Switching questions become easier when you first decide what one physical link is supposed to do.
Start with the intended link purpose
Ask four questions:
- Is the link carrying one VLAN or several VLANs?
- Is the interface switching frames or routing packets?
- Is this one physical link or a member of a logical bundle?
- Is spanning tree forwarding, protecting, or blocking this path?
A physical link can be up while the logical design is wrong. Check interface mode, VLAN allowance, port-channel state, and spanning-tree role before replacing hardware.
Separate access ports, trunks, and routed interfaces
| Interface role | What it carries | Common use |
|---|---|---|
| Access port | Ordinary endpoint traffic for one access VLAN | Desktop, printer, camera, or other single-VLAN endpoint |
| 802.1Q trunk | Multiple VLANs, normally identified by tags | Switch uplink, router-on-a-stick, access point, or virtualized host |
| Routed port | Layer 3 traffic with an IP address on the physical interface | Point-to-point routed connection |
| Switch virtual interface | Layer 3 gateway or management function for a VLAN | Inter-VLAN routing or switch management |
A switchport in the wrong access VLAN can still show connected. The endpoint may receive an address from the wrong scope or fail because the expected DHCP service is not reachable from that VLAN.
Read native and allowed VLANs separately
An 802.1Q trunk can carry several VLANs across one physical or logical link.
- The allowed VLAN list controls which VLANs may cross the trunk.
- The native VLAN handles untagged traffic on the trunk.
- The operational trunk state proves what the interface is doing now.
If VLAN 10 and VLAN 20 work while VLAN 30 fails, the shared physical link is not completely down. Check whether VLAN 30 exists, is allowed on both ends, and is active across the path.
A native VLAN mismatch can place untagged frames into different VLANs at opposite ends. Do not confuse the native VLAN on a trunk with the access VLAN on an endpoint port.
show interfaces trunk
show interfaces switchport
show vlan brief
An SVI provides a Layer 3 interface for a VLAN
A switch virtual interface (SVI) can provide a default gateway or management address for a VLAN.
interface Vlan20
ip address 192.0.2.1 255.255.255.0
no shutdown
An SVI may remain down when the VLAN does not exist or has no active Layer 2 port participating in that VLAN, depending on platform behavior and configuration.
Creating VLANs does not automatically permit communication between them. Inter-VLAN traffic still depends on Layer 3 routing, gateway configuration, and access policy.
LACP EtherChannel makes several links one logical interface
EtherChannel combines compatible physical links into one port-channel. Spanning tree normally sees the bundle as one logical interface.
Link Aggregation Control Protocol (LACP) modes:
- active: sends LACP messages and can form a bundle with active or passive.
- passive: listens for LACP and forms a bundle when the other side is active.
- on: forces a static bundle without LACP negotiation. Both ends must be configured consistently.
passive plus passive does not start negotiation.
Member interfaces generally need consistent speed, duplex, switchport mode, VLAN, trunk, and channel settings. A mismatch can suspend a member or prevent the bundle from forming.
interface range GigabitEthernet1/0/47-48
channel-group 10 mode active
interface Port-channel10
switchport mode trunk
Verify the logical and physical state:
show etherchannel summary
show interfaces port-channel 10
show interfaces trunk
One large conversation may stay on one member because load balancing commonly uses a hash. Four 1-Gbps links do not guarantee that one TCP flow reaches 4 Gbps.
Rapid PVST+ keeps Layer 2 redundancy loop free
Rapid Per-VLAN Spanning Tree Plus (Rapid PVST+) maintains one rapid spanning-tree instance per VLAN. Different VLANs can use different roots and forwarding paths.
Key roles:
- Root bridge: reference switch for one VLAN's tree.
- Root port: best path toward the root on a non-root switch.
- Designated port: forwarding port selected for a segment.
- Alternate port: redundant path that can replace the current path.
- Backup port: redundant path on the same shared segment, uncommon in modern switched networks.
Rapid spanning tree uses discarding, learning, and forwarding states. A discarding redundant port may be healthy and intentionally preventing a loop.
spanning-tree mode rapid-pvst
spanning-tree vlan 20 root primary
show spanning-tree vlan 20
Match each spanning-tree protection to the assumption it protects
| Feature | Plain-language purpose | Typical clue |
|---|---|---|
| PortFast | Lets an edge port begin forwarding without the normal delay. | An endpoint, not another switch, is expected on the port. |
| BPDU Guard | Protects the edge-port assumption by reacting if a BPDU arrives. | An unexpected switch appears on a PortFast port. |
| Root Guard | Prevents a neighbor from becoming the path to a superior root. | The connected network must never control root placement. |
| Loop Guard | Prevents a redundant path from forwarding when expected BPDUs disappear. | A root or alternate path may have a one-way failure. |
Do not place every protection on every interface. Each feature protects a different design assumption.
Choose IOS evidence that matches the suspected state
| Question | Useful command |
|---|---|
| Which ports belong to each VLAN? | show vlan brief |
| What is one port's access or trunk state? | show interfaces switchport |
| Which VLANs cross each trunk? | show interfaces trunk |
| Did the LACP bundle form? | show etherchannel summary |
| Which switch is root and which ports forward? | show spanning-tree vlan |
| Which neighbor is physically connected? | show cdp neighbors detail or show lldp neighbors detail |
| Why was a port disabled? | show logging and interface status |
Scenario comparisons
One VLAN fails across a trunk while others work
Check VLAN existence and the allowed VLAN list on the port-channel or trunk. Do not replace the shared cable first.
Two parallel links are connected but only one should forward
If they are independent Layer 2 links, spanning tree may correctly block one. If both should act as one logical link, configure and verify EtherChannel consistently on both ends.
An edge port becomes error-disabled after a switch is connected
BPDU Guard may have protected a PortFast edge port. Find the unexpected device before removing the protection.
A port-channel exists, but one member is suspended
Compare member speed, duplex, switchport mode, VLAN, trunk, and channel configuration. Fix the mismatch rather than configuring the suspended link independently.
Same-VLAN traffic works, but traffic to another VLAN fails
Check the SVI or routed gateway, routing state, host default gateway, and access policy. Layer 2 VLAN membership alone does not provide inter-VLAN forwarding.
Common exam traps
- Treating a trunk as a faster access port.
- Assuming VLAN creation automatically enables routing.
- Confusing a trunk's native VLAN with an endpoint's access VLAN.
- Replacing a healthy spanning-tree blocked link.
- Expecting
passivepluspassiveto form an LACP bundle. - Configuring physical EtherChannel members differently from the port-channel.
- Assuming EtherChannel multiplies the speed of one conversation.
- Applying PortFast, BPDU Guard, Root Guard, and Loop Guard as though they solve the same problem.
Rapid review grid
| Requirement or clue | Best fit |
|---|---|
| Place an endpoint in one VLAN | Access port |
| Carry several VLANs across one link | 802.1Q trunk |
| Provide a Layer 3 interface for a VLAN | SVI |
| Combine compatible physical links | EtherChannel, commonly with LACP |
| Prevent a Layer 2 loop while keeping redundancy | Rapid PVST+ |
| Protect an edge port from an unexpected switch | PortFast with BPDU Guard |
| Prevent an unexpected superior root | Root Guard |
| Protect a redundant path when BPDUs disappear | Loop Guard |