VLAN Configuration Commands Step by Step Explained

Switches do not understand broadcast messages. They forward them from all ports. VLAN is a switch feature. It allows you to create a group of devices that share broadcast messages.

The vlan command in global configuration mode creates a new VLAN and updates an existing VLAN. The switchport mode access vlan command in the interface configuration mode of the port assigns it to a VLAN.

Lab setup

Create a Packet Tracer lab as shown in the following image.

This lab has three switches and six PCs. Each switch has a connection to two PCs. All PCs have IP configurations. Three PCs have an IP configuration from the network 10.0.0.0/8, and the remaining three have an IP configuration from the network 20.0.0.0/8. It has a router to provide connectivity between VLANs.

Configuring VLANs on switches

Configure two VLANs: VLAN-10 and VLAN-20. Use VLAN-10 for the network 10.0.0.0/8 and VLAN-20 for the network 20.0.0.0/8. Keep one PC from each switch in a VLAN.

Access the first switch's CLI prompt. Enter global configuration mode and use the vlan command to create a new VLAN. This command needs a VLAN number as an argument. It checks the specified VLAN number for an existing VLAN before creating a new VLAN. If it finds an existing VLAN having the specified number, it does not create a new VLAN. It enters VLAN configuration mode for the existing VLAN. If it does not find an existing VLAN having the specified number, it creates a new VLAN and enters VLAN configuration mode for the new VLAN. VLAN configuration mode allows you to configure additional options, such as name and RSPAN. In a basic configuration, you do not need to configure these options. Use the exit command to exit VLAN configuration mode.

The following commands create VLAN-10.

Switch>enable
Switch#configure terminal
Switch(config)#vlan 10
Switch(config-vlan)#exit
Switch(config)#

The following commands create VLAN-20.

Switch(config)#vlan 20
Switch(config-vlan)#exit
Switch(config)#

Since all three switches have PCs in these VLANs, run the above commands on all switches.

After creating VLANs, assign them to the switch ports. The switchport mode access vlan command assigns a VLAN to the switch port. It accepts a VLAN number as an argument. It runs in the interface configuration mode of the port. It assigns the specified VLAN number to the port. The device connected to the port becomes a member of the specified port. The following commands make the device connected to port 1 a member of VLAN-10.

Switch(config)#interface fastethernet 0/1
Switch(config-if)#switchport access vlan 10
Switch(config-vlan)#exit

The following commands make the device connected to port 2 a member of VLAN-20.

Switch(config)#interface fastethernet 0/2
Switch(config-if)#switchport access  vlan 20
Switch(config-vlan)#exit
Switch(config)#

Run the above commands on all switches.

A switch port can work in two modes: access and trunk. In access mode, it works with a single VLAN. In trunk mode, it works with multiple VLANs. Access mode is the default mode on all switch ports. If you connect an end device to a switch port, you do not need to change the default mode. However, if you connect a switch port to another switch port, you must change the default mode to trunk mode on both ports.

Change the default mode to trunk mode on the ports you used to connect switches. Use the switchport mode trunk command to change the default mode. Run this command in the interface configuration mode of the port.

The following commands change the default mode to trunk mode on GigabitEthernet 0/1.

Switch(config)#interface gigabitEthernet 0/1
Switch(config-if)#switchport mode trunk
Switch(config-if)#exit

The following commands change the default mode to trunk mode on GigabitEthernet 0/2.

Switch(config)#interface gigabitEthernet 0/2
Switch(config-if)#switchport mode trunk
Switch(config-if)#exit
Switch(config)#

Run the above commands on all switches.

Testing and verifying VLANs

To test and verify VLAN configuration, check connectivity between PCs in the same VLAN. Click the PC icon, click Desktop, and click Command Prompt. Use the ping command to test connectivity.

PC0 is a member of VLAN-10. It has connectivity with PC2 and PC4. PC2 and PC4 are other members of VLAN-10.

Testing connectivity in the same vlan

Similarly, you can test connectivity between PC1, PC3, and PC5. These are members of VLAN-20.

PCs in the same VLAN have connectivity. It verifies VLAN configuration.

Connecting different VLANs

VLANs are logical subnets. PCs in different VLANs do not have connectivity. To provide connectivity between different VLANs, you must configure a router. The last tutorial in this tutorial series explains how to configure a router to provide connectivity between different VLANs.

Conclusion

VLANs are logical subnets. They allow you to create groups of devices that share broadcasts and traffic at Layer 2. They enhance network security. This tutorial explained the steps to configure and implement VLANs in a network.