A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Every switch port is either an access port or a trunk. Access ports belong to one VLAN and connect to endpoints. Trunk ports carry multiple VLANs and connect switches (or a switch to a router). Get the two right and 90% of VLAN configuration falls into place.
| Port type | Carries | Connects to | Frame handling |
|---|---|---|---|
| Access | One VLAN | Endpoints (PCs, printers, phones) | Untagged frames |
| Trunk | Multiple VLANs | Switches, routers, hypervisors | 802.1Q tagged frames |
The key insight: an access port strips VLAN tags from frames going to the endpoint, and applies the port's configured VLAN to frames coming from the endpoint. Endpoints don't know they're in a VLAN — they just see normal Ethernet.
Switch1(config)# vlan 10Switch1(config-vlan)# name SalesSwitch1(config-vlan)# exitSwitch1(config)# interface gigabitEthernet0/1Switch1(config-if)# description Sales-PC-01Switch1(config-if)# switchport mode accessSwitch1(config-if)# switchport access vlan 10Switch1(config-if)# no shutdownSwitch1(config-if)# end
The `vlan 10` command creates VLAN 10 in the VLAN database. It's idempotent — running it again on an existing VLAN just enters config mode for that VLAN. The `name Sales` is documentation but useful — `show vlan brief` will show it.
The `switchport mode access` line is technically optional on ports that don't negotiate trunking, but explicitly setting it disables DTP (Dynamic Trunking Protocol) on the port — a security best practice against VLAN hopping attacks.
VLAN 10 (Sales) has Gi0/1 and Gi0/2. VLAN 20 (Engineering) has Gi0/25 and Gi0/26. Everything else is still in VLAN 1 (default). The `act/unsup` VLANs 1002–1005 are legacy defaults — ignore them.
If you assign a port to VLAN 50 but VLAN 50 doesn't exist in the database, the port goes into an inactive state (`inactive` in `show interfaces status`). The fix is to create the VLAN first, or configure it correctly. The port won't forward traffic until the VLAN exists.
Switch1(config)# interface gigabitEthernet0/5Switch1(config-if)# switchport access vlan 20Switch1(config-if)# end
No need to remove the previous VLAN assignment — the new `switchport access vlan` command replaces the old one. The port briefly drops as the VLAN changes, then comes back up in the new VLAN.
Use `interface range gi0/1 - 12` to configure multiple ports at once. A voice deployment to 48 ports in a batch: one `interface range` command plus three subcommands. Saves ten minutes per switch.
Access port discipline locked in. Next lesson: VLAN database management and verification commands.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.