VLAN (Virtual LAN) is one of the most fundamental and widely-used CCNA concepts — it lets you split a single physical network into several separate logical networks, without needing extra wiring or hardware. Let's build a real VLAN on a Cisco switch together, step by step.
Step 1: Enter configuration mode
First, enter Privileged EXEC mode, then Global Configuration mode:
enable
configure terminal
Step 2: Create a new VLAN
Let's say we want to create a VLAN for the sales department:
vlan 10
name Sales
exit
This creates a VLAN numbered 10 named "Sales."
Step 3: Assign ports to the VLAN
Now we need to specify which physical switch ports belong to this VLAN. Let's assign ports 1 through 5 to the sales VLAN:
interface range fastEthernet 0/1-5
switchport mode access
switchport access vlan 10
exit
The switchport mode access command specifies that these ports connect to an end device (like a computer), not another switch or router.
Step 4: Create a second VLAN (for comparison)
Now let's create another VLAN for the finance department:
vlan 20
name Finance
exit
interface range fastEthernet 0/6-10
switchport mode access
switchport access vlan 20
exit
From this point on, devices connected to ports 1-5 (Sales VLAN) and devices connected to ports 6-10 (Finance VLAN) are completely isolated from each other — even on the same physical switch, they can't exchange traffic directly.
Step 5: Configure a trunk (if spanning multiple switches)
If these VLANs need to extend across multiple switches, the port connecting the switches together needs to be a trunk so it can carry traffic for all VLANs:
interface fastEthernet 0/24
switchport trunk encapsulation dot1q
switchport mode trunk
exit
Step 6: Verify
To confirm everything's configured correctly:
show vlan brief
This command shows the full list of VLANs and which ports are assigned to each.
Why does VLAN matter so much?
Beyond logically organizing a network (sales, finance, IT each with their own VLAN), VLANs are also a core network security tool — because traffic from one segment is isolated from another, even if a device in the sales VLAN gets infected, it can't directly reach devices in the finance VLAN.
This is exactly the kind of hands-on exercise we do in my CCNA courses, on real and simulated equipment alike.
Blog