Cisco 200-301: VLANs, Trunks, Spanning Tree and EtherChannel — Study Guide

By Laurynas Brazys · 14 August 2026 · #cisco #200-301 #certification #exam-prep #study-guide

Part of the Cisco CCNA 200-301 — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Virtual LANs (VLANs), trunking, Spanning Tree Protocol (STP), and EtherChannel are foundational Layer 2 technologies that segment broadcast domains, carry multiple VLANs across links, prevent loops, and increase bandwidth and resiliency. Correct design and consistent configuration prevent common outages caused by mismatches, loops, and mis-negotiation. This section explains operational behavior, configuration intent, and trade-offs, and calls out failure modes you are likely to encounter in campus and small enterprise designs.

VLANs, Trunks, and Inter-VLAN Routing

VLAN creation and access-port assignment

• VLANs logically segment a switch into multiple broadcast domains; a switch maintains a separate MAC table per VLAN. Unknown-destination frames are flooded only within the VLAN.
• Define VLANs with ids (1–4094). VLAN 1 is the default/native by default; VLANs 1002–1005 are reserved. Avoid user traffic on VLAN 1 for security/operational clarity.
• Access ports carry one data VLAN. Configure with switchport mode access and switchport access vlan X to prevent Dynamic Trunking Protocol (DTP) from negotiating a trunk unexpectedly.

Voice VLANs and QoS considerations

• IP phones commonly insert an internal 802.1Q tag for voice while a PC daisy-chained through the phone remains untagged on the access VLAN.
• Configure switchport voice vlan Y and trust Layer 2 CoS or Layer 3 DSCP marks according to policy. Ensure the access VLAN and voice VLAN are both permitted on upstream trunks.

Native VLANs

• On 802.1Q trunks, the native VLAN is sent untagged. For security and clarity, set an unused, dedicated native VLAN on both sides and prune it from user access.
• A native VLAN mismatch can cause traffic leaks, spanning-tree anomalies, and control-plane exposure.

802.1Q trunks, allowed VLAN lists, tagging, and negotiation

• An 802.1Q trunk carries multiple VLANs by tagging frames with a VLAN ID; the native VLAN is untagged. Use IEEE 802.1Q with third‑party equipment.
• Explicitly restrict carriage with switchport trunk allowed vlan to limit unnecessary broadcast traffic and reduce attack surface.
• Trunk establishment can be manual (switchport mode trunk) or negotiated with DTP. dynamic desirable actively attempts trunking; dynamic auto is passive. With non-Cisco neighbors, statically configure 802.1Q and consider switchport nonegotiate.

Short examples

vlan 10
 name Users
vlan 20
 name Voice

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable

interface GigabitEthernet1/0/48
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 10,20,30

Inter-VLAN routing

• Router-on-a-stick: A single router interface with 802.1Q subinterfaces routes between VLANs. Scale is limited by single-interface bandwidth and CPU forwarding on low-end routers.
• Layer 3 switch: Create switched virtual interfaces (SVIs) per VLAN and enable ip routing for hardware-based inter-VLAN routing. Offers higher throughput and simpler policy application.

Short examples

! Router-on-a-stick
interface GigabitEthernet0/0.10
 encapsulation dot1q 10
 ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1q 20
 ip address 192.168.20.1 255.255.255.0

! Layer 3 switch with SVIs
ip routing
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
interface Vlan20
 ip address 192.168.20.1 255.255.255.0

Common mismatches and trade-offs

• Trunk native VLAN or allowed VLAN mismatches cause VLAN bleed and orphaned hosts. Always validate both ends.
• Voice/data VLAN misconfigurations break phone/PC connectivity; verify the phone sends tagged voice and that QoS trust is consistent.
• Avoid VLAN sprawl; document VLAN-to-subnet mappings and summarize routing when possible.

Spanning Tree Operation and Loop Guarding

Purpose and behavior

• Ethernet lacks a TTL and fails open on loops. STP builds a loop-free tree by blocking redundant links while preserving a single active path per VLAN.
• Root bridge election uses lowest bridge ID (priority + MAC). Set deterministic roots for each VLAN or instance. Example: spanning-tree vlan 200 priority 0.

Port roles, states, and path cost

• Roles: Root Port (non-root switch’s best path to root), Designated Port (best path on a segment), Alternate/Backup (loop-prevention standbys).
• Classic 802.1D states: Blocking, Listening, Learning, Forwarding, Disabled. Rapid STP (802.1w) collapses into Discarding, Learning, Forwarding.
• Path cost is cumulative; lower is preferred. Use default 802.1t costs or explicitly tune on high-speed links to bias path selection.

Rapid PVST+ and MST

• Rapid PVST+ runs one instance per VLAN and converges quickly via handshakes and proposal/agreement on point-to-point links; ideal for smaller numbers of VLANs needing granular control.
• MST maps multiple VLANs to a few instances, scaling in larger environments. All switches in an MST region must agree on name, revision, and VLAN-to-instance mapping; otherwise they interoperate in PVST+ compatibility mode with suboptimal spanning trees.
• Topology changes: 802.1D uses TCN BPDUs from the designated bridge on the changed segment; RSTP flags TC in BPDUs from the root, expiring CAM entries rapidly to limit flooding duration.

Edge and protection features

• PortFast: Immediately places access ports into forwarding, preventing long convergence delays on host links. Do not enable on links that may become transit.
• BPDU Guard: Errdisables a PortFast port if a BPDU is received, protecting against accidental loops via unmanaged switches.
• Root Guard: Keeps a designated port from becoming a root port if superior BPDUs are received; the port is placed in root-inconsistent state until the threat is removed.
• Loop Guard: Protects against unidirectional failures or lost BPDUs on non-designated ports; keeps the port blocked (loop-inconsistent) rather than erroneously forwarding.
• BPDU Filter: Suppresses sending/processing BPDUs. Use only in tightly controlled situations (for example, at the network edge on hosts), as misuse can create loops.

Short examples

spanning-tree mode rapid-pvst
spanning-tree vlan 10,20 root primary
spanning-tree portfast default
spanning-tree bpduguard default

Failure modes and troubleshooting

• Unexpected root bridge due to priority defaulting; explicitly set root/distribution priorities.
• Native VLAN mismatch can drag control BPDUs into the wrong VLAN. Align native VLANs on trunks.
• Unidirectional fiber links: Loop Guard helps, but consider physical monitoring tools as well.

EtherChannel and Load Distribution

Operation and protocols

• EtherChannel aggregates parallel links into one logical port-channel for increased bandwidth and rapid failover. STP, MAC tables, and routing see a single link.
• LACP (IEEE 802.1AX/802.3ad) is open standard; modes active/passive. PAgP is Cisco proprietary; modes desirable/auto. mode on forces bundling with no protocol—use only when both sides are hard set identically.
• Member consistency is mandatory: speed/duplex, link type (access or trunk), allowed VLANs and native VLAN, STP settings, MTU, and Layer 3 versus Layer 2 mode must match. Inconsistencies lead to suspended members or errdisable.

Load balancing

• Traffic distribution is flow-based hashing on fields such as source/destination MAC, IP, or Layer 4 ports. Select a hash that diversifies your typical traffic pattern.
• Per-packet load balancing is not supported due to ordering concerns; expect uneven utilization for small flow counts.

Layer 2 vs Layer 3 port-channels

• Layer 2: Build the bundle on member interfaces and the Port-Channel with switchport; then set access/trunk attributes on the Port-Channel.
• Layer 3: Configure no switchport on the Port-Channel, assign an IP, and add members. Useful for routed distribution uplinks.

Short examples

! LACP Layer 2 trunked port-channel
interface range Gi1/0/1-2
 channel-group 10 mode active
!
interface Port-channel10
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30

! Layer 3 port-channel
interface Port-channel20
 no switchport
 ip address 172.16.0.1 255.255.255.0

Common pitfalls

• One side LACP, other side PAgP or on: bundle will not form or will form inconsistently. Standardize on LACP for multivendor.
• Members with different allowed VLAN lists or native VLANs on a trunked port-channel cause unexpected blackholes.
• Changing member interface settings instead of the Port-Channel leads to re-negotiations and instability; apply configuration to the Port-Channel, not the physicals.

Operational Hygiene: VLAN Pruning, VTP, and Fault Isolation

VLAN pruning

• Manually prune with switchport trunk allowed vlan to prevent unnecessary flooding on trunks.
• VTP pruning (if using VTP) prunes automatically based on VLAN presence, but it relies on accurate advertisements. Manual pruning is predictable and audit-friendly.

VTP awareness and risks

• VTP propagates VLAN database across a domain. Modes: server, client, transparent. All switches in a domain share a name and revision number.
• A device with a higher revision and empty VLAN database can erase VLANs domain-wide when joined. Best practice: use VTP transparent (or server with strict controls), set passwords, and reset revision when repurposing gear.

Mismatch issues to watch

• Native VLAN mismatch: produces control-plane leakage and STP anomalies. Align native on both ends.
• Trunk allowed VLAN mismatch: causes one-way reachability for specific VLANs.
• DTP mismatch: dynamic auto-to-auto does not form a trunk; explicitly set mode on inter-switch links.
• Access port in wrong VLAN: common cause of host isolation. Verify with show interfaces switchport.

Loop prevention and fault isolation

• Combine PortFast and BPDU Guard at the edge, Root Guard toward access from distribution, and Loop Guard on non-designated redundant uplinks.
• Use storm control to cap broadcast/multicast on access ports, limiting blast radius during faults.
• Troubleshoot with show spanning-tree detail to locate TCNs and role/state changes, show etherchannel summary for bundle health, and show mac address-table dynamic vlan X to confirm learning. CDP/LLDP provide neighbor identity and port mapping when Layer 3 is down.

Practical Problem Scenario

Northwind Textiles is consolidating two buildings into a single campus access and distribution design. Requirements: converge quickly on link failures, support user and voice VLANs, prevent accidental loops from unmanaged devices, and ensure even utilization across redundant uplinks.

Approach

1. Define VLANs and standardize native VLAN

• Create VLAN 10 (Users) and VLAN 20 (Voice). Reserve VLAN 999 as native and keep it unused elsewhere. Configure access ports with switchport mode access, switchport access vlan 10, and switchport voice vlan 20.
• Rationale: Clear segmentation and a dedicated native VLAN prevent untagged leakage and simplify auditing. Voice VLAN ensures phones tag traffic and receive QoS.

2. Build deterministic 802.1Q trunks with pruning

• On access-to-distribution links, set switchport mode trunk, switchport trunk encapsulation dot1q, switchport trunk native vlan 999, and switchport trunk allowed vlan 10,20 only.
• Rationale: Explicit trunking avoids DTP ambiguity, consistent native VLAN prevents mismatches, and pruning reduces broadcast scope and attack surface.

3. Deploy Rapid PVST+ with root control and edge protections

• Enable spanning-tree mode rapid-pvst. Set the distribution pair as primary/secondary root using spanning-tree vlan 10,20 root primary/secondary. Enable spanning-tree portfast default and spanning-tree bpduguard default on access switches; apply spanning-tree guard root toward access and loop guard on redundant uplinks.
• Rationale: Rapid convergence limits outage time. Root placement stabilizes path selection. Edge protections prevent loops from unmanaged devices and unidirectional faults.

4. Aggregate uplinks with LACP EtherChannels

• Bundle two or more access-to-distribution links using channel-group X mode active on both ends. Configure Port-Channel interfaces as trunks with identical allowed VLANs and native VLAN 999. Set the system’s port-channel load-balance to src-dst-ip.
• Rationale: LACP provides standards-based negotiation, fast member failure handling, and detects inconsistencies. Hashing on IP pairs spreads diverse user traffic across links.

5. Implement Layer 3 SVIs at distribution for inter-VLAN routing

• On distribution switches, enable ip routing and create SVIs for VLANs 10 and 20 with HSRP/VRRP for gateway redundancy. Keep access layer purely Layer 2.
• Rationale: Hardware-based routing at distribution scales throughput, localizes failure domains, and simplifies policy enforcement and ACLs near the core.

6. Harden trunk and VTP behavior

• Set all switches to vtp mode transparent and configure switchport nonegotiate on trunks to third-party devices. Validate native and allowed VLAN symmetry with show commands and templates.
• Rationale: Eliminates risk of VTP revision wipes and prevents unintended DTP trunking, preserving predictable topology and VLAN integrity.

7. Validate and monitor

• Verify spanning tree roles with show spanning-tree vlan 10 detail, EtherChannel health with show etherchannel summary, and MAC learning per VLAN. Enable syslog for STP TCNs and errdisable recovery for BPDU Guard with caution.
• Rationale: Continuous validation catches drift and highlights cabling or configuration faults early, minimizing mean time to repair.

← Ethernet Switching and Layer 2 Forwarding · All domains · IPv4 Addressing →

Practice these questions → · Timed practice on ExamRoll.io →