Virtual LANs and Layer 2 switching, the foundation of every campus network. Articles tagged VLAN cover fundamentals, trunking, inter-VLAN routing, EtherChannel, troubleshooting, and campus design on Cisco Catalyst switches.
The native VLAN is the one untagged VLAN on an 802.1Q trunk, and it can break a link through a mismatch or get hopped through double tagging. This post explains why it exists, both failure modes, and how to configure it safely.
How VTP propagates VLANs across a domain, the three modes, the revision-number disaster, v1/v2/v3 differences, and why many engineers disable it.
Per-VLAN Spanning Tree explained: PVST+ vs Rapid-PVST+, the sys-id-ext Bridge ID trick, per-VLAN root placement for uplink load balancing, and when to move to MSTP.
VLAN vs VXLAN explained: a VLAN tags L2 segments, VXLAN encapsulates them across L3. The 4,094 limit, VTEPs, BGP EVPN, and when you actually need VXLAN.
How EtherChannel hides bundled links from STP, the bundling protocols (LACP, PAgP, on), the dangerous failure modes, and why LACP active on both sides is the only safe configuration.
The two ways to route between VLANs on Cisco: SVIs on an L3 switch and router-on-a-stick. Real IOS XE config for both, the performance gap, and the gotchas.
VLAN, subnet, and broadcast domain are not the same thing. The layer each lives at, the relationships between them, and the misalignment that breaks hosts silently.
Tagged and untagged frames are the half of every VLAN problem nobody explains clearly. The mental model, when each is correct, the native VLAN, and the cross-vendor (Cisco / Aruba / Juniper) cheat sheet.
VLAN hopping bypasses Layer 2 isolation. The two attacks (switch spoofing via DTP, double tagging via the native VLAN) and the four-line Cisco configuration that defeats both.
The 802.1Q VLAN tag is 4 bytes inserted into Ethernet frames to carry VLAN identity across trunks. TPID, TCI, PCP, DEI, VID, and the native VLAN explained byte by byte.
A good VLAN design scales cleanly, keeps STP domains small, and makes troubleshooting obvious. Here is how to plan VLANs for a multi-building campus network.
VLANs provide segmentation, not security. Without explicit hardening — disabling DTP, fixing the native VLAN, enabling DHCP snooping and DAI — your Layer 2 network is wide open to attack.