{"id":3436,"date":"2026-10-27T13:16:26","date_gmt":"2026-10-27T20:16:26","guid":{"rendered":"https:\/\/cyber.mag212.com\/learn\/vlan-cheat-sheet\/"},"modified":"2026-10-27T13:16:26","modified_gmt":"2026-10-27T20:16:26","slug":"vlan-cheat-sheet","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/vlan-cheat-sheet\/","title":{"rendered":"Aide-m\u00e9moire VLAN"},"content":{"rendered":"<style>.m212vl{background:#07111c;color:#e5eef6;font-family:Arial,Helvetica,sans-serif;font-size:16px;line-height:1.6;border:1px solid #1f3b4d;border-radius:14px;padding:28px 26px}\n.m212vl *{box-sizing:border-box}\n.m212vl .mast{border-top:6px solid #46db82;padding-top:14px}.m212vl .mast b{font-size:34px;letter-spacing:-1px;color:#46db82}.m212vl .mast small{display:block;letter-spacing:3px;color:#8ebbc9;font-size:12px}\n.m212vl .vl-title{font-size:clamp(30px,5vw,42px);line-height:1.08;margin:20px 0 7px;color:#fff;border:0;padding:0}\n.m212vl h2{color:#46db82;font-size:24px;border-bottom:1px solid #275061;margin:32px 0 12px;padding-bottom:6px}\n.m212vl h3{color:#3cc8e8;font-size:18px;margin:18px 0 6px}\n.m212vl p,.m212vl li{color:#d3e3ee}.m212vl p{margin:0 0 12px}\n.m212vl .lead{font-size:19px;color:#b4cad6}\n.m212vl .tag{color:#f25c5c;font-weight:bold;letter-spacing:2px;font-size:13px;margin-top:14px}\n.m212vl .hero{border:1px solid #2b5b68;border-radius:12px;overflow:hidden;margin:18px 0;padding:0}.m212vl .hero svg{width:100%;height:auto;display:block}\n.m212vl .cols{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr);gap:16px}\n.m212vl .code{background:#041018;border:0;border-left:4px solid #3cc8e8;border-radius:5px;padding:14px;white-space:pre-wrap;color:#a6edda;font:13px\/1.5 'DejaVu Sans Mono',ui-monospace,monospace;overflow-wrap:anywhere;margin:10px 0 14px}\n.m212vl code{color:#9cebd3;font-family:ui-monospace,Consolas,monospace}\n.m212vl table{width:100%;border-collapse:collapse;margin:13px 0;font-size:14px}\n.m212vl th{text-align:left;color:#46db82;background:#17334a}.m212vl th,.m212vl td{padding:9px;border:1px solid #365265;vertical-align:top}.m212vl td{color:#d7e5ed}\n.m212vl .warn{border-left:5px solid #f25c5c;background:#2b1e2c;padding:13px;border-radius:4px}\n.m212vl .note{border-left:5px solid #46db82;background:#123329;padding:13px;border-radius:4px}\n.m212vl ul{padding-left:22px}.m212vl li{margin-bottom:6px}\n.m212vl a{color:#3cc8e8}\n.m212vl .vl-dl{display:inline-block;margin:4px 0 6px;background:#46db82;color:#04130c;font-weight:800;text-decoration:none;border-radius:8px;padding:11px 18px;font-family:Arial,sans-serif}\n.m212vl .vl-foot{margin-top:36px;border-top:1px solid #336;padding-top:14px;color:#8da2ad;font-size:13px}\n@media(max-width:700px){.m212vl{padding:18px 12px}.m212vl .cols{grid-template-columns:minmax(0,1fr)}.m212vl table{font-size:12.5px}.m212vl th,.m212vl td{padding:7px}}.tblw{overflow-x:auto;-webkit-overflow-scrolling:touch;margin:13px 0}.tblw table{margin:0;min-width:520px}<\/style>\n<div class=\"m212vl\" id=\"m212-vlan\"><div class=\"mast\"><b>MAG212 CYBER<\/b><small>NETWORK ENGINEERING \u00b7 SWITCHING MASTERCLASS \u00b7 2026<\/small><\/div><p class=\"tag\">ULTIMATE CHEAT SHEET \/ CCNA \u00b7 CCNP \u00b7 IT ADMINISTRATORS<\/p><h2 class=\"vl-title\">VLANs Ultimate Cheat Sheet<\/h2><p class=\"lead\">802.1Q Trunking \u2022 Access &amp; Voice Ports \u2022 SVIs \u2022 Inter-VLAN Routing \u2022 VTP \u2022 Security \u2022 Troubleshooting<\/p><p>Publi\u00e9 par <strong>MAG212 CYBER<\/strong> \u00b7 \u00c9dition enseignement technique<\/p><a class=\"vl-dl\" href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/10\/MAG212_CYBER_VLAN_Ultimate_Cheat_Sheet.pdf\" target=\"_blank\" rel=\"noopener\">\u2b07 T\u00e9l\u00e9charger l&#039;\u00e9dition PDF<\/a>\n<figure class=\"hero\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewbox=\"0 0 1800 1100\" role=\"img\" aria-labelledby=\"vlT vlD\"><title id=\"vlT\">VLAN campus lab topology<\/title><desc id=\"vlD\">DIST-01, a Layer 3 switch with SVI gateways, connects over 802.1Q trunks to ACCESS-01 and ACCESS-02. ACCESS-01 port Gi1\/0\/3 serves an IP phone in voice VLAN 30 with a staff PC in VLAN 10 behind it. ACCESS-02 port Gi1\/0\/2 serves a student laptop in VLAN 20. VLAN 99 is the management VLAN on every switch and VLAN 999 is the unused native VLAN.<\/desc><defs><lineargradient id=\"vlbg\" x2=\"1\" y2=\"1\"><stop stop-color=\"#05121e\"\/><stop offset=\"1\" stop-color=\"#0f2a3d\"\/><\/lineargradient><\/defs><rect width=\"1800\" height=\"1100\" fill=\"url(#vlbg)\"\/><g stroke=\"#1f3d52\" opacity=\".45\"><path d=\"M0 0V1100\"\/><path d=\"M50 0V1100\"\/><path d=\"M100 0V1100\"\/><path d=\"M150 0V1100\"\/><path d=\"M200 0V1100\"\/><path d=\"M250 0V1100\"\/><path d=\"M300 0V1100\"\/><path d=\"M350 0V1100\"\/><path d=\"M400 0V1100\"\/><path d=\"M450 0V1100\"\/><path d=\"M500 0V1100\"\/><path d=\"M550 0V1100\"\/><path d=\"M600 0V1100\"\/><path d=\"M650 0V1100\"\/><path d=\"M700 0V1100\"\/><path d=\"M750 0V1100\"\/><path d=\"M800 0V1100\"\/><path d=\"M850 0V1100\"\/><path d=\"M900 0V1100\"\/><path d=\"M950 0V1100\"\/><path d=\"M1000 0V1100\"\/><path d=\"M1050 0V1100\"\/><path d=\"M1100 0V1100\"\/><path d=\"M1150 0V1100\"\/><path d=\"M1200 0V1100\"\/><path d=\"M1250 0V1100\"\/><path d=\"M1300 0V1100\"\/><path d=\"M1350 0V1100\"\/><path d=\"M1400 0V1100\"\/><path d=\"M1450 0V1100\"\/><path d=\"M1500 0V1100\"\/><path d=\"M1550 0V1100\"\/><path d=\"M1600 0V1100\"\/><path d=\"M1650 0V1100\"\/><path d=\"M1700 0V1100\"\/><path d=\"M1750 0V1100\"\/><path d=\"M1800 0V1100\"\/><path d=\"M0 0H1800\"\/><path d=\"M0 50H1800\"\/><path d=\"M0 100H1800\"\/><path d=\"M0 150H1800\"\/><path d=\"M0 200H1800\"\/><path d=\"M0 250H1800\"\/><path d=\"M0 300H1800\"\/><path d=\"M0 350H1800\"\/><path d=\"M0 400H1800\"\/><path d=\"M0 450H1800\"\/><path d=\"M0 500H1800\"\/><path d=\"M0 550H1800\"\/><path d=\"M0 600H1800\"\/><path d=\"M0 650H1800\"\/><path d=\"M0 700H1800\"\/><path d=\"M0 750H1800\"\/><path d=\"M0 800H1800\"\/><path d=\"M0 850H1800\"\/><path d=\"M0 900H1800\"\/><path d=\"M0 950H1800\"\/><path d=\"M0 1000H1800\"\/><path d=\"M0 1050H1800\"\/><path d=\"M0 1100H1800\"\/><\/g><text x=\"60\" y=\"70\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"42\" font-weight=\"900\" fill=\"#46db82\">MAG212 CYBER<\/text><text x=\"460\" y=\"70\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"34\" font-weight=\"800\" fill=\"#e3f4fc\">\u00b7 VLAN CAMPUS LAB<\/text><text x=\"62\" y=\"106\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"20\" fill=\"#9cc3d9\">802.1Q trunks \u00b7 access and voice ports \u00b7 SVI gateways on a Layer 3 distribution switch \u00b7 lab addressing<\/text><path d=\"M810 330L510 540\" stroke=\"#3cc8e8\" stroke-width=\"11\" stroke-linecap=\"round\"\/><path d=\"M990 330L1290 540\" stroke=\"#3cc8e8\" stroke-width=\"11\" stroke-linecap=\"round\"\/><rect x=\"785.0\" y=\"250.0\" width=\"230\" height=\"80\" rx=\"12\" fill=\"#155a78\" stroke=\"#9fe6ff\" stroke-width=\"3\"\/><rect x=\"785.0\" y=\"250.0\" width=\"230\" height=\"33.6\" rx=\"12\" fill=\"#2c7ea2\"\/><g stroke=\"#effaff\" stroke-width=\"3\" fill=\"none\" stroke-linecap=\"round\"><path d=\"M821 266.8h26\"\/><path d=\"M847 266.8l-6 -5M847 266.8l-6 5\"\/><path d=\"M865 266.8h26\"\/><path d=\"M865 266.8l6 -5M865 266.8l6 5\"\/><path d=\"M909 266.8h26\"\/><path d=\"M935 266.8l-6 -5M935 266.8l-6 5\"\/><path d=\"M953 266.8h26\"\/><path d=\"M953 266.8l6 -5M953 266.8l6 5\"\/><\/g><rect x=\"807.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"839.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"871.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"903.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"935.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"967.0\" y=\"302\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1029.0\" y=\"273\" width=\"58\" height=\"34\" rx=\"8\" fill=\"#0a1f2f\" stroke=\"#46db82\" stroke-width=\"2\"\/><text x=\"1058.0\" y=\"297\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"18\" font-weight=\"800\" fill=\"#46db82\" text-anchor=\"middle\">L3<\/text><rect x=\"335.0\" y=\"540.0\" width=\"230\" height=\"80\" rx=\"12\" fill=\"#155a78\" stroke=\"#9fe6ff\" stroke-width=\"3\"\/><rect x=\"335.0\" y=\"540.0\" width=\"230\" height=\"33.6\" rx=\"12\" fill=\"#2c7ea2\"\/><g stroke=\"#effaff\" stroke-width=\"3\" fill=\"none\" stroke-linecap=\"round\"><path d=\"M371 556.8h26\"\/><path d=\"M397 556.8l-6 -5M397 556.8l-6 5\"\/><path d=\"M415 556.8h26\"\/><path d=\"M415 556.8l6 -5M415 556.8l6 5\"\/><path d=\"M459 556.8h26\"\/><path d=\"M485 556.8l-6 -5M485 556.8l-6 5\"\/><path d=\"M503 556.8h26\"\/><path d=\"M503 556.8l6 -5M503 556.8l6 5\"\/><\/g><rect x=\"357.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"389.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"421.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"453.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"485.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"517.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1235.0\" y=\"540.0\" width=\"230\" height=\"80\" rx=\"12\" fill=\"#155a78\" stroke=\"#9fe6ff\" stroke-width=\"3\"\/><rect x=\"1235.0\" y=\"540.0\" width=\"230\" height=\"33.6\" rx=\"12\" fill=\"#2c7ea2\"\/><g stroke=\"#effaff\" stroke-width=\"3\" fill=\"none\" stroke-linecap=\"round\"><path d=\"M1271 556.8h26\"\/><path d=\"M1297 556.8l-6 -5M1297 556.8l-6 5\"\/><path d=\"M1315 556.8h26\"\/><path d=\"M1315 556.8l6 -5M1315 556.8l6 5\"\/><path d=\"M1359 556.8h26\"\/><path d=\"M1385 556.8l-6 -5M1385 556.8l-6 5\"\/><path d=\"M1403 556.8h26\"\/><path d=\"M1403 556.8l6 -5M1403 556.8l6 5\"\/><\/g><rect x=\"1257.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1289.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1321.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1353.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1385.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><rect x=\"1417.0\" y=\"592\" width=\"18\" height=\"10\" rx=\"2\" fill=\"#46db82\"\/><text x=\"900\" y=\"208\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"30\" font-weight=\"800\" fill=\"#fff\" text-anchor=\"middle\">DIST-01 \u00b7 Layer 3 switch<\/text><text x=\"900\" y=\"236\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"17\" fill=\"#8fd8a9\" text-anchor=\"middle\">ip routing \u00b7 SVI gateways Vlan10\/20\/30\/99 = .1<\/text><rect x=\"390.4\" y=\"414\" width=\"499.2\" height=\"62\" rx=\"10\" fill=\"#0a1f2f\" stroke=\"#3d6a84\"\/><text x=\"640\" y=\"439\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"18\" font-weight=\"700\" fill=\"#e3f4fc\" text-anchor=\"middle\">802.1Q trunk \u00b7 allowed 10,30,99,999<\/text><text x=\"640\" y=\"463\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"16\" fill=\"#a9c7d8\" text-anchor=\"middle\">DIST Gi1\/0\/1 \u2194 ACCESS-01 Gi1\/0\/24 \u00b7 native 999<\/text><rect x=\"910.4\" y=\"414\" width=\"499.2\" height=\"62\" rx=\"10\" fill=\"#0a1f2f\" stroke=\"#3d6a84\"\/><text x=\"1160\" y=\"439\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"18\" font-weight=\"700\" fill=\"#e3f4fc\" text-anchor=\"middle\">802.1Q trunk \u00b7 allowed 20,99,999<\/text><text x=\"1160\" y=\"463\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"16\" fill=\"#a9c7d8\" text-anchor=\"middle\">DIST Gi1\/0\/2 \u2194 ACCESS-02 Gi1\/0\/24 \u00b7 native 999<\/text><text x=\"315\" y=\"588\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"28\" font-weight=\"800\" fill=\"#fff\" text-anchor=\"end\">ACCESS-01<\/text><text x=\"1485\" y=\"588\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"28\" font-weight=\"800\" fill=\"#fff\">ACCESS-02<\/text><path d=\"M450 620V720\" stroke=\"#f6b544\" stroke-width=\"6\"\/><text x=\"466\" y=\"662\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"16\" font-weight=\"700\" fill=\"#ffd58f\">Gi1\/0\/3 \u00b7 access 10 \u00b7 voice 30<\/text><rect x=\"270.0\" y=\"720\" width=\"360\" height=\"92\" rx=\"12\" fill=\"#0f2233\" stroke=\"#f6b544\" stroke-width=\"2.5\"\/><text x=\"450\" y=\"750\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"19\" font-weight=\"800\" fill=\"#f6b544\" text-anchor=\"middle\">VLAN 30 \u00b7 VOICE<\/text><text x=\"450\" y=\"776\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"17\" font-weight=\"700\" fill=\"#e3f4fc\" text-anchor=\"middle\">IP phone \u00b7 10.10.30.0\/24<\/text><text x=\"450\" y=\"799\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"15\" fill=\"#a9c7d8\" text-anchor=\"middle\">voice frames tagged VLAN 30<\/text><path d=\"M450 812V846\" stroke=\"#46db82\" stroke-width=\"6\"\/><rect x=\"270.0\" y=\"846\" width=\"360\" height=\"92\" rx=\"12\" fill=\"#0f2233\" stroke=\"#46db82\" stroke-width=\"2.5\"\/><text x=\"450\" y=\"876\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"19\" font-weight=\"800\" fill=\"#46db82\" text-anchor=\"middle\">VLAN 10 \u00b7 STAFF<\/text><text x=\"450\" y=\"902\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"17\" font-weight=\"700\" fill=\"#e3f4fc\" text-anchor=\"middle\">Staff PC \u00b7 10.10.10.0\/24<\/text><text x=\"450\" y=\"925\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"15\" fill=\"#a9c7d8\" text-anchor=\"middle\">behind the phone \u00b7 untagged<\/text><path d=\"M1350 620V720\" stroke=\"#f25c5c\" stroke-width=\"6\"\/><text x=\"1366\" y=\"662\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"16\" font-weight=\"700\" fill=\"#ffb3b9\">Gi1\/0\/2 \u00b7 access 20<\/text><rect x=\"1170.0\" y=\"720\" width=\"360\" height=\"92\" rx=\"12\" fill=\"#0f2233\" stroke=\"#f25c5c\" stroke-width=\"2.5\"\/><text x=\"1350\" y=\"750\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"19\" font-weight=\"800\" fill=\"#f25c5c\" text-anchor=\"middle\">VLAN 20 \u00b7 STUDENTS<\/text><text x=\"1350\" y=\"776\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"17\" font-weight=\"700\" fill=\"#e3f4fc\" text-anchor=\"middle\">Student laptop \u00b7 10.10.20.0\/24<\/text><text x=\"1350\" y=\"799\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"15\" fill=\"#a9c7d8\" text-anchor=\"middle\">untagged access port<\/text><rect x=\"60\" y=\"985\" width=\"1680\" height=\"80\" rx=\"12\" fill=\"#0a1f2f\" stroke=\"#3cc8e8\" stroke-width=\"2\"\/><text x=\"90\" y=\"1018\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"19\" font-weight=\"800\" fill=\"#3cc8e8\">VLAN 99 \u00b7 MANAGEMENT \u00b7 10.10.99.0\/24<\/text><text x=\"90\" y=\"1046\" font-family=\"DejaVu Sans,Arial,sans-serif\" font-size=\"16\" fill=\"#cfe4ef\">Management SVI on every switch, carried on both trunks \u00b7 VLAN 999 = dedicated unused native VLAN on both trunks<\/text><\/svg><\/figure><p class=\"note\"><strong>Lab convention:<\/strong> All addresses below are original private lab values. The diagram matches the configurations below: trunk allowed lists, native VLAN 999, the voice port on ACCESS-01 Gi1\/0\/3 and the student port on ACCESS-02 Gi1\/0\/2. Interface numbering assumes Cisco Catalyst IOS XE hardware; adapt it to your switch model.<\/p>\n<h2>01 \/ VLAN essentials at a glance<\/h2><div class=\"tblw\"><table><tr><th>Term<\/th><th>Signification<\/th><th>Example<\/th><\/tr><tr><td>Access VLAN<\/td><td>Unmodified endpoint Ethernet frames belong to one data VLAN<\/td><td>Staff PC on VLAN 10<\/td><\/tr><tr><td>Voice VLAN<\/td><td>Phone traffic may be tagged on a host-facing port while PC traffic is untagged<\/td><td>PC VLAN 10 \/ voice VLAN 30<\/td><\/tr><tr><td>802.1Q trunk<\/td><td>Transports multiple VLANs over one physical link by using an 802.1Q tag<\/td><td>Access-to-distribution uplink<\/td><\/tr><tr><td>Native VLAN<\/td><td>Default untagged VLAN on an 802.1Q trunk, unless platform-wide native tagging is enabled<\/td><td>VLAN 999 dedicated unused<\/td><\/tr><tr><td>SVI<\/td><td>Switch virtual interface serving as Layer 3 gateway when routing is enabled<\/td><td>Vlan10 \/ 10.10.10.1<\/td><\/tr><tr><td>VTP<\/td><td>Cisco protocol that can propagate VLAN database changes<\/td><td>Use transparent\/off where appropriate<\/td><\/tr><\/table><\/div>\n<h2>02 \/ Original network design &amp; addressing<\/h2><div class=\"tblw\"><table><tr><th>VLAN<\/th><th>Nom<\/th><th>R\u00e9seau<\/th><th>Gateway SVI<\/th><th>Example location<\/th><\/tr><tr><td>10<\/td><td>STAFF<\/td><td>10.10.10.0\/24<\/td><td>10.10.10.1<\/td><td>ACCESS-01 Gi1\/0\/3 (PC behind the phone)<\/td><\/tr><tr><td>20<\/td><td>STUDENTS<\/td><td>10.10.20.0\/24<\/td><td>10.10.20.1<\/td><td>ACCESS-02 Gi1\/0\/2<\/td><\/tr><tr><td>30<\/td><td>VOICE<\/td><td>10.10.30.0\/24<\/td><td>10.10.30.1<\/td><td>ACCESS-01 Gi1\/0\/3<\/td><\/tr><tr><td>99<\/td><td>MANAGEMENT<\/td><td>10.10.99.0\/24<\/td><td>10.10.99.1<\/td><td>Switch management SVIs<\/td><\/tr><tr><td>999<\/td><td>NATIVE-UNUSED<\/td><td>No user subnet<\/td><td>Aucun<\/td><td>Native trunk VLAN<\/td><\/tr><\/table><\/div>\n<h2>03 \/ Create the VLANs on the switches<\/h2><pre class=\"code\" data-no-translation=\"\">configure terminal\nvlan 10\n name STAFF\nvlan 20\n name STUDENTS\nvlan 30\n name VOICE\nvlan 99\n name MANAGEMENT\nvlan 999\n name NATIVE-UNUSED\nend\nshow vlan brief<\/pre><p><strong>Why:<\/strong> The switches must recognize each VLAN locally. A trunk allow-list does not create the VLAN; it only controls which VLAN tags are permitted across that uplink.<\/p>\n<h2>04 \/ Access ports: one data VLAN<\/h2><pre class=\"code\" data-no-translation=\"\">! ACCESS-02 \u2013 student laptop on Gi1\/0\/2\nconfigure terminal\ninterface GigabitEthernet1\/0\/2\n description STUDENT-LAPTOP\n switchport mode access\n switchport access vlan 20\n spanning-tree portfast\n spanning-tree bpduguard enable\n no shutdown\nend\nshow interfaces GigabitEthernet1\/0\/2 switchport<\/pre><p><strong>Expected result:<\/strong> An ordinary untagged host joins VLAN 20. PortFast is only for verified end-device interfaces; BPDU Guard can disable the port if switch BPDUs appear.<\/p>\n<h2>05 \/ Access port with separate voice VLAN<\/h2><pre class=\"code\" data-no-translation=\"\">! ACCESS-01 \u2013 phone with PC behind it\nconfigure terminal\ninterface GigabitEthernet1\/0\/3\n description STAFF-PHONE-PLUS-PC\n switchport mode access\n switchport access vlan 10\n switchport voice vlan 30\n spanning-tree portfast\n spanning-tree bpduguard enable\n no shutdown\nend<\/pre><p>Data uses VLAN 10; a compatible IP phone tags voice frames for VLAN 30, commonly using LLDP-MED\/CDP information. Supply DHCP scope\/relay and QoS policies separately for real deployments.<\/p>\n<h2>06 \/ Manual 802.1Q trunk \u2014 both ends<\/h2><div class=\"cols\"><div><h3>ACCESS-01 \/ uplink Gi1\/0\/24<\/h3><pre class=\"code\" data-no-translation=\"\">interface GigabitEthernet1\/0\/24\n description TRUNK-TO-DIST-01\n switchport mode trunk\n switchport trunk native vlan 999\n switchport trunk allowed vlan 10,30,99,999\n switchport nonegotiate\n no shutdown<\/pre><\/div><div><h3>DIST-01 \/ downlink Gi1\/0\/1<\/h3><pre class=\"code\" data-no-translation=\"\">interface GigabitEthernet1\/0\/1\n description TRUNK-TO-ACCESS-01\n switchport mode trunk\n switchport trunk native vlan 999\n switchport trunk allowed vlan 10,30,99,999\n switchport nonegotiate\n no shutdown<\/pre><\/div><\/div><p class=\"note\">Both ends of a trunk must match: the same native VLAN (999, a dedicated unused VLAN) and the same allowed list. Configure the second trunk, DIST-01 Gi1\/0\/2 to ACCESS-02 Gi1\/0\/24, the same way with <code data-no-translation=\"\">20,99,999<\/code> on both ends.<\/p><p class=\"warn\">Modern fixed-802.1Q Catalyst platforms may not support <code data-no-translation=\"\">switchport trunk encapsulation dot1q<\/code>. Do not paste the old command unless your switch actually offers encapsulation selection.<\/p>\n<h2>07 \/ Layer 3 switch: SVI gateways and inter-VLAN routing<\/h2><pre class=\"code\" data-no-translation=\"\">! DIST-01 (multilayer switch)\nconfigure terminal\nip routing\ninterface Vlan10\n description STAFF-GATEWAY\n ip address 10.10.10.1 255.255.255.0\n no shutdown\ninterface Vlan20\n description STUDENT-GATEWAY\n ip address 10.10.20.1 255.255.255.0\n no shutdown\ninterface Vlan30\n description VOICE-GATEWAY\n ip address 10.10.30.1 255.255.255.0\n no shutdown\ninterface Vlan99\n description MANAGEMENT-GATEWAY\n ip address 10.10.99.1 255.255.255.0\n no shutdown\nend\nshow ip interface brief | include Vlan\nshow ip route connected<\/pre><p>SVI line protocol generally requires the VLAN to exist and have an active Layer 2 forwarding path (or qualifying autostate conditions). By default, a Layer 3 switch with <code data-no-translation=\"\">ip routing<\/code> can route between connected VLANs; use ACLs\/firewall policy to restrict access.<\/p>\n<h2>08 \/ Restrict students from staff network<\/h2><pre class=\"code\" data-no-translation=\"\">! Example only: deny Student-to-Staff, permit other IPv4\nip access-list extended STUDENT-IN\n deny ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255\n permit ip 10.10.20.0 0.0.0.255 any\ninterface Vlan20\n ip access-group STUDENT-IN in\n!\nshow ip access-lists STUDENT-IN<\/pre><p class=\"warn\">This is only an illustrative ACL\u2014not a complete school segmentation policy. It allows other destinations (including management) unless additional explicit denies are added. In production, build and test a least-privilege matrix and account for IPv6 separately.<\/p>\n<h2>09 \/ VTP: decide before enabling<\/h2><div class=\"tblw\"><table><tr><th>Mode<\/th><th>Behavior<\/th><th>Operational note<\/th><\/tr><tr><td>Server<\/td><td>Creates and advertises VLAN database updates<\/td><td>Misconfiguration can affect an entire VTP domain<\/td><\/tr><tr><td>Client<\/td><td>Receives VLAN database information from upstream<\/td><td>Manual local VLAN creation may be restricted<\/td><\/tr><tr><td>Transparent<\/td><td>Uses locally controlled VLAN configuration, while VTP message handling varies by version<\/td><td>Practical choice for independently managed switches<\/td><\/tr><tr><td>Off (where supported)<\/td><td>Disables VTP participation\/forwarding<\/td><td>Check device support<\/td><\/tr><\/table><\/div><pre class=\"code\" data-no-translation=\"\">! Example \u2013 configure independently managed VLANs\nvtp mode transparent\nshow vtp status<\/pre><p>VTP v3 offers different controls and safer revision handling than v1\/v2; still confirm design and change control before using centralized VLAN propagation.<\/p>\n<h2>10 \/ Troubleshooting \u2014 what to run and why<\/h2><div class=\"tblw\"><table><tr><th>Commande<\/th><th>What it proves<\/th><\/tr><tr><td><code data-no-translation=\"\">show vlan brief<\/code><\/td><td>VLANs are present and access ports are assigned<\/td><\/tr><tr><td><code data-no-translation=\"\">show interfaces trunk<\/code><\/td><td>Trunk state, native VLAN, allowed\/active\/forwarding VLANs<\/td><\/tr><tr><td><code data-no-translation=\"\">show interfaces Gi1\/0\/24 switchport<\/code><\/td><td>Administrative versus operational trunk state<\/td><\/tr><tr><td><code data-no-translation=\"\">show mac address-table dynamic vlan 20<\/code><\/td><td>Source MAC learning within VLAN 20<\/td><\/tr><tr><td><code data-no-translation=\"\">show spanning-tree vlan 20<\/code><\/td><td>STP forwarding versus blocking on VLAN 20<\/td><\/tr><tr><td><code data-no-translation=\"\">show ip interface brief<\/code><\/td><td>SVI addresses and up\/down status<\/td><\/tr><tr><td><code data-no-translation=\"\">show ip route connected<\/code><\/td><td>Connected VLAN routes on the Layer 3 switch<\/td><\/tr><tr><td><code data-no-translation=\"\">show ip dhcp snooping<\/code><\/td><td>Whether DHCP snooping is active and on which VLANs<\/td><\/tr><\/table><\/div>\n<h3>Case A: VLAN 20 users on ACCESS-02 cannot reach their gateway<\/h3><p><strong>Check:<\/strong> the port is in VLAN 20, the VLAN exists on both switches, the trunk is forwarding VLAN 20, DIST-01 Vlan20 is up\/up, and clients have correct subnet\/mask\/gateway. <strong>R\u00e9parer:<\/strong> align both trunk allowed-lists and check STP, DHCP, and SVI state.<\/p>\n<h3>Case B: One access switch displays native VLAN mismatch<\/h3><p><strong>Check:<\/strong> <code data-no-translation=\"\">show interfaces trunk<\/code> on both ends. <strong>R\u00e9parer:<\/strong> set the same dedicated native VLAN and align tagging expectations; investigate before suppressing warnings.<\/p>\n<h3>Case C: Same-VLAN works but different VLANs cannot talk<\/h3><p><strong>Check:<\/strong> <code data-no-translation=\"\">ip routing<\/code>, SVI operational status, default gateways, ACL directions, routing\/firewall policies. <strong>R\u00e9parer:<\/strong> correct gateway\/SVI\/policy, not trunk settings by default.<\/p>\n<h2>11 \/ VLAN security checklist<\/h2><ul><li>Disable unused ports and park them in an unused VLAN; document exceptions.<\/li><li>Set access ports explicitly and avoid dynamic trunk negotiation where not needed.<\/li><li>Limit trunks to necessary VLANs; match both sides and use a dedicated native VLAN.<\/li><li>Apply PortFast and BPDU Guard only to verified endpoint interfaces.<\/li><li>Enable DHCP Snooping and Dynamic ARP Inspection where compatible; define trusted uplinks carefully.<\/li><li>Use 802.1X or MAC authentication policies for user\/device identity, with tested fallback handling.<\/li><li>Protect management VLAN access with ACLs, AAA, SSH, and a dedicated administration path.<\/li><li>Separate sensitive segments using ACLs or stateful firewalls; VLANs by themselves are not security boundaries.<\/li><\/ul>\n<h2>12 \/ Practice questions &amp; explained answers<\/h2><h3>Q1. A switch access port is in VLAN 20. Does it add 802.1Q tags to a normal PC&#8217;s frames?<\/h3><p><strong>Answer:<\/strong> Normally no. Frames to\/from a conventional host on an access port are untagged; the switch tracks VLAN association internally.<\/p><h3>Q2. Why is a trunk allowed VLAN list not enough to create end-to-end connectivity?<\/h3><p><strong>Answer:<\/strong> The VLAN must exist and be active on the relevant switches, STP must permit forwarding, and a valid Layer 3 gateway\/policy must exist where routing is required.<\/p><h3>Q3. A PC can ping another device on VLAN 10 but not a device in VLAN 20. What changes?<\/h3><p><strong>Answer:<\/strong> Inter-VLAN connectivity requires a Layer 3 routing function (SVIs or router-on-a-stick), correct host gateways, and policies that permit the traffic.<\/p><h3>Q4. How does a voice VLAN differ from a second trunk between switches?<\/h3><p><strong>Answer:<\/strong> It is a special host-facing arrangement allowing a capable phone to send tagged voice frames while the attached PC generally sends untagged data; it is not a general-purpose switch-to-switch trunk.<\/p><h3>Q5. Which command quickly reveals a missing allowed VLAN?<\/h3><p><strong>Answer:<\/strong> <code data-no-translation=\"\">show interfaces trunk<\/code>. Compare both ends, the VLAN existence table, and the VLANs currently forwarding through STP.<\/p><h3>Q6. Why should you avoid blindly enabling VTP server mode?<\/h3><p><strong>Answer:<\/strong> Central propagation of VLAN database updates can introduce unintended changes across multiple switches. Choose VTP architecture deliberately and verify version\/domain\/revision behavior.<\/p>\n<h2>13 \/ Sources &amp; further reading<\/h2><p>This is an original MAG212 CYBER guide. The three-switch campus lab, diagram, security checklist and troubleshooting cases were written independently and checked against current Cisco Catalyst documentation and the IEEE standard.<\/p><ul><li><a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/switches\/lan\/c9000\/lyr2-fwd\/vlan\/vlan-configuration-guide\/configure-vlan-trunks.html\" target=\"_blank\" rel=\"noopener\">Cisco IOS XE \u2014 Configure VLAN Trunking<\/a><\/li><li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc3069\" target=\"_blank\" rel=\"noopener\">RFC 3069 \u2014 VLAN Aggregation for Efficient IP Address Allocation (background)<\/a><\/li><li><a href=\"https:\/\/www.ieee802.org\/1\/pages\/802.1Q.html\" target=\"_blank\" rel=\"noopener\">IEEE 802.1Q overview<\/a><\/li><\/ul><p>Older ISL encapsulation and the <code data-no-translation=\"\">switchport trunk encapsulation dot1q<\/code> command are historical\/platform-specific; this guide uses fixed 802.1Q trunks. Example configs are for training and need change-control validation before production use.<\/p>\n<div class=\"vl-foot\">MAG212 CYBER  \u2022  Learn \/ Cheat Sheets  \u2022  VLAN Ultimate Cheat Sheet  \u2022  Original educational illustrations and configuration examples<br><a href=\"\/fr\/learn\/\">Plus de guides dans Apprendre<\/a> \u00b7 <a href=\"\/fr\/learn\/stp-cheat-sheet\/\">Arbre couvrant<\/a> \u00b7 <a href=\"\/fr\/learn\/interior-routing-protocols\/\">Comparaison des protocoles de routage<\/a> \u00b7 <a href=\"\/fr\/services\/\">Conseil en r\u00e9seau et s\u00e9minaires<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBERNETWORK ENGINEERING \u00b7 SWITCHING MASTERCLASS \u00b7 2026 ULTIMATE CHEAT SHEET \/ CCNA \u00b7 CCNP \u00b7 IT ADMINISTRATORS VLANs Ultimate Cheat Sheet 802.1Q Trunking \u2022 Access &amp; Voice Ports \u2022 SVIs \u2022 Inter-VLAN Routing \u2022 VTP \u2022 Security \u2022 Troubleshooting Published by MAG212 CYBER \u00b7 Technical education edition \u2b07 Download the PDF edition VLAN campus [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3436","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3436"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3436\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}