1 VLANs and Access Ports
Learn how VLANs separate switched network traffic, how to configure endpoint-facing access ports, and how to verify connectivity within and between VLANs.
How VLANs separate traffic
A divides a switched network into separate Layer 2 broadcast domains. Devices in different VLANs are logically separated even if they connect to the same physical switch. VLANs can organize and separate traffic, but they should not be treated as a substitute for security controls.
An carries traffic for one VLAN and is typically used for an end device, such as a computer or printer. VLAN membership by itself does not allow devices in different VLANs to communicate. Without routing, devices in different VLANs cannot communicate directly at Layer 2.
Create VLANs and assign access ports
In the example, ports GigabitEthernet1/0/1-2 connect staff computers and belong to VLAN 10; ports GigabitEthernet1/0/3-4 connect guest computers and belong to VLAN 20. The VLANs are created and named before the endpoint-facing ports are configured as static access ports.
switchport mode access sets the port to access mode. switchport access vlan assigns the port to the specified VLAN. Check interface names and supported command syntax for the switch model.
Verify VLAN membership and connectivity
Use these commands to check that the VLANs exist and that ports have the intended membership:
In show vlan brief, confirm that VLANs 10 and 20 appear and that their access ports are listed under the correct VLAN. In the interface output, check that the port is in access mode and its access VLAN is correct.
Test connectivity with endpoints whose IP addresses and subnet masks are configured appropriately. Two active endpoints in VLAN 10 and the same IP subnet should generally be able to communicate, assuming their host firewalls and other network settings allow it. An endpoint in VLAN 10 cannot communicate directly at Layer 2 with one in VLAN 20. Communication between them requires and appropriate IP addressing and gateway configuration.
Troubleshoot and save the configuration
If a connectivity test fails, check that the switch port is up, the endpoint is connected to the expected port, VLAN membership is correct, and the endpoints’ IP settings are valid.
After confirming the configuration, save it if required by the switch workflow: