Switching and VLANs
Lesson 3 of 6
3Switching and VLANs
The big pictureA company has an accounting floor, a guest network and cameras, all plugged into the same switches. You do not want a guest to see the accountant's machine, and you do not want separate switches for every department. The answer is to split the switch itself into virtual networks.
What the picture shows: The switch writes each frame's source in its table, and sends the frame to the destination's port if it knows it, or out of every port if it does not yet.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
A switch is a receptionist in a building: at first they know no one, so a message for someone whose office is unknown gets called out in every corridor. Over time they learn every office and deliver directly. A VLAN splits the building into sealed departments: accounting never hears the guests' announcements, even in the same building.
A switch reads the source MAC and records it against the port (aged out after a timeout, 300 seconds by default on Cisco), then forwards by the destination MAC: one port if known, flooding within the VLAN if unknown or broadcast. Each VLAN is a separate broadcast domain and usually a subnet; its ID is 12 bits (1 to 4094). A trunk carries several VLANs with a 4-byte 802.1Q tag, except the native VLAN. Routing between them uses router-on-a-stick or an SVI on a layer 3 switch. STP or Rapid PVST+ prevents loops, and EtherChannel (LACP) bundles cables.
Before You Start
🏷️MAC
You know MAC is the layer 2 address.
🧮Subnets
Each VLAN is usually its own subnet.
The Core Idea
1How a switch learns
Nobody programs a switch with device locations; it learns them from the traffic itself. Every frame that comes in tells it "this device is behind this port". When it does not know the destination it floods the frame, and learns where it is from the reply.
A switch in ten lines: learn, then forward or flood.
table = {} # MAC -> port
def frame(src, dst, port, all_ports=(1, 2, 3, 4)):
table[src] = port # learn the source
if dst in table:
out = [table[dst]] # known: one port
how = "forward"
else:
out = [p for p in all_ports if p != port] # unknown: flood
how = "flood"
print(f"{src}->{dst} in port {port}: {how} to {out} table={table}")
frame("AA", "CC", 1)
frame("CC", "AA", 3)
frame("AA", "CC", 1)| Incoming frame | What the switch does |
|---|---|
| To an address in the table | Sends it out one port |
| To an unknown address | Floods it out every VLAN port except the one it came in |
Broadcast FF:FF:FF:FF:FF:FF | Out every port of the same VLAN |
| Its destination is on the incoming port | Drops it |
2VLANs: virtual networks on one switch
Each switch port is assigned to a VLAN. Devices in VLAN 10 do not see VLAN 20's broadcasts or reach it directly, as if on separate switches. When two switches connect, one trunk link carries every VLAN, and each frame on it carries a tag saying which network it belongs to.
This is how the commands look in Packet Tracer and on real Cisco gear.
! Cisco IOS: two VLANs, an access port and a trunk SW1(config)# vlan 10 SW1(config-vlan)# name ACCOUNTING SW1(config)# vlan 20 SW1(config-vlan)# name GUESTS SW1(config)# interface gi0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config)# interface gi0/24 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk allowed vlan 10,20 SW1# show vlan brief
3Loops and STP
For backup we connect switches with more than one cable. But a layer 2 frame has no TTL, so a loop would carry a broadcast round forever and flood the network in seconds. STP elects a root bridge, works out each switch's shortest path to it, blocks the spare ports, and opens them only if the main path fails.
Worked example
The task: a second-floor machine is plugged in and reaches nothing, and the port light is green. What do you check? The answer: layer 1 is fine (green light). Check layer 2: show vlan brief to see whether the port is in the right VLAN, then show interfaces trunk to confirm the VLAN is allowed on the trunk towards the router. A very common mistake: a new VLAN was created but never added to the trunk's allowed list.
Myth vs Reality
| Myth | Reality |
|---|---|
| VLANs are enough for security. | They isolate broadcasts, but security also needs ACLs and port protection. |
| A switch sends everything to every device. | That is the old hub. A switch sends only to the destination once it has learned. |
| Two cables between switches double the speed automatically. | Without EtherChannel, STP blocks one of them. |
Where you meet it at work
🏢Company network
One VLAN for staff, another for guests, a third for cameras and phones.
🏠Home
The "guest network" on your router is usually a separate VLAN.
🧪Lab
Packet Tracer: two switches, VLANs 10 and 20, router-on-a-stick.
Test your understanding
Which address does a switch learn from?
The source tells it where the sender is, so it records it with the incoming port.
What does a switch do with a frame for an unknown destination?
Flooding ensures delivery, and the reply teaches it where the destination is.
How many bits is the VLAN ID in an 802.1Q tag?
12 bits give 4096 values, 4094 of them usable.
What prevents loops at layer 2?
Frames have no TTL, so STP blocks the spare ports.
What does a switch do with a frame whose destination is not in its table?
Flooding guarantees delivery, then the switch learns from the reply.
What is STP for?
It blocks redundant ports so one loop-free path remains.
Quick review cards
Check Your Understanding
Why can a VLAN 10 device not reach a VLAN 20 device on the same switch?
Because they are different networks; a router or layer 3 switch is needed between them.
What is the danger of a layer 2 loop?
A broadcast storm circling forever and freezing the network, since frames have no TTL.
What is the native VLAN?
The VLAN that crosses the trunk untagged.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Video1
Done with this lesson?
Sign in to save your progress.