VLANs (Virtual Local Area Networks) are a Layer 2 network technology defined by the IEEE 802.1Q standard that logically partitions a physical switch into multiple isolated broadcast domains, enabling efficient traffic management, enhanced security, and simplified network administration without requiring separate physical infrastructure. VLANs operate by tagging Ethernet frames with a 12-bit VLAN identifier (supporting 4,094 usable VLANs), allowing 802.1Q trunk ports to carry traffic for multiple VLANs simultaneously while access ports assign untagged traffic to a single VLAN. Understanding VLAN segmentation is foundational to modern network design because every VLAN represents a separate broadcast domain—meaning broadcasts, multicasts, and unknown unicast floods are contained within the VLAN boundary, preventing a single misbehaving device from disrupting the entire network and creating natural security zones that enforce policy-based access control at Layer 2 or through Layer 3 inter-VLAN routing.
What This Cheat Sheet Covers
This topic spans 12 focused tables and 77 indexed concepts, 68 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: VLAN Fundamentals and Types
Before you can segment anything, you need to know the cast of characters—and most VLANs fall into a handful of recognizable roles. Data, voice, management, native, and guest VLANs each exist for a specific reason, and several of them (the default VLAN 1 in particular) carry security baggage worth understanding up front. The standard versus extended range distinction matters too: it dictates where the VLAN lives in configuration and how VTP propagates it.
| Concept | Example | Description | |
|---|---|---|---|
vlan 10name Sales_Data | • User-generated traffic VLAN carrying application and workstation data • segregated from voice and management traffic for optimal performance and security isolation. | ||
switchport voice vlan 100mls qos trust cos | • Dedicated VLAN for VoIP traffic with automatic CoS (Class of Service) priority tagging (typically CoS 5) • IP phones tag voice frames with 802.1Q while passing through untagged data traffic to a connected PC | ||
interface vlan 99ip address 192.168.99.1 255.255.255.0 | • VLAN for remote switch/router administration via Telnet, SSH, SNMP, or syslog • best practice: separate from user data VLANs and never use VLAN 1 for management | ||
switchport trunk native vlan 999 | • VLAN carrying untagged frames on an 802.1Q trunk port • security best practice: change from default VLAN 1 to an unused VLAN to prevent VLAN hopping attacks and VLAN mismatch issues | ||
All ports assigned to VLAN 1 by default | • Pre-configured on all Cisco switches • carries CDP, VTP, and STP traffic • security risk: should not carry user data—reassign all ports and use a different native VLAN | ||
authentication guest-vlan 50 | • Provides limited network access to devices that fail 802.1X authentication or lack 802.1X capability • redirects non-compliant devices to restricted services (e.g., internet-only access). | ||
VLANs 1-1005 | • Normal range VLANs stored in vlan.dat file• VLAN 1 and VLANs 1002-1005 are reserved • compatible with VTP versions 1 and 2 for propagation across switches | ||
VLANs 1006-4094 | • High-scale VLAN IDs for large enterprise deployments • stored in running configuration (not vlan.dat)• requires VTP transparent or off mode on older VTP versions • supported by VTP version 3. |