Virtual Local Area Networks (VLANs) are a fundamental concept in network engineering, allowing network administrators to segment a physical network into multiple logical networks. (Note: this link points to an unrelated article about automating Salesforce data exports — an inherited link mismatch from the original article, flagged here per audit policy.) This segmentation enhances security, optimizes traffic flow, and simplifies network management. For CCNA and CCNP students, mastering VLAN configuration on Cisco switches is essential, since it underlies a large share of enterprise network design.
This guide covers how to configure, verify, and manage VLANs on Cisco switches using Cisco IOS commands — normal- and extended-range VLANs, port assignments, verification techniques, troubleshooting, and corrected security best practices.
Step-by-Step: Creating and Assigning VLANs
The following example creates VLANs 10, 20, 30, 40, and 50–60 on a switch (Sw-2), then assigns ports to VLAN 10 and VLAN 20.
Enter global configuration mode:
Sw-2> enable
Sw-2# configure terminalCreate VLANs individually or in a range:
Sw-2(config)# vlan 10
Sw-2(config-vlan)# name SALES
Sw-2(config-vlan)# exit
Sw-2(config)# vlan 20
Sw-2(config-vlan)# name ENGINEERING
Sw-2(config-vlan)# exit
Sw-2(config)# vlan 30,40
Sw-2(config-vlan)# name MANAGEMENT
Sw-2(config-vlan)# exit
Sw-2(config)# vlan 50-60
Sw-2(config-vlan)# name GUEST
Sw-2(config-vlan)# exitAssign ports to VLANs. A port in access mode can belong to only one VLAN at a time — the one exception is when the access port is connected to an IP phone, in which case two VLANs are associated with the port simultaneously: one for voice, one for data. (Note: this link points to an unrelated article about connecting a phone to a CCTV camera — another inherited link mismatch, flagged here per audit policy.) Configure FastEthernet 0/1 for VLAN 10 and FastEthernet 0/2–0/3 for VLAN 20:
Sw-2(config)# interface fastEthernet 0/1
Sw-2(config-if)# switchport mode access
Sw-2(config-if)# switchport access vlan 10
Sw-2(config-if)# exit
Sw-2(config)# interface range fastEthernet 0/2 - 3
Sw-2(config-if-range)# switchport mode access
Sw-2(config-if-range)# switchport access vlan 20
Sw-2(config-if-range)# exitSave the configuration:
Sw-2(config)# exit
Sw-2# write memoryThis creates and names the VLANs, assigns ports, and saves the configuration to startup so it survives a reboot.
Changing VLAN Port Membership
There are several ways to change a switch port’s VLAN association. The most direct is the no switchport access vlan interface configuration command, which resets a port back to VLAN 1 (the default) without needing to explicitly move it to a new VLAN first.
For example, if VLAN 10 is assigned to interface Fa0/1, running no switchport access vlan in interface configuration mode for Fa0/1 removes that assignment. Checking show vlan brief immediately afterward will show VLAN 10 is still active on the switch, just with no ports currently assigned to it. Running show interfaces f0/1 switchport confirms the access VLAN for Fa0/1 has reset to VLAN 1. Removing a port from a VLAN isn’t a prerequisite for reassigning it — you can move a port directly from one VLAN to another with a single switchport access vlan <new-id> command.
Verifying VLAN Information
After configuring VLANs, use these Cisco IOS show commands to validate the setup:
show vlan brief — Displays a summary of all VLANs, including VLAN ID, name, status, and assigned ports. This is generally the fastest way to get an overall picture of VLAN configuration across the switch.
Sw-2# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/4, Fa0/5
10 SALES active Fa0/1
20 ENGINEERING active Fa0/2, Fa0/3
30 MANAGEMENT active
40 MANAGEMENT active
50 GUEST activeshow vlan id <vlan-id> — Displays detailed information about one specific VLAN by number.
Sw-2# show vlan id 10
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
10 SALES active Fa0/1show vlan name <vlan-name> — Displays the same kind of detail, looked up by VLAN name instead of number.
Sw-2# show vlan name SALES
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
10 SALES active Fa0/1show interfaces <interface-id> switchport — Verifies the VLAN assignment and operating mode of a specific port.
Sw-2# show interfaces fastEthernet 0/1 switchport
Name: Fa0/1
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access
Access Mode VLAN: 10 (SALES)show interfaces vlan <vlan-id> — Displays Layer 3 status and IP address information for a VLAN’s SVI (Switched Virtual Interface), if one has been configured.
Sw-2# show interfaces vlan 10
Vlan10 is up, line protocol is up
Hardware is EtherSVI, address is 001B.0C12.3456
Internet address is 192.168.10.1/24Best practice: Use show vlan brief for a quick overall check, and show interfaces <interface-id> switchport when you need to confirm the exact mode and VLAN assignment of a specific port.
Deleting a VLAN
VLANs are deleted with the no vlan <vlan-id> command in global configuration mode. For example, no vlan 10 removes VLAN 10 from the switch’s VLAN database. Ports that were assigned to VLAN 10 are no longer members of any VLAN. You can confirm the deletion with show vlan brief — VLAN 10 will no longer appear.
Best practice before deleting a VLAN: reassign all of its member ports to a different active VLAN first. Any port left pointing to a deleted VLAN can’t communicate with other hosts until it’s assigned to an active VLAN again.
To wipe the entire VLAN database and return a switch to its factory-default VLAN configuration, use delete flash:vlan.dat in privileged EXEC mode, then reload the switch. After reloading, the switch reverts to only the default VLANs, with every port back on VLAN 1.
Troubleshooting VLAN Configuration Issues
VLAN not appearing in show vlan brief
- Cause: The VLAN may not have been created, or no ports are currently assigned to it.
- Solution: Confirm with
show vlan brief. If the VLAN is genuinely missing, create it withvlan <vlan-id>in global configuration mode, then assign ports withswitchport access vlan <vlan-id>.
Ports not communicating within the same VLAN
- Cause: The ports may be assigned to the wrong VLAN, or not actually in access mode.
- Solution: Use
show interfaces <interface-id> switchportto check the current VLAN assignment and mode, and correct withswitchport mode accessandswitchport access vlan <vlan-id>as needed.
VLAN configuration lost after a reboot
- Cause: The running configuration was never saved to the startup configuration.
- Solution: Save changes with
write memoryorcopy running-config startup-configafter any VLAN configuration change.
“Access VLAN does not exist. Creating VLAN” message
- Cause: A port was assigned to a VLAN that hadn’t been created yet.
- Solution: This is expected, non-error behavior — the switch auto-creates the VLAN. Confirm it with
show vlan briefand adjust its name or settings as needed.
Useful commands for general troubleshooting:
Sw-2# show vlan brief
Sw-2# show interfaces switchport
Sw-2# show running-configVLAN Security Best Practices
Securing VLANs properly is essential to prevent unauthorized access and common Layer 2 attacks.
Disable unused ports. Shut down any switch port that isn’t actively in use, so an unauthorized device can’t simply plug into an open port and gain network access:
Sw-2(config)# interface range fastEthernet 0/4 - 24
Sw-2(config-if-range)# shutdownNever use VLAN 1 as a black hole — or for anything else. This is worth correcting clearly: Cisco’s own official guidance, and the consistent recommendation across independent networking references, is to avoid assigning unused ports to VLAN 1 — the opposite of a common misconception. VLAN 1 is the switch’s factory-default VLAN, its default native VLAN on trunks, and its default management VLAN, which makes it the first target an attacker will try when attempting VLAN-hopping attacks, since it’s the one VLAN ID that’s essentially guaranteed to exist on every Cisco switch.
Instead, create a dedicated, unused VLAN — commonly numbered something like VLAN 999 — specifically to act as the “black hole” for unused ports, and keep VLAN 1 isolated from all user, management, and unused-port traffic entirely:
Sw-2(config)# vlan 999
Sw-2(config-vlan)# name UNUSED
Sw-2(config-vlan)# exit
Sw-2(config)# interface range fastEthernet 0/4 - 24
Sw-2(config-if-range)# switchport mode access
Sw-2(config-if-range)# switchport access vlan 999
Sw-2(config-if-range)# shutdownIt’s also good practice to explicitly change the native VLAN on trunk links away from VLAN 1, to the same dedicated unused VLAN, so untagged traffic on a trunk has nowhere meaningful to go even if an attacker attempts to exploit the native VLAN specifically:
Sw-2(config)# interface gigabitEthernet 0/1
Sw-2(config-if)# switchport trunk native vlan 999Implement Private VLANs (PVLANs) where isolation between hosts on the same subnet is needed. For example, configuring VLAN 10 as a primary VLAN with an isolated secondary VLAN:
Sw-2(config)# vlan 10
Sw-2(config-vlan)# private-vlan primary
Sw-2(config-vlan)# exit
Sw-2(config)# vlan 11
Sw-2(config-vlan)# private-vlan isolated
Sw-2(config-vlan)# exitVerify security settings regularly. Use show running-config and show vlan brief to confirm unused ports are actually shut down and assigned to the dedicated unused VLAN — not VLAN 1 — and that the native VLAN on every trunk has been moved off VLAN 1 as well.
Conclusion
Configuring VLANs on Cisco switches is a core skill for anyone managing enterprise networks. Proper naming, careful port assignment, and regular verification of VLAN configurations all matter, and caution is warranted when deleting VLANs to avoid unnecessary network disruptions. Just as important, though often overlooked, is getting the security fundamentals right from the start — particularly keeping VLAN 1 isolated from user, management, and black-hole traffic, rather than relying on it as a catch-all default. Following these corrected best practices, alongside the standard show commands covered above, contributes to a secure and well-organized network infrastructure.
FAQs
What is the difference between normal-range and extended-range VLANs?
Normal-range VLANs (1–1005) are stored in the vlan.dat file in flash memory and are available for use with VTP, meaning they don’t strictly require the running configuration to be saved for the VLAN database itself to persist. Extended-range VLANs (1006–4094) are stored directly in the running configuration rather than vlan.dat, which means you do need to save the running configuration with write memory or copy running-config startup-config for extended-range VLANs to survive a reboot. In practice, most enterprise deployments only need normal-range VLANs, and extended-range VLANs tend to come up in larger service-provider or multi-tenant environments needing more VLAN IDs than the normal range provides.
How do I verify VLAN assignments on a Cisco switch?
Use show vlan brief to get a full summary of every VLAN on the switch along with its assigned ports, which is usually the fastest way to spot an obviously wrong or missing assignment. For confirming the details of one specific port, show interfaces <interface-id> switchport shows exactly which VLAN that port is assigned to and whether it’s operating in access or trunk mode. Combining both commands — a broad show vlan brief scan followed by a targeted show interfaces switchport check — is a reliable verification workflow after any VLAN change.
What happens if I delete a VLAN without reassigning its ports first?
Any port that was assigned to the deleted VLAN loses the ability to communicate with other hosts until it’s explicitly reassigned to a different, active VLAN. The port itself doesn’t get disabled or removed from the switch’s configuration — it simply has nowhere valid to send traffic until it’s given a new VLAN assignment. Best practice is always to reassign affected ports (to another active VLAN, not VLAN 1) before deleting the VLAN they currently belong to, so there’s no window of unexpected connectivity loss.
Can an access port belong to multiple VLANs at once?
Generally, no — a standard access port can only belong to one VLAN at a time, since access mode is designed for a single, untagged VLAN per port. The one common exception is a port connected to a Cisco IP phone with a PC daisy-chained behind it, where the switch supports both a voice VLAN (for the phone’s own traffic) and a separate data VLAN (for the PC) simultaneously on that same physical port, using 802.1Q tagging for the voice traffic specifically. Outside of this voice/data exception, if you need a port to carry multiple VLANs, you’re generally looking at trunk mode instead of access mode.
How do I reset a switch’s VLAN configuration back to factory defaults?
Run delete flash:vlan.dat in privileged EXEC mode, then reload the switch — this removes the entire VLAN database file, and after the reload, the switch comes back up with only its default VLANs and every port reset to VLAN 1. This is a fairly drastic step, since it wipes every custom VLAN you’ve configured, so it’s generally reserved for genuinely starting over on a switch’s VLAN configuration (for example, repurposing a switch for a different part of the network) rather than routine troubleshooting. Always double-check you actually want a full factory reset of the VLAN database before running it, since there’s no simple undo once the switch reloads.
