A VLAN splits one physical switch into many logical networks. Create VLANs, assign access ports, and carry multiple VLANs between switches over a trunk.
Why: by default every port on a switch is one big broadcast domain — a VLAN partitions it into separate logical networks, isolating traffic (and broadcasts) between groups like Sales and Engineering on the same hardware. When: use VLANs to segment by department, function, or security zone. Where: devices in different VLANs cannot talk without a router (next lesson).
One physical switch, two logical networks:
VLAN 10 (Sales) ports 1-12 -> broadcast domain A
VLAN 20 (Eng) ports 13-24 -> broadcast domain B
A broadcast in VLAN 10 never reaches VLAN 20. Same switch, isolated.Why: an access port belongs to exactly one VLAN and carries untagged traffic for the device plugged into it — this is how you put a PC into a VLAN. When: assign every user-facing port to its VLAN. Where: verify with show vlan brief to see which ports map to which VLAN.
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# vlan 20
SW1(config-vlan)# name Engineering
SW1(config-vlan)# exit
SW1(config)# interface range Fa0/1 - 12
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10 ! ports 1-12 -> Sales
SW1# show vlan briefWhy: when VLANs span more than one switch, the link between switches must carry traffic for all of them — a trunk does this by tagging each frame with its VLAN ID (802.1Q). When: configure the switch-to-switch (and switch-to-router) link as a trunk. Where: access ports are for end devices; trunks are for infrastructure links.
SW1(config)# interface Gig0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20 ! only these VLANs
SW1# show interfaces trunk ! confirm the trunk and allowed VLANs
! 802.1Q tags each frame with its VLAN ID so the far switch keeps them separate.