Study Guide
Switch Ports, VLANs and 802.1Q Trunks
How linked switches carry several separate networks over shared links: access ports, VLANs, 802.1Q trunks, and why moving between VLANs needs a router.
Lesson 3.13 Networking Fundamentals
A school might want staff computers and visitors’ devices on separate networks, without buying two sets of switches and cables. This lesson works out how one physical network can be divided into several, and how switches keep those networks apart on the cables between them.
Stage: Think
Two groups, one building
Think it through
A school wants staff computers and visitors’ phones on separate networks, but it has only one set of switches and cables. How could one set of equipment behave like two separate networks?
- Hint 1: What if the switch knew which group each socket belonged to?
Think it through
Show the answer
Answer: B. So that guests cannot reach staff systems.
A device on the same network can reach, and attack, everything else on it. Keeping guests separate limits what an infected or hostile device can reach.
Stage: Explain
Linking switches
A single switch has a limited number of ports, so larger networks connect several switches together with a cable from one to the next. Devices plugged into different switches can then reach each other, and the whole building works as one local network.
A link that carries traffic between switches is called a trunk link.
Stage: Explain
One switch, several networks
Imagine putting a coloured sticker on every socket of a switch: blue for staff, green for guests. Then make one rule: a blue socket can only talk to other blue sockets, and a green one only to other green ones. The switch now behaves like two separate switches in one box.
Check your understanding
Show the answer
Answer: A. No: only same-colour sockets can.
No. Only sockets of the same colour can talk, so the switch behaves like two separate switches.
That is a VLAN (virtual local area network). Each colour is a VLAN, and in practice each is given a number instead of a colour, such as VLAN 10 for staff and VLAN 20 for guests. Devices in the same VLAN can reach each other directly, even when they are plugged into different switches. Devices in different VLANs cannot, even when they are plugged into the same switch.
Each VLAN is its own broadcast domain: a broadcast from a staff computer is heard by the other staff devices and by no guest device.
This needs a managed switch, meaning one that can be configured. The simple switches sold for homes cannot do it.
Stage: Predict
Linked switches, access ports and VLAN trunks
Stickers on sockets work inside one switch. The difficulty comes when two switches are joined by a single cable, and both staff and guest traffic have to share it. How does the second switch know which colour each frame belongs to?
Think it through
Show the answer
Answer: B. By a label added to each frame.
By a label the first switch adds to each frame before sending it across, saying which network it belongs to.
The answer is a tag: a small label that the first switch adds to each frame before sending it across the shared cable, saying which VLAN it belongs to. The second switch reads the label, removes it and delivers the frame only to sockets of that VLAN.
That gives two kinds of port.
- An access port is where an ordinary device plugs in. It belongs to one VLAN. The device knows nothing about VLANs, and its frames carry no tag: the switch simply remembers which VLAN that port is in.
- A trunk port connects to another switch and carries several VLANs at once, with each frame tagged.
The standard that defines the tag is 802.1Q (usually said “dot one Q”). It is published by the Institute of Electrical and Electronics Engineers (IEEE), so it is written in full as IEEE 802.1Q.
Think it through
Show the answer
Answer: C. Not unless both ends are set up as one.
Not unless both ends are configured as a trunk and told which VLANs to allow.
Joining two switches with a cable does not make the link a trunk. Both ends have to be configured as one, and told which VLANs are allowed across. Left alone, the link may simply be an access link carrying a single VLAN.
Go deeper Untagged frames on a trunk: the native VLAN
Most trunks have one VLAN, called the native VLAN, whose frames cross the trunk without a tag. A frame that arrives on a trunk with no tag is treated as belonging to it. So it is not true that every frame on every trunk is tagged, and exactly what happens depends on the equipment and how it is configured.
Stage: Predict
Fictional example: staff and guest networks across two switches
Imagine two managed switches in a fictional school. Each connects a staff computer through a VLAN 10 access port and a guest device through a VLAN 20 access port. Their inter-switch trunk allows VLANs 10 and 20. VLAN numbers identify these illustrative broadcast domains; they are not transport-layer port numbers or IP subnet addresses.
Think it through
From that description, can Staff A reach Staff B, on the other switch? Can Staff A reach Guest A, on the same switch?
- Hint 1: Does sharing a switch matter, or sharing a VLAN?
Show what happens
Staff A can reach Staff B, because both are in VLAN 10, even across the trunk. Staff A cannot reach Guest A directly, even though they share a switch, because they are in different VLANs.
A fictional school network. Each endpoint connects to an access port in one VLAN, untagged. The trunk between the switches carries both VLANs, each frame tagged with its VLAN number. Moving traffic between VLAN 10 and VLAN 20 needs a router or Layer 3 switch.
Switch A
VLAN 10Staff A · access port, untagged
VLAN 20Guest A · access port, untagged
802.1Q trunk
Frames tagged VLAN 10
Frames tagged VLAN 20
Switch B
VLAN 10Staff B · access port, untagged
VLAN 20Guest B · access port, untagged
Staff A and Staff B share VLAN 10 across the trunk. Guest devices share VLAN 20. A broadcast in VLAN 10 does not reach VLAN 20 ports.
Staff A can reach Staff B across the trunk, because both are in VLAN 10. Guest A and Guest B share VLAN 20 instead. A broadcast from a staff device reaches the other VLAN 10 ports and no VLAN 20 port.
Inside each VLAN the switches work exactly as in Ethernet Switching and MAC Addresses: they learn source MAC addresses and forward on destination MAC addresses, keeping a separate list for each VLAN.
Think it through
Show the answer
Answer: B. A router or Layer 3 switch.
A router, or a switch that can also route. Each VLAN is a separate network, and joining networks is a router’s job.
Traffic between VLAN 10 and VLAN 20 has to go through a router, because the two VLANs are separate networks and joining networks is a router’s job. Many organisations use a Layer 3 switch for this: a switch that can also route. Routing provides the path. Rules on the router or firewall then decide which traffic is allowed to use it. A VLAN alone separates devices; it does not decide who may talk to whom once a router connects them. See default gateways and IP forwarding for the packet’s next-hop decision, and Virtual Machines for a different use of virtual networking.
Staff A sends a frame to Staff B in the fictional school.
- Into Switch A. The frame arrives untagged on Staff A’s access port. Switch A knows that port belongs to VLAN 10.
- Onto the trunk. Staff B is reached through the trunk, so Switch A adds an 802.1Q tag saying “VLAN 10” and sends the frame across.
- Into Switch B. Switch B reads the tag and treats the frame as VLAN 10 traffic.
- Out to Staff B. Switch B removes the tag and delivers the frame, untagged, on Staff B’s VLAN 10 access port.
- Guest traffic never mixes in. A guest frame would be tagged VLAN 20 and could only leave on VLAN 20 ports.
The result: one cable carried the staff frame between the two switches, and at no point could a guest device have received it. The tag existed only while the frame was on the trunk; neither computer ever saw it.
Check your understanding
Show the answer
Answer: C. Only while on the trunk.
Only on the trunk: Switch A added it and Switch B removed it, so neither computer ever saw it.
VLANs are one of the most common ways to separate groups such as staff, guests, printers or building systems. They reduce the reach of broadcasts and of some local attacks. But because a router can connect them, the real security boundary is the policy on that router or firewall, not the VLAN on its own.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Apply it
Show the answer
Answer: B. The VLAN number names a network.
A VLAN number identifies a separate network, not a socket. Any access port can be configured into VLAN 10.
Apply it
Show the answer
Answer: C. All VLAN 10 devices, both switches.
Every VLAN 10 device on both switches, and no VLAN 20 device: each VLAN is its own broadcast domain, and the trunk carries it across.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Ordinary endpoint access links can carry untagged frames assigned to their configured VLAN.; An appropriately configured 802.1Q trunk can carry both VLANs using tags to distinguish them.
Access ports typically serve one VLAN; trunk configuration and tagging preserve separation across a shared link. Native or untagged behaviour depends on configuration, and routing is a separate function.
Revision sources: What Is a Network? (Supplementary Study Guide explanation)
Show answer
Answer: Layer 3 forwarding, suitable IP configuration and access policy permitting the traffic.
A trunk extends VLAN connectivity between switches; it does not perform inter-VLAN routing. A router or Layer 3 switch supplies a path, and access rules determine permitted traffic.
Revision sources: What Is a Network? (Supplementary Study Guide explanation)
Study and revision
Practise VLAN tagging and inter-VLAN routing through the Networking & Protocols topic.
Stage: Consolidate
What to remember
- A VLAN divides one switching network into separate networks, each its own broadcast domain.
- An access port belongs to one VLAN, and the device on it sends untagged frames.
- A trunk carries several VLANs between switches, tagging each frame with 802.1Q; both ends must be configured.
- Inside a VLAN, switches learn and forward as usual, keeping a separate table for each VLAN.
- Moving between VLANs needs a router or Layer 3 switch, and the policy there is the real boundary.
Key terms
- VLAN (Virtual Local Area Network)
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
- Access port
A switch port for an ordinary device such as a computer or printer. It belongs to one VLAN, and the frames on it carry no VLAN tag.
- Trunk
A link between switches that carries traffic for several VLANs at once. Each frame is given a tag saying which VLAN it belongs to, in the format defined by IEEE 802.1Q.
Common misunderstandings
A trunk needs matching configuration at both ends. An unconfigured link may simply be an access link carrying one VLAN.
VLAN numbers identify separate broadcast domains. They have nothing to do with transport-layer port numbers or physical port positions.
They can, through a router or Layer 3 switch, if routing and policy allow it. VLANs separate; routing reconnects.
Lesson sources and acknowledgements
Sources and scope
The Study Buddy entry introduced linked switches and trunking. The two-switch example in this lesson is a supplementary educational explanation, not a record of switch configuration. The original Study Buddy network drawing has not been recovered; this new illustration does not reproduce it.
- From the Study Buddy session on 9 September (see the entry): linked switches and trunk links carrying traffic between switches. The session was supplementary to the course, not a numbered classroom session.
- Taught in Session 5: broadcast domains often being bounded by a VLAN.
- Moved from an earlier lesson: “Linked switches, access ports and VLAN trunks” and the fictional two-switch example were previously part of What Is a Network? and keep their headings and anchors here, with the example now drawn in the access-and-trunk diagram; their wording was simplified on 13 October 2026.
- Supplementary explanation: the coloured-sticker comparison, the plain description of a tag, the “Go deeper” note on the native VLAN, VLAN, access-port and 802.1Q detail, the access-and-trunk diagram, the frame walkthrough, the practical note and the misunderstandings. No switch configuration work is claimed.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the two-groups opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
A switch port for an ordinary device such as a computer or printer. It belongs to one VLAN, and the frames on it carry no VLAN tag.
Communication sent to every device in the relevant broadcast domain. Routers do not normally forward ordinary local broadcasts.
The set of devices that receive one another’s local broadcasts. It is often bounded by a VLAN, and routers do not normally forward ordinary broadcasts between domains.
A control that allows or blocks network traffic according to configured rules.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
A device that forwards traffic between networks, for example between a private local network and the internet.
A software endpoint for network communication, managed by the operating system.
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A link between switches that carries traffic for several VLANs at once. Each frame is given a tag saying which VLAN it belongs to, in the format defined by IEEE 802.1Q.
A separate network created inside a switch, or a group of linked switches, by assigning each port to a numbered group. Devices in the same VLAN reach each other directly; devices in different VLANs can communicate only through a router.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.