3 Ethernet Switching and VLANs
Learn how Ethernet switches forward frames, how VLANs and trunks organize Layer 2 networks, and how to configure, manage, protect, and troubleshoot a switch.
Frame forwarding and VLANs
An Ethernet switch learns from each frame’s source , building a forwarding table that associates MAC addresses with VLANs and ports. It forwards a known unicast frame toward its destination port. When the destination is unknown, the switch floods the frame within that ; broadcast frames are also confined to their .
A is a logical Layer 2 network. For example, 10 might serve office users and 20 might serve guests. Devices in different VLANs do not communicate directly at Layer 2; communication between them requires a router or a Layer 3 switch. VLANs can support segmentation, but they do not replace access controls or firewall policy. IEEE 802.1Q defines -aware bridging and tagging.
Access ports and trunks
An carries one data and normally sends and receives untagged frames. Use access mode on end-device ports so those devices do not negotiate a trunk.
A carries multiple VLANs between network devices, identifying most frames with an IEEE 802.1Q tag. Traffic for the is typically untagged. Trunk endpoints must agree on the and allowed VLANs; allow only the VLANs required on each trunk rather than relying on a broad default.
The following Cisco IOS XE-style example creates user, guest, management, and unused native VLANs, assigns two end-device ports to 10, and configures an uplink trunk. Plan IDs and subnets first, and ensure each needed on the uplink exists on both switches. Configure matching trunk settings at both ends.
Preventing Layer 2 loops
Redundant switch links improve resilience, but multiple active Layer 2 paths can create loops. A loop can cause broadcast storms and unstable MAC learning.
exchanges Bridge Protocol Data Units (BPDUs), elects a , and places redundant paths into a non-forwarding state. If an active path fails, STP can activate an alternate path. Rapid STP variants generally converge faster than classic STP; supported modes depend on the switch and network design.
Choose a stable distribution or core switch as the intended root for each relevant . Do not make an access switch the root by accident. In a Cisco IOS XE-style network using Rapid PVST+, a distribution switch could use:
Enable only on ports connected to end devices. It allows an edge port to reach forwarding promptly and is not appropriate for ordinary switch-to-switch links. shuts an edge port if it receives a BPDU, helping protect the spanning-tree topology from an unexpectedly connected bridge or switch.
Management and secure access
For in-band management, assign the switch an IP address on a management using a . The SVI provides IP connectivity to the switch, but it does not by itself route traffic between VLANs. A Layer 2 switch typically needs a default gateway to reply to management devices on other subnets.
The management must be carried to the switch over its connected access or trunk path, and its SVI must be operational for remote access. Keep management access limited to authorized systems and use SSH rather than Telnet for remote command-line administration. Follow the organization’s approved authentication, key, and management-access policies; exact SSH setup syntax can differ by release.
This example configures a Layer 2 switch for management on 99:
An SVI can also serve as a routed gateway when the switch supports Layer 3 routing and is configured for it. That routing function is separate from using the SVI for switch management.
Verification and troubleshooting
After configuration, check both the switch configuration and the link’s operational state. These IOS XE-style commands can help verify VLANs, port settings, trunks, learned MAC addresses, spanning tree, interface status, and the running configuration:
If a device cannot connect, check link status, port mode, assigned , and whether that exists. For trunk problems, compare allowed VLANs and settings at both ends. For management-access problems, verify the management SVI address and status, reachability, default gateway, and SSH configuration.
Save a verified configuration using the method supported by the platform. For example, many Cisco IOS XE switches use copy running-config startup-config. Command syntax and defaults vary by vendor, model, and software release, so check the documentation for the switch being configured.