Two steps
- Create the VLAN:
vlan 10, thenname SALES(optional, but do it). - Make each port an access port in it:
switchport mode accessandswitchport access vlan 10.
An access port belongs to exactly one VLAN and sends ordinary, untagged frames: the PC doesn't know VLANs exist. interface range configures several ports at once.
In NetLab
▶ SW1 SW1>enable SW1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)#vlan 10 SW1(config-vlan)#name SALES SW1(config-vlan)#vlan 20 SW1(config-vlan)#name HR SW1(config-vlan)#exit SW1(config)#interface range fa0/1 , fa0/3 SW1(config-if-range)#switchport mode access SW1(config-if-range)#switchport access vlan 10 SW1(config-if-range)#interface range fa0/2 , fa0/4 SW1(config-if-range)#switchport mode access SW1(config-if-range)#switchport access vlan 20 SW1(config-if-range)#end *Mar 1 00:00:14.000: %SYS-5-CONFIG_I: Configured from console by console SW1#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16, Fa0/17, Fa0/18, Fa0/19, Fa0/20, Fa0/21, Fa0/22, Fa0/23, Fa0/24, Gi0/1, Gi0/2 10 SALES active Fa0/1, Fa0/3 20 HR active Fa0/2, Fa0/4 1002 fddi-default act/unsup 1003 token-ring-default act/unsup 1004 fddinet-default act/unsup 1005 trnet-default act/unsup SW1#show interfaces fa0/1 switchport | include Mode|Access Administrative Mode: static access Operational Mode: static access Access Mode VLAN: 10 (SALES) Trunking Native Mode VLAN: 1 (default) Capture Mode Disabled ▶ PC1 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ping 192.168.10.12 Pinging 192.168.10.12 with 32 bytes of data: Reply from 192.168.10.12: bytes=32 time<1ms TTL=64 Reply from 192.168.10.12: bytes=32 time<1ms TTL=64 Reply from 192.168.10.12: bytes=32 time<1ms TTL=64 Reply from 192.168.10.12: bytes=32 time<1ms TTL=64 Ping statistics for 192.168.10.12: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms
If you assign a port to a VLAN that doesn't exist yet, the switch creates it for you (% Access VLAN does not exist. Creating vlan 30).
Even the same subnet can't cross a VLAN
To prove VLANs really separate traffic, give PC2 an address in PC1's subnet. It's still in VLAN 20, so PC1's ARP broadcast never reaches it:
In NetLab
▶ SW1 SW1>enable SW1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)#interface fa0/1 SW1(config-if)#switchport mode access SW1(config-if)#switchport access vlan 10 % Access VLAN does not exist. Creating vlan 10 SW1(config-if)#interface fa0/2 SW1(config-if)#switchport mode access SW1(config-if)#switchport access vlan 20 % Access VLAN does not exist. Creating vlan 20 SW1(config-if)#end *Mar 1 00:00:09.000: %SYS-5-CONFIG_I: Configured from console by console ▶ PC2 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>netsh interface ip set address "Ethernet" static 192.168.10.99 255.255.255.0 ▶ PC1 NetLab Windows-style command prompt. Type help to see the commands. C:\Users\student>ping 192.168.10.99 Pinging 192.168.10.99 with 32 bytes of data: Reply from 192.168.10.11: Destination host unreachable. Reply from 192.168.10.11: Destination host unreachable. Reply from 192.168.10.11: Destination host unreachable. Reply from 192.168.10.11: Destination host unreachable. Ping statistics for 192.168.10.99: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Common mistake: Deleting a VLAN (
no vlan 10) doesn't move its ports back to VLAN 1: they stay assigned to VLAN 10 and become inactive, so the PCs lose the network until you recreate the VLAN.