VLANs, trunking, VTP and inter-VLAN routing
In short: Each switch port is its own collision domain, but a switch floods broadcasts everywhere. VLANs split one switch into several broadcast domains; 802.1Q trunks carry many VLANs over one link; and routers or Layer 3 switches route between VLANs.
Collision and broadcast domains
- Collision domain: the part of a network where two devices sending at once would collide. Every hub port shares one; every switch, bridge and router port is its own.
- Broadcast domain: all devices that receive each other's broadcasts. By default every port on a switch is in the same broadcast domain; routers stop broadcasts at their interfaces.
Large broadcast domains waste bandwidth and CPU on every device. Routers split them, but have few LAN ports. VLANs split them on the switches themselves.
What a VLAN is
A VLAN groups switch ports into a logical network, regardless of where the devices physically sit. Devices in one VLAN behave as if they were on their own separate switch: unicast, broadcast and multicast traffic stays inside that VLAN, and reaching another VLAN needs a router.
Benefits: better security (groups are separated), lower cost (fewer devices), better performance (smaller broadcast domains), easier management, and grouping by department or project instead of by floor.
Access ports, trunk ports and tagging
- Access port: belongs to one VLAN and connects an end device. Frames are sent untagged. (A port can also carry one extra voice VLAN for an IP phone.)
- Trunk port: carries many VLANs between switches, routers or servers. The sending switch adds a 4-byte 802.1Q tag with the VLAN ID (1 to 4094); the receiving switch reads it and removes it before delivering the frame.
- Native VLAN: the one VLAN sent untagged on a trunk. Change it to an unused VLAN for security.
VTP: VLAN Trunking Protocol
VTP is a Cisco protocol that copies VLAN definitions from one switch to others in the same (case-sensitive) VTP domain. It is not a trunking protocol; it simply runs over trunks.
| Mode | Behaviour |
|---|---|
| Server | Creates, changes and deletes VLANs and advertises them (the default mode) |
| Client | Can't change VLANs; applies what the server sends |
| Transparent | Keeps its own local VLANs and passes VTP messages on without applying them |
Careful: a switch added with a higher VTP revision number can overwrite and delete VLANs across the whole domain. Many engineers run switches in transparent mode (or VTP version 3 with a primary server) to avoid this.
Routing between VLANs
- Legacy: one router interface per VLAN. Simple but doesn't scale.
- Router-on-a-stick: one router interface split into sub-interfaces, one per VLAN, over a trunk. Cheap, but all inter-VLAN traffic shares one link and the router's CPU.
- SVI on a Layer 3 switch: a virtual interface per VLAN acts as each VLAN's default gateway; routing happens in switch hardware. The usual choice today.
! Layer 3 switch with SVIs
ip routing
vlan 10
name STAFF
vlan 20
name GUEST
interface vlan 10
ip address 192.168.10.1 255.255.255.0
interface vlan 20
ip address 192.168.20.1 255.255.255.0
interface gigabitEthernet 1/0/1
switchport mode access
switchport access vlan 10
interface gigabitEthernet 1/0/48
switchport mode trunk
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20Real-world example: VLANs in a hotel
A 90-room hotel used one flat network for guests, staff, IP phones and CCTV cameras. Guests could see staff printers on their laptops. The hotel's network partner created four VLANs: guest Wi-Fi, staff, voice and CCTV. Access ports in rooms and offices were assigned to the right VLAN, phones used a separate voice VLAN on the same port as the desk PC, and 802.1Q trunks carried all VLANs between the floor switches and the core.
A Layer 3 core switch with an SVI for each VLAN handled inter-VLAN routing at full speed. ACLs on the SVIs blocked the guest VLAN from every internal network and allowed it only to reach the internet. The CCTV VLAN could reach only the recording server. Guests now see nothing of the hotel's own systems.
Practice
A 24-port switch has no VLANs. How many collision and broadcast domains are there?
How big is an 802.1Q tag, and how many VLAN IDs can it carry?
Why are SVIs usually preferred over router-on-a-stick?
Key takeaways
- Switch ports are separate collision domains but share one broadcast domain.
- VLANs create separate broadcast domains on the same switches.
- Access ports carry one VLAN untagged; trunks carry many with 802.1Q tags.
- VTP copies VLANs between switches; beware the revision-number risk.
- Route between VLANs with router-on-a-stick or, better, SVIs on a Layer 3 switch.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.