VLAN Design Challenge — TechKnowSurge

About this interactive

What you're doing: a two-floor office with one switch per closet, a fibre between them and one router. You assign the five VLANs to what each is for, then designate five links — plain access, access with a voice VLAN, or trunk. Why it matters: the rule most people learn first, that a trunk is the port carrying more than one VLAN, is wrong, and this scenario is built to break it. A Sales desk port carries VLAN 10 for the PC and VLAN 30 for the phone and is still configured as an access port, because what decides the mode is whether the far end reads 802.1Q tags — a PC does not. The switch-to-switch fibre and the router link are trunks for exactly that reason: both ends do. How to use it: for each port, ask what device is on the other end and whether it understands tags before you ask how many VLANs cross the cable. The last position is the one worth sitting with — management is not a port role at all, and the card that says so also names the mistake that follows from thinking it is.

What you'll learn

Assign VLAN IDs and names to the departments, the voice devices, and the switch management interfaces of a small two-closet office, and explain what each VLAN buys that a flat network does not
Distinguish an access port from an 802.1Q trunk by what is on the other end of the cable rather than by how many VLANs cross it
Explain why a port serving an IP phone with a PC behind it is configured as an access port with a voice VLAN rather than as a trunk
Trace how the native VLAN, the management VLAN, and a router-on-a-stick subinterface each depend on the trunk between switches, and predict what breaks when a VLAN is pruned off that trunk

Aligned to

Cisco CCNA

2.1 Configure and verify VLANs (normal range) spanning multiple switches

2.2 Configure and verify interswitch connectivity

3.4 Configure and verify inter-VLAN routing

CompTIA Network+

2.3 Given a scenario, configure and deploy common Ethernet switching features

5.4 Given a scenario, troubleshoot common network issues

Cisco CCST Networking

3.3 Explain the basic functionality of switches and VLANs

Key terms

Virtual LAN: A logical grouping of switch ports into a single broadcast domain, independent of the physical location of the devices. Each VLAN is normally mapped to its own IP subnet, and traffic between VLANs must pass through a router or a layer 3 switch.
Access Port: A switch port that belongs to a single data VLAN and sends and receives untagged frames, used for connecting end devices such as PCs and printers. An access port may additionally carry a tagged voice VLAN for an IP phone without becoming a trunk.
Trunk Port: A switch port that carries traffic for multiple VLANs over a single link by tagging frames with their VLAN ID, used between switches or between a switch and a router. All VLANs are tagged except the native VLAN.
IEEE 802.1Q: The standard for VLAN tagging on Ethernet, which inserts a four-byte tag containing a 12-bit VLAN ID and a 3-bit priority field into the frame header so that a single link can carry traffic for many VLANs.
Native VLAN: The one VLAN on an 802.1Q trunk whose frames are sent untagged. Any untagged frame received on the trunk is assigned to it. Both ends of a trunk must be configured with the same native VLAN.
Voice VLAN: A VLAN dedicated to IP telephony traffic, configured on an access port alongside a data VLAN. The switch instructs the attached IP phone via CDP or LLDP-MED to tag its voice frames with the voice VLAN ID, while an attached PC's untagged frames remain in the data VLAN.
Switch Virtual Interface: A virtual layer 3 interface on a switch associated with a VLAN. On a layer 2 switch a single SVI provides the management IP address; on a layer 3 switch, SVIs also route between VLANs.
Router-on-a-Stick: An inter-VLAN routing design in which a single physical router interface is connected to a switch trunk and divided into subinterfaces, one per VLAN, each configured with 802.1Q encapsulation and the default gateway address for that VLAN's subnet.
Broadcast Domain: The set of devices that will receive a broadcast frame sent by any one of them. A switch forwards broadcasts to every port in the same VLAN, so each VLAN is one broadcast domain and a router is required to cross between them.
Management VLAN: A VLAN reserved for administrative access to network devices, separating switch and router management traffic from user data traffic so that a compromised end device does not share a broadcast domain with the management addresses.
VLAN Hopping: An attack in which traffic reaches a VLAN it should not, either by negotiating a trunk on a port left in dynamic mode or by double-tagging a frame so the outer tag is stripped as the native VLAN and the inner tag carries it into another VLAN.

Topics

Interactive Build

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →