CompTIA Network+ Preparation · lesson 9 of 30 · 25 min
VLAN Fundamentals
VLAN (Virtual Local Area Network) — logical segmentation of a physical network. Devices in the same VLAN communicate as if on the same physical switch, regardless of physical location. Devices in different VLANs cannot communicate without a router (or Layer 3 switch).
Why use VLANs: Security (isolate sensitive systems), performance (reduce broadcast domains), flexibility (group users by function not location), simplified management.
Broadcast domain — all devices that receive a broadcast frame. Each VLAN is its own broadcast domain. Smaller broadcast domains = less broadcast traffic = better performance.
VLAN IDs: 1–4094. VLAN 1 is the default VLAN on Cisco switches — all ports belong to VLAN 1 by default. VLAN 1 should not be used for user traffic (security best practice).
Native VLAN — untagged traffic on a trunk port. Default is VLAN 1. Change the native VLAN to an unused VLAN to prevent VLAN hopping attacks.
Trunk Ports and 802.1Q
Access port — switch port assigned to a single VLAN. End devices (PCs, printers) connect to access ports. Traffic is untagged.
Trunk port — switch port that carries traffic for multiple VLANs. Used between switches and between switches and routers. Traffic is tagged with VLAN ID using 802.1Q.
802.1Q (dot1q) — IEEE standard for VLAN tagging. Inserts a 4-byte tag into the Ethernet frame containing the VLAN ID (12 bits = 4094 VLANs). The native VLAN is not tagged on a trunk.
Inter-VLAN routing — VLANs are separate Layer 2 networks. To route between them, you need a Layer 3 device:
Router-on-a-stick — single physical router interface with sub-interfaces, one per VLAN. Each sub-interface has an IP and is configured with 802.1Q encapsulation.
Layer 3 switch (SVI) — switch with routing capability. SVIs (Switched Virtual Interfaces) act as the default gateway for each VLAN. More scalable than router-on-a-stick.
Security Note
VLAN hopping attacks exploit the native VLAN or DTP (Dynamic Trunking Protocol). Mitigate by: changing the native VLAN to an unused VLAN, disabling DTP (switchport nonegotiate), and explicitly configuring all ports as access or trunk.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Network+ — VLANs
Each VLAN creates its own:
- Routing table
- Broadcast domain
- MAC address table
- IP subnet automatically
- Answer: Broadcast domain
VLANs segment broadcast domains — broadcasts in VLAN 10 do not reach VLAN 20. Smaller broadcast domains improve performance. 802.1Q tagging is used on:
- Access ports
- Trunk ports
- All switch ports
- Router WAN interfaces
- Answer: Trunk ports
802.1Q tags frames with VLAN IDs on trunk ports so the receiving switch knows which VLAN each frame belongs to. The native VLAN on a trunk port is:
- Always VLAN 1 and cannot be changed
- The VLAN whose traffic is untagged on the trunk
- The management VLAN
- The highest-numbered VLAN
- Answer: The VLAN whose traffic is untagged on the trunk
Native VLAN traffic is not tagged with 802.1Q. Default is VLAN 1 but should be changed to an unused VLAN for security. Router-on-a-stick uses:
- Multiple physical router interfaces
- One physical interface with sub-interfaces, one per VLAN
- A Layer 3 switch only
- Multiple routers
- Answer: One physical interface with sub-interfaces, one per VLAN
Router-on-a-stick: single physical link to the switch, with logical sub-interfaces (e.g., Gi0/0.10, Gi0/0.20) for each VLAN. To communicate between VLANs, you need:
- A hub
- A Layer 2 switch
- A router or Layer 3 switch
- Nothing — VLANs communicate automatically
- Answer: A router or Layer 3 switch
VLANs are separate Layer 2 networks. Inter-VLAN routing requires a Layer 3 device (router or L3 switch with SVIs). VLAN hopping attacks can be mitigated by:
- Using VLAN 1 for all traffic
- Changing the native VLAN and disabling DTP
- Enabling all VLANs on all ports
- Using access ports for uplinks
- Answer: Changing the native VLAN and disabling DTP
VLAN hopping exploits the native VLAN and DTP auto-negotiation. Fix: change native VLAN to unused, disable DTP (switchport nonegotiate). An SVI (Switched Virtual Interface) on a Layer 3 switch acts as:
- A physical port
- The default gateway for a VLAN
- A trunk port
- A DHCP server
- Answer: The default gateway for a VLAN
SVIs are virtual interfaces on a Layer 3 switch — one per VLAN, each with an IP address that serves as the default gateway for that VLAN.
End devices connect to which type of switch port?
- Trunk port
- Access port
- Uplink port
- Management port
Answer: Access port
Access ports carry traffic for a single VLAN and are untagged — used for end devices like PCs, printers, and IP phones.
The default VLAN on Cisco switches is:
- VLAN 0
- VLAN 1
- VLAN 100
- VLAN 4094
- Answer: VLAN 1
VLAN 1 is the default — all ports belong to it initially. Best practice: do not use VLAN 1 for user traffic.
802.1Q inserts a _____ -byte tag into Ethernet frames to carry the VLAN ID.
Answer: 4
The 802.1Q tag is 4 bytes: 2-byte TPID (0x8100) + 2-byte TCI containing the 12-bit VLAN ID and priority bits.
Previous lesson: IPv6 addressing: types, notation, autoconfiguration (SLAAC), DHCPv6
Back to CompTIA Network+ Preparation
Next lesson: Cabling and connectors: Cat 5e/6/6A, fiber (SMF/MMF), LC/SC/ST, RJ-45, twinaxial