Week 30%

Lesson 2 — VLANs and Broadcast Domains

Week 3Lesson 2Required34 min estimated0% progress

VLANs and Broadcast Domains

Create VLANs, assign access ports, and prove that broadcasts stay inside their VLAN unless a Layer 3 hop is introduced.

What you'll learn (4 objectives)~34 min: video → lesson → check → apply → lab prep

Learning objectives

Explain how a VLAN splits one physical switch into isolated broadcast domains and why that reduces flooded traffic
Assign an access port to a VLAN and verify membership with show vlan brief
Predict which hosts can communicate on a single switch with no router or SVI present
State why inter-VLAN traffic requires a Layer 3 hop even when the hosts share a chassis

Terms you will see

VLANBroadcast domainAccess portUntagged frameVLAN-to-subnet mappingSVIRouter-on-a-stickInter-VLAN routing

Time breakdown

Read the notes16 min
VLAN Campus Visualizer8 min
Connectivity prediction5 min
Lab stage — VLANs and access ports5 min

Opens on YouTube

VLANs Part 1 (Day 16)

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch: ~12 min

Watch on YouTube

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

Creating VLAN 10 and VLAN 20 splitting one switch into two broadcast domains
An access port being bound to exactly one VLAN
show vlan brief confirming where each port landed

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

One switch, one broadcast domain — until VLANs

By default every access port on a switch shares one Layer 2 space. A broadcast frame — an ARP request, a DHCP discover, an unknown-unicast flood — reaches every other port, which is exactly the flooding behaviour from the previous lesson. Before any VLAN is configured, an eight-port switch has precisely one broadcast domain.

What a VLAN actually does

A VLAN divides that single switch into separate broadcast domains. A frame in VLAN 10 is flooded only to VLAN 10 ports; a frame in VLAN 20 only to VLAN 20 ports. The two groups behave as though they were on physically separate switches. The MAC table you learned to read in the last lesson now tracks a VLAN alongside each MAC and port — which is why that Vlan column exists.

An access port connects an ordinary host, which sends untagged frames. The switch, not the host, decides membership: whatever VLAN the port is assigned to is the VLAN those frames belong to. Carrying several VLANs across one inter-switch link needs a trunk, which is the next lesson.

A VLAN maps to a subnet

In typical designs each VLAN carries one IP subnet — VLAN 10 for 10.10.10.0/24, VLAN 20 for 10.10.20.0/24. This is a design convention rather than a rule the switch enforces, but it matters because of the interaction with broadcasts: since a broadcast, including ARP, stays inside its VLAN, a host in VLAN 10 cannot resolve a host in VLAN 20 at Layer 2 even when they share a chassis.

Why reaching another VLAN needs Layer 3

Different VLANs are different subnets, so moving traffic between them is routing, not switching. A host sends off-subnet traffic to its default gateway and a Layer 3 device forwards it into the other VLAN. Three options exist conceptually: a router with one physical interface per VLAN; router-on-a-stick, where one trunked router interface carries a subinterface per VLAN; or a Layer 3 switch using SVIs — interface vlan 10 — with routing enabled. The configuration detail belongs to the routing weeks. What matters here is only that the inter-VLAN hop must be Layer 3.

Membership decides the domain, not the address

Four hosts on one switch, no router. A broadcast leaving Host A floods only to Host B. Hosts C and D never see it — including Host D, which has deliberately been given an address inside the VLAN 10 subnet to make the point.

Broadcast scope on a single switch with two VLANs

Host	Port	VLAN	IP address	Sees a broadcast from A?
A	Gi0/1	10	10.10.10.11/24	— (sender)
B	Gi0/2	10	10.10.10.12/24	Yes
C	Gi0/3	20	10.10.20.13/24	No
D	Gi0/4	20	10.10.10.14/24	No — different VLAN, despite the matching subnet

Host D is the instructive row. It shares a subnet with A and still cannot hear A's ARP, because they are in different broadcast domains. VLAN membership defines the domain; the IP address has no say in it.

Configure and verify

Create a VLAN and assign an access port

! Create a VLAN and name it (global config)
Switch(config)# vlan 10
Switch(config-vlan)# name SALES

! Put the port in access mode and assign its VLAN
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

! Verify
Switch# show vlan brief
Switch# show interfaces GigabitEthernet0/1 switchport

show vlan brief lists each VLAN ID, its name, status, and assigned ports — the fastest confirmation that a port landed where you intended. show interfaces <intf> switchport drills into one port and reports its administrative mode and access VLAN, which is how you catch a port in the wrong VLAN or one that was never set to access mode at all.

Set the mode explicitly, even though it often defaults

It is tempting to type only switchport access vlan 10 and rely on the default. Don't. A port left in dynamic mode can negotiate itself into a trunk if the neighbour pushes for one, which is both unpredictable and a security exposure. Forcing switchport mode access pins the port to a single VLAN and stops any trunk negotiation. The trunk lesson returns to that negotiation protocol, DTP, and to why turning it off is the production habit.

What you should retain

A VLAN is a broadcast domain carved out of one physical switch.
An access port carries one data VLAN, and the switch — not the host — sets membership.
A VLAN normally maps to one IP subnet, and ARP never crosses the VLAN boundary.
Inter-VLAN traffic is routing: it needs a router interface, router-on-a-stick, or a Layer 3 switch SVI.
Verify the whole switch with show vlan brief and a single port with show interfaces <intf> switchport.
Membership decides the broadcast domain — a matching IP subnet does not help across VLANs.

Pause and predictNot scored — nothing is recorded

Before you read on

Using the four hosts in the table above, with no router, no SVI and no trunk: (1) Can A ping B? Can C ping D? (2) Can A ping C? (3) Host D is in VLAN 20 but carries 10.10.10.14/24, matching A's subnet — can A ping D?

Interactive tool

See it happen

Required~8 min

VLAN Campus Visualizer

Move ports between VLANs and watch the broadcast scope change. Seeing the flood boundary redraw itself as you reassign a port is the fastest way to stop thinking of a VLAN as a label and start thinking of it as a boundary.

Open the tool

Section quiz

Check this section before moving on

Required8 questions~10 min

Switching & VLAN Fundamentals

The quiz opens on its own page so you can focus on it. It is a Week 1 milestone, tracked separately from this lesson's own completion.

Topics covered

• Learning from the source MAC and the three forwarding actions
• Aging, relearning, and reading show mac address-table
• VLANs as broadcast domains and access-port membership
• Why inter-VLAN traffic needs a Layer 3 hop

Start the quiz

Lab preparation

Prepare for the lab

Available nowWeek 3

Week 3 Lab — VLAN and Trunk (stage 1 of 4)

This is the VLAN stage of a progressive lab you extend across the week. You create VLANs 10 and 20 on SW1, assign the host access ports, and prove that a broadcast stays inside its VLAN when no Layer 3 path exists. The trunk, STP and EtherChannel lessons all continue this same topology.

This lesson prepares you to:

• Creating normal-range VLANs with names in global config
• Assigning access ports with switchport mode access and switchport access vlan
• Confirming placement with show vlan brief
• Proving cross-VLAN isolation by ping and by inspecting the ARP cache

The same lab is extended in Lessons 3, 5 and 6 — do not reset the topology between stages.

Open the lab

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

VLANs & Trunks

For the exhaustive VLAN advantage list and the normal/extended ID range tables — 1–1005 and 1006–4094 — which this lesson deliberately does not repeat

Open guide

Lesson orientation