Cisco Catalyst Switch: Complete VLAN and Trunking Setup

Introduction

Cisco Catalyst switches are the most widely deployed enterprise switching platform. VLAN configuration on Catalyst switches is a fundamental skill — getting it wrong causes network outages, security violations (traffic leaking between VLANs), and performance issues. This guide covers VLAN setup, inter-VLAN routing, trunking, and VTP management in production Catalyst deployments.

VLAN Fundamentals

TEXT

VLANs separate a physical switch into multiple logical networks:

Physical: One switch, 24 ports
Logical:
  VLAN 10: Users    (ports 1-12)
  VLAN 20: Servers  (ports 13-18)
  VLAN 30: Printers (ports 19-22)
  VLAN 99: Native   (trunk)

Benefits:
- Security: VLANs can't communicate by default
- Performance: Broadcast domains are smaller
- Management: Logical grouping regardless of physical location

Creating and Managing VLANs

TEXT

! Create VLANs in global configuration
vlan 10
  name USERS
vlan 20
  name SERVERS
vlan 30
  name PRINTERS
vlan 99
  name NATIVE

! Verify
show vlan brief
! Output:
! VLAN Name              Status    Ports
! ---- ----------------  --------- --------------------
! 10   USERS             active    Gi1/0/1, Gi1/0/2
! 20   SERVERS           active    Gi1/0/13

Access Ports (End Devices)

TEXT

! Configure access port for end device
interface GigabitEthernet1/0/1
  description PC-John
  switchport mode access
  switchport access vlan 10
  switchport nonegotiate         ! Don't negotiate DTP
  spanning-tree portfast         ! Instant connectivity for end devices
  spanning-tree bpduguard enable ! Protect against loops from this port
  no shutdown

! Configure multiple ports at once
interface range GigabitEthernet1/0/1-12
  description USERS-PORTS
  switchport mode access
  switchport access vlan 10
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown

Trunk Ports (Switch-to-Switch and Switch-to-Router)

TEXT

! Configure trunk port to another switch/router
interface GigabitEthernet1/0/24
  description Uplink-to-Core-SW01
  switchport mode trunk
  switchport trunk encapsulation dot1q    ! Required on older IOS
  switchport trunk native vlan 99        ! Untagged traffic goes here
  switchport trunk allowed vlan 10,20,30,99  ! Only allow specific VLANs
  switchport nonegotiate                 ! Disable DTP negotiation

! Verify trunk
show interface GigabitEthernet1/0/24 trunk
! Output shows:
! Port        Mode    Encapsulation  Status    Native vlan
! Gi1/0/24    on      802.1q         trunking  99
! VLANs allowed and active in management domain: 10,20,30,99

VTP (VLAN Trunking Protocol)

TEXT

! VTP manages VLAN config across multiple switches
! WARNING: VTP can cause catastrophic VLAN deletion if misconfigured

! Best practice for most shops: Use VTP transparent mode (no sync)
vtp mode transparent   ! Don't sync, just pass VTP messages

! Or disable VTP entirely (IOS 15.2+ supports VTP version 3)
no vtp

! If you must use VTP server/client:
vtp domain COMPANY
vtp password VTPSecret123
vtp version 2
vtp mode server   ! Only on core switch

! Client switches:
vtp domain COMPANY
vtp password VTPSecret123
vtp mode client

Inter-VLAN Routing

VLANs can't communicate without routing. Three options:

Option 1: Router-on-a-Stick (one physical link, subinterfaces):

TEXT

! On Cisco router:
interface GigabitEthernet0/0.10
  encapsulation dot1Q 10
  ip address 10.10.10.1 255.255.255.0

interface GigabitEthernet0/0.20
  encapsulation dot1Q 20
  ip address 10.20.20.1 255.255.255.0

interface GigabitEthernet0/0.99
  encapsulation dot1Q 99 native
  ip address 10.99.99.1 255.255.255.0

Option 2: Layer 3 Switch (SVIs) — Best for enterprise:

TEXT

! Enable IP routing on Catalyst (Layer 3 switches only)
ip routing

! Create SVI (Switch Virtual Interface)
interface Vlan10
  description Users-Gateway
  ip address 10.10.10.1 255.255.255.0
  ip helper-address 192.168.100.10   ! Forward DHCP to server
  no shutdown

interface Vlan20
  description Servers-Gateway
  ip address 10.20.20.1 255.255.255.0
  no shutdown

! Routed uplink to core
interface GigabitEthernet1/0/24
  no switchport          ! Convert to routed port
  ip address 10.0.0.2 255.255.255.252

ip route 0.0.0.0 0.0.0.0 10.0.0.1   ! Default route to core

Security: VLAN Hardening

TEXT

! Disable unused ports and put in unused VLAN
interface range GigabitEthernet1/0/1-24
  shutdown    ! Default all ports off

! Configure secure port
interface GigabitEthernet1/0/5
  description Reception-PC
  switchport mode access
  switchport access vlan 10
  switchport port-security
  switchport port-security maximum 1         ! Only 1 MAC allowed
  switchport port-security violation restrict ! Log but don't shut down
  switchport port-security mac-address sticky ! Learn current MAC

! DHCP Snooping (prevents rogue DHCP servers)
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
no ip dhcp snooping information option

! Trusted ports (legitimate DHCP server location)
interface GigabitEthernet1/0/24
  ip dhcp snooping trust

! Dynamic ARP Inspection (prevents ARP spoofing)
ip arp inspection vlan 10,20,30
interface GigabitEthernet1/0/24
  ip arp inspection trust

Troubleshooting VLANs

TEXT

! Device can't communicate
! Step 1: Verify port is in correct VLAN
show interfaces GigabitEthernet1/0/5 switchport
! Look for: Access Mode VLAN: 10

! Step 2: Verify VLAN exists and is active
show vlan id 10

! Step 3: Verify trunk allows VLAN
show interfaces GigabitEthernet1/0/24 trunk
! Look for: VLANs allowed and active: 10,...

! Step 4: Verify SVI is up
show interface Vlan10
! Must be: Vlan10 is up, line protocol is up
! If down: no active ports in VLAN 10

! Step 5: Check routing
show ip route 10.10.10.0
ping 10.10.10.1 source Vlan20  ! Test inter-VLAN routing

! Common mistake: native VLAN mismatch
show interfaces trunk | include Native
! Both sides must agree on native VLAN

Cisco Catalyst VLAN configuration is the most fundamental enterprise switching skill. The key principle: always explicitly configure trunk allowed VLANs (don't allow all), use transparent VTP or disable it to prevent accidental VLAN deletion, and use Layer 3 switching SVIs for inter-VLAN routing at enterprise scale.