Ethernet switching is one of the most important foundations for Network Engineers and System Administrators.
A switch operates primarily at Layer 2 and uses MAC addresses to make forwarding decisions. VLANs then allow a physical switch infrastructure to be logically divided into separate Layer 2 networks.
In this article, we will cover:
- Ethernet switching
- MAC address learning
- MAC address tables
- Known and unknown unicast
- Broadcast forwarding
- Flooding
- Collision domains
- Broadcast domains
- VLANs
- Access ports
- Trunk ports
- IEEE 802.1Q
- Native VLAN
- VLAN tagging
- Inter-VLAN communication
- Basic Cisco switch commands
- VLAN troubleshooting
- Real-world Layer 2 scenarios
This part builds the foundation required for the upcoming CCNA switching topics.
Ethernet Switching
1. What is an Ethernet switch?
An Ethernet switch is a network device that forwards Ethernet frames based primarily on destination MAC addresses.
A switch learns which MAC addresses are reachable through which interfaces and uses that information to forward frames efficiently.
For example:
PC-A
|
| Fa0/1
|
Switch
|
| Fa0/2
|
PC-B
The switch can learn:
MAC-A → Fa0/1
MAC-B → Fa0/2
When PC-A communicates with PC-B, the switch can forward the frame directly toward Fa0/2.
2. How does a switch learn MAC addresses?
A switch normally learns MAC addresses from the source MAC address of incoming Ethernet frames.
For example:
Frame arrives on Fa0/1
Source MAC:
AA:AA:AA:AA:AA:AA
The switch learns:
AA:AA:AA:AA:AA:AA → Fa0/1
This information is stored in the switch’s MAC address table.
The switch does not learn a destination MAC from the destination field.
3. What is a MAC address table?
A MAC address table, also called a CAM table on many switches, maps learned MAC addresses to switch interfaces and VLAN context.
A simplified example:
VLAN MAC Address Port
---- ------------------ -----
10 00:11:22:33:44:55 Gi1/0/1
10 00:11:22:33:44:66 Gi1/0/2
20 00:11:22:33:44:77 Gi1/0/3
The VLAN is important because the same MAC address must be interpreted within the appropriate Layer 2 context.
4. What happens when a switch receives a frame?
A switch generally performs these steps:
1. Receive frame
↓
2. Learn source MAC
↓
3. Examine destination MAC
↓
4. Search MAC table in the applicable VLAN
↓
5. Forward, flood, or filter
If the destination is known, the switch can forward the frame toward the correct port.
If the destination is unknown, the switch may flood the frame within the applicable VLAN.
5. What is known unicast forwarding?
If the destination MAC address exists in the MAC table for the applicable VLAN, the switch forwards the frame toward the associated interface.
Example:
Destination MAC:
AA:AA:AA:AA:AA:AA
MAC table:
AA:AA:AA:AA:AA:AA → Gi1/0/5
The switch forwards the frame toward Gi1/0/5 rather than flooding it to every port in that VLAN.
6. What is unknown unicast flooding?
If a switch receives a unicast frame and does not know the destination MAC address within the applicable VLAN, it normally floods the frame out the other forwarding ports belonging to that VLAN.
The frame is not sent back out the ingress interface.
Once the destination device responds, the switch can learn its source MAC address and future frames can usually be forwarded as known unicast.
7. What is broadcast flooding?
A Layer 2 broadcast frame is forwarded to the other forwarding interfaces in the same VLAN/broadcast domain, subject to switch configuration and control mechanisms.
A common IPv4 broadcast destination MAC is:
FF:FF:FF:FF:FF:FF
Routers normally do not forward ordinary Layer 2 broadcasts between IP subnets.
8. What is a multicast frame?
A multicast frame is intended for a group of receivers rather than one specific destination.
How a switch handles multicast depends on the switch’s multicast configuration and features.
Without appropriate multicast optimization, multicast traffic may be flooded within a VLAN similarly to other traffic that the switch cannot selectively constrain.
Features such as IGMP snooping can help switches make more informed forwarding decisions for IPv4 multicast.
Collision and Broadcast Domains
9. What is a collision domain?
A collision domain is a network segment in which Ethernet transmissions could contend for the same shared transmission medium.
Modern switched Ethernet using full-duplex links largely eliminates collisions on those point-to-point links.
Each active full-duplex switch port is effectively its own collision domain.
10. What is a broadcast domain?
A broadcast domain is the Layer 2 domain in which a Layer 2 broadcast is propagated.
A VLAN normally represents a separate broadcast domain.
For example:
VLAN 10 → Broadcast Domain 1
VLAN 20 → Broadcast Domain 2
VLAN 30 → Broadcast Domain 3
A router or Layer 3 switch is required to route traffic between these different IP/VLAN networks.
11. Does a switch break broadcast domains?
A normal Layer 2 switch does not separate broadcast domains simply because it is a switch.
All ports in the same VLAN normally belong to the same broadcast domain.
VLANs are what logically separate the broadcast domains.
12. Does a router break broadcast domains?
Yes.
A router does not normally forward Layer 2 broadcasts from one IP network/interface to another.
Therefore, routing boundaries normally separate broadcast domains.
VLAN Fundamentals
13. What is a VLAN?
VLAN stands for Virtual Local Area Network.
A VLAN logically separates a Layer 2 switch infrastructure into distinct broadcast domains.
For example:
VLAN 10 → Users
VLAN 20 → Servers
VLAN 30 → Management
Even if these devices are connected to the same physical switch, VLANs can keep their Layer 2 traffic logically separated.
14. Why are VLANs used?
VLANs are commonly used for:
- Network segmentation
- Broadcast-domain separation
- Security architecture
- Departmental separation
- Server segmentation
- Voice networks
- Management networks
- Guest networks
VLANs alone are not a complete security solution. Inter-VLAN traffic and access policies must also be controlled appropriately.
15. Can devices in different VLANs communicate directly at Layer 2?
Normally, no.
For example:
PC-A → VLAN 10
PC-B → VLAN 20
They are in different Layer 2 broadcast domains.
Communication between them requires Layer 3 routing, such as:
VLAN 10
|
v
Layer 3 Switch / Router
|
v
VLAN 20
Access Ports
16. What is an access port?
An access port is a switch port configured to carry traffic for a single VLAN in the normal access-port model.
It is commonly used for end devices such as:
- PCs
- Printers
- Servers
- Cameras
- Certain appliances
Example:
interface GigabitEthernet1/0/10
switchport mode access
switchport access vlan 10
The exact CLI varies by Cisco platform and software.
Normally, traffic delivered to a traditional endpoint over an access port is sent as untagged Ethernet traffic.
The switch internally associates that traffic with the configured access VLAN.
There are specialized exceptions and endpoint technologies that can use tagging, so avoid treating “access port = physically incapable of tagging” as an absolute rule.
18. What happens when an untagged frame enters an access port?
The switch associates the incoming frame with the VLAN configured for that access port.
For example:
Gi1/0/10
Access VLAN 20
An untagged frame entering Gi1/0/10 is treated as traffic belonging to VLAN 20.
Trunk Ports
19. What is a trunk port?
A trunk port is designed to carry traffic for multiple VLANs across a single physical link.
Typical uses include:
- Switch-to-switch connections
- Switch-to-router connections
- Switch-to-firewall connections
- Switch-to-hypervisor connections
- Other infrastructure links carrying multiple VLANs
Example:
Switch A
|
| Trunk
|
Switch B
The trunk can carry:
VLAN 10
VLAN 20
VLAN 30
20. What is VLAN tagging?
VLAN tagging adds information to an Ethernet frame identifying its VLAN.
IEEE 802.1Q is the standard commonly associated with VLAN tagging on Ethernet trunks.
Simplified:
Original Ethernet frame
↓
802.1Q VLAN information added
↓
Tagged frame
This allows multiple VLANs to share one physical trunk link.
IEEE 802.1Q
21. What is IEEE 802.1Q?
IEEE 802.1Q is the standard for VLAN tagging in Ethernet networks.
The tag contains VLAN-related information, including the VLAN identifier and priority-related fields.
A common conceptual structure is:
Destination MAC
Source MAC
802.1Q Tag
EtherType/Length
Payload
FCS
The tag is inserted into the Ethernet frame after the source MAC address.
22. What is the VLAN ID field in an 802.1Q tag?
The VLAN Identifier (VID) is a 12-bit field.
This provides 4096 possible numeric values:
2^12 = 4096
However, not every value is available for normal VLAN assignment because certain values have reserved/special meanings and usable VLAN ranges can vary by platform.
Therefore, do not simply say:
“Every VLAN from 0 to 4095 can be configured normally.”
23. What is the native VLAN?
On an 802.1Q trunk, the native VLAN is the VLAN associated with frames transmitted untagged on the trunk under the configured native-VLAN behavior.
For example:
Native VLAN = 99
An untagged frame received on a trunk may be classified into the configured native VLAN, depending on platform configuration.
Native VLAN behavior must match appropriately across connected trunk ports.
24. Why can a native VLAN mismatch be a problem?
Suppose:
Switch A native VLAN = 99
Switch B native VLAN = 10
An untagged frame sent across the trunk can be interpreted as belonging to different VLANs on the two sides.
This can cause:
- Unexpected traffic
- Connectivity problems
- Security concerns
- STP inconsistencies
- Troubleshooting difficulties
The exact detection behavior depends on the platform and configuration.
25. Should the native VLAN be used for normal user traffic?
A common enterprise design is to avoid using the native VLAN for ordinary user traffic and to use a dedicated/native VLAN that is not used by normal endpoints.
However, the correct design depends on the organization’s security architecture and vendor configuration.
The important principle is to understand and deliberately control untagged traffic on trunks.
VLAN Allowed Lists
26. Can a trunk carry every VLAN?
Not necessarily.
A trunk can be configured to allow only specific VLANs.
For example:
Allowed VLANs:
10,20,30
This prevents unrelated VLANs from being carried over that trunk.
Restricting allowed VLANs is an important network-design and security practice.
27. What happens if VLAN 20 is not allowed on a trunk?
Suppose:
Switch A
VLAN 20
|
| Trunk
|
Switch B
VLAN 20
If VLAN 20 is not permitted on the trunk, VLAN 20 traffic cannot traverse that trunk.
The VLAN may exist on both switches, but the Layer 2 path between them is unavailable.
This commonly causes connectivity problems for devices whose traffic depends on that trunk.
VLAN Creation and Assignment
28. How do you create a VLAN on a Cisco switch?
A common Cisco IOS example is:
configure terminal
vlan 10
name USERS
exit
This creates VLAN 10 and gives it the name USERS.
Exact commands can vary by Cisco platform and operating system.
29. How do you assign an access port to a VLAN?
Example:
configure terminal
interface GigabitEthernet1/0/10
switchport mode access
switchport access vlan 10
This places the access port into VLAN 10.
30. How do you configure a basic trunk on a Cisco switch?
A common configuration is:
configure terminal
interface GigabitEthernet1/0/24
switchport mode trunk
On platforms that support explicit trunk encapsulation selection, additional commands may be available or required depending on the platform.
Modern Cisco platforms commonly use 802.1Q.
Inter-VLAN Routing
31. What is inter-VLAN routing?
Inter-VLAN routing allows devices in different VLANs to communicate through Layer 3 routing.
For example:
VLAN 10
192.168.10.0/24
|
v
Layer 3 Switch
|
v
VLAN 20
192.168.20.0/24
The Layer 3 device provides routing between the VLANs.
32. What is a Switch Virtual Interface (SVI)?
An SVI is a logical Layer 3 interface associated with a VLAN on a multilayer switch.
Example:
interface Vlan10
ip address 192.168.10.1 255.255.255.0
The SVI can act as the default gateway for hosts in VLAN 10 when the switch is configured for Layer 3 routing.
33. What is router-on-a-stick?
Router-on-a-stick is a design in which a single physical router interface carries multiple VLANs using an 802.1Q trunk.
The router uses subinterfaces.
Conceptually:
Switch
|
| 802.1Q Trunk
|
Router
|
+--- Subinterface for VLAN 10
|
+--- Subinterface for VLAN 20
Each subinterface provides Layer 3 connectivity for its associated VLAN.
VLAN and MAC Table Behavior
34. Can the same MAC address appear in different VLANs?
Yes.
The MAC table is interpreted in VLAN context.
For example:
VLAN 10 → AA:AA:AA:AA:AA:AA → Gi1/0/1
VLAN 20 → AA:AA:AA:AA:AA:AA → Gi1/0/5
This is possible because VLANs create separate Layer 2 forwarding domains.
35. Why does a switch need VLAN information when forwarding a frame?
A MAC address alone is not always sufficient to determine the forwarding context.
The switch needs to consider the VLAN because the same MAC address can legitimately appear in different VLANs and because broadcasts/unknown unicasts are scoped to a VLAN.
MAC Address Aging
36. What is MAC address aging?
Switches do not normally keep dynamically learned MAC addresses forever.
After a period without seeing traffic from a dynamically learned MAC address, the switch can remove the entry from its MAC table.
This is called MAC aging.
The exact aging timer depends on the platform and configuration.
37. Why is MAC aging useful?
Imagine a device moves from one switch port to another.
If the old MAC-table entry never expired, the switch could continue forwarding traffic toward the old port.
Learning and aging allow the switch to update its forwarding information as devices move.
MAC Flapping
38. What is MAC address flapping?
MAC flapping occurs when a switch repeatedly learns the same MAC address on different interfaces.
Example:
MAC AA:AA:AA:AA:AA:AA
Gi1/0/1
Gi1/0/2
Gi1/0/1
Gi1/0/2
Possible causes include:
- Layer 2 loop
- Redundant path without proper loop prevention
- Incorrect cabling
- Virtualization behavior
- Misconfigured port channels
- Device movement
- Network topology changes
Do not automatically assume that every MAC flap is caused by an STP loop.
VLAN Troubleshooting
39. Two PCs are connected to the same switch but cannot communicate. What should you check?
Check:
1. Link status
2. VLAN assignment
3. IP address
4. Subnet mask
5. MAC learning
6. Port security
7. Host firewall
8. Duplicate IP
9. Switch configuration
Useful Cisco commands include:
show vlan brief
show interfaces status
show mac address-table
40. Two PCs are in the same IP subnet but different VLANs. Can they communicate directly?
Normally, no.
For example:
PC-A
192.168.10.10/24
VLAN 10
PC-B
192.168.10.20/24
VLAN 20
Although their IP addresses appear to belong to the same subnet, their Layer 2 domains are different.
This is an incorrect network design unless a special architecture is intentionally being used.
A normal host expects devices in its own IP subnet to be reachable directly at Layer 2.
41. What happens if a host is placed in the wrong VLAN?
Suppose the host is configured:
IP:
192.168.10.50/24
Gateway:
192.168.10.1
but the switch port is accidentally placed into VLAN 20 instead of VLAN 10.
Possible symptoms include:
- Cannot reach the default gateway
- Cannot reach local hosts
- Cannot reach remote networks
- ARP failure
- DHCP failure if DHCP is VLAN-specific
The IP configuration may look correct while the Layer 2 configuration is wrong.
42. A PC receives no DHCP address after being moved to another switch port. What should you check?
Check:
1. Is the new switch port up?
2. What VLAN is assigned?
3. Is the VLAN active?
4. Is the VLAN allowed across trunks?
5. Is DHCP available for that VLAN?
6. Is DHCP relay configured if required?
7. Is the port blocked or restricted?
Useful commands include:
show interfaces status
show vlan brief
show interfaces trunk
Trunk Troubleshooting
43. Two switches are connected, but VLAN 20 devices on different switches cannot communicate. What should you check?
Check:
1. Is VLAN 20 present on both switches?
2. Is the inter-switch link actually a trunk?
3. Is VLAN 20 allowed on the trunk?
4. Is the native VLAN configuration correct?
5. Is the trunk operational?
6. Are there STP restrictions?
7. Are the endpoint ports in VLAN 20?
Useful commands:
show interfaces trunk
show vlan brief
show interfaces status
44. What does show interfaces trunk help you determine?
On supported Cisco platforms, it can provide information such as:
- Which interfaces are trunking
- Encapsulation
- Native VLAN
- Allowed VLANs
- VLANs allowed and active
- VLANs forwarding and not pruned
It is one of the most useful commands for troubleshooting trunk problems.
45. What does show vlan brief show?
It commonly shows:
- VLAN IDs
- VLAN names
- VLAN status
- Access ports associated with VLANs
It is useful for quickly verifying access-port VLAN assignments.
46. What does show mac address-table show?
It displays learned MAC-address information.
A typical output conceptually contains:
VLAN MAC Address Type Port
10 aaaa.bbbb.cccc DYNAMIC Gi1/0/1
20 dddd.eeee.ffff DYNAMIC Gi1/0/5
This is useful when troubleshooting Layer 2 forwarding.
Real-World Scenario 1
47. PC-A and PC-B are on the same VLAN and IP subnet, but cannot ping each other. What is your troubleshooting approach?
Check in order:
Physical link
↓
Switch port status
↓
VLAN assignment
↓
MAC learning
↓
IP configuration
↓
ARP
↓
Host firewall
Useful commands:
show interfaces status
show vlan brief
show mac address-table
On Windows:
ipconfig /all
arp -a
Do not immediately assume that the switch is faulty.
Real-World Scenario 2
48. A user can communicate with other devices in the same VLAN but cannot access the Internet. What should you investigate?
Since local Layer 2 communication works, investigate the Layer 3 boundary.
Check:
IP address
Subnet mask
Default gateway
ARP for gateway
Routing
NAT
Firewall
DNS
On Windows:
ipconfig /all
route print
Then test progressively:
Local gateway
↓
Remote IP
↓
DNS
↓
Application
Real-World Scenario 3
49. A new VLAN was created, but users cannot obtain DHCP addresses. What should you check?
Use this path:
User device
↓
Access VLAN
↓
Switch VLAN exists
↓
Trunk carries VLAN
↓
Layer 3 gateway
↓
DHCP relay
↓
DHCP server
↓
Correct DHCP scope
A VLAN existing on one switch does not automatically mean that it is available throughout the network.
Real-World Scenario 4
50. A trunk is operational, but one VLAN does not work across the trunk. What is the most important configuration to verify?
Verify whether that VLAN is allowed on the trunk.
For example:
Allowed VLANs:
10,20,30
If VLAN 40 is required but not included, VLAN 40 traffic will not cross that trunk.
Check:
show interfaces trunk
Real-World Scenario 5
51. You see frequent MAC flapping between two switch ports. What should you investigate?
Investigate possible causes such as:
- Layer 2 loop
- Incorrect cabling
- Redundant links
- EtherChannel/port-channel configuration
- Virtualization
- Device movement
- STP events
- Network topology changes
Do not simply clear the MAC table and consider the problem solved.
Clearing the table may temporarily hide the symptom without removing the underlying cause.
Real-World Scenario 6
52. A server works when connected to one switch port but fails when moved to another. What should you compare?
Compare the two switch-port configurations.
Check:
VLAN
Access/trunk mode
Port security
Authentication
Speed/duplex
STP state
ACL/security features
PoE if applicable
The most common starting point is to compare the VLAN and port configuration.
Important Interview Traps
53. Does a switch always forward a frame only to one port?
No.
Depending on the destination:
- Known unicast → specific forwarding port
- Unknown unicast → flood within applicable VLAN
- Broadcast → flood within applicable VLAN
- Multicast → forwarding depends on multicast handling/configuration
54. Does a VLAN automatically provide security?
No.
A VLAN provides Layer 2 segmentation and separate broadcast domains.
It does not automatically provide complete security between networks.
Security can require:
- Inter-VLAN firewall policies
- ACLs
- Port security
- Authentication
- Network segmentation
- Endpoint controls
55. Does a trunk mean that all VLANs automatically pass through it?
No.
The trunk can have an allowed-VLAN list that restricts which VLANs are carried.
56. Can a Layer 2 switch route between VLANs?
A traditional Layer 2 switch cannot perform normal IP routing between VLANs.
A multilayer switch with Layer 3 routing capability can route between VLANs using SVIs or routed interfaces.
57. Is a VLAN the same thing as an IP subnet?
Not technically.
A VLAN is a Layer 2 construct.
An IP subnet is a Layer 3 addressing construct.
In common enterprise designs, one VLAN is often mapped to one IPv4 subnet, but they are conceptually different.
Cisco Switching Command Cheat Sheet
Show VLANs
show vlan brief
Show trunk information
show interfaces trunk
Show MAC table
show mac address-table
Show interface status
show interfaces status
Show detailed interface information
show interfaces GigabitEthernet1/0/1
Show running configuration
show running-config
Show interface configuration
show running-config interface GigabitEthernet1/0/1
Show STP information
show spanning-tree
STP will be covered in greater depth later in the CCNA section.
Quick Revision
Switch
MAC-based Layer 2 forwarding
MAC Learning
Source MAC
↓
Incoming interface
↓
MAC table
Known Unicast
Known destination
↓
Forward toward specific port
Unknown Unicast
Unknown destination
↓
Flood within applicable VLAN
Broadcast
FF:FF:FF:FF:FF:FF
↓
Flood within applicable VLAN
VLAN
Logical Layer 2 segmentation
Access Port
Normally one configured access VLAN
Trunk
Multiple VLANs
↓
Single physical link
802.1Q
VLAN tagging standard
SVI
Layer 3 logical interface associated with a VLAN
Inter-VLAN Routing
VLAN 10
↓
Layer 3 device
↓
VLAN 20
Exam Answer Summary
What is a VLAN?
A VLAN is a logical Layer 2 segmentation mechanism that creates a separate broadcast domain within a switched network.
What is an access port?
An access port normally carries traffic for one configured VLAN and is commonly used for endpoint devices.
What is a trunk port?
A trunk port carries traffic for multiple VLANs across a single physical link, typically using IEEE 802.1Q VLAN tagging.
How does a switch learn MAC addresses?
A switch learns the source MAC address of incoming Ethernet frames and associates that MAC address with the incoming interface and VLAN context.
What happens when the destination MAC is unknown?
The switch normally floods the frame within the applicable VLAN, except the ingress interface.
What is the difference between a VLAN and an IP subnet?
A VLAN is a Layer 2 construct used for segmentation, while an IP subnet is a Layer 3 addressing boundary. They are often mapped one-to-one in enterprise networks but are not the same concept.
What is inter-VLAN routing?
Inter-VLAN routing allows communication between different VLANs through a Layer 3 router or multilayer switch.
What is the native VLAN?
The native VLAN is the VLAN associated with untagged traffic on an 802.1Q trunk according to the trunk’s configuration.
Senior Interview Tip
When troubleshooting a VLAN problem, avoid immediately changing configurations.
Think in this sequence:
Endpoint
↓
Access Port
↓
VLAN
↓
Trunk
↓
VLAN Allowed?
↓
STP
↓
Layer 3 Gateway
↓
Routing
↓
Firewall / ACL
A very common enterprise troubleshooting mistake is to verify that a VLAN exists but fail to verify that the VLAN is actually being carried across every required trunk.
Remember:
Creating a VLAN is not the same as providing end-to-end Layer 2 connectivity for that VLAN.
What Comes Next?
Part 7 — Networking Fundamentals: Spanning Tree Protocol (STP), RSTP, Root Bridge, Port Roles, Port States & Layer 2 Loop Prevention
The next part will cover:
- Why Layer 2 loops are dangerous
- STP purpose
- Root bridge
- Bridge ID
- Root port
- Designated port
- Alternate/blocking behavior
- STP port states
- STP convergence
- RSTP
- BPDU
- Root bridge election
- STP troubleshooting
- Common Layer 2 loop scenarios
- Cisco STP commands