Home > Articles > Certification > Cisco Certification > CCNP

CCNP BCMSN Exam Cram: VLANs, Trunks, and VTP

In preparation for the CCNP BCMSN Exam, Richard Deal explains VLANs, trunking, and the Virtual Trunk Protocol (VTP), areas that play an integral part in the setup of VLANs in your network.
This chapter is from the book

Terms you'll need to understand:

  • Virtual LAN (VLAN)

  • Static and dynamic VLANs

  • Local and end-to-end VLANs

  • VLAN Membership Policy Server (VMPS)

  • InterSwitch Link (ISL)

  • IEEE 802.1Q and 802.1Q tunneling

  • Native VLAN

  • Dynamic Trunk Protocol (DTP)

  • VLAN Trunk Protocol (VTP)

  • VLAN Pruning

Techniques you'll need to master:

  • Understanding the advantages of VLANs

  • Comparing dynamic and static VLANs

  • Configuring static VLANs and associating ports to them

  • Troubleshooting VLAN configurations

  • Comparing IEEE 802.1Q and ISL trunking protocols

  • Tunneling 802.1Q VLAN information in a Metro network

  • Knowing the DTP modes and when a trunk is formed

  • Configuring and troubleshooting trunks and pruning

  • Understanding the three different VTP modes

  • Comparing VTP versions 1 and 2

  • Configuring and troubleshooting VTP

There are many definitions for a virtual LAN (or VLAN, for short). A VLAN can be described as a grouping of ports on a switch or a grouping of ports on different switches. It can also be characterized as a group of related users in a data network or as a group of users at the same geographic location (which is the most common). In the simplest terms, a VLAN is a broadcast domain. In a bridged network, all devices are in the same broadcast domain. One of the problems of using bridges for LAN segmentation is that they solve bandwidth problems, but not broadcast problems. Switches, even though they act like bridges, have some additional features that make them more robust in solving your networking problems.

The remainder of this chapter focuses on three areas: VLANs, trunking, and the Virtual Trunk Protocol (VTP). All three of these areas play an integral part in the setup of VLANs in your network.

Virtual LANs

Virtual LANs (VLANs) give an administrator the ability to break up a switched Layer 2 network into multiple broadcast domains. The advantage of this approach is that it can be done using switches that cost less than traditional routers. However, each broadcast domain is typically considered to be a separate subnet. To go between subnets, a Layer 3 component, such as a router, is still required.

VLANs can be based on the port identifier of a switch, on an end station's MAC address or Layer 3 address, or on directory or application information. They also can be implemented in many different ways, depending on the media topology (Ethernet, FDDI, or ATM) that's deployed.

Advantages of VLANs

One of the main reasons that network administrators buy switches is to help control bandwidth problems by creating multiple collision or bandwidth domains, but they can also help contain broadcasts by implementing VLANs. However, VLANs offer a network administrator many more advantages than just these. Here are some examples:

  • They ease adding, moving, or changing users in a network, thereby reducing personnel costs.

  • They enhance network security via logical segmentation of users and groups.

  • They allow multiple parallel paths in a switched network for load balancing, unlike bridges and the Spanning Tree Protocol.

  • They isolate problems within a small part of the intranet.

  • They remove the physical boundaries of a network, thus enabling users and servers to be located anywhere.

  • They allow for the deployment of applications across different media topologies, such as Ethernet, FDDI, and ATM.

  • They increase performance by limiting the scope of broadcast traffic.

Containment of Broadcasts

Broadcasts are a normal occurrence in LAN-based protocols such as IP, IPX, and AppleTalk. In many cases, these broadcasts help users to find and use services. Many applications also use multicasts to disseminate information, which include LAN-based TV, video conferencing, routing protocols such as OSPF and Cisco's Enhanced IGRP, and even the bridges' and switches' Spanning Tree Protocol. Faulty network cards, Spanning Tree Protocol problems, or an incorrect application or desktop configuration could cause a flood of broadcasts or multicasts in a network. When switches see broadcasts and multicasts, they treat them as unknown destinations and flood the frames out all of their ports. Too many broadcasts, even from a single PC, can seriously slow a network's performance, if not bring it down completely.

From the users' perspective, the use of broadcasts makes their lives easier. However, from the network administrator's perspective, broadcasts use up bandwidth and affect every user's desktop in the switched network. Some mechanism is needed to reign in the propagation of broadcasts.

Routers were traditionally used to solve broadcast problems in data networks. Unfortunately, the use of routers on a port-by-port basis is a very expensive solution for performing this barrier function. When switches were first developed, they were essentially bridges with many ports. All ports were in the same broadcast domain, just like a bridge. This is sometimes referred to as a flat network.

Broadcasts and VLANs

VLANs are created by logically segmenting a network into separate broadcast domains. When you create VLANs, frames created by a member of one VLAN are switched only among ports that are designated as belonging to the same virtual LAN, which results in a more efficient use of bandwidth. In addition, instead of broadcast traffic propagating throughout the physical infrastructure, such traffic is restricted to the broadcast domain that represents the VLAN.

The advantage of this approach is that if a machine goes bonkers with broadcasts, it affects only the other machines in the same VLAN, not computers in other VLANs. VLANs allow for the extension of a broadcast barrier from the router. VLANs basically create the traditional illusion that users are off of different ports of a router, but in reality, the users are part of the same switched fabric. Because of this, routers are still required to connect the VLANs together. Each VLAN, as mentioned earlier, is typically a unique subnet; to go from one subnet to another, a router is required. Therefore, routers still perform their traditional role of containing broadcasts, but the quantity of ports is greatly reduced because of the use of switches.

Because of this huge advantage, VLANs should not be employed across an intranet, but should rather be terminated within an access layer or building access. In other words, broadcasts that occur in one-building access should not be propagated across the core or backbone of the network.

VLAN Implementations

Because broadcasts can be generated in all kinds of network operating systems and applications, you have a lot of flexibility in creating VLANs and assigning people and computers to them. You can base VLANs on the following items:

  • The Layer 3 protocols currently being used in the network

  • The groups, departments, or divisions in a company

  • The specific security needs of certain resources

  • The applications being used in the network

End-to-End VLANs

One of the unique properties of VLANs is that they can span multiple switches. The physical boundaries of where people and resources are located are removed. In Figure 3.1, a switched network has three VLANs spread across three switches: Accounting, Information Services, and Marketing.

Figure 3.1Figure 3.1 A physical view of computers and a logical representation of VLANs.

Note that all the servers are located off of one switch. In traditional networks, resources such as local file servers would usually be located in the same place as the users. Spreading the resources like this makes their management much harder and security harder still. Using VLANs, an administrator can create the illusion that the file server is on the same segment as the users that access it, even though the file server could be on a completely different floor in a completely different building. Figure 3.2 gives a detailed view of both a physical and logical representation of this concept.

End-to-end VLANs have the following characteristics:

  • Users are grouped into a VLAN based on function, not location.

  • The user belongs to the same VLAN no matter where she plugs her PC into the network (this requires Cisco's VMPS, which is discussed later in this chapter).

  • End-to-end VLANs are typically used for security reasons or for application or resource requirements.

  • End-to-end VLANs are difficult to implement and troubleshoot.

Figure 3.2Figure 3.2 A physical representation of VLANs.

Local VLANs

The problem with end-to-end VLANs is that they become extremely difficult to maintain as the campus network grows and changes. Because of this, most network administrators of campus environments use local VLANs.

Unlike end-to-end VLANs, local VLANs are very easy to plan and implement. Local VLANs are based on geographic locations by demarcation at a hierarchical boundary (core, distribution, access). Therefore, a local VLAN would never span from an access layer to a core block. Because VLANs are created based on geographic or physical boundaries, it's not uncommon to see much of the traffic leaving the broadcast domain to access a resource.

There are two generic rules when dealing with traffic flow: 80/20 and 20/80. The 80/20 rule assumes that 80% of the traffic stays local to a VLAN and 20% leaves a VLAN through a Layer 3 device. Local VLANs assume this premise. Note that with this implementation, VLANs are solely used to solve broadcast problems.

With the 20/80 rule, 20% of the traffic stays within the VLAN and 80% leaves it. In this situation, a burden is placed on the Layer 3 device that is used to interconnect VLANs. Although they do introduce a latency issue because of the access of resources outside of the VLAN, this can easily be solved with multilayer switching, which is discussed in Chapter 6, "Multilayer Switching."

VLAN Assignment

There are two methods that you can use to associate users to VLANs: dynamic and static. The following two sections compare and contrast the two methods.

Dynamic VLANs

Dynamic VLANs require you to assign a user to a VLAN, and switches dynamically use this information to configure the port on the switch automatically. Dynamic VLANs can be based on the following items:

  • The MAC addresses of workstations

  • The Layer 3 addresses (such as IP addresses)

  • The protocol type (such as IP or IPX)

  • Directory information stored in Novell's NDS or Microsoft's Active Directory

The advantage of using dynamic VLANs is that network technicians don't have to worry about making any changes on a switch when they move a user from one location to another, which is advantageous when end-to-end VLANs are deployed. Cisco currently allows you to use CiscoWorks 2000 to implement dynamic VLANs based on MAC addresses.

A VLAN Management Policy Server (VMPS) associates MAC addresses to VLANs. When a user connects to a switch and the switch sees the user's MAC address, the switch sends the user's MAC address to the VMPS server. The server responds with the user's VLAN and the switch associates this VLAN with the user's interface.

Problems with MAC-based dynamic VLANs include PC NICs failing, PCs being upgraded, and new PCs continually being added to the network. Managing these MAC addresses soon becomes a headache in a large-scale switched network.

Therefore, most administrators choose to base VLAN membership on directory information. Out of all these mechanisms for implementing dynamic VLANs, the use of directory information is the most flexible and the easiest to maintain. The only time you would have to make changes to the VLAN database is when a user is hired, fired, or changes departments. Many vendors, including Cisco, are developing directory-based dynamic VLANs. The remainder of this chapter and book focus on static VLANs and their configuration.


Dynamic VLANs use a VMPS to assign VLAN information to a switch, which is then associated with a user's port. This enables users to be located anywhere in the network and still be assigned to the correct VLAN. Membership is typically based on a device's MAC address.

Static VLANs

Cisco's initial implementation of VLANs was based on the port that a user was assigned to. This is sometimes referred to as port-based membership. Using this initial implementation, you would configure every port on a switch to reflect the appropriate VLAN for the users. This could easily be done either via a command-line interface or an SNMP-based product using a graphical interface. Anytime a user moved his workstation to a different area, you would have to reconfigure only the port to which the user attaches.

Static VLANs are normally used in local VLAN implementations, where the problem of containing broadcasts is more important than placing specific users in certain VLANs. Use static VLANs when any of the following criteria apply to your situation:

  • You have tight control over the moving of users and resources in the campus

  • You do not want the hassles of maintaining the large tables required of dynamic VLANs

  • You have a management package that easily maintains VLANs in your campus


Static VLANs are manually configured: You specify which interface belongs to which VLAN. This configuration is typically used in a more stable or static environment. Configuring static VLANs is a very simple process.

Creating and Deleting VLANs

Creating VLANs on your switch is a very simple process. There are two methods for creating VLANs on Cisco IOS switches: from Privilege EXEC mode and Configuration mode. The old way, shown here, is done from Privilege EXEC mode:

Switch# vlan database
Switch(vlan)# [no] vlan vlan_number [name vlan_name]

The newer method for configuring VLANs is shown here:

Switch(config)# [no] vlan vlan_number [name vlan_name]

As you can see, the newer method is done from within Configuration mode. To delete a VLAN, just preface the vlan command with the no parameter.


Cisco recommends that you perform all your VLAN configurations using the newer method; that is, from Configuration mode.


Use the vlan command to create your VLANs. This can be done from Privilege EXEC mode within the vlan database or from Configuration mode.

Associating Ports to VLANs

After you've created your VLANs, you can associate your switch's ports to your VLAN with the following configuration:

Switch(config)# interface type slot_#/port_#
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan VLAN_#

When you've entered the interface, use the switchport mode access command to specify that this interface is associated with a single VLAN. The switchport access vlan command associates a VLAN to this particular interface.


Depending on the model, there is at least one pre-configured VLAN on your switch: VLAN 1. By default, all ports are associated with VLAN 1.


Use the switchport mode access command to define an interface as an access link and the switchport access vlan command to associate an interface with a VLAN.

Verifying Your Configuration

After you've created your VLANs and placed interfaces in them, you can use various show commands to verify your VLAN configuration. To view your configured VLANs, use the show vlan command:

Switch# show vlan [id VLAN_# | name VLAN_name]

Without any of the optional parameters, all VLANs are listed. You can optionally specify a VLAN number or name to examine a specific VLAN. Here's an example of the use of this command:

Switch# show vlan
VLAN Name               Status  Mod/Ports
---- -------------------------------- --------- ------------------
1  default             active  fa0/3-24
10  VLAN0010             active  fa0/1-2
20  VLAN0020             active

VLAN Type SAID  MTU  Parent RingNo BridgeNo Stp Trans1 Trans2
---- ----- ------- ----- ------ ------ -------- ---- ------ ------
1  enet 100001 1500 -   -   -    -  0   0
10  enet 100010 1500 -   -   -    -  0   0
20  enet 100020 1500 -   -   -    -  0   0

Primary Secondary Type       Ports
------- --------- --------------- -----------------------------

To see an interface's configuration, use the show running-config interface command:

Switch# show running-config interface fastethernet 0/1
Building configuration...
Current configuration: 33 bytes
interface FastEthernet 0/1
 switchport access vlan 10
 switchport mode access

To see switch port information, use the show interfaces command with the switchport parameter:

Switch# show interfaces type slot_#/port_# switchport

Here's an example:

Switch# show interface fastethernet0/1 switchport 
Name: Fa0/1
Switchport: Enabled
Administrative mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001

Protected: false
Unknown unicast blocked: disabled
Unknown multicast blocked: disabled

Broadcast Suppression Level: 100
Multicast Suppression Level: 100
Unicast Suppression Level: 100

To see which MAC addresses are associated with which interfaces, as well as which VLAN the interface is associated with, you can use the show mac-address-table command, which displays the port address or CAM (content addressable memory) table:

Switch# show mac-address-table
     Mac Address Table

Vlan  Mac Address    Type    Ports
----  -----------    ----    -----
  1  0008.7422.1234  DYNAMIC  Fa0/1

As you can see in this example, there is one MAC address in the table off of interface fa0/1, which is associated with VLAN 1.

Troubleshooting VLAN Problems

If you're experiencing connectivity problems in a VLAN environment, you should perform the following troubleshooting steps:

  1. Do you have a physical and data link layer connection? Check the status of the interface with the show interfaces command. Use CDP to check connectivity. Check the duplexing of the connection (auto negotiation is a common problem with the negotiation of the duplexing mode).

  2. Is your router and switch configuration correct? Verify that you've configured your routing protocol and your router's interface. If you're trunking between the router and the switch, verify this configuration.

  3. Have you set up your VLAN configuration correctly? Check to make sure that the appropriate interfaces are associated with the correct VLANs.

InformIT Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from InformIT and its family of brands. I can unsubscribe at any time.


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.


Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites, develop new products and services, conduct educational research and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.


If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@informit.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.


This site is not directed to children under the age of 13.


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.


Users can always make an informed choice as to whether they should proceed with certain services offered by InformIT. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.informit.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020