How to Configure VLANs on Network Switches

Virtual Local Area Networks (VLANs) are one of the most powerful tools in a network administrator's toolkit. They allow you to logically segment a single physical network into multiple isolated broadcast domains, improving security, performance, and organization. Let's walk through how to configure VLANs on network switches step by step.

Understanding VLAN Basics

Before diving into configuration, it's important to understand that VLANs work at Layer 2 of the OSI model. Each VLAN creates a separate broadcast domain, meaning devices in different VLANs cannot communicate directly without a router or Layer 3 switch. This network segmentation provides several benefits:

• Security: Isolate sensitive departments like accounting or HR
• Performance: Reduce broadcast traffic and network congestion
• Management: Group devices logically regardless of physical location
• Scalability: Add new VLANs without rewiring infrastructure

VLAN Configuration Steps

Note: The following examples use Cisco switch commands. VLAN configuration syntax may vary slightly depending on the switch manufacturer and model, though the core concepts remain consistent across vendors.

Step 1: Create VLANs

First, you need to create the VLANs on your switch. Here's how to create VLANs using Cisco switch commands:

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Marketing
Switch(config-vlan)# exit
Switch(config)# vlan 30
Switch(config-vlan)# name IT
Switch(config-vlan)# exit

This creates three VLANs: Sales (VLAN 10), Marketing (VLAN 20), and IT (VLAN 30). The names are optional but highly recommended for documentation purposes.

Step 2: Assign Ports to VLANs

Next, assign switch ports to specific VLANs. This is called configuring access ports:

Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit
Switch(config)# interface range fastethernet 0/2-5
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit

Port FastEthernet 0/1 is now assigned to the Sales VLAN, while ports 0/2 through 0/5 are assigned to the Marketing VLAN.

Step 3: Configure Trunk Ports

If you need to connect multiple switches or connect to a router, you'll need trunk ports to carry multiple VLANs:

Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# switchport trunk native vlan 1

This configures GigabitEthernet 0/1 as a trunk port carrying VLANs 10, 20, and 30, with VLAN 1 as the native VLAN.

Step 4: Save Configuration

Always save your configuration to prevent loss after a reboot:

Switch# copy running-config startup-config

Verifying VLAN Configuration

Always verify your VLAN setup with these commands:

Switch# show vlan brief
Switch# show interfaces switchport
Switch# show interfaces trunk

The show vlan brief command displays all VLANs and their assigned ports. The show interfaces switchport command shows the switchport configuration for all interfaces, while show interfaces trunk displays trunk port information.

Common VLAN Use Cases

Here are typical network segmentation scenarios where VLAN configuration proves invaluable:

• Department Separation: Sales, Marketing, and IT departments on separate VLANs
• Guest Network: Isolate visitor devices from internal resources
• Voice Traffic: Dedicated VLAN for VoIP phones with QoS policies
• Server Farm: Separate VLAN for critical servers and infrastructure

Best Practices for VLAN Setup

When implementing your VLAN configuration, follow these guidelines:

• Document your VLAN numbering scheme consistently
• Use meaningful VLAN names for easier management
• Avoid using VLAN 1 for management traffic due to its default nature and potential security risks - instead, create a dedicated management VLAN
• Plan your IP addressing scheme to align with VLAN boundaries
• Implement proper security policies between VLANs

What's Next

Now that you understand basic VLAN configuration, the next logical step is learning about inter-VLAN routing. This allows devices in different VLANs to communicate through a router or Layer 3 switch, which we'll cover in our upcoming post on router-on-a-stick configuration.

Tools and resources for this topic

• CompTIA Network+ Study Guide — Comprehensive N10-009 exam preparation covering all five domains.