VLANs and trunking
What a VLAN actually does to a frame, the difference between an access port and a trunk, and why the native VLAN is the setting that turns a tidy design into a way onto another network. Covers tagging, allowed lists, voice VLANs, and the specific faults that look like cabling problems and are not.
Doing it
Setting up segmentation that holds, in the order the ports get configured — with the defaults that quietly undo it called out where they bite.
- 01
Decide what each VLAN is for before you number it
A VLAN is a broadcast domain, and the only reasons to make another one are separation of traffic, separation of trust, or containing broadcast on a large flat network. Numbering first and finding a purpose later is how a site ends up with fourteen VLANs and one subnet doing all the work.
- 02
Set access ports explicitly, both halves
An access port carries one VLAN, untagged, to one device. Set the mode and the VLAN — `switchport mode access` and `switchport access vlan <id>` — because a port left on dynamic will negotiate a trunk with anything that asks for one, which is the classic VLAN-hopping opening.
Caution`switchport mode dynamic desirable` on an access port is a finding, not a default. Add `switchport nonegotiate` and set the mode by hand.
- 03
Trunk only where a trunk is needed
A trunk carries several VLANs between switches, or to an access point or hypervisor that tags for itself. Everywhere else, a trunk is extra reach for anything that gets onto the port. Set the allowed list explicitly rather than leaving it at all — a trunk defaults to carrying every VLAN the switch knows about.
- 04
Change the native VLAN, and match it at both ends
The native VLAN is the one that crosses a trunk untagged. Leaving it at VLAN 1 means untagged traffic arriving on a trunk lands in the same VLAN as the management interface on most default configurations. Move it to an unused ID, set it identically on both ends, and put nothing else in it.
CautionA native VLAN mismatch between two ends merges two broadcast domains silently. It does not error — it just quietly bridges networks that were supposed to be separate.
- 05
Give voice its own VLAN, on the same port
A desk phone with a PC behind it wants the phone tagged into a voice VLAN and the PC untagged in the data VLAN, on one access port. That is what `switchport voice vlan` does. It is not a trunk, and configuring it as one gives the PC reach it should not have.
- 06
Prune, then verify from the far end
Remove VLANs from trunks that do not need to carry them, then check what actually arrives rather than what the config says should. A device that links at gigabit and gets no address is almost always in the wrong VLAN, not on a bad cable.
- What is the difference between an access port and a trunk port?
- An access port belongs to exactly one VLAN and sends frames untagged — the device on the end has no idea a VLAN exists. A trunk carries several VLANs and tags each frame with its VLAN ID so the switch at the other end can tell them apart. Devices get access ports; the links between switches, and to access points or hypervisors that tag for themselves, get trunks.
- Why is the native VLAN a security problem?
- Traffic in the native VLAN crosses a trunk untagged, and on most default configurations the native VLAN is 1 — the same VLAN the switch manages itself in. That means untagged frames injected onto a trunk land next to the management interface. Move the native VLAN to an unused ID, use it for nothing, and set it identically at both ends.
- My device links but gets no IP address. Is that a VLAN problem?
- Usually, yes. A link light means the physical layer is fine, so the cable is not the suspect. Either the port is in a VLAN with no DHCP service reaching it, or the VLAN has been pruned off the trunk somewhere upstream. Check the port's VLAN first, then check the trunk between that switch and wherever DHCP lives.
- Does a VLAN make traffic secure?
- It separates broadcast domains; it does not encrypt anything, and it only separates traffic as well as the configuration holds. VLANs are a segmentation tool, and the routing between them is where policy is actually enforced. Treating a VLAN boundary as a security boundary without an access list between them is a common and expensive assumption.
- How many VLANs should a small office have?
- Fewer than most designs propose. Data, voice, and something for devices you do not trust — cameras, door controllers, guest — covers most sites. Each additional VLAN needs routing, a DHCP scope, and a firewall rule to be useful, so one you cannot describe the purpose of is a maintenance cost with no benefit.
The rest of the section
- 01RJ45 Wiring: T568A and T568BBoth colour codes, pin by pin, side by side.
- 02RJ11 Wiring and Phone PinoutsSix positions, three lines, two colour systems.
- 03Keystone Jack TerminationStrip, seat, punch, snap — without failing the certification.
- 0466 Block WiringFifty rows, four columns, and where the bridging clips go.
- 05110 Block WiringLay the pairs in, press the connecting block on.
- 06Cat5e vs Cat6 vs Cat6a vs Cat8Speed, distance, and power decide it — not the bigger number.
- 07Fibre Types, Connectors and PolishRead the jacket, read the connector, don't mate blue to green.
- 08Subnetting, ExplainedWhere the numbers come from, and the meaning behind them.
- 09PoE Standards and Why It Won't PowerThe switch reserves the class, not the draw.
- 10Camera Lens, Field of View and Pixel DensityCovering the room is not the same as identifying a face in it.
- 11Patch Panels and Labelling to TIA-606A label that survives is worth more than a tidy rack.
- 12Rack Planning: Units, Depth, Weight and HeatIt fits vertically. That was never the hard part.
- 13Writing a Switch ConfigurationFrom factory default to a switch you would hand over.
- 14Networking and Cabling GlossaryThe terms, and what they mean on a job.
- 15POTS to VoIP: What BreaksThe lines nobody remembers until they stop working.
- 16Testing an Analogue Phone LineTip, ring, and the four numbers that tell you whose fault it is.
- 17Toning and Tracing a CableFinding one pair in a bundle of two hundred.
- 18Reading a Cable Certifier ReportWhat PASS* actually means, and which number to look at first.
- 19Which Cable Tester Do You Need?Three tiers, and the one most people actually need.
- 20Running an Office Floor RestackEveryone sits down Monday and their machine works.
- 21Cable Management for Desks and RacksTidy is a by-product. Serviceable is the point.
- 22Asset Tagging and CMDB AuditsThe scan is easy. Scanning it into the right record is the job.
- 23Cabling an Office Fit-OutHow many drops, run where, and what it takes to add one later.
- 24Parcel Locker Site SurveysWhether the unit fits, powers, connects — and gets in the door.
- 25Spanning Tree and Switching LoopsWhy one patch cord can take a whole floor down in seconds.
- 26Reading a TracerouteWhich loss is real, and whose network it is in.
- 27DHCP, DNS and Helper AddressesWhy the new VLAN gets no addresses, and why it is always DNS.
- 28Wi-Fi Channel Planning and AP PlacementMore access points at lower power, not fewer at maximum.
- 29SMART Attributes That Predict FailureA drive can report PASSED while it is visibly dying.
- 30BitLocker: Keys, Recovery and EscrowThe key exists somewhere, or the data does not.
- 31Grounding and Bonding a Telecom RoomOne ground, one path, and no loops between rooms.
- 32UPS Sizing: VA, Watts and RuntimeThe number on the box is not the number you need.
- 33Mounting Displays on Any WallFind the structure. Everything else is a repair bill.
- 34Mounting IP CamerasHeight, angle, and the surfaces that ruin the picture at night.
We do this work
as well as document it
Anyone configuring a switch port and wanting to be sure what will and will not reach it, or diagnosing a device that links but has no address.