VLANs on Cisco Switches: Creating, Assigning, and Verifying

A VLAN (virtual LAN) is created on a Catalyst switch with vlan <id> in global configuration mode, optionally named with name <text>, and a port joins it with the interface pair switchport mode access followed by switchport access vlan <id>. Verification is show vlan brief, which prints every VLAN with its name, status, and the access ports that belong to it. Normal-range VLAN definitions do not live in the configuration file; they live in a separate database file in flash called vlan.dat, and that single fact explains most of the surprises engineers hit with VLANs.

What a VLAN is on the switch

Each VLAN is one broadcast domain. Two ports in the same VLAN forward frames to each other through the switch fabric; two ports in different VLANs cannot exchange a frame at Layer 2 at all, no matter what IP addresses the hosts carry. Putting two hosts in the same IP subnet does nothing to help them if their ports sit in different VLANs, and this is the most common cause of a “same subnet, cannot ping” ticket. A VLAN ID is locally significant to the switch until the traffic leaves on a trunk, at which point the ID travels inside the frame header (covered in 802.1Q trunking).

Reaching hosts in a different VLAN requires a routed hop, either an SVI (switched virtual interface) on a Layer 3 switch or a router, which is the subject of inter-VLAN routing. An SVI is not needed for two hosts inside one VLAN to talk to each other, and confusing those two cases is a reliable way to lose a troubleshooting question.

Creating VLANs

SW1(config)# vlan 40
SW1(config-vlan)# name DATA
SW1(config-vlan)# exit

The switch will also create a VLAN implicitly. If you assign a port to a VLAN ID that is not yet in the database, IOS builds it for you and says so:

SW1(config)# interface range GigabitEthernet1/0/11 - 14
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 55
% Access VLAN does not exist. Creating vlan 55

The result is identical to typing vlan 55 by hand except for one detail: an auto-created VLAN receives the default name pattern VLAN0055. If a requirement specifies a name, you must create the VLAN explicitly and name it, because the implicit path never produces a custom name.

switchport mode access pins the administrative mode so the port can never be talked into becoming a trunk, since it also stops the port from sending or acting on DTP (Dynamic Trunking Protocol) frames. On any port facing an end device, configure it.

VLAN ranges and reserved IDs

Property	Normal range	Extended range
VLAN IDs	1 to 1005	1006 to 4094
Reserved entries	1002 to 1005 (FDDI and Token Ring)	none
Default storage	vlan.dat in flash	running configuration
VTP version 1 and 2 support	Advertised normally	Requires VTP transparent mode

Five entries are built into the platform and cannot be removed: VLAN 1, named default, plus 1002 through 1005. A switch whose VLAN database file has been deleted and whose startup configuration has been erased comes back up with exactly those five, never with an empty database. VLAN 1 is also the access VLAN every port sits in out of the box, which is why an unconfigured switch behaves as one flat segment.

The four legacy entries display a status of act/unsup, a contraction of active and unsupported. They exist for FDDI and Token Ring media that an Ethernet-only switch cannot carry. A VLAN an engineer has shut down reads act/lshut instead, and a defined VLAN with no member ports still reads active.

Extended-range VLANs carry one extra condition. On VTP version 1 and 2 the switch has to be in transparent mode before it will accept them, which is one of the practical differences between the VTP modes.

Reading show vlan brief

SW1# show vlan brief

VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/5, Gi1/0/6, Gi1/0/7
10   DATA                             active    Gi1/0/1, Gi1/0/2
20   VOICE                            active    Gi1/0/3
30   MGMT                             active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup

The Ports column lists interfaces whose access VLAN is that VLAN. An operational trunk belongs to many VLANs at once, so trunks are omitted from this output entirely. An uplink that passes traffic normally yet appears nowhere in this table is almost always trunking, and show interfaces trunk is where it will show up. A shut-down access port, by contrast, is still printed under its access VLAN.

To narrow the table to one VLAN, use show vlan id 20. There is no VLAN argument for the brief keyword, so show vlan brief 20 is invalid syntax. show vlan name exists but takes a name rather than a number. For per-port detail including the operational mode and the voice VLAN a phone and a PC share on one port, use show interfaces gigabitethernet 1/0/7 switchport.

Deleting a VLAN and its consequences

no vlan 25 in global configuration mode removes the database entry and nothing else. Interfaces carrying switchport access vlan 25 keep that line in the running configuration, so they are stranded in a VLAN the switch no longer knows and go inactive. IOS does not relocate them to VLAN 1 and does not err-disable them. Re-creating the VLAN with vlan 25 restores service without touching a single interface.

Persistence and wiping a switch

Normal-range VLANs are written to vlan.dat in flash, separate from the startup configuration in NVRAM (non-volatile RAM). Because of that separation, write erase followed by reload leaves the previous site’s VLANs fully intact on a redeployed switch. Clearing them requires deleting the file:

SW1# delete flash:vlan.dat
SW1# write erase
SW1# reload

Repeating erase startup-config never touches the database, and copy running-config startup-config moves in the opposite direction.

Rejected commands on a routed port

On a Layer 3 Catalyst switch, no switchport converts an interface into a routed port with its own IP address. That port has no VLAN membership, so IOS refuses every switchport subcommand on it and reports that the interface is not a switching port. Nothing is stored for later. Entering the bare switchport command converts the interface back to Layer 2 and discards the routed configuration including the IP address, and only then is switchport access vlan 25 legal. This is the opposite of what happens on a trunking port, where switchport access vlan 70 is accepted, stored, and simply lies dormant until the port operates in access mode.

How the 200-301 exam tests this

• Two hosts, one subnet, no connectivity. The output shows one host’s port with Access Mode VLAN: 1 (default) while the other sits in the intended VLAN. The fix is the access VLAN assignment on the misconfigured port, not an SVI, not the native VLAN, and not the trunk’s allowed list.
• Works locally, fails across the uplink. Hosts on one switch reach each other but not their peers on the neighbor switch. The two checks that matter are whether the VLAN is defined and not shut down on the far switch, and whether it survives the allowed VLAN list on both trunk ports.
• Persistence trick. A used switch still shows old VLANs after an erase and reload. The answer is always deleting vlan.dat from flash.
• Command outcome. A command is applied to a port in an unexpected mode, and you pick between accepted-and-dormant, rejected, auto-created, or err-disabled. Access VLAN on a trunk is stored; any switchport command on a routed port is rejected; an access VLAN naming a missing VLAN creates it.

Assigning a port to a VLAN is the archetypal simulation task, which is why typing these commands beats recognizing them when the emulator hands you a live prompt and no hints. The multiple-choice side yields to the same treatment — exam-style practice questions surface the command-outcome traps before test day does.

Quick reference

• Create with vlan <id> then name <text>; assign with switchport mode access plus switchport access vlan <id>.
• Assigning a nonexistent normal-range VLAN auto-creates it with the name VLAN00xx.
• switchport mode access also disables DTP, which is what makes the port unable to become a trunk.
• VLAN 1 and 1002 through 1005 cannot be deleted; the legacy four read act/unsup.
• Normal-range VLANs live in flash:vlan.dat and survive write erase and reload.
• Deleting a VLAN leaves its ports configured and inactive rather than moving them to VLAN 1.
• show vlan brief lists access ports only; operational trunks never appear in it.
• show vlan id 20 filters to one VLAN; show vlan brief 20 is not valid syntax.