Switching: VLANs, Trunks, and Spanning Tree

What Is a VLAN?

A Virtual Local Area Network (VLAN) is a logical grouping of switch ports that behaves as if those ports were on a completely separate physical switch. Devices in the same VLAN can communicate at Layer 2 (the data-link layer) without a router. Devices in different VLANs cannot communicate unless traffic passes through a Layer 3 device such as a router or a Layer 3 switch. VLANs reduce broadcast domains, improve security, and let network administrators organize users by function rather than by physical location.

In this lab you will create VLAN 10 (Sales) and VLAN 20 (IT) on two Cisco 2960 switches. Each VLAN will have two access ports per switch, giving you four hosts total across the two switches.

Access Ports vs. Trunk Ports

An access port carries traffic for exactly one VLAN. The switch strips the VLAN tag before forwarding frames to the end device, so the PC never sees a tag. You assign an access port with:

```

interface FastEthernet0/1

switchport mode access

switchport access vlan 10

```

A trunk port carries traffic for multiple VLANs simultaneously over a single link. The 802.1Q standard defines how switches insert a 4-byte tag into each Ethernet frame to identify its VLAN. When two switches are connected to each other, that uplink is almost always configured as a trunk so that every VLAN can pass between them. You configure an 802.1Q trunk with:

```

interface GigabitEthernet0/1

switchport mode trunk

```

After issuing `show interfaces trunk` you will see which VLANs are allowed and active on the trunk. After issuing `show vlan brief` you will see which ports belong to each VLAN on the local switch.

Why Hosts in Different VLANs Cannot Ping Each Other

Switch forwarding is a Layer 2 operation based on MAC addresses. A frame from a host in VLAN 10 will only be forwarded to other ports in VLAN 10. The switch has no mechanism to move a frame from one VLAN to another. That is intentional: VLANs create security boundaries. To allow inter-VLAN communication you need a router (or a Layer 3 switch with an SVI) — a topic covered in a later lesson. In today's lab, cross-VLAN pings are expected to fail, and that failure is proof your VLANs are working correctly.

Spanning Tree Protocol (STP)

Ethernet has no built-in TTL mechanism at Layer 2. If you connect two switches with two cables and no loop-prevention mechanism exists, a single broadcast frame will circulate forever, consuming all bandwidth in what is called a broadcast storm. This can crash an entire network segment within seconds.

Spanning Tree Protocol (STP), standardized as IEEE 802.1D, prevents Layer 2 loops automatically. Every switch running STP participates in an election to choose a root bridge — the switch with the lowest Bridge ID (priority + MAC address). Once the root bridge is elected, every other switch determines the shortest path back to the root. STP then places any redundant ports into a blocking state so that only one active path exists at any time.

Port roles in STP:

• Root port — the port on a non-root switch that offers the best path toward the root bridge.
• Designated port — the forwarding port on each network segment; the root bridge has all designated ports.
• Alternate (blocked) port — a port that has been placed in the blocking state to prevent a loop. If the active path fails, STP reconverges and the alternate port may transition to forwarding.

You will observe these roles live using `show spanning-tree` when your instructor adds a redundant cable to create a deliberate loop.

Safety and Lab Conduct

• Electrical awareness: The 2960 switches use low-voltage DC internally, but they connect to 120 V AC wall outlets. Inspect power cords for damage before plugging in. Never open switch chassis — there are no user-serviceable parts inside.
• ESD (electrostatic discharge): When handling SFP modules or any internal component, use a grounded anti-static wrist strap. Even though today's lab uses external cables only, form the habit.
• Cable management: Keep patch cables tidy and labeled. A stray cable accidentally creating a physical loop is the most common way students trigger a broadcast storm during this lab; always announce to the group before plugging in a redundant link.
• Console cable handling: RJ-45 to DB-9 console cables and USB adapters carry no hazardous voltage, but connector pins bend easily. Insert and remove them straight, never at an angle.
• PuTTY / terminal sessions: Log every session to a text file (Session → Logging in PuTTY). Saved output is required for your lab log.

Verification Commands Reference

| Command | What it shows |

|---|---|

| `show vlan brief` | All VLANs and their assigned ports on this switch |

| `show interfaces trunk` | Trunk ports, allowed VLANs, and active VLANs |

| `show spanning-tree` | Root bridge, port roles, port states |

| `show interfaces status` | Port speed, duplex, VLAN membership at a glance |

Record the exact output of `show vlan brief` and `show interfaces trunk` in your lab log. Your instructor will verify reachability by pinging between all four PCs; same-VLAN pings must succeed and cross-VLAN pings must fail.