One physical switch, many isolated networks. Create VLANs, assign access ports, carry multiple VLANs over a single 802.1Q trunk, and route between them — first with router-on-a-stick, then with an L3 switch. With the native-VLAN gotchas that catch everyone.
A VLAN turns one physical switch into several logical switches. Ports in VLAN 10 can't talk to ports in VLAN 20 — different broadcast domains, as isolated as if they were separate boxes. That's how you put staff, guests, VoIP, and cameras on the same hardware without letting them touch each other.
Two port roles make it work. An access port belongs to exactly one VLAN and faces an end device — a PC, a printer, an AP — which knows nothing about VLANs. A trunk port carries many VLANs between switches (or to a router) by tagging each frame with its VLAN ID using 802.1Q. This tutorial builds both, then routes between VLANs two different ways. If you've done VLANs on MikroTik, the concepts are identical — only the syntax changes, and section 08 maps them directly.
01
A VLAN has to exist in the switch's VLAN database before you can put a port in it. Create it, name it, done. Naming is optional but you will regret skipping it.
SW1# configure terminal SW1(config)# vlan 10 SW1(config-vlan)# name STAFF SW1(config-vlan)# exit SW1(config)# vlan 20 SW1(config-vlan)# name GUEST SW1(config-vlan)# exit SW1(config)# vlan 99 SW1(config-vlan)# name NATIVE-MGMT SW1(config-vlan)# end # Confirm they exist (all safe, read-only) SW1# show vlan brief VLAN Name Status Ports 1 default active Gi0/3, Gi0/4, Gi0/5 ... 10 STAFF active 20 GUEST active 99 NATIVE-MGMT active # New VLANs have no ports yet — every port still lives in VLAN 1 (default).
Every port ships in VLAN 1, and by default VLAN 1 is also the native and management VLAN. That's convenient and insecure — it means an attacker on a default port shares a broadcast domain with your management traffic. Best practice: don't use VLAN 1 for anything real. Put a dedicated management VLAN (we use 99) and move the native VLAN off 1 (section 03).
02
An access port carries exactly one VLAN, untagged, to an end device. This is where you put PCs, printers, and access points. The interface range keyword configures many at once.
# A single port into VLAN 10 SW1(config)# interface GigabitEthernet0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# exit # Twelve ports into VLAN 20 in one shot with "interface range" SW1(config)# interface range GigabitEthernet0/13 - 24 SW1(config-if-range)# switchport mode access SW1(config-if-range)# switchport access vlan 20 SW1(config-if-range)# end # Verify: each port now shows its VLAN SW1# show interfaces status Port Name Status Vlan Duplex Speed Type Gi0/1 connected 10 a-full a-1000 ... Gi0/13 notconnect 20 auto auto ...
Cisco ports default to dynamic auto (DTP), meaning a port can negotiate itself into a trunk if the neighbour asks — a known attack vector (VLAN hopping). Always pin end-user ports with switchport mode access, and for extra safety add switchport nonegotiate so the port never sends DTP frames at all. An access port should never become a trunk by accident.
03
A trunk carries many VLANs over one link by tagging each frame with its VLAN ID. This is the link between two switches, or between a switch and a router. One untagged VLAN — the native VLAN — rides without a tag.
SW1(config)# interface GigabitEthernet0/24 # On switches that support ISL, set the encapsulation first. # On 2960/2960-X (dot1q-only) this command doesn't exist — just skip it. SW1(config-if)# switchport trunk encapsulation dot1q SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# switchport trunk allowed vlan 10,20,99 SW1(config-if)# switchport nonegotiate SW1(config-if)# end # Verify the trunk: allowed VLANs and native VLAN SW1# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/24 on 802.1q trunking 99 Port Vlans allowed on trunk Gi0/24 10,20,99
Both ends of a trunk must agree on the native VLAN. If SW1 uses native 99 and SW2 uses native 1, untagged frames land in the wrong VLAN and CDP throws %CDP-4-NATIVE_VLAN_MISMATCH every 60 seconds. It's a real security and connectivity problem, not just noise. Set switchport trunk native vlan 99 identically on both sides. Equally: if a VLAN isn't in the allowed list, its traffic is silently dropped across the trunk — a classic "VLAN 20 can't reach the other switch" cause.
04
VLANs are isolated by design — VLAN 10 can't reach VLAN 20 without a router. The cheapest way to route between them is one router interface, trunked, carrying a subinterface per VLAN. Each subinterface is that VLAN's default gateway.
# The switch port facing the router must be a trunk (see section 03). # On the ROUTER, carve the physical interface into tagged subinterfaces: R1(config)# interface GigabitEthernet0/0 R1(config-if)# no shutdown # the physical parent needs no IP, just "up" R1(config-if)# exit R1(config)# interface GigabitEthernet0/0.10 R1(config-subif)# encapsulation dot1q 10 R1(config-subif)# ip address 192.168.10.1 255.255.255.0 R1(config-subif)# exit R1(config)# interface GigabitEthernet0/0.20 R1(config-subif)# encapsulation dot1q 20 R1(config-subif)# ip address 192.168.20.1 255.255.255.0 R1(config-subif)# exit # The native VLAN uses the "native" keyword so its frames stay untagged R1(config)# interface GigabitEthernet0/0.99 R1(config-subif)# encapsulation dot1q 99 native R1(config-subif)# ip address 192.168.99.1 255.255.255.0 R1(config-subif)# end
Now set each host's default gateway to its subinterface IP (e.g. VLAN 10 hosts → 192.168.10.1) and VLAN 10 can reach VLAN 20 through the router. Great for small sites; the single link is the bottleneck at scale.
05
A layer-3 switch routes between VLANs in hardware, at wire speed, with no trunk bottleneck. Instead of router subinterfaces you create a Switched Virtual Interface (SVI) per VLAN. This is how real sites do it.
# 1. Turn on IP routing — off by default on a switch L3-SW(config)# ip routing # 2. A virtual interface per VLAN — this IP is the VLAN's gateway L3-SW(config)# interface vlan 10 L3-SW(config-if)# ip address 192.168.10.1 255.255.255.0 L3-SW(config-if)# no shutdown L3-SW(config-if)# exit L3-SW(config)# interface vlan 20 L3-SW(config-if)# ip address 192.168.20.1 255.255.255.0 L3-SW(config-if)# no shutdown L3-SW(config-if)# end # Verify routing between VLANs is now local and active L3-SW# show ip route C 192.168.10.0/24 is directly connected, Vlan10 C 192.168.20.0/24 is directly connected, Vlan20
A VLAN's SVI stays down/down until at least one access port in that VLAN is connected and up (or the VLAN is allowed on an up trunk). Configure everything perfectly and the SVI can still show down simply because nothing is plugged into VLAN 10 yet. show ip interface brief | include Vlan tells you the truth. Also don't forget ip routing — without it, the L3 switch has SVIs but won't route between them.
06
Four read-only commands answer almost every VLAN problem: which VLAN is a port in, what does the trunk carry, is the native VLAN consistent, and does the SVI have an IP.
| Command | Answers |
|---|---|
| show vlan brief | Which VLANs exist and which access ports are in each. |
| show interfaces trunk | Which ports are trunks, their native VLAN, and the allowed-VLAN list. |
| show interfaces status | Per-port: connected/notconnect, access VLAN, speed/duplex. |
| show interfaces gi0/1 switchport | Full switchport detail for one port — mode, access VLAN, trunk settings. |
| show ip interface brief | SVI IPs and up/down state (L3 switch / router). |
| show ip route | Confirms the inter-VLAN routes are directly connected and active. |
# 1. Are both hosts actually in the VLAN you think? SW1# show interfaces status | include connected # 2. Does the trunk between switches carry BOTH VLANs? SW1# show interfaces trunk # If VLAN 20 is missing from "allowed", add it: SW1(config-if)# switchport trunk allowed vlan add 20 # 3. Is there a router/SVI with a gateway IP in each subnet? L3-SW# show ip interface brief | include Vlan # 4. Does each host use that gateway? (ping the gateway, then across) SW1# ping 192.168.20.1
07
If you came from RouterOS, the model is identical — a bridge with VLAN filtering is a switch, tagged/untagged is trunk/access. Only the vocabulary differs.
| MikroTik / RouterOS | Cisco IOS |
|---|---|
| Bridge with vlan-filtering=yes | The switch itself (VLAN-aware by default) |
| Bridge port pvid=10, untagged | switchport mode access ; switchport access vlan 10 |
| Bridge VLAN tagged=ether1,ether2 | switchport mode trunk ; switchport trunk allowed vlan … |
| Frame tagging = 802.1Q | 802.1Q — identical wire format |
| /interface vlan (VLAN interface + IP) | interface vlan 10 (SVI) or router subinterface |
| PVID on ingress port | Access VLAN / native VLAN on trunk |
MikroTik makes you build the bridge and enable VLAN filtering explicitly — the switch behaviour is opt-in. On Cisco, a Catalyst is a VLAN-aware switch out of the box; you're configuring roles on ports that already switch. Neither is harder — but Cisco hides less, which is why the native VLAN and DTP catch newcomers. When we migrate a MikroTik site to Cisco (or run both), this table is the cheat sheet we hand the client's team.
Takeaways
vlan 10 ; name STAFF), then assign ports. Name everything — show vlan brief becomes self-documenting.switchport mode access and nonegotiate so they can never negotiate into a trunk.encapsulation dot1q) for small sites, or an L3 switch with SVIs and ip routing for anything real.interface vlan 10 shows down/down until something is connected in VLAN 10.NOCTIS designs VLAN layouts that keep staff, guests, VoIP, and cameras properly isolated — on Cisco, MikroTik, or a mix — and documents every port and trunk so your team can maintain it without us.
Book a Discovery Call →