Cisco VLAN and Inter-VLAN Routing Configuration Guide

VLAN configuration looks easy until traffic silently goes to the wrong place — which is why verification and hardening matter as much as the commands themselves. This guide walks through the complete workflow on Cisco Catalyst switches (IOS 15.x / IOS-XE 17.x): creating VLANs, assigning access ports, building 802.1Q trunks with a dedicated native VLAN, enabling ip routing, creating SVIs for inter-VLAN routing, adding DHCP pools, and finishing with security hardening. Every step includes the show commands that catch mistakes before they become outages.

Step 1: Create the VLANs

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit
Switch(config)# vlan 99
Switch(config-vlan)# name Native-VLAN
Switch(config-vlan)# exit
Switch# show vlan brief

Step 2: Assign Access Ports

Switch(config)# interface range GigabitEthernet1/0/1 - 8
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# spanning-tree portfast
Switch(config-if-range)# no shutdown

Enable spanning-tree portfast only on ports connected to end devices — never on switch-to-switch links.

Step 3: Configure Trunk Ports

Switch(config)# interface GigabitEthernet1/0/24
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# switchport trunk allowed vlan 10,20,30,99
Switch(config-if)# no shutdown

Always set the allowed VLAN list explicitly — the default "all" is a security risk — and use a native VLAN other than 1 to mitigate VLAN hopping. Both ends must agree on encapsulation, native VLAN, and allowed VLANs.

Step 4: SVIs for Inter-VLAN Routing

Switch(config)# ip routing
Switch(config)# interface vlan 10
Switch(config-if)# ip address 10.10.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit
Switch(config)# interface vlan 20
Switch(config-if)# ip address 10.10.20.1 255.255.255.0

Hosts in each VLAN use the SVI IP as their default gateway. A common mistake is forgetting ip routing — the SVIs come up but nothing routes between them.

Step 5: DHCP Pools (Optional but Recommended)

Switch(config)# ip dhcp pool VLAN10-POOL
Switch(dhcp-config)# network 10.10.10.0 255.255.255.0
Switch(dhcp-config)# default-router 10.10.10.1
Switch(dhcp-config)# dns-server 10.10.30.10
Switch(config)# ip dhcp excluded-address 10.10.10.1 10.10.10.10

Step 6: Verify and Harden

Switch# show vlan brief
Switch# show interfaces trunk
Switch# show ip interface brief
Switch# show ip route

Test inter-VLAN routing by pinging from a host in VLAN 10 to a host in VLAN 20; if it fails, check the SVI state, the host default gateway, and ip routing. Finally: shut down VLAN 1 on trunks, shut unused ports into a dead-end VLAN (e.g., VLAN 999), keep the dedicated native VLAN, and save with copy running-config startup-config. For the Arista equivalent, see our EOS VLAN, trunk and port-channel guide; for redundancy design, the Cisco Nexus vPC failover checklist is a good next stop.

原文链接：https://syseng.io/blog/guide-31-vlan-configuration-cisco