First, the essential ideas
- VLAN and broadcast domain
- A virtual LAN is a logical Layer 2 group. Broadcast frames remain within that group's eligible forwarding ports. A VLAN does not encrypt traffic or automatically provide a route to another VLAN.
- Access port
- An access port normally places untagged data frames into one configured data VLAN. A voice VLAN is a special additional edge-port capability, not permission for an arbitrary set of tagged VLANs.
- Default and normal-range VLANs
- VLAN 1 is the default Ethernet VLAN. Normal-range IDs are 1 through 1005; IDs 1002 through 1005 are legacy reserved defaults. Use ordinary lab IDs 10, 20 and 30 rather than deleting defaults.
- Voice VLAN and tag
- A voice VLAN separates a phone's voice frames from its attached computer's data frames. An 802.1Q tag carries VLAN information; a compatible phone can tag voice while passing untagged computer traffic.
- PoE, PSE and PD
- Power over Ethernet delivers electrical power on supported cabling. The power sourcing equipment is the switch or injector; the powered device is the phone or AP. VLAN configuration does not create electrical power.
- AP and virtualized host
- An access point joins wireless clients to a wired network. A virtualized host runs multiple virtual machines. Their uplinks can need one untagged network or several tagged networks depending on design.
- Subnet and gateway
- A subnet is an IP prefix group. A gateway routes packets between IP networks. Putting two same-prefix endpoints in different VLANs does not supply the missing local delivery path.
- Console and verification
- The Console is the named device's management window. Verification compares intended configuration with operational state and a specific traffic test; a displayed configuration alone does not prove service.
Start with membership, not an IP address guess. Two sockets on the same chassis can belong to different local networks. We first prove a common-VLAN path, then move one port into an unused VLAN and use switch evidence to explain the failure.
See the idea
One edge port, separate requirements
Data membership, voice tagging and electrical power are different checks; none proves the others.
Check data membership
An access data VLAN classifies ordinary untagged computer traffic. A correct IP prefix does not correct wrong port membership.
What this model leaves out: Conceptual comparison, not a wiring diagram. The virtual lab has no phone or powered device, so voice service and electrical operation are unmeasured.
Full visual explanation and references
Three records compare data VLAN 10, voice VLAN 30 and physical PoE. They are separate edge-port requirements, not three connected devices.
Conceptual comparison, not a wiring diagram. The virtual lab has no phone or powered device, so voice service and electrical operation are unmeasured.
- Check data membership
An access data VLAN classifies ordinary untagged computer traffic. A correct IP prefix does not correct wrong port membership.
www.cisco.com - Check voice attributes
A compatible phone can use voice VLAN 30 while its attached computer uses data VLAN 10. The virtual lab inspects settings only.
www.cisco.com - Check actual power
PoE requires capable physical equipment and sufficient budget. A virtual voice setting does not provide watts or prove a call.
www.cisco.com
One idea at a time
Start with something familiar.
Imagine the switch's ports sorted into labeled groups. Draw Gi0/0 and Gi0/1 inside VLAN 10, then draw an empty VLAN 20 group. The upcoming fault moves only Gi0/1 between those groups.
Why learn this?
A device can have a correct address and an illuminated link while belonging to the wrong local network. Reading membership before changing addresses can prevent a second fault from hiding the first.
An everyday comparison
A building can contain several separate meeting rooms even when every participant uses the same street address. Being in the building does not put everyone in the same conversation.
What happens in a network
The chassis is the building and the VLAN groups are rooms. Port membership determines the local conversation; routing is a separately provided path between groups.
Where the comparison stopsVLANs are forwarding boundaries, not acoustic walls or encryption. Their isolation depends on correct configuration and other security controls.
Follow one worked example
- Create a group before assigning its members.
VLAN 10 must exist and be active. Access mode and access VLAN are separate attributes on the chosen interface.
Why: A VLAN name alone neither changes the port's mode nor configures an IP gateway.
- Check the endpoint's tagging expectations.
A desktop normally sends untagged frames. A phone plus computer can use a voice/data split. Some APs and hypervisors need multiple tagged networks.
Why: The port configuration must match the actual endpoint design, not simply its device category.
- Compare the failed path with the known baseline.
Moving H2's port to VLAN 20 breaks its local exchange with H1 in VLAN 10. Restoring VLAN 10 and repeating the same test isolates the effect.
Why: One reversible change makes membership evidence more informative than a collection of unrelated changes.
Your first small task
On paper, give two endpoints 192.0.2.10/24 and 192.0.2.20/24 but place their access ports in VLAN 10 and VLAN 20. Predict whether ordinary local ARP can reach the other endpoint without routing or bridging between groups.
Show a hint
The local ARP request is an Ethernet broadcast and remains in its VLAN; an IP mask does not select a switch's access VLAN.
Check the expected result
It cannot cross the separate VLAN boundary merely because the IPv4 prefixes match.
Pause and explain it in your own words
Does configuring voice VLAN 30 prove that a phone can make calls?
Show a hint
List what is absent from a port's configuration display.
Show the explanation
No. It establishes a port attribute only. A compatible powered phone, discovery or provisioning, addressing and the voice service path must also work; no call is tested in this virtual lab.
Short answer
What should you understand today?
A VLAN defines a separate Layer 2 broadcast domain. An access port assigns ordinary untagged endpoint traffic to its data VLAN; a compatible phone can additionally use a configured voice VLAN. Create the VLAN, set the edge-port mode and membership, then verify both the switch state and the intended peer test. Matching IP prefixes do not overcome different VLAN membership.
Before you begin
Learning targets
- Understand source MAC learning and local IPv4 neighbor discovery.
- Have an existing CML 2.10 entitlement and fresh IOSvL2/IOSv nodes.
- Keep the lab disconnected from external connectors and shared networks.
- Identify normal-range, reserved default and default access VLAN distinctions.
- Configure and verify data access membership and a voice-VLAN attribute.
- Explain edge requirements for computers, phones, APs and virtualized hosts.
- Observe, restore and retest a wrong-VLAN fault without changing IP addresses.
- Separate PoE capability and budget observations from simulator output.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
VLAN and broadcast domain
A virtual LAN is a logical Layer 2 group. Broadcast frames remain within that group's eligible forwarding ports. A VLAN does not encrypt traffic or automatically provide a route to another VLAN.
Access port
An access port normally places untagged data frames into one configured data VLAN. A voice VLAN is a special additional edge-port capability, not permission for an arbitrary set of tagged VLANs.
Default and normal-range VLANs
VLAN 1 is the default Ethernet VLAN. Normal-range IDs are 1 through 1005; IDs 1002 through 1005 are legacy reserved defaults. Use ordinary lab IDs 10, 20 and 30 rather than deleting defaults.
Voice VLAN and tag
A voice VLAN separates a phone's voice frames from its attached computer's data frames. An 802.1Q tag carries VLAN information; a compatible phone can tag voice while passing untagged computer traffic.
PoE, PSE and PD
Power over Ethernet delivers electrical power on supported cabling. The power sourcing equipment is the switch or injector; the powered device is the phone or AP. VLAN configuration does not create electrical power.
AP and virtualized host
An access point joins wireless clients to a wired network. A virtualized host runs multiple virtual machines. Their uplinks can need one untagged network or several tagged networks depending on design.
Subnet and gateway
A subnet is an IP prefix group. A gateway routes packets between IP networks. Putting two same-prefix endpoints in different VLANs does not supply the missing local delivery path.
Console and verification
The Console is the named device's management window. Verification compares intended configuration with operational state and a specific traffic test; a displayed configuration alone does not prove service.
VLAN membership is independent of the IP prefix
A switch groups Layer 2 ports without deriving the group from the address inside each packet. Hosts commonly share one IP subnet per VLAN, but those two concepts remain distinct. Moving a port does not rewrite its host's address. VLAN separation limits local forwarding; it supplies neither encryption nor a router.
- Create and verify the intended group before testing traffic.
- A link-up indication does not prove correct VLAN membership.
Know the defaults without depending on them
VLAN 1 is the default Ethernet VLAN and default access membership on these IOS switch platforms. The normal range is 1-1005, with 1002-1005 reserved for legacy defaults. Ordinary configurable Ethernet lab VLANs such as 10 and 20 are inside that range. Extended IDs 1006-4094 are a separate range, not needed here.
- VLAN ID and VLAN name are different fields; a name is not an address.
- The current v1.1 normal-range objective is only partially completed here; multi-switch and routed use follow.
A phone edge can carry data and voice separately
With a compatible phone, the access VLAN carries ordinary untagged computer data and the configured voice VLAN carries tagged voice traffic. Discovery and endpoint configuration must agree. This specialized access-port behavior should not be described as an unrestricted trunk. A voice VLAN is also not a complete QoS policy or call-control configuration.
- Verify the voice VLAN exists and read the interface's switchport details.
- A phone's attached computer should not be assumed to share the voice subnet.
Choose edge attributes from the actual endpoint design
A desktop, printer or simple appliance often needs one data access VLAN. A standalone AP advertising several locally bridged networks may require a trunk; a controller-based AP can use an access management VLAN when its traffic is centrally tunneled. A virtualized host can need tagged VLANs or an explicitly configured link aggregation group. None of those requirements follows from a label alone.
- Never configure all AP or server ports identically without checking their design.
- This chapter provides a selection framework, not tested AP or hypervisor service.
Power delivery is a separate physical dependency
PoE requires a compatible powered device, a capable sourcing port, suitable cabling and adequate available budget. Virtual IOSvL2 does not generate electrical watts. A configured voice VLAN cannot fix denied power, and a powered phone can still have incorrect VLAN settings. Keep power and data evidence in separate worksheet columns.
- Treat unsupported virtual power commands as a platform boundary, not a reason to invent wattage.
- Do not override consumption budgets to make a device power on.
Restore one attribute and repeat the same test
A wrong-access-VLAN fault can leave the interface up and the IP address unchanged. Read the port's administrative mode, operational mode and access VLAN, then compare with the known working state. Restore only the intended membership. A successful retest supports that selected local path, not every VLAN or application.
- Do not save a deliberate fault into the desired baseline.
- Preserve observed output and label all unexecuted exercises as predictions.
Real-world walkthrough
The moved desk has link but cannot reach its neighbor
A hypothetical desk move reconnects a computer to a spare port assigned to a different department. Its static IPv4 address is unchanged and its link is up, so the user blames the address plan. The operator has a prior port worksheet and can compare intended membership before changing the host.
- Record the new cable socket, switch interface and endpoint address without assuming the old label is accurate.
- Read the interface's access VLAN and confirm that the intended VLAN exists and is active.
- Compare the path with the known working department peer, preserving a failed test as evidence.
- Restore only the authorized access membership and repeat the identical peer test.
- Document remaining scope: DHCP, authentication, printing and application services need their own checks.
Guided GNS3 lab
A wrong access VLAN with unchanged endpoint addresses
Verify a working VLAN 10 path, move only H2's access port to VLAN 20, then restore and retest. Inspect a separate voice-port configuration without claiming phone or PoE operation. Runtime is unmeasured.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| H1 | Gi0/0 | 192.0.2.10/24 | VLAN 10 data source |
| H2 | Gi0/0 | 192.0.2.20/24 | Peer remains addressed during fault |
| SW1 | Gi0/2 | No IP; data 10, voice 30 | Unconnected configuration-only port |
Set up the lab
- Use fresh CML nodes under existing entitlement, with the exact two cables shown. Record image builds and do not attach external connectors.
- Start the nodes, decline the initial setup dialog if offered, and preserve their original configurations and port mappings.
- Use the CML Console for every device change. If interfaces differ or commands are unsupported, stop and consult that image's documentation.
- Paper alternative: make a port/VLAN/IP worksheet and predict the fault. A paper result does not count as traffic, phone or electrical validation.
Record defaults and create the VLANs
In CML, select SW1, open its Console tab and connect before typing. Inspect the fresh configuration first. Use VLANs 10, 20 and 30 only; leave all reserved default VLANs intact.
enable
show version
show vlan brief
configure terminal
vlan 10
exit
vlan 20
exit
vlan 30
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
show version- Record the actual virtual switch release.
show vlan brief- Record default VLANs and existing access membership.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
vlan 10- Create the intended data VLAN.
exit- Return to global configuration.
vlan 20- Create the isolated fault VLAN.
exit- Return to global configuration again.
vlan 30- Create the voice VLAN for attribute inspection.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- VLANs 10, 20 and 30 exist alongside the default records.
- Why this step matters
- Explicit creation separates an intended broadcast domain from a port merely referencing a number.
Assign both data ports
In CML, select SW1, open its Console tab and connect before typing. Confirm the two cabled ports before using the range command. No other port is included in this data baseline.
configure terminal
interface range GigabitEthernet0/0 - 1
switchport mode access
switchport access vlan 10
no shutdown
end
show interfaces GigabitEthernet0/1 switchportWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface range GigabitEthernet0/0 - 1- Select exactly the H1 and H2 data ports.
switchport mode access- Make untagged data access mode explicit.
switchport access vlan 10- Place both endpoint ports in the same data domain.
no shutdown- Enable the selected data interfaces.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/1 switchport- Read H2's administrative mode and access VLAN.
- What you should see
- Both mapped data ports are access VLAN 10.
- Why this step matters
- The working membership must be known before intentionally moving one endpoint.
Address the first endpoint
In CML, select H1, open its Console tab and connect before typing. Open the H1 Console and configure only its mapped Gi0/0. No gateway is required for the local /24 peer.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.10 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select H1's sole data cable.
ip address 192.0.2.10 255.255.255.0- Give H1 its distinct local /24 address.
no shutdown- Enable H1's endpoint link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- H1 has 192.0.2.10/24 on its cabled interface.
- Why this step matters
- Keeping endpoint addresses fixed will isolate the later Layer 2 membership change.
Address the second endpoint
In CML, select H2, open its Console tab and connect before typing. Open H2's separate Console. Verify the .20 value, and do not add a route intended to bypass the VLAN experiment.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.20 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select H2's cable to SW1 Gi0/1.
ip address 192.0.2.20 255.255.255.0- Give H2 its distinct address in the same planned subnet.
no shutdown- Enable H2's endpoint link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- H2 is configured as the distinct .20 peer.
- Why this step matters
- Matching prefixes are necessary for this local test but are not sufficient without common VLAN membership.
Prove the common-VLAN baseline
In CML, select H1, open its Console tab and connect before typing. Wait for links and spanning tree to settle. Repeat once after initial discovery if necessary; investigate sustained failure before proceeding.
ping 192.0.2.20
show arpWhat each command means
ping 192.0.2.20- Test the other endpoint using the fixed local destination.
show arp- Record whether H2's local neighbor entry is learned.
- What you should see
- Expect repeatable replies from H2; record actual results and timestamps.
- Why this step matters
- The fault comparison is meaningful only when this exact peer test first works.
Inspect the reserved phone-port attributes
In CML, select SW1, open its Console tab and connect before typing. Gi0/2 must remain disconnected. This inspects configuration only; stop and label unsupported if the virtual image rejects voice syntax.
configure terminal
interface GigabitEthernet0/2
shutdown
switchport mode access
switchport access vlan 10
switchport voice vlan 30
end
show interfaces GigabitEthernet0/2 switchportWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/2- Select the disconnected reserved phone-port example.
shutdown- Keep this unused example port disabled.
switchport mode access- Use the specialized access-port voice/data model.
switchport access vlan 10- Assign untagged data to VLAN 10.
switchport voice vlan 30- Assign the voice VLAN attribute to 30.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/2 switchport- Inspect data and voice VLAN fields separately.
- What you should see
- Expect configured access VLAN 10 and voice VLAN 30; no phone traffic or power is observed.
- Why this step matters
- Configuration acceptance establishes an attribute, not a powered phone, negotiated service or successful call.
Introduce the wrong-access-VLAN fault
In CML, select SW1, open its Console tab and connect before typing. Change only H2's access membership after the successful baseline. Do not change H2's address or the cable and do not save the fault.
configure terminal
interface GigabitEthernet0/1
switchport access vlan 20
end
show interfaces GigabitEthernet0/1 switchport
show interfaces statusWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select only H2's mapped access port.
switchport access vlan 20- Move H2 into the isolated fault domain.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/1 switchport- Record the changed VLAN while checking mode.
show interfaces status- Observe that physical connectivity can remain up.
- What you should see
- H2's port belongs to VLAN 20 even if the link remains connected.
- Why this step matters
- This demonstrates why link status and same-prefix addresses do not establish a common local network.
Observe the unchanged destination fail
In CML, select H1, open its Console tab and connect before typing. Repeat the original .20 destination with both endpoints still using their original addresses. Do not clear tables as an attempted repair.
ping 192.0.2.20What each command means
ping 192.0.2.20- Repeat the exact baseline peer test across the now-separated VLANs.
- What you should see
- Expect no successful peer echo exchange through this isolated topology.
- Why this step matters
- Previously cached neighbor information does not create a forwarding path across a separate VLAN.
Restore intended membership
In CML, select SW1, open its Console tab and connect before typing. Return only Gi0/1 to its recorded data VLAN. The reserved phone-port example remains disconnected and untouched.
configure terminal
interface GigabitEthernet0/1
switchport access vlan 10
end
show vlan briefWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select the port changed by the fault.
switchport access vlan 10- Restore H2's original local broadcast domain.
end- Return to privileged EXEC without saving or reversing the configuration.
show vlan brief- Confirm both data ports again belong to VLAN 10.
- What you should see
- The membership record matches the working baseline.
- Why this step matters
- An explicit inverse is safer than erasing all VLANs or restoring an unrelated full configuration.
Retest and document the boundary
In CML, select H1, open its Console tab and connect before typing. Use the same source and peer after normal convergence. Preserve results whether or not they match the prediction.
ping 192.0.2.20
show arpWhat each command means
ping 192.0.2.20- Repeat the original peer echo exchange after membership restoration.
show arp- Compare the local neighbor mapping with the baseline.
- What you should see
- Expect replies to return; no voice, AP, power or application test is implied.
- Why this step matters
- The conclusion is narrow: the selected local data path recovered after restoring the intended membership.
Verify
- Record the default VLAN and normal-range VLANs without deleting reserved entries.
- Read both data and voice attributes on the reserved port; distinguish configured from operational endpoint service.
- Require a working local baseline before moving Gi0/1.
- During the fault, correlate failed peer traffic with wrong VLAN and unchanged link/address state.
- After restoration, compare the same peer test and membership with the baseline.
Troubleshoot
- If the VLAN is absent or inactive, correct that prerequisite before interpreting an access-port assignment. A number in configuration alone is insufficient.
- If the baseline fails, verify actual cables, access modes, distinct /24 addresses and normal spanning-tree convergence before introducing the fault.
- If a virtual voice or PoE command is unsupported, record the exact image and stop that optional branch. Do not fabricate phone registration or electrical observations.
- If physical PoE is denied, inspect supported hardware and available budget through an authorized read-only session; do not bypass protective limits.
Use an existing Cisco Modeling Labs 2.10 entitlement and its bundled reference images inside CML only. GNS3 does not provide Cisco images; use images there only when a separate applicable license permits that environment. Do not share or redistribute image files. A CML subscription alone does not authorize exporting its Cisco images to GNS3. Without entitlement, use the explicitly labeled paper exercises; they do not establish hands-on competence.
- Restore Gi0/1 to VLAN 10 and retain the successful peer retest before stopping nodes.
- Leave the disconnected Gi0/2 example shutdown. Preserve private notes and the clean starting snapshot; do not erase shared VLAN databases.
Practice set
Answer before you reveal
01Why can two /24 peers still fail on one switch?
An IP prefix does not move Ethernet broadcasts across separate Layer 2 domains; inspect the access membership.
02Which VLAN is the default Ethernet VLAN?
A default value is not a design mandate; the lab explicitly uses VLAN 10 and does not delete default records.
03Are all IDs 1-1005 ordinary user VLANs?
Normal-range terminology includes these IDs, but the lesson uses ordinary configurable Ethernet VLANs such as 10.
04What separates phone data from voice here?
A compatible phone must handle the expected tagging; an access voice feature is not an arbitrary multi-VLAN trunk.
05Does a virtual switch demonstrate PoE wattage?
Physical port capability, powered-device requirements and budget need real authorized hardware observations.
06Why not change H2's address during the fault?
Changing an address too would obscure whether restoration of the original VLAN actually explains recovery.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- VLAN membership and IP subnetting are distinct decisions.
- VLAN 1 is a default, not a requirement to place all endpoints together.
- Normal-range VLAN coverage includes recognition of reserved defaults.
- Data and voice attributes need compatible endpoint behavior.
- PoE needs physical capability and budget; virtual watts are not evidence.
- Restore one known fault and repeat the same verification.