How to configure VLANs on Cisco Catalyst Switch

(SINAN A) #16

Hello Rene,

What would happen if we delete VLAN that exit on switchport?
a) port down and use native vlan
b) port down and use default vlan
c) port up and use native vlan
d) port up and use default vlan


Thank you

(Rene Molenaar) #17

Hi Sinan,

By default the native and default VLAN is both VLAN 1 which you can’t delete. If your switchport is assigned to any VLAN which you delete then it will just “float” around in no man’s land…it won’t be assigned automatically to another VLAN.


(jeffery d) #18

when i use switch 2950 enter all the config info all of my links are still show up as if all my interfaces 0/1 & 0/2 are down but all my links are up what do you think the issue could be.

(jeffery d) #19

when i config the switch 2950 fa1 and fa2 with vlan 50 conn my pc 1 to fa1 conn pc to fa2 the computer are unable to ping each other

(jeffery d) #20

i followed these steps

SwitchA(config)interface fa0/1
SwitchA(config-if)#switchport mode access
SwitchA(config-if)#switchport access vlan 50
SwitchA(config)interface fa0/2
SwitchA(config-if)#switchport mode access
SwitchA(config-if)#switchport access vlan 50
(jeffery d) #21

it would be helpful to let the user aware what model switches and model routers that are being used when explaining the steps.

(Rene Molenaar) #22

Hi Jeffery,

Those commands are all you need to put two interfaces in VLAN 50. What’s the output of the following commands?

  • show vlan (to verify that the VLAN exists)
  • show ip interface brief (to check the interface statuses
  • show run int fa0/1 and show run int fa0/2 (to make sure no other commands are applied

The configuration of VLANs is the same on any of the Catalyst switches…the 2950, 2960, 3550, 3560, 3750 and 4500/6500 series use the same commands. The same thing applies to most of the routers.

Also, make sure your windows firewall is not blocking ICMP between your computers…might be wise to disable it for the moment.


(Muhammad Abid s) #23

Sir, I have two queries:

Q1. what is the purpose of native vlan , default vlan?
Q2. what is the difference between native and default vlan ?

thanking you in anticipation.
with best regards.

(Rene Molenaar) #24

Hi Muhammad,

On 802.1Q trunk links, we can send tagged and untagged Ethernet frames. Frames that are untagged are considered to belong to the native VLAN. It is possible to configure your switches to tag the native VLAN btw.

On the native VLAN, you’ll find frames from protocols like CDP, DTP, etc.

On 802.1Q trunk links, we can send tagged and untagged Ethernet frames. Frames that are untagged are considered to belong to the native VLAN. It is possible to configure your switches to tag the native VLAN btw.

On the native VLAN, you’ll find frames from protocols like CDP, DTP, etc.

When you configure an interface in access mode, it will always belong to a default VLAN. On Cisco switches, this is VLAN 1.

The native VLAN is also VLAN 1 by default.

Hope this helps!


(florian k) #25

Hi Rene,

just a short question about the “active” state of Vlan50. In the example mentioned above you create Vlan50 and with “sh vlan” we can see that its active right away, but i thought a Vlan is only active if it has at least one Up/Up interface in it OR if a SVI is configured!?



(Lazaros Agapides) #26

Hello Florian.

The status of a VLAN that shows up in the show vlancommand is by default “active”. Note Cisco’s explanation:

By default, a newly created VLAN is operational; that is, the VLAN is in the no shutdown condition. Additionally, you can configure VLANs to be in the active state, which is passing traffic, or the suspended state, in which the VLANs are not passing packets. By default, the VLANs are in the active state and pass traffic.


What I believe you are referring to are the conditions under which the VLAN’s SVI would be in an UP/UP state.

In order to have an SVI be in an UP/UP state, there must be at least one physical interface assigned to the VLAN as an access port that is not shut down or a trunk port where this vlan is “allowed” that is not shut down.

I hope this has been helpful!


(florian k) #27

Hi Laz,

thanks a lot for the explanation! I think i really confused a VLAN with a SVI.



(Lazaros Agapides) #28

Hi Florian.

Glad I could be of help!


(Abhishek D) #29

Hi Rene,
in a typical enterprise design , can you help me understandin what is the role of VLANs between router and SW 3850, if there is any . while mkaing a trunk link , do i need to create any vlans between “FW…SW–Router” ?

Also is there any role of VLANs post fw , once natting is done ?

| trunk
cisco 3850
| Access
fw (NATting)
LAN (User VLANs)

(Lazaros Agapides) #30

Hello Abhishek.

There are advantages and disadvantages to creating a trunk between the Router and the Cisco 3850 switch. It all depends on what you want to achieve.

You would want to do this if:

  1. you want all of the routing of your network to take place at the Router
    a) advantages of this include: to be able to apply security, access lists and other policies at a single location
    b) disadvantages include single point of failure for routing
  2. if you want to allow VLANs to span multiple areas of your network (if the Router is a layer 3 switch)

You would avoid doing this to:

  1. limit the extent of your VLANs to avoid broadcast traffic going to other access areas of your network
  2. Avoid a single point of failure. The 3850 switch is a layer 3 device and can do routing for all of the local VLANs.

Keep in mind that since you have an access port at the Cisco 3850 you will not create any VLANs beyond this device (lower down in your diagram).

To answer your other questions, please clarify:

What is the FW device and what is the purpose of implementing NAT at this location?

I hope this was helpful!


(Shantel - split this topic #31

19 posts were merged into an existing topic: How to configure VLANs on Cisco Catalyst Switch

(Vitaly K) #32

Hello Rene,
it would be good to mention somewhere about default-gateway vs default-network config. I have never had a chance to use default-network command. Is it usable? if so in what scenarios. I assume it can be pointing to L3 GW network address if L3 routing is enabled on a L3 switch. Please elaborate either privately or add some content if possible.

(Lazaros Agapides) #33

Hello Vitaly

There are essentially three ways to configure a gateway of last resort on an L3 switch or on a router. These differ in their implementation and their functionality.

The ip default-gateway command should only be used when routing is disabled. It essentially tells the device what its default gateway is much like a PC has the default gateway configured. It is used only for the purposes of connectivity with subnets other than its own.

The ip default-network command can be used only when routing is enabled. When you configure ip default-network the router considers routes to that network for installation as the gateway of last resort on the router. In other words, routes to that network become candidate default routes.

A third way of configuring a gateway of last resort is to install a static default route with the command ip route Of course, routing must be enabled for this case as well.

You can find more information about these three commands and their uses at this Cisco documentation.

I hope this has been helpful!


(William V) #34

renee or laz do you know where the voice vlan is stored on a switch also in the vlan.dat file or is it depend on wether it is a normal or extended vlan then stored accordingly to the either vlan.dat or nvram according to rules ? many thanks

(Lazaros Agapides) #35

Hello William

A voice VLAN is the same as any other VLAN. What makes it a voice VLAN is the fact that you define it as such on an interface where a phone is installed. Otherwise, it is no different than any other VLAN. So as far as where it is stored, it is stored in the same place and in the same way as all other VLANs.

I hope this has been helpful!