VLANs & Routing

Your JD says "Handle IP addressing, VLANs, and basic routing" — so expect both a conceptual question and a troubleshooting scenario.

Why VLANs exist

A VLAN logically segments one physical switch into separate broadcast domains.

Benefit	Explanation
Broadcast containment	A broadcast domain stays within its VLAN. 200 hosts in one flat VLAN means every broadcast hits all 200.
Security	Hosts in different VLANs cannot talk without a router. Segmentation is a real control.
Traffic management	Put voice in its own VLAN and prioritise it.
Flexibility	Move a port between VLANs without moving the cable.
Compliance	Guest, finance and HR networks are demonstrably separated.

◆The one-line answer

"A VLAN splits a switch into separate broadcast domains without extra hardware — so a broadcast stays inside its VLAN, which reduces load and provides segmentation. Inter-VLAN traffic needs a Layer 3 device."

Access vs trunk ports

	Access port	Trunk port
Carries	One VLAN, untagged	Multiple VLANs, tagged 802.1Q
Typical use	PC to switch	Switch-to-switch, switch-to-router
Config	switchport mode access	switchport trunk encapsulation dot1q

✖The native VLAN problem

On a 802.1Q trunk, one VLAN is sent untagged — the native VLAN. If one side has native VLAN 1 and the other native VLAN 10, untagged traffic lands in the wrong VLAN. This causes exactly the symptom "some ports work, some don't" and is a genuinely common field fault.

Routing between VLANs

Three ways:

1. Router-on-a-stick — one physical link, sub-interfaces, 802.1Q. Legacy but still seen.
2. Layer 3 switch — ip routing plus an SVI per VLAN. Most common today.
3. Multilayer firewall — for routing and inspection.

The SVI — where it goes wrong

interface vlan 10
 ip address 10.0.10.1 255.255.255.0

# Verify on a Windows Server acting as a router
Get-NetIPAddress -InterfaceAlias "vEthernet (VLAN 10)"
route print

⚠Three classic VLAN routing faults

1. SVI is up but not in the routing table — wrong subnet mask, or the interface is administratively shutdown.
2. Wrong gateway on the clients — the PC's default gateway points at an SVI that doesn't exist or isn't up.
3. Missing trunk or wrong native VLAN — the frame arrives with the wrong tag, so the destination VLAN never matches.

Routing basics

The routing table

route print

0.0.0.0          0.0.0.0      10.0.10.1   10.0.10.50   2911  ← default route
10.0.20.0        255.255.255.0 On-link     10.0.10.50   2911

ip route

Two rules you will be asked about

1. Longest prefix match always wins. If routes to 0.0.0.0/0 and 10.0.20.0/24 both match 10.0.20.5, the /24 is used.
2. Static vs dynamic routing. Static is manual, predictable, no protocol overhead — fine on a small flat network. Dynamic (OSPF, RIP, BGP) scales and adapts, at the cost of CPU and attack surface. OSPF uses link-state and is what you would meet in an enterprise network.

Layer 3 vs Layer 2 loops

Two switches connected by two cables form a loop. Frames broadcast forever, swamping the network — a broadcast storm.

Spanning Tree Protocol (STP/RSTP/MSTP) prevents this by putting redundant links into a blocking state and only unblocking if the primary link fails.

⚠The support scenario

"The network went down and came back about 30 seconds later." That timing is STP reconvergence. Something — a failed switch, an unplugged cable, a new device — triggered a topology change and the network blocked and unblocked ports while it recalculated.

Wi-Fi and VLANs

# The AP reports which SSID maps to which VLAN
netsh wlan show interfaces
netsh wlan show profiles

interface Wireless0.10
 encapsulation dot1Q 10

ℹWhy a laptop works in one office and not another

SSIDs usually map to VLANs. The same SSID in a different building may land in a different VLAN with a different DHCP scope — so the machine gets a valid address but the wrong gateway or the wrong DNS. Always compare ipconfig /all between a working and a failing location.

Common interview questions

What is a VLAN and why use it?

A VLAN splits a switch into separate broadcast domains without extra hardware. Benefits: broadcasts are contained rather than flooding the whole segment, traffic is lower, you get security segmentation between departments, and voice/data can be prioritised separately. Inter-VLAN traffic requires a Layer 3 device or SVI.

How would you troubleshoot 'this one port has no network'?

Layer by layer: check the cable and link lights, confirm the access port is up and assigned to the correct VLAN, verify the PVID matches, confirm the trunk to the switch above carries that VLAN, then check ipconfig /all on the client — a 169.254 address means DHCP is not reaching it, which points at the DHCP relay or the VLAN rather than the port itself.

Next

Windows & PowerShell.