JUMP TO SECTIONChoose a lesson section
Start with what the switch can see.
An Ethernet frame includes a source MAC (who sent it) and a destination MAC (who it is meant for). Switches use these addresses, together with the frame's VLAN context, to make local forwarding decisions.
Real frames have additional details such as preamble and optional tags; the simplified view above focuses on the fields that matter for this lesson. The FCS helps detect transmission errors. An 802.1Q tag can identify the VLAN on a tagged link.
Switching a frame in the same Layer 2 domain is not the same as routing an IP packet between subnets. An endpoint talking to another subnet typically sends its Ethernet frame toward its default gateway's MAC address.
Learn first. Forward second.
When a frame arrives on a forwarding switchport, the switch can learn the source MAC on that port for the relevant VLAN. It then looks for the destination MAC in its MAC address table (sometimes called a CAM or forwarding table).
Forward
Destination MAC is learned on another forwarding port in that VLAN. Send the frame out that port only.
Flood
No matching destination entry. Send it to eligible ports in that VLAN, but not back to the ingress port.
Flood within VLAN
A broadcast destination reaches eligible ports in its broadcast domain. A VLAN boundary contains the Layer 2 flood.
A learned address can age out after inactivity. Multiple MACs may be learned through one uplink. A MAC learned on a different port can indicate a legitimate move or an issue worth investigating.
Watch the forwarding decision change.
Start with an empty MAC table. Send frames between simulated endpoints and observe how the switch learns, floods, and forwards. Try both directions, then compare endpoints in different VLANs.
Select a source and destination, then send a frame. Try PC-A → PC-B, then PC-B → PC-A to compare flooding versus a learned unicast.
| VLAN | Source MAC learned | Ingress port |
|---|---|---|
| Empty. Send a frame to learn the sender. | ||
Educational model: all ports are assumed connected and in STP forwarding state. Broadcast handling, MAC aging, inter-switch links, security features, and L3 gateways are not simulated. No commands run on a real switch.
One switch. Separate Layer 2 networks.
A VLAN groups switchports into a separate Layer 2 broadcast domain. Two devices attached to the same physical switch can be unable to exchange Layer 2 traffic if they belong to different VLANs.
An access port ordinarily connects a workstation or other endpoint to one untagged data VLAN. Its configured access VLAN determines the Layer 2 domain for incoming untagged frames. VLAN membership is not an IP address assignment and does not create inter-VLAN routing.
vlan 20 name FINANCE ! interface GigabitEthernet1/0/4 description FINANCE-WORKSTATION switchport mode access switchport access vlan 20
Carry multiple VLANs between switches.
An 802.1Q trunk can carry traffic for several VLANs on one physical interface. Non-native VLAN traffic is normally tagged; native VLAN traffic is untagged by default unless configured otherwise. Both ends must agree on the design.
interface GigabitEthernet1/0/24 switchport mode trunk switchport trunk allowed vlan add 20 ! end show interfaces trunk show vlan brief
Production caution: switchport trunk allowed vlan 20 replaces the allowed list, whereas ... add 20 preserves current entries. On a live uplink, confirm the approved baseline, both ends, and rollback plan before changing either. An operational trunk can still fail to carry a particular VLAN.
Redundancy needs loop prevention.
Redundant physical links improve resilience, but unmanaged Layer 2 loops can cause broadcasts to circulate, produce duplicate frames, and destabilize MAC tables. Spanning Tree Protocol selects a loop-free forwarding topology and can keep a redundant path in a non-forwarding state.
In Rapid STP, a discarding interface is not necessarily broken. It may be intentionally preventing a loop. Different STP variants and configurations may make decisions per VLAN or per instance, so always check the actual mode before reasoning about paths.
Check the root bridge, port roles, allowed VLANs, and actual topology first. A working physical link and a safe forwarding path are different things.
Don't assume a green port means a healthy VLAN.
Imagine Finance workstations in VLAN 20 on Switch B cannot reach a service on Switch A. The uplink shows connected. Instead of restarting switches, collect evidence in layers:
show mac address-table dynamicSee learned source MAC addresses, their VLANs and the ports associated with them. Entries age out and can move.
show interfaces statusEstablish which interfaces are connected, disabled, or assigned to access VLANs.
show vlan briefConfirm VLAN IDs and access-port membership. It does not prove a VLAN forwards across a trunk.
show interfaces trunkCheck which ports are trunking and compare allowed, active, and spanning-tree forwarding VLANs.
show interfaces gi1/0/24 switchportSee the administrative and operational switching mode, access VLAN, and trunk native VLAN on the uplink.
show spanning-tree vlan 20Verify the current STP root and forwarding/discarding role for the VLAN. An intentional blocked path is not necessarily a fault.
Correlate observations before making a change: VLAN exists → access port is assigned → trunk carries it → STP permits forwarding → endpoints can reach the intended network. MAC-table entries and connectivity are supporting evidence, not substitutes for examining the path.
For vendor-specific command behavior, see Cisco's VLAN Trunking Configuration Guide ↗. CLI syntax and defaults can vary by platform and software release.
Capture relevant before and after output and document which interfaces and VLANs were affected. A configuration that works for Finance but accidentally removes another VLAN isn't a successful change.
Make the ideas stick.
01Does a switch learn a source or destination MAC when a frame arrives?
It learns the source MAC address and the ingress port in that VLAN. It then looks up the destination MAC to decide where to send the frame.
02What if a unicast destination is not yet in the MAC table?
It floods the frame to eligible forwarding ports in the same VLAN, excluding the port where it arrived. It does not automatically flood into other VLANs.
03Can VLAN 10 talk to VLAN 20 through a Layer 2 switch alone?
No. Different VLANs are separate Layer 2 broadcast domains. Cross-VLAN communication requires a Layer 3 device or capability with appropriate routing and policy.
04Does an up/up trunk guarantee that VLAN 20 traffic will pass?
No. VLAN 20 must exist where required, be allowed on the trunk, and be in a forwarding state. Compare both ends and check STP.
05Why shouldn't you turn off STP to activate a redundant link?
A redundant Layer 2 topology may produce forwarding loops, broadcast storms and unstable MAC learning. Verify the topology and STP design instead.