A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Users in one department can't reach file shares after their switch port was moved. Pings to the gateway fail, but the port shows `connected`. You have console access to the switch. What's your first move?
VLAN and trunk problems have a small set of root causes. Once you know the checklist, diagnosis is fast — a couple of show commands, and you know whether the problem is VLAN assignment, trunk allowed VLANs, native VLAN mismatch, or something upstream.
| Symptom | Likely cause | First check |
|---|---|---|
| Port shows inactive status | VLAN doesn't exist or port in wrong VLAN mode | show vlan brief |
| Host can't reach gateway | Wrong VLAN, wrong gateway, or VLAN not on trunk | show interfaces switchport, show interfaces trunk |
| CDP logs show native VLAN mismatch | Different native VLANs on trunk ends | show interfaces trunk (native VLAN) |
| Some VLANs work on trunk, others don't | Missing VLAN from allowed list, or VLAN not created on both sides | show interfaces trunk (allowed VLANs) |
| Hosts get IP but can't reach other VLANs | No L3 interface or missing default gateway | show ip route on router |
| Port cycles up/down | DTP negotiation or speed/duplex mismatch | show interfaces status |
Port is `connected` in VLAN 10. Host should be in VLAN 10. Check the VLAN database — does VLAN 10 exist, and is the port actually a member?
VLAN 10 exists and Gi0/5 is a member. So VLAN assignment is fine. Now check if VLAN 10 is on the trunk to the router.
There it is. The trunk to the router only allows VLANs 20 and 30 — VLAN 10 is missing. The port's traffic can't reach the router, so it can't leave VLAN 10. Users' traffic stops at the switch.
! Fix — add VLAN 10 to the allowed listSwitch1(config)# interface gigabitEthernet0/24Switch1(config-if)# switchport trunk allowed vlan add 10Switch1(config-if)# endSwitch1# show interfaces trunk
Note the `add` keyword. `switchport trunk allowed vlan 10` REPLACES the current list. `switchport trunk allowed vlan add 10` APPENDS. This catches more engineers than any other trunk command — including many experienced ones.
Native VLAN mismatch doesn't break the trunk — it silently leaks traffic between VLANs. If one side is native 1 and the other is native 99, traffic in native VLAN 1 on one side crosses as if it were VLAN 99 on the other. Users may not notice until an ACL rule or a monitoring tool misattributes the traffic. Always check both ends of a trunk match.
Section 6 complete. You understand VLAN segmentation, access and trunk configuration, voice VLANs, native VLANs, inter-VLAN requirements, and how to troubleshoot all of it. The next sections build on this foundation — STP protects trunks from loops, EtherChannel bundles them, and inter-VLAN routing puts it all together.
Section 6 wraps. Sections 7 (STP), 8 (EtherChannel), and 9 (Inter-VLAN Routing) follow the same pattern and will be delivered in the next batch.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.