breakfixlearn.com

NET-06Networking

VLANs & 802.1Q trunking

Use this when: you split a switch into separate networks, carry them between switches on a trunk, or route between them.

CCNA 200-301 topics 2.1 and 2.2/v1.0//1 page/CC BY-NC 4.0
NET-06 VLANs & 802.1Q trunking cheat sheet. Every table on it is repeated as text below.
Tap the sheet for the full-size image. The text version below is screen-reader friendly.

Text version

Everything on the sheet, as plain HTML: handy for screen readers, copy-paste and search.

The 802.1Q tag

A trunk adds a 4-byte tag between the source MAC and the Type field of each Ethernet frame.

FieldSizePurpose
TPID16 bits0x8100 marks the frame as tagged
PCP3 bitsPriority (QoS)
DEI1 bitDrop eligible
VLAN ID12 bits1 to 4094

An access port carries one VLAN with no tag. A trunk carries many VLANs, each tagged. The native VLAN is the one sent untagged (VLAN 1 by default).

VLAN numbers

RangeMeaning
1Default; can't be deleted. Don't use it for users.
2 to 1001Normal range, your VLANs
1002 to 1005Reserved (Token Ring, FDDI)
1006 to 4094Extended range

Does a trunk form? (DTP)

Switch ports default to dynamic auto.

One sideautodesirabletrunkaccess
autoNoYesYesNo
desirableYesYesYesNo
trunkYesYesYesMismatch

Configure

Access port:

  • vlan 10, then name SALES
  • interface g0/1, then switchport mode access and switchport access vlan 10
  • switchport voice vlan 150 for an IP phone

Trunk port:

  • interface g0/24, then switchport mode trunk
  • switchport nonegotiate (no DTP)
  • switchport trunk native vlan 999
  • switchport trunk allowed vlan 10,20,150, and later switchport trunk allowed vlan add 30

Route between VLANs

Router on a stick: interface g0/0.10, encapsulation dot1q 10, ip address 192.0.2.1 255.255.255.192.

Layer 3 switch (SVI): ip routing, interface vlan 10, ip address 192.0.2.1 255.255.255.192, no shutdown.

CommandShows
show vlan briefVLANs and access ports
show interfaces trunkTrunks, native VLAN, allowed VLANs
show interfaces g0/1 switchportMode of one port

Stop VLAN hopping

Danger. Ports left in dynamic mode let an attacker negotiate a trunk. Set access, or trunk plus nonegotiate.

Caution. Use an unused native VLAN (999) and the same one on both ends.

Caution. switchport trunk allowed vlan 30 replaces the whole list. Use add.

Trunk down? Check

  • Native VLAN: the same on both ends? CDP logs a mismatch.
  • Allowed list: is the VLAN allowed on both trunks?
  • VLAN exists: was it created on the far switch too?

Remember

  • One VLAN = one subnet
  • auto + auto = no trunk
  • Shut unused ports and park them in an unused VLAN

Sources

Go deeper on the blog