Tutorials · Switching
How to Configure VLANs on a Managed Switch
Separate staff, guests, voice and cameras into their own VLANs: create VLANs, set access and trunk ports, and verify traffic separation.
Before you start
- A managed (L2 or L3) switch with console, SSH or web access
- An IP plan listing each VLAN ID, name and subnet
- A backup of the current configuration
Step by step
Plan your VLANs
Give each group its own VLAN ID and subnet. A common pattern is 10 = Staff, 20 = Voice, 30 = CCTV, 40 = Guests and 99 = Management. Avoid VLAN 1 for user traffic.
Create the VLANs
In the web interface this is usually under VLAN → VLAN settings. From the CLI:
vlan 10 name STAFF vlan 20 name VOICE vlan 30 name CCTV vlan 40 name GUEST
Assign access ports
Ports to end devices are access (untagged) ports in a single VLAN.
interface range gigabitEthernet 0/1-12 switchport mode access switchport access vlan 10
Configure trunk ports
Uplinks to other switches, routers and access points carry several VLANs, tagged with 802.1Q.
interface tengigabitEthernet 0/1 switchport mode trunk switchport trunk allowed vlan 10,20,30,40,99
Set the management VLAN
Move switch management to VLAN 99 so users cannot reach it.
interface vlan 99 ip address 10.99.0.11 255.255.255.0
Verify
Check VLAN membership and test that a device in VLAN 40 cannot reach VLAN 10 unless a router or ACL allows it.
show vlan show interface trunk
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Document every port: switch, port, VLAN and connected device.
- Prune unused VLANs from trunks.
- Shut down unused ports or put them in an unused 'parking' VLAN.
FAQ
Frequently asked questions
What is the difference between an access port and a trunk port?
An access port carries one untagged VLAN for an end device. A trunk carries several tagged VLANs between switches, routers and access points.
Do VLANs need a router?
Devices in different VLANs need a Layer 3 device, a router or Layer 3 switch, to communicate. That is how you control traffic between them.
Keep learning
Related guides
Inter-VLAN routing on a Layer 3 switch
Read more →Layer 2 vs Layer 3 switches
Read more →How to Set Up Inter-VLAN Routing on a Layer 3 Switch
Route between VLANs at wire speed using switch virtual interfaces (SVIs), a DHCP relay and ACLs that control which networks can talk.
Read more →How to Configure Link Aggregation (LACP) Between Switches
Bundle two or more links into one logical link for more bandwidth and redundancy using IEEE 802.3ad LACP.
Read more →How to Prevent Network Loops With Spanning Tree (RSTP)
Stop broadcast storms caused by loops: enable RSTP, choose the root bridge, and protect edge ports with BPDU guard.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.