VLANs and Broadcast Domains

Watch first

Plain-English explanation

A VLAN (Virtual LAN) is a logical broadcast domain inside a switch. Devices in VLAN 10 cannot ARP or broadcast to VLAN 20 unless traffic passes through a router (or Layer 3 switch / SVI).

VLANs let you segment departments, guests, servers, and voice without running separate physical switches — but each VLAN still needs its own IP subnet for routed communication.

Deep dive

Additional topic reference

VLANs — Panagiss CCNAmd notes

Access port: Belongs to one VLAN. Untagged frames from the host — the switch assigns VLAN membership.

Trunk port: Carries multiple VLANs between switches (and to routers) with 802.1Q tags (next lesson).

Inter-VLAN routing: Router-on-a-stick (subinterfaces), switched virtual interfaces (SVIs) on L3 switches, or dedicated firewall/router legs.

| Concept | One VLAN | Multiple VLANs | |---------|----------|----------------| | Broadcast domain | Single | One per VLAN | | IP subnet | Typically one | One per VLAN | | Security isolation | L2 only | L2 + L3 ACLs possible |

VLAN ranges: Normal 1–1005, extended 1006–4094. VLAN 1 is default on many switches — avoid using it for production data if policy requires.

Step-by-step — design three VLANs

Site needs Sales (40 hosts), Engineering (80 hosts), Guest Wi-Fi (200 clients):

Assign VLAN IDs: 10 Sales, 20 Engineering, 30 Guest
Assign subnets: 10.10.10.0/26, 10.10.20.0/25, 10.10.30.0/24 (VLSM from Week 2)
Gateway: SVI or router subinterface per VLAN (.1 convention)
Access ports: assign VLAN on edge ports
Uplink to core: trunk carrying 10,20,30

Commands to know

Basic VLAN and access port

vlan 10 name SALES ! interface GigabitEthernet0/1 switchport mode access switchport access vlan 10

Verify VLANs

show vlan brief show interfaces switchport

Troubleshooting

| Problem | Check | |---------|-------| | Host wrong subnet | Port in wrong VLAN | | Cannot reach other VLAN | Missing L3 gateway, ACL, or trunk missing VLAN | | VLAN exists but no traffic | Trunk not allowing VLAN on uplink | | Duplicate IP across VLANs | OK if isolated — confusion if L3 merged incorrectly |

"VLAN doesn't work" is usually port assignment or missing gateway, not exotic bugs.

Exam relevance

Exam trap

Same VLAN = same broadcast domain = same IP subnet (in typical designs). Different VLANs need routing to talk — even on one switch.

Native VLAN preview

Trunks have a native VLAN for untagged traffic — mismatch breaks odd failures. Covered in the next lesson.

Practice checklist

Draw a switch with two VLANs and a router-on-a-stick
List differences between collision and broadcast domain
Assign VLAN IDs and subnets for a four-department floor plan
Predict which VLANs flood ARP for a given host
Complete Week 3 lab VLAN portion if assigned

Two hosts are in different VLANs on the same switch. How do they communicate at Layer 3?

What type of port typically connects an end-user PC?

Learning objectives