Network Access

A VLAN is a logically segmented broadcast domain created in software on a switch, letting one physical switch carry multiple isolated Layer 2 networks. Devices in different VLANs cannot communicate without a Layer 3 device.

The normal VLAN range is 1-1005. VLANs 1002-1005 are reserved for legacy Token Ring/FDDI. VLANs 1006-4094 are the extended range. VLAN ID 0 and 4095 are reserved and cannot be used.

In global config: `vlan 10` then `name SALES`. This creates the VLAN in the VLAN database. Verify with `show vlan brief`.

An access port belongs to a single VLAN and carries untagged traffic for one end device. Configure with `switchport mode access` and `switchport access vlan 10`.

`switchport voice vlan 150` tells the port to tag phone traffic in the voice VLAN (802.1Q) while the PC's data stays in the untagged access VLAN. The phone passes data through to the PC, so one cable carries two VLANs.

VLAN 1 is the default VLAN; all ports belong to it out of the box. It cannot be deleted or renamed. Best practice is to move management, native, and user traffic off VLAN 1 for security.