2 Switching, VLANs, and Wireless Networks

Learn how switches forward traffic, how VLANs and Layer 3 devices organize LAN communication, and how spanning tree, EtherChannel, and wireless settings support reliable connectivity.

How switches forward frames

A forwards Ethernet frames based on MAC addresses. When a frame arrives, the switch learns the source MAC address and ingress port, then records their association in its MAC address table, also called the CAM table. Dynamically learned entries age out after a period without traffic.

The switch looks up the destination MAC address to decide where to send the frame:

If the destination is known, the switch forwards the frame only out the associated port, unless that port is the ingress port.
If the destination is unknown, the switch floods the frame out eligible ports in the same VLAN, except the ingress port.
Broadcast frames are flooded within the VLAN.

A does not route traffic between IP subnets by default. Hosts in different VLANs need a Layer 3 device to communicate.

VLANs and access ports

A logically groups switch ports into separate Layer 2 networks, even when connected devices are on different switches. VLANs help contain broadcasts and organize users or devices by function. They do not, by themselves, provide a complete security boundary; routing and access controls must be designed appropriately.

An normally carries traffic for one VLAN. Frames sent to and from an end device are untagged, and the switch associates incoming frames with the port’s configured access VLAN. VLAN 1 is the common default VLAN on Cisco switches, but production networks often assign explicit VLANs to user ports.

A voice-capable port can carry a data VLAN for a computer and a voice VLAN for a connected IP phone. Exact behavior and commands depend on the platform and phone configuration.

Example configuration creates VLANs for users and voice, then assigns an to VLAN 10:

Use show vlan brief to check VLAN membership and port state. A port assigned to a VLAN that has not been created may not forward as intended, so create and verify the VLAN as well as the port assignment.

Trunks and 802.1Q

A carries traffic for multiple VLANs over one link, commonly between switches or between a switch and a router or wireless controller. IEEE 802.1Q identifies a frame’s VLAN by adding a tag to frames on the . The is used for untagged traffic on an 802.1Q ; its setting should match at both ends. A native-VLAN mismatch can cause traffic and spanning-tree problems.

Example configuration:

Both ends must agree on operation, , and the VLANs carried. Restricting the allowed VLAN list to what the link needs can reduce unnecessary VLAN propagation. Verify settings with show interfaces and show interfaces gigabitEthernet 0/24 switchport.

Routing between VLANs

Hosts in different VLANs are in different IP subnets and require Layer 3 routing to communicate. Each host uses the IP address of its VLAN’s router interface as its default gateway. Two common designs provide those gateways.

Router-on-a-stick: A router connects to the switch through one . Router subinterfaces provide gateways for multiple VLANs.
Layer 3 switch: Switch virtual interfaces (SVIs) provide VLAN gateways, and the switch routes between them when Layer 3 routing is enabled.

Example router-on-a-stick subinterfaces:

The switch port connected to the router must be an 802.1Q , and hosts must have the correct subnet, mask, and gateway. On a multilayer switch, an SVI such as interface vlan 10 can serve as the gateway. The VLAN and SVI must be operational, and IP routing must be enabled when the switch is to route between VLANs.

Preventing Layer 2 loops

Redundant Layer 2 links improve resilience but can create loops. A loop can cause broadcast storms, duplicate frames, and unstable MAC learning. prevents these loops by logically placing redundant paths in a nonforwarding state while preserving a backup path. If the active path fails, STP can activate an alternate path. Cisco Rapid PVST+ runs a rapid spanning-tree instance per VLAN.

STP elects a root bridge: the switch with the lowest bridge ID. Configured priority is considered first, and MAC address breaks a tie. Each non-root switch selects one root port, its best path toward the root. Each network segment has a designated port that forwards toward that segment; other redundant paths are placed in a nonforwarding role or state.

Important STP safeguards and port behavior include:

PortFast lets a host-facing edge port transition rapidly to forwarding. Use it only on ports intended for end devices, not ordinary switch-to-switch links.
BPDU Guard disables a PortFast-enabled port if it receives a BPDU, helping protect the spanning-tree topology from an unexpected switch connection.
Root Guard prevents a port from accepting a superior BPDU that would make an unexpected device the root.
Loop Guard helps prevent a port from incorrectly transitioning to forwarding when expected BPDUs stop arriving.

PortFast is recommended with BPDU Guard on appropriate host-facing ports, and PortFast should not be used on links to switches or hubs. Useful checks include show spanning-tree, show spanning-tree vlan 10, and show spanning-tree summary. When troubleshooting, confirm the root bridge and port roles, then check for unintended blocked ports, VLAN inconsistencies, or unexpected BPDUs.

Bundling links with

bundles multiple physical links into one logical link, increasing aggregate capacity and providing link redundancy. STP treats a correctly formed bundle as one logical port rather than blocking individual links within it. Traffic is distributed across member links using a hash of packet attributes, so a single conversation may use only one member link and does not necessarily receive the bundle’s total bandwidth.

negotiates an using IEEE 802.1AX, formerly 802.3ad. The active mode initiates negotiation, while passive responds; at least one side must be active. Member interfaces should have compatible speed, duplex, switchport mode, access or settings, and allowed VLANs.

Example configuration on both switches, with matching settings on member interfaces:

Verify the bundle with show summary and inspect the logical interface with show interfaces port-channel 1. If ports fail to bundle, check modes and ensure member-link settings match.

Wireless LAN components

A wireless LAN (WLAN) uses radio-frequency (RF) signals to connect clients to a wired network. An provides wireless connectivity. The is the WLAN name clients select; the WLAN configuration associates that name with settings such as security and, in many deployments, a VLAN. A basic service set (BSS) is an AP and its associated clients. An extended service set (ESS) uses multiple APs to provide a broader WLAN with a common network identity.

In controller-based designs, APs are managed by a . APs connect to the wired network, and depending on the design, their switch ports may be access or ports. The WLC centralizes WLAN configuration and management. Common controller settings include WLAN creation, security settings, QoS profiles, and other GUI settings.

Wireless performance and connectivity

Wireless clients share radio airtime, so performance depends on signal strength, interference, channel use, channel width, and the number and behavior of clients. Walls and other obstacles can weaken signals. Overlapping transmissions and non-Wi-Fi devices can interfere. In the United States, channels 1, 6, and 11 are the commonly used nonoverlapping channels in the 2.4-GHz band. Bluetooth equipment and microwave ovens also use that band. Channel availability and rules vary by regulatory domain and wireless equipment.

For client connectivity, check that the client selects the correct SSID and uses compatible security credentials and settings. Then verify the AP’s radio and WLAN configuration, the AP-to-switch connection, VLAN assignment, DHCP service, and gateway reachability. A client may associate successfully with an AP yet still fail to reach network services if its VLAN or IP configuration is wrong.