CCNA Switching Fundamentals: VLANs, Trunking (802.1Q), and Spanning Tree Protocol (STP)

Layer 2 switching is the bedrock of modern local area networks (LANs). In enterprise environments, network engineers must segment traffic, isolate sensitive departments, prevent broadcast storms, and ensure redundant uplinks remain loop-free.

This comprehensive CCNA 200-301 study tutorial breaks down VLAN architectures, 802.1Q trunking mechanics, Spanning Tree Protocol (STP) operations, and Inter-VLAN routing with step-by-step Cisco IOS CLI configuration examples.

1. What is a VLAN and Why is it Critical?

A VLAN (Virtual Local Area Network) is a logical grouping of switch ports that behave as if they are connected to distinct physical switches. By default, all ports on a Cisco switch belong to VLAN 1 (the default management VLAN).

Key Advantages of VLAN Segmentation:

• Broadcast Domain Containment: Limits broadcast traffic (like ARP, DHCP requests) to the specific VLAN, preventing bandwidth degradation across the campus network.
• Security & Isolation: Devices in different VLANs cannot communicate directly at Layer 2. Traffic must pass through a Layer 3 firewall or router where Access Control Lists (ACLs) can be enforced.
• Departmental Organization: Logically separates Finance, HR, IT Support, Guest Wi-Fi, and IoT devices regardless of physical desk locations.

2. Step-by-Step Cisco Switch VLAN Configuration

Here is how to create VLANs and assign access ports on a Cisco Catalyst switch using standard Cisco IOS CLI:

Switch# configure terminal
Switch(config)# vlan 10
Switch(config-vlan)# name FINANCE
Switch(config-vlan)# vlan 20
Switch(config-vlan)# name DEVELOPERS
Switch(config-vlan)# exit

! Assign single interface to VLAN 10
Switch(config)# interface FastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Assign a range of interfaces to VLAN 20
Switch(config)# interface range FastEthernet 0/2 - 10
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# end

! Verification command
Switch# show vlan brief

3. Trunking & IEEE 802.1Q Encapsulation

When multiple VLANs need to traverse a single physical link between two switches (or between a switch and a router), an Access Port is insufficient. We must configure a Trunk Port.

Trunk links insert an IEEE 802.1Q 4-byte Tag into the Ethernet frame header. This tag contains a 12-bit VLAN Identifier (VID), allowing the receiving switch to identify which VLAN the frame belongs to before forwarding it.

! Configuring a Gigabit Trunk Uplink
Switch(config)# interface GigabitEthernet 0/1
Switch(config-if)# switchport trunk encapsulation dot1q  (Required on some Catalyst models)
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# end

! Verify active trunk interfaces
Switch# show interfaces trunk

4. Spanning Tree Protocol (STP - IEEE 802.1D / 802.1w)

In enterprise networks, physical redundancy is essential so that a single cable or switch failure doesn't disconnect an entire building. However, redundant Layer 2 links create catastrophic Broadcast Storms and MAC Table instability without a loop prevention mechanism.

Spanning Tree Protocol (STP) solves this by placing redundant physical links into a temporary Blocking / Discarding state while keeping active paths open. If the primary link fails, STP recalculates and transitions the backup port to Forwarding.

STP Port Roles & States:

• Root Port (RP): The port on a non-root switch with the lowest path cost to the Root Bridge.
• Designated Port (DP): The port forwarding traffic on a given network segment.
• Blocking / Alternate Port: Port held in standby to prevent loops.

! Enabling Rapid-PVST+ (802.1w) for sub-second convergence
Switch(config)# spanning-tree mode rapid-pvst

! Making this switch the Root Bridge for VLAN 10
Switch(config)# spanning-tree vlan 10 root primary

! Verifying STP Root and Port States
Switch# show spanning-tree vlan 10

5. Inter-VLAN Routing (Router-on-a-Stick)

Because VLANs live in isolated broadcast domains, hosts in VLAN 10 cannot talk to VLAN 20 without Layer 3 routing. The most common traditional method is Router-on-a-Stick (ROAS), where a router uses logical sub-interfaces over a single physical 802.1Q trunk.

! Cisco Router Configuration for Inter-VLAN Routing
Router(config)# interface GigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface GigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

Router(config)# interface GigabitEthernet 0/0
Router(config-if)# no shutdown

Summary & Practical Exam Tips

When studying for CCNA 200-301, remember:

1. Native VLAN mismatches cause security vulnerabilities and traffic leaks. Always keep native VLANs consistent across both ends of a trunk.
2. Use spanning-tree portfast and bpduguard enable on all edge access ports connected to end-user PCs for fast DHCP negotiation and protection.