. Which is the point..

Imagine a large office building. But everyone on the finance team needs to talk to each other and their own servers, but they don’t need to see what the marketing team is doing. So instead of putting finance on the 3rd floor and marketing on the 4th (which is expensive and inflexible), you can use VLANs. And you can assign every finance employee’s desk port to VLAN 10, and every marketing desk port to VLAN 20. Even if their desks are mixed together on the same floor, they are logically separated. A finance computer can’t accidentally see a marketing computer’s traffic unless a router (or a Layer 3 switch) explicitly allows it Most people skip this — try not to..

What About Trunking?

Now, what if you have a switch in the finance department and another switch in the marketing department? How does a finance computer on Switch A talk to the finance server that happens to be connected to Switch B?

This is where trunking comes in. It’s like a highway for VLAN traffic. A trunk link is a special cable that carries traffic for multiple VLANs at once. Instead of having one cable for VLAN 10, another for VLAN 20, and so on, you have a single trunk that carries all of them, with a special "tag" on each packet of data saying which VLAN it belongs to Turns out it matters..

The official docs gloss over this. That's a mistake.

This tag is called an 802.When a finance packet travels from Switch A to Switch B over the trunk, it gets a dot1q tag with the number 10. Still, 1Q tag (we’ll call it dot1q for short). Switch B sees that tag and knows, "Ah, this is VLAN 10 traffic, so I’ll forward it only to the finance ports No workaround needed..

Why This Matters: The Real-World Benefits

Understanding VLANs and trunking isn't just for passing a certification exam. It solves real problems.

1. Security: This is the biggest one. By default, a computer can see every other computer on the same network. If someone in accounting clicks on a malicious link, it could potentially attack any system on the same broadcast domain. VLANs segment this, containing the blast radius. A breach in the guest Wi-Fi VLAN won’t automatically give an attacker access to your corporate server VLAN And it works..

2. Performance: Networks suffer from unnecessary traffic, like broadcasts (e.g., "Who has the IP address 192.168.1.10?"). In a flat network, every computer has to process these broadcasts. By placing different departments on different VLANs, you contain these broadcasts. The marketing team’s computers don’t have to waste CPU cycles processing accounting’s broadcast messages And that's really what it comes down to..

3. Management and Flexibility: Remember how easy it is to change a user’s network access in your head? "Move them from marketing to finance? Just plug them into a different port." With VLANs, you can do that physically or, even better, logically. You can change the VLAN assignment of a port with a single command, no matter where the user is. It makes your network incredibly agile Easy to understand, harder to ignore..

How to Configure VLANs and Trunking: A Lab Walkthrough

Let’s get our hands dirty. We’ll use a simple two-switch lab. The goal is to have PC1 (VLAN 10) talk to PC3 (VLAN 10), and PC2 (VLAN 20) talk to PC4 (VLAN 20), all over a single trunk link between the switches No workaround needed..

Here’s the topology:

[PC1] -- [Switch A] ==trunk== [Switch B] -- [PC3]
[PC2] -- [Switch A]                [Switch B] -- [PC4]

(The == represents the trunk link.)

Step 1: The Planning Phase

Before you touch any commands, plan. This is the most important step.

• VLAN ID and Name:

  • VLAN 10: Finance
  • VLAN 20: Marketing

• IP Addressing Scheme:

  • VLAN 10: 192.168.10.0/24
  • VLAN 20: 192.168.20.0/24

• Port Assignments:

  • Switch A: Port Fa0/1 (PC1) -> VLAN 10, Port Fa0/2 (PC2) -> VLAN 20, Port Gi0/1 (to Switch B) -> Trunk
  • Switch B: Port Gi0/1 (from Switch A) -> Trunk, Port Fa0/1 (PC3) -> VLAN 10, Port Fa0/2 (PC4) -> VLAN 20

Step 2: Creating the VLANs

On both switches, you need to create the VLANs in the VLAN database Took long enough..

On Switch A:

SwitchA> enable
SwitchA# configure terminal
SwitchA(config)# vlan 10
SwitchA(config-vlan)# name Finance
SwitchA(config-vlan)# exit
SwitchA(config)# vlan 20
SwitchA(config-vlan)# name Marketing
SwitchA(config-vlan)# exit

Do the exact same thing on Switch B Easy to understand, harder to ignore. That's the whole idea..

Step 3: Configuring Access Ports

Access ports are for end devices like computers. They belong to a single VLAN.

On Switch A:

SwitchA(config)# interface fastethernet 0/1
SwitchA(config-if)# switchport mode access
SwitchA(config-if)# switchport access vlan 10
SwitchA(config-if)# exit

SwitchA(config)# interface fastethernet 0/2
SwitchA(config-if)# switchport mode access
SwitchA(config-if)# switchport access vlan 20
SwitchA(config-if)# exit

On Switch B:

SwitchB(config)# interface fastethernet 0/1
SwitchB(config-if)# switchport mode access
SwitchB(config-if)# switchport access vlan 10
SwitchB(config-if)# exit

SwitchB(config)# interface fastethernet 0/2
SwitchB(config-if)# switchport mode access
SwitchB(config-if)# switchport access vlan 20

### Step 4: Configuring the Trunk Port

Now we wire the two switches together with a trunk. Trunk ports carry traffic for **all** VLANs that are allowed on that link. On both Switch A and Switch B we’ll set the Gigabit Ethernet port that connects to the other switch as a trunk and specify which VLANs are permitted.

**On Switch A (Gi0/1 to Switch B):**

SwitchA(config)# interface gigabitEthernet 0/1 SwitchA(config-if)# switchport trunk encapsulation dot1q ! (only on Catalyst 2960/3560) SwitchA(config-if)# switchport mode trunk SwitchA(config-if)# switchport trunk allowed vlan 10,20 SwitchA(config-if)# exit

**On Switch B (Gi0/1 from Switch A):**

SwitchB(config)# interface gigabitEthernet 0/1 SwitchB(config-if)# switchport trunk encapsulation dot1q SwitchB(config-if)# switchport mode trunk SwitchB(config-if)# switchport trunk allowed vlan 10,20 SwitchB(config-if)# exit

> **Tip:** If you’re using a newer Catalyst or Nexus switch, the `trunk encapsulation` command is optional because the device defaults to 802.Which means 1Q. On older hardware you must explicitly set it.

> **Tip:** By default, a trunk will allow *all* VLANs. Restricting the list (`allowed vlan`) reduces broadcast traffic and improves security.

### Step 5: Assigning Native VLANs (Optional Deloitte)

If you want to keep the default native VLAN (VLAN 1) on the trunk, you can leave it as is. On the flip side, it’s a common best practice to change the native VLAN to something other than 1 (e.Worth adding: g. , 99) to avoid accidental untagged traffic leaking into the default VLAN. 

SwitchA(config)# interface gigabitEthernet 0/1 SwitchA(config-if)# switchport trunk native vlan 99 SwitchA(config-if)# exit

Repeat the same on Switch B if you want symmetry. Remember to create VLAN 99 on both switches if you use it.

### Step 6: Verifying the VLAN Configuration

Once the switches are configured, verify that the VLANs exist and that the trunk is passing the correct VLANs.

SwitchA# show vlan brief SwitchA# show interfaces trunk SwitchA# show interfaces gigabitEthernet 0/1 switchport

On **Switch A**, you should see:

- VLAN 10 and VLAN 20 listed with their names.
- Port Fa0/1 in VLAN 10, Fa0/2 in VLAN 20.
- Gi0/1 in trunk mode, allowed VLANs 10 and 20, native VLAN 1 (or 99 if you changed it).

On **Switch B**, the same checks should confirm the counterpart configuration.

### Step 7: Configuring IP Addresses on End Devices

Now that the layer‑2 connectivity is in place, give each PC an IP address in its respective subnet.

| PC | VLAN | IP Address | Subnet Mask | Default Gateway |
|-----|------|------------|-------------|-----------------|
| PC1 | Finance (10) | 192.11 | 255.Worth adding: 11 | 255. 168.255.20.Plus, 255. 0 | 192.0 | 192.168.Worth adding: 10. Now, 10 | 255. 168.Consider this: 255. And 255. 20.That said, 168. So 255. Worth adding: 255. 168.10.10.255.0 | 192.On the flip side, 0 | 192. 1 |
| PC3 | Finance (10) | 192.1 |
| PC4 | Marketing (20) | 192.Now, 168. 10.255.168.So 168. On top of that, 1 |
| PC2 | Marketing (20) | 192. But 20. Still, 10 | 255. 20.

> **Note:** In this lab the PCs are purely layer‑2 devices. If you want to route between VLANs you’d need a Layer 3 device (router, Layer‑3 switch) with sub‑interfaces or SVIs for each VLAN, and you’d set the PCs’ default gateway to that device’s IP.

### Step 8: Testing Connectivity

With the IP addresses in place, open a command prompt (or terminal) on each PC and ping the peer on the same VLAN:

PC1> ping 192.168.10.11 ! Should succeed PC2> ping 192.168.20.11 ! Should succeed

If any ping fails, check:

1. **VLAN membership** – ensure each port is in the correct VLAN (`show vlan`).
2.