Ethernet Switching and VLANs
Configure and troubleshoot switched networks including MAC learning, VLANs, trunking, and loop prevention.
- Certification
- CompTIA Network+
- Recommended study time
- 5h 35m
- Status
- Not started
Recommended study time
About 5h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 8 sittings.
- Read the lesson22 min
About 2,851 words at a careful technical reading pace.
- Second pass with notes13 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice2h 40m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 20m
4 short review sessions spread over the following weeks.
Learning objectives
- Explain MAC learning, forwarding, flooding, and broadcast domains.
- Design VLAN segmentation with access and trunk ports.
- Diagnose loops, mismatches, and port-level errors with switch evidence.
Start here
About 8 minutes of reading, in 10 short parts.
Switches are the devices that make a local office network work, quietly learning where every device sits and forwarding traffic only where it needs to go. VLANs let one physical switch behave like several separate networks. Most 'random' local outages, from isolated departments to site-wide slowdowns, trace back to switching and VLAN configuration.
Where you meet it: A technician moves a desk to a new office and the user suddenly cannot reach a shared drive, because the new wall port belongs to the wrong VLAN.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
Think of a switch as a very efficient receptionist in an office building. When mail arrives addressed to a specific person, the receptionist remembers which room that person sits in and delivers it directly, rather than shouting the message down every corridor. Over time the receptionist learns where everyone sits by watching who sends mail from which room.
A VLAN is like dividing one office building into several separate companies that share the same walls and corridors but must never see each other's mail. Even though the wiring and switch are physically shared, VLANs keep traffic from one department completely separate from another, as if they were on different buildings entirely.
Key ideas
If you remember nothing else from this topic, remember these.
- A switch builds a MAC address table dynamically by recording the source MAC and incoming port of every frame it sees.
- VLANs divide a single physical switch into multiple logical broadcast domains that cannot communicate without a routing device.
- Access ports carry a single untagged VLAN for end devices, while trunk ports carry multiple VLANs tagged with 802.1Q identifiers between switches or to routers.
- The native VLAN on a trunk is the one VLAN sent untagged, and it must match on both ends of the link or traffic will bleed between VLANs.
- Spanning Tree Protocol prevents switching loops by electing a root bridge and placing redundant links into a blocking state.
- Inter-VLAN routing requires a router or layer 3 switch, because switches alone cannot move traffic between different broadcast domains.
- Port security restricts which MAC addresses may use a port and can shut the port down (error-disable) on a violation.
Standing up an isolated VLAN for a new department
A worked example, step by step.
A newly formed compliance team of 12 staff needs a network segment isolated from the rest of the building, sharing the existing switching infrastructure.
- 01Plan the addressingReserve VLAN 40 and subnet 10.40.0.0/24 for the compliance team.
- 02Create the VLANOn the core switch, create VLAN 40 named Compliance using the switch's VLAN database configuration.
- 03Assign access portsConfigure the 12 wall ports used by compliance staff as access ports in VLAN 40.
- 04Configure the uplink trunkSet the link between the access switch and the core switch as a trunk carrying VLAN 40 alongside the existing VLANs, and confirm the allowed VLAN list explicitly includes 40.
- 05Match the native VLANVerify both ends of the trunk use the same native VLAN, typically VLAN 1, so untagged traffic is not misclassified.
- 06Add the routed gatewayOn the router, create subinterface GigabitEthernet0/1.40 with encapsulation dot1Q 40 and IP address 10.40.0.1/24 to serve as the default gateway.
- 07Verify VLAN membershipRun show vlan brief on the access switch and confirm all 12 ports appear under VLAN 40.
- 08Test end-to-endConfirm a compliance workstation receives an address in 10.40.0.0/24 via DHCP, can ping 10.40.0.1, and cannot reach a workstation on a different VLAN without going through the router's access control list.
Outcome: The compliance team is fully isolated at layer 2 while still sharing physical switches, and any cross-VLAN access is explicitly controlled at the router.
Switching and VLAN terminology
Worth keeping at hand while you work.
- MAC address table
- Maps learned MAC addresses to switch ports
- Broadcast domain
- The set of ports that receive each other's broadcast frames, bounded by VLAN
- Access port
- Carries one untagged VLAN, used for end devices
- Trunk port
- Carries multiple VLANs tagged with 802.1Q
- Native VLAN
- The single VLAN sent untagged on a trunk, must match both ends
- 802.1Q
- The IEEE standard for VLAN tagging on Ethernet frames
- Spanning Tree Protocol (STP)
- Prevents loops by blocking redundant links
- Root bridge
- The switch elected as the reference point for the STP topology
- Port security
- Limits or locks which MAC addresses may use a port
- Error-disable state
- A port automatically shut down after a security or STP violation
- Inter-VLAN routing
- Router or layer 3 switch function allowing traffic to cross VLAN boundaries
- Voice VLAN
- A separate tagged VLAN for VoIP phones sharing a port with a data VLAN
Common misunderstandings
What most beginners get wrong here.
Two VLANs on the same switch can talk to each other automatically.
VLANs are separate broadcast domains and require a router or layer 3 switch to communicate; a switch alone cannot bridge them.
A trunk port belongs to one VLAN like an access port does.
A trunk port carries multiple VLANs simultaneously, distinguished by 802.1Q tags, rather than being assigned to a single VLAN.
Mismatched native VLANs on a trunk cause an immediate hard failure.
A native VLAN mismatch often causes a quiet security and traffic-leak problem rather than an obvious outage, which is why it is hard to detect.
Spanning Tree Protocol is optional and only matters in large data centres.
STP matters anywhere redundant links exist between switches, including small offices, because a physical loop causes a broadcast storm within seconds.
Port security only blocks unauthorized devices silently.
Depending on the configured violation action, port security can shut the port down entirely (error-disable), requiring manual or timed recovery.
Exam traps
How the question writers try to catch you out.
- Network+ often gives a scenario where a desk move breaks connectivity and expects you to identify a VLAN assignment mismatch, not a cabling fault.
- Expect questions distinguishing an access port from a trunk port purely by description, without using those exact words.
- Trick questions describe symptoms of a broadcast storm (high CPU, flapping MAC entries) and expect you to name STP as the missing or misconfigured protection.
- Native VLAN mismatch questions are commonly phrased around unexpected VLAN traffic bleeding rather than a total outage.
- Questions may ask what device is required for inter-VLAN communication, expecting router or layer 3 switch, not another layer 2 switch.
Check yourself
Answer in your head first, then reveal. This is not scored.
What does a switch use to decide which port to forward a frame to?
What is the difference between an access port and a trunk port?
What problem does Spanning Tree Protocol solve?
What is required for two devices on different VLANs to communicate?
Why must the native VLAN match on both ends of a trunk?
What typically happens when a port security violation occurs with the shutdown action configured?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
A switch builds a MAC address table by learning source addresses on each port, then forwards frames to the known port or floods to the VLAN when unknown. VLANs partition one physical switch into separate broadcast domains. Access ports carry a single untagged VLAN; trunk ports carry multiple VLANs with 802.1Q tags. Spanning Tree Protocol blocks redundant paths to prevent loops.
Why It Matters
VLAN and trunk errors silently isolate departments. A single loop can saturate an entire site in seconds. Interface counters and MAC tables provide fast, factual answers where guesswork would take hours.
How It Works
- Frames are forwarded to the port that learned the destination MAC, or flooded within the VLAN when unknown.
- Trunk ports add and remove 802.1Q tags so multiple VLANs share one link.
- STP elects a root bridge and blocks redundant ports to keep the topology loop-free.
Where You See It
- Office wiring closets, data centre access layers, VoIP deployments, and guest network segmentation.
Key Terms
- MAC table
- The switch's learned map of addresses to ports.
- Broadcast domain
- The set of devices that receive one another's broadcasts.
- 802.1Q
- The VLAN tagging standard used on trunk links.
- Native VLAN
- The untagged VLAN on a trunk port.
- STP
- Spanning Tree Protocol, which blocks redundant links to avoid loops.
Examples
- Moving a port from VLAN 20 to VLAN 30 changes the device's subnet and gateway entirely.
- A mismatched native VLAN on a trunk can merge two networks that were meant to stay separate.
Common Problems
- Wrong access VLAN
- Missing VLAN on a trunk
- Duplex or speed mismatch
- Switching loop
- Port security violation
How It Fails
- A VLAN missing from a trunk isolates that VLAN's users on one switch.
- A loop floods broadcasts until CPU and links saturate and the site stops working.
- Port security can shut a port when a user attaches a hub or second device.
How to Troubleshoot
- Check port status, VLAN assignment, speed, duplex, and error counters.
- Verify the trunk's allowed VLAN list and native VLAN on both ends.
- Look for MAC flapping and broadcast storms when many users fail simultaneously.
Practical Knowledge
- Label ports and document VLAN purpose; undocumented switching is unmaintainable.
- Enable loop protection on user-facing ports to survive accidental patching.
Exam Coverage
- Switching operation and MAC tables
- VLANs, trunking, and 802.1Q
- Spanning tree and port errors
Interview Questions
- What happens if the native VLAN differs on each end of a trunk?
- How would you detect a switching loop quickly?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01Read a switch MAC address table and locate one known device.
- 02Sketch a two-VLAN design with a trunk to a router.