Cisco VLAN Config and Verification: Repeatable Workflow

Most VLAN incidents are not caused by a single broken command but by an incomplete verification process that misses mismatches between access ports, trunks and gateways. This article presents a practical, repeatable workflow for configuring and verifying VLANs on Cisco IOS and IOS XE switches: plan VLAN IDs and subnets first, build access ports and trunks explicitly, choose inter-VLAN routing (router-on-a-stick or SVIs), then verify in a fixed order that catches mistakes fast. It is written from real troubleshooting experience and ends with the failure modes seen most often in production.

Plan First: IDs, Subnets, Trunks and Gateways

Choose stable VLAN IDs and names (USERS, SERVERS, NATIVE, PARKING), assign a clean IP subnet per VLAN even if routing is not needed today, and decide trunk policy up front: a dedicated native VLAN that carries no user traffic (e.g. 99) and an explicit allowed list per trunk.

Building VLANs and Access Ports

enable
configure terminal
vlan 10
 name USERS
vlan 30
 name SERVERS
vlan 99
 name NATIVE
vlan 999
 name PARKING
interface range gigabitEthernet 1/0/1 - 12
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
end
write memory

Explicit switchport mode access prevents DTP from negotiating a trunk by surprise; PortFast and BPDU Guard protect edge ports from rogue switches and loops.

Trunks Done Right

interface gigabitEthernet 1/0/24
 description Uplink-to-Distribution
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,99
 spanning-tree guard root
end

Inter-VLAN Routing: SVIs vs Router-on-a-Stick

For a Layer 3 switch, enable routing and create SVIs:

ip routing
interface vlan 10
 description USERS-Gateway
 ip address 192.168.10.1 255.255.255.0
 no shutdown

For labs, router subinterfaces with encapsulation dot1Q tags work the same way. Remember: VLAN configuration and SVI configuration are separate — an SVI stays down if no port in the VLAN is active.

Verification Workflow

show vlan brief
show interfaces status
show interfaces trunk
show mac address-table vlan 10
show spanning-tree vlan 10
show ip interface brief

Then test with targeted pings in a ladder: host to gateway (access + gateway), host to same-VLAN host across switches (trunk), host to other-VLAN host (routing). If step 1 fails, do not waste time on step 3.

Common Failure Modes

Access port in wrong VLAN, trunk native VLAN mismatch, VLAN not allowed on trunk, SVI down/down, and router subinterface tag mismatch are the classics. Three invariants prevent most of them: edge ports forced to access with PortFast + BPDU Guard; trunks with explicit allowed lists and a dedicated native VLAN; and a single documented gateway per routed VLAN.

Related: Arista EOS configuration cheat sheet and Juniper EX inter-VLAN communication troubleshooting.

原文链接：https://thelinuxcode.com/configuring-and-verifying-vlans-on-cisco-switches-a-practical-repeatable-workflow