📘 CCNA Module 3 — VLANs & Trunking

🔴 HIGH PRIORITY — Know These First

1. What is a VLAN?

A VLAN (Virtual Local Area Network) logically separates devices into different networks even when they are connected to the same physical switch infrastructure.

Key idea:

VLAN = separate logical network / broadcast domain

Devices in the same VLAN can communicate at Layer 2 without a router.

Devices in different VLANs need inter-VLAN routing.

2. Why use VLANs?

The three benefits emphasized in your quiz:

🔐 Security — separates groups of devices
💰 Cost reduction — better use of existing infrastructure
🛠 Improved IT staff efficiency — easier management

Other benefits:

Smaller broadcast domains
Better network performance
Easier project/application management

3. VLAN Types

VLAN Type	Purpose
Default VLAN	VLAN 1; all switch ports are assigned here by default
Data VLAN	Carries normal user-generated traffic
Native VLAN	Carries untagged traffic on an 802.1Q trunk
Management VLAN	Used for management traffic such as SSH, HTTPS, SNMP
Voice VLAN	Carries IP phone/VoIP traffic

🔴 VLAN 1

Remember:

Default VLAN
All ports start in VLAN 1
Cannot be renamed or deleted
Default native VLAN
Default management VLAN
Best practice: don't use VLAN 1 as the native VLAN

🔴 Access Ports vs. Trunk Ports

Access Port

An access port normally belongs to one data VLAN.

Example:

switchport mode access
switchport access vlan 20

Think:

Access = one VLAN

Trunk Port

A trunk carries multiple VLANs across one physical link.

Example:

switchport mode trunk

Think:

Trunk = many VLANs

A trunk can connect:

Switch ↔ Switch
Switch ↔ Router
Switch ↔ Server/device with an 802.1Q NIC

🔴 VLAN Tagging — 802.1Q

Ethernet frames normally don't contain VLAN information.

When traffic travels across a trunk, IEEE 802.1Q adds a 4-byte VLAN tag.

The VLAN tag contains:

TPID
Priority
CFI
VLAN ID

VLAN ID

The VLAN ID field is 12 bits, allowing VLAN IDs up to 4096 values.

This is why the maximum VLAN number is associated with 4094 in the module's extended VLAN range.

🔴 Native VLAN

The native VLAN handles untagged frames on an 802.1Q trunk.

Default:

Native VLAN = VLAN 1

If a trunk receives an untagged frame:

Untagged frame → Native VLAN

Important exam trap

If the native VLAN is VLAN 99:

Native VLAN = 99
PVID = 99

Cisco's recommended practice is to use an unused, separate native VLAN rather than VLAN 1.

Another exam trap

Both ends of a trunk should have the same native VLAN.

A mismatch can cause errors and connectivity problems.

🔴 Voice VLAN

IP phones use a separate VLAN for voice traffic.

Example:

switchport access vlan 20
switchport voice vlan 150

This means:

VLAN 20 = data
VLAN 150 = voice

An access port can therefore carry one data VLAN + one voice VLAN.

Why separate voice traffic?

Voice requires:

Reliable bandwidth
QoS
Low delay
Priority over congested traffic

The module specifies a desired delay of less than 150 ms.

🔴 VLAN Ranges

Normal-Range VLANs

1–1005

Characteristics:

VLAN 1 and 1002–1005 are automatically created
VLAN 1 and 1002–1005 cannot be removed
Configuration stored in vlan.dat
Stored in flash
Can be synchronized with VTP

Extended-Range VLANs

1006–4094

Characteristics:

Stored by default in the running configuration
Have fewer features
VTP must be transparent

⭐ Memorize

Normal VLAN → vlan.dat → Flash

Extended VLAN → running-config

🔴 VLAN Configuration

Create a VLAN

configure terminal
vlan 20
name student
end

Assign a port to a VLAN

interface fa0/6
switchport mode access
switchport access vlan 20
end

The VLAN is configured on the switch port, not on the end device.

The device's IP address/subnet should correspond to the VLAN.

🔴 VLAN Verification Commands

`show vlan`

Displays configured VLAN information.

Useful options include:

show vlan brief
show vlan id 20
show vlan name student
show vlan summary

`show interfaces [interface-id] switchport`

Used to verify:

Access VLAN
Voice VLAN
Switchport mode

`show interfaces trunk`

Used to verify trunk information, including:

Native VLAN
Allowed VLANs
Trunk status

⭐ Quiz connection:

If asked which command can be used to view the native VLAN:

show interfaces trunk

🔴 Changing VLAN Membership

To move a port:

switchport access vlan 30

To return the port to VLAN 1:

no switchport access vlan

Important:

A VLAN can remain active even if no ports are currently assigned to it.

🔴 Deleting VLANs

Delete a specific VLAN:

no vlan 20

This removes it from vlan.dat.

Important exam scenario

If a port is still assigned to a VLAN that gets deleted:

The port becomes inactive and devices connected to it cannot communicate.

The port hasn't necessarily been reassigned automatically.

Delete the entire VLAN database

delete flash:vlan.dat

Then reload the switch.

🔴 Trunk Configuration

Basic trunk configuration:

interface fa0/1
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,99
end

This means:

Port = trunk
Native VLAN = 99
Allowed VLANs = 10, 20, 30, 99

🔴 Allowed VLANs

This is a major exam trap.

Suppose the current allowed VLANs are:

10,20

Then you enter:

switchport trunk allowed vlan 30

The result is:

Only VLAN 30 is allowed.

It replaces the existing list.

To add VLAN 30 instead:

switchport trunk allowed vlan add 30

Think:

allowed vlan = replace

allowed vlan add = add

🔴 Resetting a Trunk

Remove the restricted VLAN list:

no switchport trunk allowed vlan

Result:

All VLANs are allowed.

Reset native VLAN:

no switchport trunk native vlan

Result:

Native VLAN returns to VLAN 1.

Turn a trunk into an access port:

switchport mode access

🔴 DTP — Dynamic Trunking Protocol

DTP = Dynamic Trunking Protocol

It is a Cisco proprietary protocol used to negotiate trunking.

Major exam fact

Other vendors generally don't support DTP.

If connecting a Cisco switch to a non-Cisco switch:

switchport mode trunk
switchport nonegotiate

This manually establishes the trunk and prevents DTP negotiation.

🔴 DTP Modes

Mode	Behavior
access	Permanent non-trunk
trunk	Permanent trunk
dynamic auto	Passive
dynamic desirable	Actively attempts to form a trunk

⭐ Critical combinations

Auto + Auto

❌ No trunk

Auto + Desirable

✅ Trunk

Desirable + Desirable

✅ Trunk

Memory trick

Auto waits. Desirable desires.

Two devices both waiting = nothing happens.

🔴 `switchport nonegotiate`

Stops DTP frames from being sent.

Used with:

switchport mode trunk
switchport nonegotiate

The neighbor must be manually configured for trunking.

Important

switchport nonegotiate is used with static access or trunk mode, not dynamic negotiation modes.

🧠 Module 3 Memory Tricks

VLAN

VLAN = Logical separation

Access vs. Trunk

Access = one

Trunk = many

Normal vs. Extended

Normal = Flash/vlan.dat

Extended = running-config

Native VLAN

Native = untagged

Voice VLAN

Data + Voice = two VLANs

DTP

Auto waits

Desirable tries

Allowed VLAN

allowed vlan = replace

allowed vlan add = add

VLAN 1

Default, Native, Management

⚠ Common Exam Traps

Deleting a VLAN doesn't automatically move its ports to VLAN 1.
Normal VLAN information is stored in vlan.dat in flash.
Extended VLANs are stored in running-config.
Untagged trunk traffic goes to the native VLAN.
Two dynamic-auto ports do NOT form a trunk.
Other-vendor switches don't support Cisco DTP.
switchport trunk allowed vlan 30 replaces the allowed list.
show interfaces trunk can show the native VLAN.
A voice VLAN can coexist with a data VLAN on the same access port when an IP phone is involved.
VLANs create smaller broadcast domains.
Different VLANs require routing to communicate.
VLAN 1 cannot be deleted or renamed.
Both ends of a trunk should use the same native VLAN.
A trunk is a point-to-point link carrying multiple VLANs.

📝 Module 3 Quiz Review

These are the quiz facts I'd prioritize because they represent the concepts your instructor is testing:

Deleted VLAN → port becomes inactive
Normal VLAN configuration → Flash
Non-Cisco switch → doesn't support DTP
vlan.dat → VLAN database
Separate native VLAN → avoids using data VLAN for untagged traffic
Untagged frame → Native VLAN
Trunks → Switch-to-switch or switch-to-802.1Q device
VLAN benefits → Security, cost reduction, IT efficiency
Extended VLAN → running configuration
Normal VLAN → Flash
Management VLAN → administrator access
show interfaces trunk → native VLAN
vlan.dat → Flash
VoIP → separate voice VLAN
switchport trunk allowed vlan 30 → only VLAN 30
Dynamic auto + dynamic auto → no trunk

📘 CCNA Module 3 — VLANs & Trunking

🔴 HIGH PRIORITY — Know These First

1. What is a VLAN?

2. Why use VLANs?

3. VLAN Types

🔴 VLAN 1

🔴 Access Ports vs. Trunk Ports

Access Port

Trunk Port

🔴 VLAN Tagging — 802.1Q

VLAN ID

🔴 Native VLAN

Important exam trap

Another exam trap

🔴 Voice VLAN

Why separate voice traffic?

🔴 VLAN Ranges

Normal-Range VLANs

Extended-Range VLANs

⭐ Memorize

🔴 VLAN Configuration

Create a VLAN

Assign a port to a VLAN

🔴 VLAN Verification Commands

show vlan

show interfaces [interface-id] switchport

show interfaces trunk

🔴 Changing VLAN Membership

🔴 Deleting VLANs

Important exam scenario

Delete the entire VLAN database

🔴 Trunk Configuration

🔴 Allowed VLANs

🔴 Resetting a Trunk

🔴 DTP — Dynamic Trunking Protocol

Major exam fact

🔴 DTP Modes

⭐ Critical combinations

Memory trick

🔴 switchport nonegotiate

Important

🧠 Module 3 Memory Tricks

VLAN

Access vs. Trunk

Normal vs. Extended

Native VLAN

Voice VLAN

DTP

Allowed VLAN

VLAN 1

⚠ Common Exam Traps

📝 Module 3 Quiz Review

`show vlan`

`show interfaces [interface-id] switchport`

`show interfaces trunk`

🔴 `switchport nonegotiate`