10 VLAN Interview Questions and Answers

Virtual Local Area Networks (VLANs) are a fundamental aspect of modern networking, allowing for the segmentation of a physical network into multiple logical networks. This segmentation enhances security, improves traffic management, and optimizes network performance. VLANs are widely used in various environments, from small businesses to large enterprises, making them a critical topic for network professionals.

This article provides a curated selection of VLAN-related interview questions and answers. By familiarizing yourself with these questions, you will gain a deeper understanding of VLAN concepts and be better prepared to demonstrate your expertise in networking scenarios.

VLAN Interview Questions and Answers

1. Explain the concept of VLAN tagging and how it works in an 802.1Q trunk.

VLAN tagging identifies packets for different VLANs by inserting a tag into the Ethernet frame header. In an 802.1Q trunk, this tag includes a 12-bit VLAN ID, allowing for up to 4096 unique VLANs. The tag consists of four bytes: the Tag Protocol Identifier (TPID), Priority Code Point (PCP), Drop Eligible Indicator (DEI), and VLAN Identifier (VID). When a frame reaches its destination, the switch removes the VLAN tag before forwarding it to the appropriate VLAN, ensuring seamless communication across switches.

2. Describe the process of setting up inter-VLAN routing on a Layer 3 switch.

To set up inter-VLAN routing on a Layer 3 switch, configure the switch to route traffic between VLANs by creating VLANs, assigning ports, enabling IP routing, creating virtual interfaces, and assigning IP addresses. For example:

Switch(config)# vlan 10
Switch(config-vlan)# name Sales
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name Engineering
Switch(config-vlan)# exit

Switch(config)# interface range fa0/1 - 2
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit

Switch(config)# interface range fa0/3 - 4
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit

Switch(config)# ip routing

Switch(config)# interface vlan 10
Switch(config-if)# ip address 192.168.10.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

Switch(config)# interface vlan 20
Switch(config-if)# ip address 192.168.20.1 255.255.255.0
Switch(config-if)# no shutdown
Switch(config-if)# exit

3. What are the differences between static and dynamic VLAN membership? Provide examples of each.

Static VLAN membership involves manually assigning each switch port to a specific VLAN, which is straightforward for smaller networks. For example:

Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Dynamic VLAN membership uses a VLAN Membership Policy Server (VMPS) to assign VLANs based on the device’s MAC address, offering more flexibility. For example:

Switch(config)# vmps server 192.168.1.100
Switch(config)# interface fastethernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access dynamic

4. You notice that devices in the same VLAN cannot communicate with each other. Describe your troubleshooting steps.

If devices in the same VLAN cannot communicate, troubleshoot by checking VLAN configuration, verifying switch port settings, examining VLAN trunking, inspecting VLAN membership, checking port security, reviewing Spanning Tree Protocol (STP), testing connectivity, and examining ACLs and firewalls.

5. Explain what a VLAN hopping attack is and how to prevent it.

A VLAN hopping attack allows an attacker to send packets to a different VLAN than the one they are connected to. This can occur through switch spoofing or double tagging. To prevent such attacks, disable unused ports, use VLAN access control lists (VACLs), disable Dynamic Trunking Protocol (DTP), use private VLANs, implement port security, and ensure the native VLAN is different from user traffic VLANs.

6. How do you configure the native VLAN on a switch, and why is it important?

A native VLAN is assigned to an untagged port on a switch, ensuring untagged traffic is properly handled. By default, VLAN 1 is the native VLAN, but it’s advisable to change this for security. To configure the native VLAN:

Switch# configure terminal
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk native vlan 99
Switch(config-if)# end
Switch# write memory

7. What is a Voice VLAN, and how do you configure it?

A Voice VLAN separates voice traffic from data traffic, ensuring voice traffic receives the necessary bandwidth and quality of service (QoS). To configure a Voice VLAN, create a VLAN for voice traffic, assign ports, configure QoS, and ensure IP phones use the Voice VLAN. For example:

Switch(config)# vlan 10
Switch(config-vlan)# name VoiceVLAN
Switch(config-vlan)# exit
Switch(config)# interface range fa0/1 - 24
Switch(config-if-range)# switchport voice vlan 10
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit
Switch(config)# mls qos
Switch(config)# interface range fa0/1 - 24
Switch(config-if-range)# mls qos trust cos
Switch(config-if-range)# exit

8. Describe how to configure and apply VLAN Access Control Lists (VACLs).

VLAN Access Control Lists (VACLs) control traffic within a VLAN, enhancing security and managing traffic flow. To configure and apply VACLs, define access control entries (ACEs), create a VLAN access map, and apply it to the desired VLANs. For example:

Switch(config)# access-list 100 permit ip 192.168.1.0 0.0.0.255 any
Switch(config)# access-list 100 deny ip any any

Switch(config)# vlan access-map MY_VACL 10
Switch(config-access-map)# match ip address 100
Switch(config-access-map)# action forward

Switch(config)# vlan filter MY_VACL vlan-list 10

9. Explain the role of VLAN Trunking Protocol (VTP) and how it simplifies VLAN management.

VLAN Trunking Protocol (VTP) simplifies VLAN management by propagating VLAN information across a network. VTP operates in Server, Client, and Transparent modes, allowing centralized VLAN management, consistency, and scalability.

10. Given a case study where a company needs to segment its network into multiple VLANs for different departments, outline your approach to designing and implementing this solution.

When designing and implementing VLANs for a company, assess requirements, plan VLANs, design the network, configure devices, test the setup, and document the configuration. For example:

Switch(config)# vlan 10
Switch(config-vlan)# name HR
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name Finance
Switch(config-vlan)# exit
Switch(config)# interface range fa0/1 - 12
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 10
Switch(config-if-range)# exit
Switch(config)# interface range fa0/13 - 24
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit
Switch(config)# interface gig0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20
Switch(config-if)# exit