VLANs, Trunks, STP, and Link Aggregation Quick Reference for Network+ N10-009

A VLAN, trunk, spanning-tree decision, and aggregated link can all involve the same switch ports. They still solve different problems.

• A VLAN defines Layer 2 membership and broadcast scope.
• A trunk carries traffic for multiple VLANs across one link.
• Spanning Tree Protocol (STP) prevents a Layer 2 loop by blocking redundant paths when necessary.
• Link aggregation combines compatible physical links into one logical link.

Four jobs at a glance

Access ports: one ordinary VLAN for the endpoint

An access port normally assigns untagged endpoint traffic to one VLAN. A workstation sends an ordinary Ethernet frame. The switch associates that frame with the access VLAN internally.

Common access-port scenarios include:

• A desktop in the user VLAN
• A printer in a device VLAN
• A camera in a surveillance VLAN
• An unused port placed in an unused VLAN and disabled

A switchport in the wrong access VLAN can still show link up. The host may receive an address from the wrong scope, reach the wrong services, or fail because no DHCP service exists in that VLAN.

Some phone deployments use a data VLAN for the attached workstation and a tagged voice VLAN for the phone. That is a special edge-port design, not a reason to treat every endpoint link as a general switch trunk.

Trunks and 802.1Q tagging

A trunk carries multiple VLANs. IEEE 802.1Q inserts a tag that identifies the VLAN for tagged frames. Both ends must agree on the trunk and on which VLANs are permitted.

Use a trunk when multiple VLANs must cross the same physical link, such as:

• Between switches
• From a switch to a router using router-on-a-stick
• From a switch to an access point carrying several wireless networks
• From a switch to a virtualization host with guests in different VLANs

An allowed VLAN list limits which VLANs can cross the trunk. If VLAN 30 is missing from the allowed list, VLAN 10 and VLAN 20 may work while VLAN 30 fails. That pattern points toward trunk configuration rather than a dead cable.

Native VLAN and untagged trunk traffic

The native VLAN identifies how untagged traffic is handled on an 802.1Q trunk. Both ends should use a consistent, intentional configuration.

A native VLAN mismatch can place untagged traffic into different VLANs on opposite ends. It can produce confusing connectivity and security behavior even though the trunk remains up.

Do not confuse the native VLAN with an access VLAN. An access VLAN classifies ordinary endpoint traffic on an access port. The native VLAN concerns untagged traffic on a trunk.

Inter-VLAN routing

Hosts in different VLANs need a Layer 3 device to communicate. Common designs include:

• Router-on-a-stick: one router interface carries multiple tagged subinterfaces.
• Layer 3 switch: switch virtual interfaces (SVIs) provide gateways and route between VLANs.
• Firewall routing: a firewall routes and applies policy between security zones or VLANs.

A VLAN does not automatically block or permit inter-VLAN traffic. The routing device, access control lists, and firewall policy decide what crosses the Layer 3 boundary.

When two hosts in the same VLAN communicate, the default gateway may not participate. When they are in different IP subnets, each host sends remote traffic toward its gateway.

Spanning tree: prevent Layer 2 loops

Redundant Ethernet paths can create loops because ordinary frames do not have a hop limit at Layer 2. Broadcast and unknown-unicast frames may circulate, multiply, and consume the switching fabric. MAC address tables can become unstable as the same source appears on different ports.

STP builds a loop-free logical topology. It elects a root bridge, calculates preferred paths, and places redundant paths into a non-forwarding role until needed.

Rapid Spanning Tree Protocol (RSTP) improves convergence compared with classic STP. Multiple Spanning Tree Protocol (MSTP) can map VLANs to spanning-tree instances so selected VLAN groups can use different logical paths.

A blocked port is not automatically broken. It may be correctly preventing a loop.

Root bridge and path decisions

The root bridge should be chosen intentionally. Switches compare bridge identifiers, which include priority and a MAC-address component. Lower values win.

Each non-root switch selects its best path toward the root based on path cost and tie breakers. The exact port-role terminology varies by STP version, but the exam-level reasoning is consistent: one logical path forwards while another redundant path may wait.

Poor root placement can cause traffic to take an inefficient path. Changing root priority can improve the logical topology, but it should be planned because the change can trigger reconvergence.

Edge protections such as BPDU guard help protect access ports from an unexpected switch. They are not substitutes for correct trunk and spanning-tree design.

Link aggregation and LACP

Link aggregation combines multiple compatible physical links into one logical channel. Link Aggregation Control Protocol (LACP) can negotiate and maintain the bundle.

The member links generally need compatible speed, duplex, VLAN, trunk, and channel settings. A mismatch can leave one member suspended or create inconsistent forwarding.

Traffic is commonly distributed using a hash of fields such as source and destination addresses or ports. One large conversation may remain on one member link, while many conversations spread across the bundle. Four 1-Gbps members do not guarantee that one TCP flow reaches 4 Gbps.

A properly formed bundle appears to STP as one logical link. Simply connecting several independent links between switches without STP or aggregation creates a loop risk.

Symptoms and likely evidence

Scenario comparisons

Add a guest wireless network without another cable to the access point

Use a trunk between the switch and access point, permit the guest VLAN, and map the guest service set identifier to that VLAN. A new STP instance does not carry the VLAN.

Preserve two switch links without creating a loop

Use a correctly configured LACP bundle when both links should actively participate as one logical channel. Use STP when the design requires separate redundant Layer 2 paths and one may remain blocked.

Users in VLAN 20 cannot reach VLAN 30

Check the gateways, SVIs or router subinterfaces, routing state, and security policy. Adding VLAN tags to an access port does not provide Layer 3 forwarding.

A redundant switch link appears down to users but shows a valid physical connection

Check STP role and state before replacing the cable. The link may be intentionally non-forwarding.

Common exam traps

• Treating a trunk as a faster access port.
• Assuming VLAN creation automatically enables routing.
• Calling every untagged frame an access-port frame without considering the native VLAN on a trunk.
• Replacing an STP-blocked redundant link.
• Assuming link aggregation multiplies the speed of one conversation.
• Creating several parallel switch links without aggregation or loop prevention.
• Changing the STP root during an outage without considering reconvergence and topology impact.

Rapid review grid

Official references

• CompTIA Network+ certification page
• CompTIA Network+ N10-009 exam objectives
• IEEE 802.1Q: Bridges and Bridged Networks
• IEEE 802.1AX: Link Aggregation