Course contents

Chapter 4: VLANs and TrunksLesson 7 of 14

Troubleshooting VLANs

One employee cannot reach a colleague on the next floor. Is the problem the access port, the shared trunk, the host settings or the router? Let's use a known path and read the evidence before changing anything.

Intermediate · 7 min read

Which part of the intended path has failed?

A VLAN is an Ethernet forwarding group; a subnet is an IP address range. We use VLAN 10 with subnet 192.168.10.0/24 and VLAN 20 with 192.168.20.0/24. These related settings are not interchangeable: changing an IP mask does not move a switchport into a different VLAN.

PC1 is 192.168.10.11/24 on SW1 Gi1/0/1. PC3 is 192.168.10.12/24 on SW2 Gi1/0/1. SW1 Gi1/0/23 connects to SW2 Gi1/0/24. Their same-subnet test needs access VLAN 10 at both hosts and a forwarding VLAN 10 path across that trunk; it does not need R1.

Choose a test with a clear expected path. Otherwise, a failed reply tells you too little about which setting is wrong. First check the active host adapter, link, IP address and mask. Then inspect the corresponding switch port. A link light shows a physical connection, not correct VLAN membership.

PC1 to PC3: one VLAN across two switches
PC1 to PC3: one VLAN across two switchesPC1 192.168.10.11/24 connects to SW1 Gi1/0/1 in access VLAN 10. SW1 Gi1/0/23 trunks to SW2 Gi1/0/24. PC3 192.168.10.12/24 connects to SW2 Gi1/0/1 in access VLAN 10. Native VLAN is 99 at both trunk ends. VLAN 10 is allowed, active and forwarding. The access links carry untagged data and the trunk carries tag 10. No router is needed for this same-subnet delivery.PC1SW1SW2PC3SW1 Gi1/0/1Access VLAN 10SW1 Gi1/0/23SW2 Gi1/0/24Trunk · native 99SW2 Gi1/0/1Access VLAN 10192.168.10.11/24192.168.10.12/24UntaggedTag: VLAN 10UntaggedSame subnet and VLAN · no default-gateway hop in this path
The IP addresses identify the communicating hosts; the VLAN tag identifies the Layer 2 broadcast domain. These switchports do not need IP addresses to switch this frame. The switch uses the VLAN and learned destination MAC to choose an egress port; ARP and MAC learning are assumed complete.

For each problem: what you'll notice, why it happens, and how to prove it. When a VLAN works on one switch but not across a trunk, start with show interfaces trunk: problems 2 and 3 both show up there.

Commands here use Cisco Catalyst IOS or IOS XE-style switches and an IOS-style router. Run show commands from privileged EXEC mode, such as SW1#. Use configure terminal for changes, then select the named interface. Confirm interface names on your device. The examples are documentation-based; this page does not query your switches.

1. Wrong access VLAN

Symptom: PC1 gets a 192.168.20.x address, or can't reach other employees. Why: its port is in the wrong VLAN, so it's in the wrong broadcast domain. Verify: show vlan brief lists Gi1/0/1 under VLAN 20. Fix: switchport access vlan 10 on that port.

Correlate show vlan brief with show interfaces GigabitEthernet1/0/1 switchport. The first shows membership; the second shows the port's configured and operational mode. A guest-looking IP is a clue, not sufficient proof: a static address or stale lease can also be wrong. Confirm the port before moving it.

2. VLAN missing from the trunk's allowed list

Allowed is only the first check for VLAN 10
Allowed is only the first check for VLAN 10On both SW1 Gi1/0/23 and SW2 Gi1/0/24, check operational trunk status, then VLAN 10 in the allowed list, allowed and active list, and forwarding and not pruned list. These checks are required for this intended data path, but do not prove endpoint addressing, MAC learning or host policy.First confirm: operational trunk · expected physical link up1 · AllowedDoes the trunk permit VLAN 10?2 · Allowed and activeDoes VLAN 10 exist and remain active locally?3 · Forwarding and not prunedCan this trunk forward VLAN 10 in the current topology?
Read all three sections of show interfaces trunk on both switches. Adding a VLAN to the allowed list does not create it locally or override spanning tree. A blocked redundant port may be healthy; inspect the intended topology before changing STP.

Symptom: PC1 can't reach PC3 (same VLAN, different switches), but everything else works. Why: the trunk doesn't carry VLAN 10. Verify:

Illustrative Cisco Catalyst IOS XE output, shortened and written for this lesson
SW1#show interfaces trunk
Port        Vlans allowed on trunk
Gi1/0/23    20,99
VLAN 10 is missing. Fix: switchport trunk allowed vlan add 10. Use add: without it, the command replaces the whole list.

If VLAN 10 is allowed but still fails, check the other two lists: allowed and active confirms the local VLAN is active; forwarding and not pruned confirms its forwarding state. Use show vlan brief andshow spanning-tree vlan 10 on both switches to narrow it down.

3. Native VLAN mismatch

Symptom: the switches log native VLAN mismatch warnings, and either untagged traffic appears in the wrong VLAN or, with Per-VLAN Spanning Tree Plus (PVST+), affected VLANs may be blocked on the trunk. Why: each end puts untagged frames in a different VLAN. Verify: the "Native vlan" column of show interfaces trunk differs between the two switches; Cisco Discovery Protocol (CDP) can report:

Illustrative Cisco native-VLAN mismatch message, written for this lesson
%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet1/0/23 (99), with SW2 GigabitEthernet1/0/24 (1).
Fix: set the same switchport trunk native vlan on both ends.

4. DHCP fails in one VLAN

Symptom: guests get 169.254.x.x addresses; employees are fine. Possible causes: in this separate DHCP example, the server is on another subnet and VLAN 20's gateway has no relay, or the server has no VLAN 20 pool. Verify: check ip helper-address on the VLAN 20 subinterface or switch virtual interface (SVI), and the server's pools. Fix: add the helper or the pool. See DHCP.

DHCP (Dynamic Host Configuration Protocol) supplies host settings. A relay forwards a client's request towards a server on another subnet. Configure ip helper-address on the client-facing Layer 3 interface, not just on an arbitrary trunk. The helper value is the server's reachable IP address. Verify the path, server scope and available addresses; policies or DHCP snooping can also block the exchange.

5. Same VLAN works, other VLANs don't

Symptom: PC1 reaches PC3 (same VLAN) but not PC2. Why: same-VLAN reachability has been demonstrated, but inter-VLAN delivery has not. Routing, host gateways and access policies are candidates; a failed ping alone does not prove routing is broken. Typical causes are a wrong gateway on the PC, a subinterface with the wrong encapsulation dot1Q VLAN, the VLAN not allowed on the router trunk, or an SVI that's down, or an access-control list (ACL) or firewall blocking Internet Control Message Protocol (ICMP). Verify: ipconfig on the PC, show ip interface brief on R1 (subinterfaces up/up?), and show interfaces trunk on SW1's router-facing port.

Exercise: an employee with a guest address

A new employee on SW1 port Gi1/0/5 says they can reach the guest Wi-Fi printer but not the employee file server. Their laptop has the address 192.168.20.57. On SW1 you run:

Example output, shortened and written for this lesson (based on Cisco documentation)
SW1#show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi1/0/6, Gi1/0/7
10   EMPLOYEES                        active    Gi1/0/1, Gi1/0/2, Gi1/0/4
20   GUESTS                           active    Gi1/0/3, Gi1/0/5
99   NATIVE                           active
Find the employee's port in the output, then answer the first question below.

The output directly identifies Gi1/0/5 in VLAN 20. Move that confirmed employee port, then renew the lab client's DHCP lease and verify its address, mask and gateway. A port move does not guarantee that an operating system immediately discards every old setting.

Controlled lab: change one condition and recover it

  1. Build the healthy static-address baseline in the linked lab. Record PC1 → PC3 and PC1 → PC2 results, plus the current trunk list. Retain console access so an intended network fault does not lock you out.
  2. On isolated SW1 Gi1/0/23, remove VLAN 10 with switchport trunk allowed vlan remove 10. PC1 → PC3 should lose its only intended Layer 2 path. The local routed PC1 → PC2 path uses R1 on the other uplink and can still work.
  3. Read both trunk ends. Restore VLAN 10 using switchport trunk allowed vlan add 10 on SW1 Gi1/0/23. Confirm the allowed, active and forwarding lists, then repeat the same tests.
  4. If recovery fails, check the observed state instead of applying unrelated fixes. MAC and ARP (Address Resolution Protocol) entries may need traffic to relearn; STP (Spanning Tree Protocol) may need to finish its transition. Do not disable loop prevention to make a test pass.

The trade-off in a shared trunk is that one configuration can affect several groups. A narrow change with a recorded rollback preserves the working VLANs and produces clearer evidence than replacing the whole configuration.

Practice questions on the lab network

Reference: Cisco IOS XE VLAN trunking guide. Check both trunk ends and preserve spanning-tree protection. After moving a host to another VLAN, renew its DHCP address and verify its gateway.

Predict · scenario 1

In the troubleshooting exercise above, what is wrong and how do you fix it?

Predict · scenario 2

VLAN 30 exists on both switches, but the trunk between them shows 'Vlans allowed on trunk: 10,20,99'.

Predict · scenario 3

PC1 (VLAN 10) and PC2 (VLAN 20) are on the same switch, and no router or SVI is configured.

Predict · scenario 4

After 'switchport trunk allowed vlan 30' is typed on a working trunk that carried 10 and 20, employees on floor 2 lose contact with floor 1.

Three small configuration tasks

These answers start in global configuration mode and assume the required VLANs already exist. They are independent tasks, not commands to paste onto an unrelated live network.

Task 1: Put port Gi1/0/7 into VLAN 20 as an access port.
interface GigabitEthernet1/0/7 switchport mode access switchport access vlan 20

Then confirm it with show vlan brief: Gi1/0/7 appears in the VLAN 20 row.

Task 2: Allow VLAN 30 on trunk Gi1/0/23 without removing VLANs 10, 20 and 99.
interface GigabitEthernet1/0/23 switchport trunk allowed vlan add 30

show interfaces trunk should now list 10,20,30,99. The same change is needed on SW2's end.

Task 3: Add a gateway for VLAN 30 (192.168.30.1/24) on R1.
interface GigabitEthernet0/0.30 encapsulation dot1Q 30 ip address 192.168.30.1 255.255.255.0

VLAN 30 must also be allowed on the R1–SW1 trunk, or the subinterface has nothing to route.

Technical references

VLAN membership and trunk checks follow the Cisco IOS XE VLAN trunking guide. DHCP evidence and relay checks follow Cisco's enterprise DHCP troubleshooting guide. No physical-switch or simulator execution is claimed.