Simple explanation
This lesson covers the specific switch configuration concepts you're expected to know how to apply in a real deployment scenario.
Technical explanation
- VLANs (Virtual LANs) — logically segmenting a physical switch into multiple isolated broadcast domains, without needing separate physical hardware for each segment.
- Trunking (802.1Q) — carrying traffic for multiple VLANs across a single physical link between switches, using VLAN tags to keep traffic separated.
- Native VLAN — the one VLAN on a trunk that's carried untagged, a common source of misconfiguration if it doesn't match on both ends of a trunk link.
- Inter-VLAN routing — since VLANs are isolated by design, a Layer 3 device (router or L3 switch) is required for devices on different VLANs to communicate at all.
- Port security — restricting which MAC addresses are allowed on a given switch port, a defense against unauthorized devices being plugged in.
- 802.1X — port-based network access control, requiring authentication before a device is granted network access through a switch port at all.
- Link aggregation (LACP) — combining multiple physical links into one logical link for increased bandwidth and redundancy.
- Spanning Tree Protocol (STP) and its faster variants (RSTP, MSTP) — preventing loops in networks with redundant physical paths, at increasingly optimized convergence speeds.
Synonyms / related terms
| Term | Means | |---|---| | 802.1Q | The trunking standard | | LACP | Link Aggregation Control Protocol | | RSTP | Rapid Spanning Tree Protocol |
Concept Check
"Two devices on different VLANs, connected to the same switch, cannot communicate with each other despite both having correct IP configurations." This is expected behavior, not a bug — VLANs are isolated broadcast domains by design. The devices need inter-VLAN routing (a Layer 3 device) to communicate; simply having correct IP addresses on the same switch isn't sufficient across VLAN boundaries.
Interview-style Q&A
Q: Why does a mismatched native VLAN on a trunk link cause problems, even though it seems like a minor configuration detail? A: "The native VLAN's traffic is sent untagged. If one switch thinks the native VLAN is 1 and the other thinks it's 99, untagged traffic gets misinterpreted on the receiving end — traffic intended for VLAN 1 could end up delivered as if it belongs to VLAN 99. It's a subtle mismatch that can silently leak traffic between VLANs that were supposed to stay isolated, which is a real security concern, not just a connectivity annoyance."
Memory trick
"Tag it to Trunk it, Route it to Cross it" — VLANs need tagging to cross a trunk, and need routing to cross between each other — two separate concepts often conflated by beginners.