Objective

A Virtual Local Area Network (VLAN) allows you to logically segment a Local Area Network (LAN) into different broadcast domains. In scenarios where sensitive data may be broadcast on a network, VLANs can be created to enhance security by designating a broadcast to a specific VLAN. Only users that belong to a VLAN are able to access and manipulate the data on that VLAN.

You can configure the ports and specify whether the port should be in access or trunk mode, and assign specific ports to VLANs. This article provides instructions on how to configure an interface VLAN as an access or trunk port on your switch through the Comman Line Interface (CLI).

Introduction

VLAN is a network that is usually segmented by function or application. VLANs behave much like physical LANs, but you can group hosts even if they are not physically co-located. A switch port can belong to a VLAN. Unicast, broadcast, and multicast packets are forwarded and flooded out ports in the same VLAN.

VLANs can also be used to enhance performance by reducing the need to send broadcasts and multicasts to unnecessary destinations. It also eases network configuration by logically connecting devices without physically relocating those devices.

Note: To learn how to configure the VLAN settings on your switch through the web-based utility, click here. For CLI-based instructions, click here.

The image below displays an SG350X switch that is configured with the following VLANs:

• VLAN1 – This is the default VLAN. The switch is connected to the router through this VLAN. This can be used but cannot be modified or deleted.
• VLAN10 – Virtual network for the Admin department. The network address is 192.168.10.1 with subnet mask 255.255.255.0 or /24.
• VLAN20 – Virtual network for the Finance department. The network address is 192.168.20.1 with subnet mask 255.255.255.0 or /24.
• VLAN30 – Virtual network for the Operations department. The network address is 192.168.30.1 with subnet mask 255.255.255.0 or /24.

In a bigger network, the configured VLANs with interfaces assigned as access and trunk ports on switches could look like this:

The port modes are defined as follows:

• Access Port – The frames received on the interface are assumed to not have a VLAN tag and are assigned to the specified VLAN. Access ports are used primarily for hosts and can only carry traffic for a single VLAN.
• Trunk Port – The frames received on the interface are assumed to have VLAN tags. Trunk ports are for links between switches or other network devices and are capable of carrying traffic for multiple VLANs.

Note: By default, all interfaces are in trunk mode, which means they can carry traffic for all VLANs. To know how to assign an interface VLAN as an Access or Trunk port through the web-based utility of the switch, click here.

To configure VLANs, follow these guidelines:

1. Create the VLANs. To learn how to configure the VLAN settings on your switch through the web-based utility, click here. For CLI-based instructions, click here.

2. (Optional) Set the desired VLAN-related configuration for ports. For instructions on how to configure the VLAN interface settings on your switch through the web-based utility, click here. For CLI-based instructions, click here.

3. Assign interfaces to VLANs. For instructions on how to assign interfaces to VLANs through the web-based utility of your switch, click here.

4. (Optional) Configure VLAN groups on your switch. You can configure any of the following:

• MAC-based VLAN Group Overview – For instructions on how to configure MAC-based VLAN Groups through the web-based utility of your switch, click here. For CLI-based instructions, click here.
• Subnet-based VLAN Groups Overview – For instructions on how to configure subnet-based VLAN Groups through the web-based utility of your switch, click here. For CLI-based instructions, click here.
• Protocol-based VLAN Groups Overview – For instructions on how to configure Protocol-based VLAN Groups through the web-based utility of your switch, click here. For CLI-based instructions, click here. 

5. (Optional) Configure TV VLAN settings on your switch. You can configure any of the following:

• Access Port Multicast TV VLAN – For instructions on how to configure Access Port Multicast TV VLAN through the web-based utility of your switch, click here.
• Customer Port Multicast TV VLAN – For instructions on how to configure Customer Port Multicast TV VLAN through the web-based utility of your switch, click here.

Applicable Devices | Software Version

• Sx300 Series | 1.4.7.06 (Download latest)
• Sx350 Series | 2.2.8.04 (Download latest)
• SG350X Series | 2.2.8.04 (Download latest)
• Sx500 Series | 1.4.7.06 (Download latest)
• Sx550X Series | 2.2.8.04 (Download latest)

Configure VLAN Interface Settings on the Switch through the CLI

Configure Interface as Access Port and Assign to VLAN

Step 1. Log in to the switch console. The default username and password is cisco/cisco. If you have configured a new username or password, enter the credentials instead.

Note: The commands may vary depending on the exact model of your switch. In this example, the SG350X switch is accessed through Telnet.

Step 2. To display the current VLAN on the switch, enter the following:

SG350X#show vlan

Note: In this example, VLANs 1, 10, 20, and 30 are available with no manually assigned ports.

Step 3. From the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 4. In the Global Configuration mode, enter the Interface Configuration context by entering the following:

SG350X(config)#interface [interface-id | range vlan vlan-range]

The options are:

• interface-id – Specifies an interface ID to be configured.
• range vlan vlan-range – Specifies a list of VLANs. Separate nonconsecutive VLANs with a comma and no spaces. Use a hyphen to designate a range of VLANs.

Note: In this example, an interface range that covers ports 14 to 24 is entered.

Step 5. In the Interface Configuration context, use the switchport mode command to configure the VLAN membership mode.

SG350X(config-if-range)#switchport mode access

Step 6. Use the switchport access vlan command to assign the port or range of ports into access ports. A port in access mode can have only one VLAN configured on the interface which can carry traffic for only one VLAN.

SG350X(config-if-range)#switchport access vlan [vlan-id | none]

The options are:

• vlan-id – Specifies the VLAN to which the port is configured.
• none – Specifies that the access port cannot belong to any VLAN.

Note: In this example, the range of ports is assigned to VLAN 30.

Step 7. (Optional) To return the port or range of ports to the default VLAN, enter the following:

SG350X(config-if-range)#no switchport access vlan

Step 8. To exit the Interface Configuration context, enter the following:SG350X(config-if-range)#exit

Step 9. (Optional) Repeat steps 4 to 6 to configure more access ports and assign to the corresponding VLANs.

Note: In this example, interface range 26 to 36 are assigned to VLAN 10, while interface range 38 to 48 are assigned to VLAN 20.

SG350X(config-if)#end

Step 10. Enter the end command to go back to the Privileged EXEC mode:

Step 11. (Optional) To display the configured ports on the VLANs, enter the following:

SG350X#show vlan

Note: The configured ports should be displayed according to the assigned VLANs. In this example, the interface range 26 to 36 are assigned in VLAN 10, 38 to 48 belong to VLAN 20, and 14 to 24 are configured to VLAN 30.

Step 12. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 13. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the interfaces on your switch as access ports and assigned to their corresponding VLANs.

Configure Interface as Trunk Port and Assign to VLAN

Step 1. In the Privileged EXEC mode of the switch, enter the Global Configuration mode by entering the following:

SG350X#configure terminal

Step 2. In the Global Configuration mode, enter the Interface Configuration context by entering the following:

SG350X#interface [interface-id | range vlan vlan-range]

The options are:

• interface-id – Specifies an interface ID to be configured.
• range vlan vlan-range – Specifies a list of VLANs. Separate nonconsecutive VLANs with a comma and no spaces. Use a hyphen to designate a range of VLANs.

Note: In this example, interface ge1/0/13 is used.

Step 3. In the Interface Configuration context, use the switchport mode command to configure the VLAN membership mode.

SG350X(config-if)#switchport mode trunk

Step 4. (Optional) To return the port to the default VLAN, enter the following:SG350X(config-if)#no switchport mode trunk

Step 5. Use the switchport trunk allowed vlan command to specify which VLANs the port belongs to when its mode is configured as trunk.

SG350X(config-if)#switchport trunk allowed vlan [all | none | add vlan-list | remove vlan-list | except vlan-list]

The options are:

• all – Specifies all VLANs from 1 to 4094. At any time, the port belongs to all VLANs existing at the time.
• none – Specifies an empty VLAN list. The port does not belong to any VLAN.
• add vlan-list – List of VLAN IDs to add to the port. Separate nonconsecutive VLAN IDs with a comma and no spaces. Use a hyphen to designate a range of IDs.
• remove vlan-list – List of VLAN IDs to remove from a port. Separate nonconsecutive VLAN IDs with a comma and no spaces. Use a hyphen to designate a range of IDs.
• except vlan-list – List of VLAN IDs including all VLANs from range 1-4094 except VLANs belonging to vlan-list.

Note: In this example, port ge1/0/13 belongs to all VLANs except VLAN 10.

Step 6. To exit the Interface Configuration context, enter the following:

SG350X(config-if)#exit

Step 7. (Optional) To return the port or range of ports to the default VLAN, enter the following:

SG350X(config-if)#no switchport trunk allowed vlan

Step 8. (Optional) Repeat steps 2 to 6 to configure more trunk ports and assign to the corresponding VLANs.

Note: In this example, interface ge1/0/25 belongs to VLAN 10 and not in VLAN 20, while interface ge1/0/27 belongs to all VLANs except VLAN 10.

Step 9. Enter the end command to go back to the Privileged EXEC mode:

SG350X(config-if)#end

Step 10. (Optional) To display the configured ports on the VLANs, enter the following:

SG350X#show vlan

Note: The configured ports should be displayed according to the assigned VLANs. In this example, the trunk port gi1/0/25 belongs to VLAN 10 and VLAN 30, gi1/0/13 and gi1/0/37 both belong to VLAN 20 and VLAN 30.

Step 11. (Optional) In the Privileged EXEC mode of the switch, save the configured settings to the startup configuration file, by entering the following:

SG350X#copy running-config startup-config

Step 12. (Optional) Press Y for Yes or N for No on your keyboard once the Overwrite file [startup-config]… prompt appears.

You should now have configured the interfaces on your switch as trunk ports and assigned to their corresponding VLANs.

Important: To proceed with configuring the VLAN group settings on your switch, follow the guidelines above.