Memory hook: VLAN separates; trunk carries; spanning tree prevents loops.
Must remember
An access port normally places untagged client traffic into one data VLAN. An 802.1Q trunk carries multiple VLANs using tags, with native/untagged behavior defined by configuration. A voice VLAN can separate phone traffic from an attached workstation. VLAN membership does not by itself authorize routing between VLANs.
Switches learn source MAC addresses, forward known unicasts to the learned port and flood unknown unicasts/broadcasts within the VLAN as appropriate. MAC-table instability, duplicate paths and loops can create storms. Spanning Tree elects a root bridge and blocks redundant forwarding paths while preserving connectivity. Rapid variants converge more quickly; root selection and path cost remain important.
Link aggregation combines compatible links into one logical bundle for capacity/resilience. LACP negotiates the bundle. Traffic is usually distributed by a hash, so one flow may not use the sum of all link bandwidth. Member speed, VLAN and trunk settings must agree.
MTU determines maximum packet/frame payload behavior at a layer. Jumbo frames need consistent path support; an MTU mismatch can allow small pings while breaking larger transfers. Duplex mismatch, CRC errors, discards and speed negotiation faults require different fixes.
Use switch port status/counters, MAC tables, VLAN/trunk information, spanning-tree state and neighbor discovery to trace a client path. Document intended native/allowed VLANs and avoid unnecessary trunks to untrusted devices.
For a new segment, verify the access port, VLAN existence, trunk allowance, routed interface/gateway and policy. A single missing VLAN on an intermediate trunk can mimic a routing problem.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| Separate guest broadcast traffic | A dedicated VLAN plus controlled Layer 3 access. |
| Redundant Layer 2 links | Spanning tree or a correctly configured logical aggregation. |
| One flow slower than aggregate link capacity | Inspect hash distribution and single-member limits. |
Traps
- A trunk does not mean all VLANs are necessarily allowed.
- PortFast/edge behavior belongs on suitable endpoint links, not arbitrary switch loops.
Active recall
1. Why does spanning tree block a link?
To remove a Layer 2 forwarding loop while retaining redundancy.
2. What does an 802.1Q tag identify?
The VLAN associated with the frame.
3. Does a two-link bundle double one TCP flow’s speed automatically?
No. Flow hashing often keeps one flow on one member.
4. Why can small pings succeed while large packets fail?
An MTU/path-MTU or fragmentation issue may affect only larger traffic.
5. What must be checked when one VLAN fails across a trunk?
Allowed VLANs, native VLAN consistency and the VLAN’s existence/state along the path.