Backup
Backup
An independent recoverable copy of data or system state.
In everyday business: It is the safety net for deletion, corruption, ransomware, hardware loss or major mistakes.
SWITCHING CONFIGURATION
Managed Switch, VLAN and Trunk Configuration Guide
A practical installer guide to designing access ports, trunks, VLANs, management interfaces and uplinks without turning a simple network into an undocumented mess.
Book 1 | Chapter 2
Chapter opening
Chapter 2 moves from the course overview into managed switch, vlan and trunk configuration. The aim is not to memorise product menus or commands. The reader should understand what problem the technology solves, how it fits into the wider networking technical textbook, what normal operation looks like, and how to prove the result in the field.
The previous chapter introduced networking. This chapter continues the sequence by focusing on managed switch, vlan and trunk configuration guide, so the reader can connect the architecture to a more specific operational problem.
Learning objectives
- Explain the main purpose of Managed Switch, VLAN and Trunk Configuration Guide in plain language.
- Identify the components that must work together for the service to operate.
- Use evidence to separate a design problem from a configuration or physical fault.
- Describe the business impact of a failure and the evidence required for handover.
Why this matters in a real company
This subject matters because networking infrastructure supports normal business operations. Understanding the design makes purchasing, troubleshooting and recovery decisions easier to explain and verify.
Course: Networking Technical Textbook
PLAIN ENGLISH
Technical terms used in this chapter
You do not need to memorise the jargon first. Understand what each term does and why somebody running a company would care about it.
Trunk
VLAN Trunk
A link that carries traffic for multiple VLANs using tags.
In everyday business: One cable between switches can transport several separated networks.
DHCP
Dynamic Host Configuration Protocol
A service that automatically gives devices IP settings such as address, gateway and DNS.
In everyday business: New laptops and phones can join the network without manual IP configuration.
VLAN
Virtual LAN
A logical Layer 2 network that separates devices even when they use the same physical switches.
In everyday business: Staff, cameras and guest WiFi can be kept apart without buying a separate switch for each.
LACP
Link Aggregation Control Protocol
A protocol that combines compatible Ethernet links into one logical bundle.
In everyday business: It can add capacity and keep a connection alive if one member link fails.
ACL
Access Control List
A list of rules that says which network traffic is allowed or blocked.
In everyday business: Like a security guard checking a list at a door.
NAT
Network Address Translation
A router or firewall function that changes IP addressing as traffic crosses a boundary.
In everyday business: Many private office devices can share one public Internet address.
PAT
Port Address Translation
A form of NAT that lets many internal connections share one public address by tracking transport ports.
In everyday business: Hundreds of users can browse the Internet through one public IPv4 address.
BUSINESS TRANSLATION
What this means outside the server room
This topic affects how reliably staff and systems can communicate. Good network design reduces downtime, makes faults easier to find and keeps departments or services separated where required.
VLAN
What it means: A VLAN creates a separate logical network even when devices share the same physical switches.
In normal business language: Think of one office building with separate departments using the same corridors but different access-controlled areas. Staff, cameras, voice and guests can share the same switching hardware without all being in one open network.
Why the decision matters: Use VLANs to separate traffic for security, performance and easier troubleshooting without buying a separate physical switch for every department.
DNS
What it means: DNS translates names into IP addresses and also helps many business services locate each other.
In normal business language: It is the company phonebook for systems. Staff type a name such as fileserver or portal instead of remembering a number.
Why the decision matters: Good DNS design reduces configuration mistakes and is especially important for Windows domains, cloud integrations and internal applications.
DHCP
What it means: DHCP automatically gives devices their network settings.
In normal business language: It is like reception assigning each new visitor a desk number and directions automatically instead of somebody configuring every laptop by hand.
Why the decision matters: Use DHCP for normal endpoints and reserve static addressing for infrastructure where predictable addressing is required.
Backup
What it means: A backup is an independent recoverable copy of data or system state.
In normal business language: Think of it as having a duplicate of important company records stored safely away from the live filing cabinet.
Why the decision matters: A backup only counts if it can be restored. Test recovery, not just backup completion.
Firewall
What it means: A firewall controls which network connections are allowed between users, systems and external networks.
In normal business language: It is a security checkpoint between parts of the company network. It should allow legitimate work while blocking unwanted access.
Why the decision matters: Firewall rules should describe real business flows such as 'staff may reach accounting on HTTPS', not unexplained broad permits.
NAT
What it means: NAT changes IP addresses as traffic crosses a network boundary.
In normal business language: It is similar to a company switchboard: many internal extensions can share one public number.
Why the decision matters: NAT helps with address use and publishing services, but it is not a substitute for firewall security.
2.1 What the client gains from a properly configured managed switch
A managed switch gives the client control over segmentation, fault isolation, PoE, port status, traffic visibility and future changes. The value is not the VLAN feature by itself. The value comes from building a predictable network where every port has an intended role, every uplink carries only the VLANs it needs, management access is controlled, and faults can be traced from a device to a physical switch port.
Design before configuration
| Item | Decide before touching the switch | Why it matters |
|---|---|---|
| VLAN IDs | Choose IDs and names for users, voice, cameras, AP management, guests, servers and management as required. | Prevents random VLAN creation and conflicting IDs. |
| IP subnets | Map each routed VLAN to its subnet and gateway. | Lets DHCP, ACLs and routing line up with the switching design. |
| Access ports | Know which endpoint belongs to which VLAN. | Keeps end devices untagged unless they are designed for tagging. |
| Trunks | Define which VLANs must cross each uplink. | Avoids carrying every VLAN everywhere. |
| Management | Choose management VLAN, IP method and authorised admin path. | Separates switch administration from ordinary users. |
Access ports
An access port normally presents one untagged VLAN to an endpoint. This is appropriate for ordinary PCs, printers, most cameras and many other single-network devices. The critical installer habit is to label the physical port and make the switch configuration match the cable schedule. If outlet A-024 is meant for Camera VLAN 30, the switch port connected to that outlet should not be left in an arbitrary default VLAN.
Trunks
An 802.1Q trunk carries multiple VLANs between devices that understand tagging, such as switch-to-switch uplinks, switch-to-router links and many AP uplinks. A trunk should have an intentional allowed VLAN list. If both sides disagree about tagging, allowed VLANs or native VLAN behaviour, the symptoms can look like DHCP failure or intermittent reachability instead of an obvious cable fault.
FIELD PRACTICE: do not solve a VLAN problem by changing several ports at once. Record the expected VLAN path from endpoint to gateway and verify each hop in order.
Configuration sequence that works
- Back up the existing switch configuration before a change.
- Create the required VLANs with useful names.
- Configure the switch management IP and secure management access.
- Configure access ports for endpoints.
- Configure trunks with an explicit allowed VLAN list.
- Configure uplink aggregation only after each physical link works individually.
- Confirm STP state and expected root location.
- Test DHCP, gateway reachability and application traffic from each VLAN.
- Save the configuration and export a backup.
- Update the port schedule.
What does not work well
- Leaving every port in the default VLAN because "it works". It removes segmentation and makes later migration harder.
- Allowing every VLAN on every trunk without a reason. It increases the blast radius of mistakes and makes troubleshooting harder.
- Using the same admin credentials everywhere and exposing management to user networks.
- Creating VLANs with no documentation of subnet, gateway, DHCP scope or purpose.
- Changing native VLAN behaviour on only one side of a trunk.
- Using a trunk where the connected endpoint expects an untagged access network.
Installer verification commands and evidence
The exact command syntax differs by vendor, but you should be able to retrieve: VLAN table, port mode, allowed VLANs, MAC address table, interface speed/duplex, error counters, PoE state, STP state, LACP state and running configuration. Save the relevant output or screenshots for important projects.
Benefit to the client
When the switch is configured properly, adding a camera, phone or AP becomes predictable because the port role is documented. Security policy can be applied by network segment, broadcasts are contained, faults are easier to isolate, and the client can replace hardware without rediscovering the entire topology.
Related guides
Spanning Tree and LACP Guide | Troubleshooting Centre | Infrastructure Project Planner | Managed switches at Server Warehouse
DEEPER TEACHING
VLANs, access ports and trunks from first principles
A switch does not understand departments, cameras or guests. It understands Ethernet frames, MAC addresses and configured port behaviour. VLANs are the mechanism that lets an administrator turn one physical switching fabric into several separate Layer 2 networks.
Imagine a 48-port switch in a small company. Ports 1 to 20 serve staff PCs, ports 21 to 28 serve VoIP phones, ports 29 to 36 serve cameras, and two access points carry both staff and guest WiFi. Without VLANs, all of those devices would normally share one Layer 2 broadcast domain. With VLANs, the same hardware can carry several isolated logical networks.
Access ports: one local network for an ordinary endpoint
An access port is normally used for a device that does not need to know about VLAN tags. The switch associates the untagged frames arriving on that port with the configured access VLAN. A normal desktop computer can therefore belong to VLAN 10 without any VLAN configuration on the computer itself.
Trunks: several VLANs across one link
A trunk carries traffic for multiple VLANs across the same physical link. IEEE 802.1Q tagging identifies which VLAN a frame belongs to. This is commonly used between switches and between a switch and a VLAN-aware firewall, router, server host or wireless access point.
The practical mistake is to think that "trunk" means "faster". A trunk is about carrying multiple VLANs. Bandwidth depends on the physical link speed and any aggregation design.
Worked office design
| Function | Example VLAN | Reason |
|---|---|---|
| Staff | 10 | Normal user devices and business applications |
| Voice | 20 | Separate phone traffic and policy |
| Cameras | 30 | Keep CCTV devices away from ordinary user access |
| Guest WiFi | 40 | Internet access without internal access |
| Management | 99 | Switch, AP and infrastructure management |
These VLAN numbers are examples only. The important work is to document the business function, subnet, gateway, DHCP method, security policy and which switch ports carry each VLAN.
Configuration walkthrough
The following Cisco-style example is vendor-specific. It illustrates the sequence, not a universal syntax.
vlan 10
name STAFF
vlan 30
name CAMERAS
vlan 40
name GUEST
interface GigabitEthernet1/0/5
description Staff-PC-05
switchport mode access
switchport access vlan 10
spanning-tree portfast
interface GigabitEthernet1/0/48
description Uplink-to-SW2
switchport mode trunk
switchport trunk allowed vlan 10,30,40,99
After configuration, do not stop at "the command was accepted". Check the VLAN table, trunk state and MAC-address learning. Then test an endpoint in each VLAN and confirm that inter-VLAN traffic is allowed only where the Layer 3 policy intends it.
What you should see
- The endpoint MAC address learned on the expected access port and VLAN.
- The trunk reports the expected VLANs as allowed and active.
- A device in Staff receives addressing for the Staff subnet, not the Camera subnet.
- Guest traffic reaches the Internet but cannot reach internal management if that is the policy.
WORKED BUSINESS SCENARIO
Scenario: one switch carries staff, phones and cameras
A 48-port managed switch supports office PCs, VoIP phones, access points and CCTV cameras. The company wants separation and resilience without installing four separate physical networks.
What the chapter teaches us: VLANs, trunks, STP and link aggregation let one switching platform support several logical services, but only if the traffic path and redundancy are understood.
Think it through
- Which endpoints belong in which VLAN?
- Which links must carry multiple VLANs?
- What happens when a redundant Layer 2 path is added without loop control?
PRACTICAL WORK
Hands-on lab
Create a small isolated lab that reproduces the chapter's core architecture. Record the starting configuration, make one controlled change and prove the result with measurable evidence.
Troubleshooting exercise
Take one realistic failure, list the evidence you would collect before changing anything, then write the shortest fault-isolation path.
Chapter field checklist
- I can explain the subject without relying only on acronyms.
- I can draw or describe the main traffic, storage, power or service path.
- I know what normal operation should look like.
- I know which logs, counters or test results prove the result.
- I can explain the business impact if this component fails.
- I would document the final configuration and evidence at handover.
Chapter summary
Managed Switch, VLAN and Trunk Configuration Guide should now be understood as a business service with a technical implementation, not simply a collection of commands or product names. The important habit is to know the purpose, understand the dependencies, measure the result and document what was proven.
END OF CHAPTER
Review questions
- Explain the subject in plain language to a business owner.
- List the main dependencies that must be healthy before this service can work.
- Describe one realistic failure and the first three pieces of evidence you would collect.
- Explain what should be documented at handover.
- What is the difference between an access port and a trunk?
- Why is loop prevention required when redundant Layer 2 paths exist?
A good answer should explain the reason, not only repeat a product name or command.
Technical references
Training manual: build a small segmented office network
Scenario: one switch serves staff PCs, IP cameras, WiFi access points and a management network. The goal is not to copy a vendor configuration blindly. The goal is to understand what each line is doing so the same design can be implemented on Cisco, Aruba, TP-Link, MikroTik, Ubiquiti or another managed platform using that vendor's syntax.
| VLAN | Name | Purpose | Example subnet |
|---|---|---|---|
| 10 | STAFF | User endpoints | 192.0.2.0/24 |
| 20 | VOICE | IP phones | 198.51.100.0/24 |
| 30 | CAMERAS | IP cameras | 203.0.113.0/24 |
| 99 | MGMT | Switch and AP management | 192.0.2.0/25 shown only as an example documentation format |
The IP ranges above are documentation examples using reserved documentation address space. They are not a recommendation for a live deployment.
Cisco IOS XE example: access port
interface GigabitEthernet1/0/7
description CAM-07 Reception
switchport mode access
switchport access vlan 30
spanning-tree portfast
spanning-tree bpduguard enable
This example makes the port a static access port in VLAN 30 and treats it as an endpoint-facing edge port. Cisco documents switchport mode access and switchport access vlan for this purpose, and Cisco recommends PortFast with BPDU Guard on host-facing access ports. Do not put PortFast on an unknown switch-to-switch connection.
Cisco IOS XE example: trunk uplink
interface GigabitEthernet1/0/48
description Uplink-to-Core
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99
Cisco states that all VLANs are allowed by default on a trunk unless the list is restricted. An explicit allowed list makes the intended path visible in the configuration and reduces accidental VLAN propagation.
Verification
show vlan brief
show interfaces GigabitEthernet1/0/7 switchport
show interfaces trunk
show mac address-table interface GigabitEthernet1/0/7
show interfaces GigabitEthernet1/0/7 counters errors
Exact output varies by model and software. The installer should verify that the endpoint MAC appears in the expected VLAN, the uplink carries that VLAN, and the gateway path is reachable.
Fault example: camera gets no DHCP lease
- Check link and PoE first.
- Check the camera switch port is access VLAN 30.
- Check VLAN 30 exists on the access switch.
- Check VLAN 30 is allowed on the uplink trunk.
- Check the upstream switch/router has VLAN 30 and the intended gateway.
- Check the DHCP scope and DHCP relay if the server is not in the same subnet.
- Only after the network path is correct should you reset the camera.
Acceptance checklist
- Every used access port has a description.
- Every uplink has a documented trunk VLAN list.
- Unused ports are administratively disabled or placed in the site's defined unused-port policy.
- Management is reachable only from the intended admin network.
- Configuration backup is exported after commissioning.
- Port schedule matches the physical labels.