VLANs, Trunking, and Layer 2 Segmentation
VLANs segment broadcast domains; 802.1Q tags frames with a 12-bit VLAN ID (1–4094 usable). Access ports carry one untagged VLAN; trunk ports carry multiple tagged VLANs. The native VLAN is untagged on an 802.1Q trunk-mismatched native VLANs cause silent misforwarding and are a classic exam trap. Voice VLANs, private VLANs, and VLAN pruning are common design tools.
Understand the frame path: ingress access port tags internally; egress trunk adds the tag (except native); egress access strips the tag. GVRP/VTP propagation and dynamic VLAN assignment (802.1X, RADIUS) appear in operational questions. Know that VLAN 1 is default and often should not carry user traffic.
Traps: (1) Native VLAN mismatch-frames hop VLANs silently. (2) A port can be access OR trunk, not both in normal config. (3) Tagged frames arriving on an access port are typically dropped. (4) Allowed-VLAN lists on both ends must match or traffic black-holes.
Rule of thumb: always explicitly set and match the native VLAN on both trunk ends, or set native to an unused VLAN and prune it.
Worked example: Switch A native VLAN 1, Switch B native VLAN 99. Untagged frames from A's VLAN 1 arrive at B and land in VLAN 99-users report "wrong subnet" symptoms. Fix: set both natives to 99 (unused) and prune VLAN 99 from allowed lists.