Lesson
VLANs, Access Ports and Trunks
Learning objective
Explain why VLANs create separate broadcast domains and how access and trunk links carry them.
Why VLANs exist
Imagine one office floor where engineering, finance and support share the same physical switches. VLANs let us group those office teams into separate logical Layer 2 broadcast domains without buying a separate switch for every team. A broadcast in VLAN 10 stays in VLAN 10; devices assigned to VLAN 20 do not receive it.
That separation reduces unnecessary broadcast delivery and makes the network easier to organize. It is not a security boundary by itself: policy enforcement still belongs to a router, firewall or another Layer 3 control point.
VLAN is not a subnet. A VLAN is a Layer 2 forwarding domain; a subnet is a Layer 3 IP-address range. Designs commonly map one subnet to one VLAN because it is clear and predictable, but the two terms describe different layers.
Access ports and membership
An access port places ordinary endpoint traffic into one operational VLAN. A laptop usually sends and receives normally untagged Ethernet frames on that access link. The switch knows that frames entering Gi0/1 belong to VLAN 10 because of the port's configuration—not because the laptop wrote VLAN 10 into every frame.
For a frame entering an access port, the switch:
- identifies the ingress interface;
- associates the frame with that port's VLAN;
- learns and looks up MAC addresses within that VLAN's forwarding context; and
- forwards, filters or floods only through eligible interfaces in the same VLAN.
Moving a cable to a differently configured access port can therefore change the host's Layer 2 membership even when the host itself has not changed.
Interactive VLAN membership
Choose a broadcast or unicast journey. The switch classifies the incoming frame by its access-port membership, then exposes every eligible egress interface.
Build the VLAN broadcast domains
Choose a journey, then move Host D to see how access-port membership changes delivery scope.
Watch the switch classify ingress traffic and forward it only inside the selected VLAN.
- Host A: Host A eth0Switch: Switch Gi0/1 · access VLAN 10
- Host B: Host B eth0Switch: Switch Gi0/2 · access VLAN 10
- Switch: Switch Gi0/3 · access VLAN 20Host C: Host C eth0
- Switch: Switch Gi0/4 · access VLAN 20Host D: Host D eth0
Active: Host A, Switch; link Host A to Switch
Step 1 of 2
1. Classify the ingress frame
The access port assigns the untagged endpoint frame to VLAN 10. That VLAN now defines the eligible Layer 2 scope.
Packet inspector
Inside the packet
Ethernet frame
- Ingress
- Gi0/1
- VLAN
- 10Changed at this hop
Technical packet details
- Boundary
- Remain inside VLAN 10
Without JavaScript, remember the same rule: a frame entering an access port joins that port's VLAN. A broadcast is copied only to other eligible ports in that VLAN, never back through the ingress port. Same-VLAN unicast can be switched directly; a different-VLAN destination stops at the Layer 2 boundary.
Trunks and 802.1Q
Tagged frame format
Swipe sideways to see all fields
| Destination MAC · 6 bytes | Source MAC · 6 bytes | ||||||||||
| Tag protocol identifier (TPID) · 2 bytes | Tag control information (TCI) · 2 bytes | ||||||||||
| Original EtherType · 2 bytes | |||||||||||
| Payload and any required padding · variable | |||||||||||
| FCS · 4 bytes | |||||||||||
One inter-switch link may need to carry VLAN 10, VLAN 20 and many other VLANs. A trunk does this while preserving each frame's VLAN identity. IEEE 802.1Q inserts a four-byte tag between the source MAC address and the original EtherType. The tag protocol identifier, or TPID, is commonly 0x8100.
The tag also carries priority (PCP), drop eligibility (DEI) and a 12-bit VLAN identifier. The original payload protocol remains identifiable by the encapsulated EtherType—for example 0x0800 for IPv4. Because inserting or removing a tag changes the transmitted frame, the switch generates a new FCS for the outgoing frame.
Endpoint-facing access links and network-device trunks describe roles, not connector types. An access-link frame is normally untagged at the endpoint, while a trunk commonly carries tagged frames for multiple VLANs. Special designs can differ, so avoid treating “untagged” as a universal law.
Interactive tag journey
Follow the same frame from an access link, across a shared trunk, and back onto an access link. Open technical inspection when the tag is visible to unfold its individual fields.
Follow the 802.1Q tag across a trunk
Watch one Ethernet frame gain a VLAN tag for the trunk and lose it before endpoint delivery.
- Host A: Host A eth0Switch A: Switch A Gi0/1 · access VLAN 10
- Host C: Host C eth0Switch A: Switch A Gi0/2 · access VLAN 20
- Switch A: Switch A Gi0/24 · 802.1Q trunkSwitch B: Switch B Gi0/24 · 802.1Q trunk
- Switch B: Switch B Gi0/1 · access VLAN 10Host B: Host B eth0
- Switch B: Switch B Gi0/2 · access VLAN 20Host D: Host D eth0
Active: Host A; link Host A to Switch A
Step 1 of 7
1. Endpoint sends an ordinary Ethernet frame
The endpoint normally sends an untagged frame on its access link.
- Destination MAC
- Source MAC
- EtherType
- Payload
- FCS
Without JavaScript, the journey is: endpoint sends an ordinarily untagged frame → the ingress access port classifies it → the switch inserts an 802.1Q tag → the tagged frame crosses the trunk → the receiving switch reads the VLAN ID → the tag is removed for the destination access link → the endpoint receives the frame.
Allowed VLANs and routing boundary
A trunk's allowed VLAN set controls which VLAN identities may use that link. Allowing a VLAN does not create it, assign access ports to it or provide routing; it only makes that VLAN eligible on the trunk.
Switching inside one VLAN and routing between VLANs are separate decisions. Hosts in VLAN 10 and VLAN 20 need a Layer 3 device—such as a router or multilayer switch—to exchange IP packets. Each host sends the local frame toward its default gateway; the Layer 3 device routes the packet and builds a new Layer 2 frame for the destination VLAN.
In this example, both gateway subinterfaces use the router's physical Fa0/0 port. The switch-facing Fa1/0/1 port is an 802.1Q trunk that allows VLANs 10 and 20. The red host sends to gateway 10.10.10.254 on Fa0/0.10; the router forwards toward 20.20.20.1 through Fa0/0.20. One physical trunk carries the tagged frame in both directions, with a different VLAN ID on the return trip.
Router on a stick: one interface, two VLANs
The red and green paths in the diagram share one switch-to-router trunk. Play the journey to see the tag change after the router makes its Layer 3 decision.
Follow one IP packet from the red VLAN to the green VLAN. The router uses two logical subinterfaces on one physical trunk.
- Red host: Red host eth0Switch: Switch Fa1/0/2 · access VLAN 10
- Switch: Switch Fa1/0/1 · 802.1Q trunk (VLANs 10, 20)Router: Router Fa0/0 · one physical interface
- Switch: Switch Fa1/0/3 · access VLAN 20Green host: Green host eth0
Active: Switch, Red host; link Red host to Switch
Step 1 of 5
1. Send toward the VLAN 10 gateway
10.10.10.1 sees that 20.20.20.1 is outside its /24. It sends an untagged Ethernet frame to its VLAN 10 default gateway, 10.10.10.254, through the access port.
Packet inspector
Inside the packet
Ethernet frame
IP packet
- Access link
- Untagged · classified as VLAN 10
- IP destination
- 20.20.20.1
Technical packet details
- Next-hop MAC
- Router Fa0/0.10 gateway MAC (resolved by ARP)
Without JavaScript, trace the path as red host → VLAN 10 access port → VLAN 10 tagged trunk → router Fa0/0.10 → Layer 3 routing → router Fa0/0.20 → VLAN 20 tagged frame down the same trunk → VLAN 20 access port → green host. The router creates a new Ethernet frame for the destination VLAN.
This lesson establishes the forwarding foundation. Later lessons will explain Spanning Tree Protocol for loop prevention and link aggregation for combining compatible physical links. Their control decisions affect which links can carry VLAN traffic, but they do not change the basic meaning of access membership or an 802.1Q VLAN ID.
Read port and capture evidence
Port evidence table
| Interface | Operational role | VLAN evidence | What it means | | --- | --- | --- | --- | | Gi0/1 | Access | VLAN 10 | Untagged endpoint ingress is classified into VLAN 10 | | Gi0/2 | Access | VLAN 20 | This endpoint belongs to a different Layer 2 domain | | Gi0/24 | Trunk | VLANs 10, 20 allowed | The inter-switch link can carry both VLAN identities |
Read the table from left to right: verify interface state and role, identify the VLAN context, then compare the intended path. A port being physically up does not prove its logical membership is correct.
Sanitized tagged-frame evidence
| Field | Example | Interpretation |
| --- | --- | --- |
| Destination MAC | 02:00:00:00:00:0B | Destination remains a Layer 2 unicast address |
| Source MAC | 02:00:00:00:00:0A | Source used for switch learning |
| TPID | 0x8100 | An 802.1Q tag follows |
| PCP / DEI | 0 / 0 | Default priority and not drop-eligible |
| VLAN ID | 10 | Frame belongs to VLAN 10 on this observed link |
| Encapsulated EtherType | 0x0800 | Payload is IPv4 |
Basic Wireshark check
Display filter: vlan || eth.type == 0x8100
Fields to inspect
eth.dsteth.srcvlan.tpidvlan.priorityvlan.deivlan.idvlan.etype
Normal evidence: A capture on a trunk can expose an 802.1Q VLAN ID, while a capture at an ordinary endpoint commonly shows the corresponding frame without that tag. Capture position matters.
Try it: Capture in a safe lab at an endpoint and on a mirrored trunk port, generate one same-VLAN exchange, then correlate MAC addresses, VLAN ID and encapsulated EtherType.
Solve VLAN reachability
Scenario 1 — Same VLAN, one switch
Host A on Gi0/1 and Host B on Gi0/2 both belong to VLAN 10. After learning their MAC addresses, the switch forwards known unicast only through the destination interface. A broadcast is copied to other eligible VLAN 10 ports except ingress.
Scenario 2 — Same VLAN, two switches
Host A and Host B belong to VLAN 20 on different switches. The inter-switch trunk carries VLAN 20, so the ingress switch tags the trunk transmission and the egress switch removes the tag before the access link. Verify access membership, trunk role and that VLAN 20 is eligible end to end.
Scenario 3 — Different VLANs
Host A belongs to VLAN 10 and Host C belongs to VLAN 20. The Layer 2 switch does not forward directly between them. Check each host's address, prefix and default gateway, then verify that a Layer 3 interface exists for each VLAN and policy permits the routed conversation.
Interview scenario
Two hosts are connected to the same physical switch but cannot communicate. How would you decide whether VLAN separation is expected or a fault?
Show answer and reasoning
First verify link state, each access port's operational VLAN and the hosts' IP configuration. If the ports belong to different VLANs, direct Layer 2 delivery is not expected; test the intended default gateways and routing path. If they should share a VLAN, compare port membership, MAC-learning evidence and the eligible path before changing configuration.
Knowledge check and summary
Remember: access classifies, trunk preserves identity, access removes the tag, and routing crosses the VLAN boundary. Always state the observation point when interpreting tagged or untagged capture evidence.