Learn how VLANs separate traffic, how access and trunk links preserve membership, what the native VLAN means, and when routing is required.

What you will be able to do

Explain how VLANs separate local traffic into distinct logical groups.
Choose access, trunk, and routed port roles for common connections.
Interpret tagged, untagged, native VLAN, and voice VLAN behavior.
Identify what is required when traffic must move between VLANs.

Why VLANs Exist

A VLAN gives a switch a logical boundary for local Ethernet traffic. Devices can share physical switching hardware while belonging to different traffic groups.

This separation is useful when groups serve different purposes, such as staff devices and guest devices. Frames stay within the relevant VLAN unless a routing function is introduced.

The switch also keeps MAC address information in VLAN context. A learned address in one VLAN does not turn a different VLAN into the same local traffic space.

Access Ports Give Endpoints a VLAN

An access port is the usual connection for a single endpoint. The switch associates incoming traffic with the VLAN selected for that port.

A static access assignment is set deliberately on the port. This makes the endpoint's local VLAN membership depend on the switch port it uses, rather than on a choice made by the endpoint.

An ordinary access port is intended for one VLAN. When no voice VLAN is present, tagged frames arriving from the endpoint are rejected instead of being accepted into an unrelated VLAN.

Match the Port Role to the Link

Switch ports can serve different link purposes. Access, trunk, and tunnel are distinct operating roles, and the role should match the devices and traffic on the connection.

Use the access idea for an endpoint that belongs to one local group. Use the trunk idea when one point-to-point link must transport traffic belonging to several VLANs.

A routed port is a different case. It acts as a Layer 3 connection and is not tied to one particular VLAN in the way an access port is.

Trunks Carry Several VLANs

A trunk lets multiple VLANs share one physical point-to-point link between network devices. This avoids needing a separate cable for each VLAN that must cross the link.

The receiving side needs enough information to preserve each frame's VLAN context. IEEE 802.1Q supports tagged traffic for this purpose while also allowing an untagged category on the trunk.

A trunk extends VLAN transport between devices; it does not merge the VLANs. Each carried VLAN remains a separate local traffic boundary.

Tagged Traffic and the Native VLAN

On an IEEE 802.1Q trunk, tagged frames identify their VLAN as they cross the shared link. Untagged frames use the trunk's native VLAN context.

Both ends must agree on which VLAN is native. A mismatch means the two devices can interpret the same untagged traffic as belonging to different VLANs.

The practical check is therefore two-sided: confirm the link is intended as a trunk, then confirm the native VLAN setting matches at both endpoints.

Voice and Data Can Share an Access Port

A voice VLAN is a controlled exception to the one-VLAN access-port pattern. A Cisco IP Phone connection can distinguish voice traffic from data traffic while using one physical access link.

With a voice VLAN configured, the port accepts tags for that voice VLAN. Tags that identify other VLANs are not accepted through the same access connection.

This exception does not make the port a general trunk. It provides a specific voice-and-data arrangement for the connected phone and data device.

Moving Between VLANs Requires Routing

VLAN separation is a Layer 2 boundary, so switching alone does not move traffic from one VLAN into another. Inter-VLAN communication needs a Layer 3 path.

One supported method is to create a VLAN interface and give it an IP address. That interface supplies an IP endpoint for routing traffic associated with the VLAN.

Do not confuse a VLAN interface with a routed physical port. The VLAN interface represents a VLAN for routing, while the routed port operates without membership in a particular VLAN.

Choose the Role, Then Check Both Ends

Start with the link's purpose. An endpoint usually needs an access membership, several VLANs between devices need a trunk, and a direct Layer 3 link may need a routed port.

Next, check how frames will be classified. Access traffic inherits the port's VLAN, trunk traffic preserves several VLAN contexts, and untagged trunk traffic follows the native VLAN.

Finally, check paired settings where a link has two network endpoints. Trunk intent and native VLAN agreement must be consistent across the connection.

Recap Before Practice and Prove

A VLAN creates a logical local traffic boundary on shared switching hardware. MAC learning and forwarding remain associated with that VLAN context.

An access port places ordinary endpoint traffic into its configured VLAN. A voice VLAN is a limited exception that can separate phone traffic from data traffic on one access link.

A trunk transports several VLANs between devices. IEEE 802.1Q tags preserve VLAN identity, while untagged trunk traffic belongs to the native VLAN.

The native VLAN must match at both trunk endpoints. This prevents the two devices from assigning different VLAN meanings to the same untagged frames.

Communication between separate VLANs needs routing. A VLAN interface with an IP address can provide that Layer 3 path, while a routed port is not assigned to one VLAN.

VLAN Fundamentals