Domain 2 of 5 · Chapter 2 of 4

Switching Technologies

VLANs, tagging, and the access vs trunk port

Two PCs plugged into the same switch but assigned to different VLANs cannot ping each other, even though one cable's length apart, and that single fact is the heart of VLAN questions. A virtual LAN (VLAN) is a broadcast domain defined in switch software rather than by physical wiring, so membership follows the port's configuration, not the patch panel. Each VLAN is its own broadcast domain, which means a broadcast in VLAN 10 never reaches VLAN 20 and the two are isolated until something at Layer 3 routes between them.

Access port vs trunk port

Every switch port operates in one of two modes. An access port is assigned to exactly one VLAN and faces an end device, a workstation, a printer, a server, that has no idea VLANs exist; frames leave and arrive on an access port untagged. A trunk port carries traffic for many VLANs at once over a single link, typically switch-to-switch or switch-to-router, and it must label each frame so the receiver can sort it back into the correct VLAN.

That labeling is IEEE 802.1Q tagging. The switch inserts a 4-byte tag into the Ethernet header carrying a 12-bit VLAN ID (VID), which gives a usable range of 1 to 4094 (0 and 4095 are reserved). The tag is what lets one trunk cable serve dozens of VLANs without mixing their traffic, and it is removed again as the frame exits onto an access port. The IEEE maintains 802.1Q as the bridges and bridged networks / VLAN standard[1].

Special VLANs to memorize

Four VLAN roles recur on the exam:

  • Default VLAN (VLAN 1): every switch port belongs to VLAN 1 out of the box. Best practice is to move user traffic off VLAN 1 and never use it for management, because an attacker who reaches an unconfigured port lands there.
  • Native VLAN: the one VLAN whose frames cross a trunk untagged. Both ends of a trunk must agree on the native VLAN; a mismatch is a classic misconfiguration that leaks traffic between VLANs and enables VLAN-hopping attacks.
  • Voice VLAN: a dedicated VLAN for IP phones so voice traffic is separated from data on the same access port, letting QoS prioritize it and keeping a compromised PC off the voice segment.
  • Management VLAN: the VLAN used to reach switch management interfaces, kept separate from user data so management traffic is isolated.

Crossing VLANs needs Layer 3

Because a VLAN is a broadcast domain, moving traffic between two VLANs is a routing job. This is inter-VLAN routing, done either by a router with one tagged subinterface per VLAN ("router on a stick") or, far more commonly today, by a Layer 3 switch that routes between VLANs in hardware. Cisco's switching documentation describes this inter-VLAN routing[2] role of the multilayer switch. The exam tell: if a stem says two VLANs "can't communicate," the missing piece is a Layer 3 device, not another VLAN.

Switch ASwitch B802.1Q trunktagged: VLAN 10 + 20native VLAN untaggedPC VLAN 10PC VLAN 20access (untagged)PC VLAN 10PC VLAN 20access (untagged)
Access ports carry one VLAN untagged to end hosts; the inter-switch trunk carries every VLAN with 802.1Q tags, while the native VLAN alone crosses untagged.

Spanning Tree: loop prevention and convergence

Add a second cable between two switches for redundancy and, without protection, you have built a bridging loop: a single broadcast frame loops endlessly because Ethernet frames carry no TTL to expire them, MAC tables thrash, and within seconds a broadcast storm saturates every link. Spanning Tree Protocol (STP, IEEE 802.1D) exists to make a physically looped topology logically loop-free by shutting the right ports.

Electing the root and choosing paths

STP first elects one root bridge for the whole topology. The election compares each switch's bridge ID, which is its bridge priority (default 32768) followed by its MAC address; the lowest bridge ID wins, so with equal priorities the switch with the lowest MAC becomes root. Every other switch then picks its single lowest-cost path toward the root (its root port) and blocks any remaining redundant path. Switches exchange this information in BPDUs (Bridge Protocol Data Units), the control frames STP uses to elect the root and detect loops; the IEEE defines the algorithm in 802.1D[3].

The classic port states

A classic 802.1D port walks through four states before it carries data, and the delay is the price of safety:

  • Blocking: receives BPDUs only, forwards no data (a redundant link parked here).
  • Listening: processes BPDUs to work out the topology, still no data, no MAC learning.
  • Learning: builds the MAC table from incoming frames but still forwards none.
  • Forwarding: the port is fully active and passing user traffic.

Walking listening then learning costs roughly 30 to 50 seconds of convergence on a topology change, which is why an access port can sit dark for half a minute after a PC boots.

RSTP and MSTP

Rapid Spanning Tree (RSTP, IEEE 802.1w) keeps the same goal but converges in about one to two seconds. It collapses the states to three (discarding, learning, forwarding) and adds explicit port roles, root, designated, alternate (a pre-computed backup to the root), and backup, so a failover can promote a standby path almost instantly instead of re-running a 30-second timer. RSTP is the modern default and is backward compatible with 802.1D. Multiple Spanning Tree (MSTP, IEEE 802.1s) runs several spanning-tree instances and maps groups of VLANs to different instances, so traffic can load-share across redundant links instead of one tree blocking the same port for every VLAN.

PortFast and BPDU Guard

On an access port facing a single host, the listening/learning delay is pure waste because no switch is behind it to form a loop. PortFast moves such a port straight to forwarding, eliminating the wait. The safety catch is BPDU Guard: if a PortFast port ever receives a BPDU, meaning someone plugged in a switch where only a host should be, BPDU Guard error-disables the port, protecting the loop-free topology from the shortcut. PortFast belongs only on edge ports; never on a switch-to-switch link.

STP (802.1D): four states, ~30-50 s to forwardBlockingBPDUs onlyListeningno data, no learnLearningbuild MAC tableForwardingpasses trafficRSTP (802.1w): three states, ~1-2 s to forwardDiscardingLearningForwarding
Classic STP walks four states (blocking, listening, learning, forwarding) in ~30-50 s; RSTP collapses to three (discarding, learning, forwarding) and converges in ~1-2 s.

Interfaces, MTU, jumbo frames, and link aggregation

Beyond VLANs and loops, switch ports carry a cluster of physical-layer settings that the exam turns into troubleshooting items: speed, duplex, MTU, and how to bond ports together.

Speed, duplex, and the duplex mismatch

The two ends of a link must agree on speed (10/100/1000 Mbps and up) and duplex (half or full). Auto-negotiation lets the ports advertise capabilities and settle on the best common pair, and leaving both ends on auto is the recommended default. Trouble starts when one end is hard-coded and the other is left on auto: the auto side cannot detect the partner's duplex and defaults to half duplex, while the hard-coded side runs full duplex. The result is a duplex mismatch, which does not bring the link down; it produces late collisions, CRC/FCS errors, and throughput that craters under load. The fix is to set both ends the same way, ideally both back to auto.

MTU and jumbo frames

The maximum transmission unit (MTU) is the largest payload a frame may carry; standard Ethernet MTU is 1500 bytes. A jumbo frame raises the payload to as much as 9000 bytes, cutting per-frame overhead and CPU interrupts for high-volume flows like iSCSI/NAS storage and backups. The catch is end-to-end consistency: every switch, NIC, and router along the path must be configured for the same jumbo MTU. A single 1500-byte device in the middle either fragments (if allowed) or silently drops the oversized frames, and the symptom presents as intermittent loss or stalled large transfers rather than an obvious error. AWS documents this same constraint for its networks, noting jumbo frames up to 9001 bytes MTU[4] and that frames are dropped where the path MTU is smaller.

Link aggregation (LACP / 802.3ad)

When one port's bandwidth is the bottleneck, bond several physical links into one logical link. Link aggregation under IEEE 802.3ad uses the Link Aggregation Control Protocol (LACP) to negotiate and monitor the bundle, often called an EtherChannel or a port channel. The bundle adds the members' bandwidth, balances flows across them by a hash, and survives losing a member link without dropping the logical link. Crucially, STP treats the whole bundle as one logical port, so the parallel links are not blocked as a loop, the very thing that would happen if you cabled them without aggregation. The IEEE specifies link aggregation as part of the 802.3 Ethernet[5] family (originally 802.3ad, since folded into 802.1AX).

The MAC address table

Underneath all of this, a switch forwards by its MAC address table (also called the CAM table, for content-addressable memory). The switch learns the source MAC of every frame and the port it arrived on, so it can forward later frames only out the matching port instead of flooding. Entries age out after a timeout. The table's finite size is also an attack surface: a MAC flooding attack overflows it so the switch fails open and floods all traffic, which the security subtopics cover.

Switch ASwitch B3 links bundled by LACP (802.3ad)one logical link: bandwidth addedSTP sees one port, not a loop
LACP (802.3ad) bonds parallel links into one logical link that adds bandwidth and survives a member failure; STP treats the bundle as a single port, so it is not blocked as a loop.

Exam-pattern recognition

Switching items reward two reflexes: read the symptom for the layer it lives at, and match the protocol to the standard number. Drill the patterns below.

Symptom-to-answer reflexes

  • "Two VLANs can't communicate" means you are missing a Layer 3 device (router or Layer 3 switch) doing inter-VLAN routing; adding another VLAN is the wrong direction.
  • "Carry many VLANs over one link between switches" means an 802.1Q trunk; "connect one end device" means an access port.
  • "Frames cross the trunk untagged" / "VLAN mismatch leaking traffic" points at the native VLAN.
  • "Broadcast storm after adding a redundant link" means Spanning Tree is off or misconfigured; the fix is STP/RSTP, not removing redundancy.
  • "Host port takes ~30 seconds to come up" means STP listening/learning delay; the fix is PortFast (with BPDU Guard), not disabling STP.
  • "Slow throughput, late collisions, CRC errors, link still up" is a duplex mismatch; set both ends to the same speed/duplex (or both auto).
  • "Large transfers stall / intermittent loss after enabling 9000-byte frames" means an MTU/jumbo-frame mismatch somewhere on the path.
  • "Bond two links for more bandwidth without a loop" means LACP / 802.3ad link aggregation.

Standard numbers to memorize

  • 802.1Q = VLAN tagging. 802.1D = STP. 802.1w = RSTP (rapid). 802.1s = MSTP (multiple). 802.3ad = LACP / link aggregation.
  • Default bridge priority 32768; lowest bridge ID (priority + MAC) wins the root election.
  • VLAN ID range 1 to 4094; default VLAN 1; standard MTU 1500, jumbo up to 9000.

High-value traps the exam plants

  • Adding a VLAN to fix inter-VLAN communication. VLANs separate broadcast domains; only a Layer 3 hop connects them. Picking "create a VLAN" for a routing problem is the planted wrong answer.
  • Disabling STP to speed up a port. That removes loop protection from the whole topology; PortFast skips the delay only on safe edge ports while leaving STP running everywhere else.
  • Native-VLAN mismatch. When both trunk ends disagree on the native VLAN, untagged frames land in the wrong VLAN; this is also how a double-tagging VLAN-hopping attack gets in, so it is a security item too.
  • Calling a duplex mismatch a 'down' link. The link stays up; the tells are late collisions and falling throughput, not loss of carrier. A stem describing a link that is "up but slow with collisions" wants duplex, not a bad cable.
  • Jumbo frames on one device only. Enabling 9000-byte MTU on the server but not the switches in between drops the big frames silently; the MTU must match end to end.
  • PortFast on a switch-to-switch link. PortFast belongs only on edge/host ports; placing it on an uplink invites the exact loop STP is meant to prevent.

STP variants and the port-state model

PropertySTP (802.1D)RSTP (802.1w)MSTP (802.1s)
Convergence after a change30 to 50 seconds~1 to 2 secondsRSTP-speed per region
Port statesBlocking, Listening, Learning, ForwardingDiscarding, Learning, ForwardingDiscarding, Learning, Forwarding
Port rolesRoot, Designated, BlockedRoot, Designated, Alternate, BackupSame roles, per instance
VLAN handlingOne tree for all VLANsOne tree for all VLANsMultiple trees mapped to VLAN groups
Typical useLegacy defaultModern defaultLarge multi-VLAN networks needing load sharing

Decision tree

Does the link carrymultiple VLANs?Yes (switch-to-switch)No (one end device)802.1Q trunk porttag VLANs; agree on native VLANAccess port, one VLANuntagged to the hostRedundant pathbetween switches?then decide topologyYes (loop possible)NoLet Spanning Tree run (RSTP)blocks the loop; one active pathNeed morebandwidth?YesEdge/host ports only:PortFast + BPDU Guard, never on uplinksBond links: LACP (802.3ad)one logical link; STP sees one port
Cheat sheet

Sharp facts the exam loves — give these one last read before exam day.

Cheat sheet

Sharp facts the exam loves — scan these before test day.

A VLAN is a broadcast domain defined in software, not by wiring

A VLAN (virtual LAN) carves one physical switch into separate broadcast domains by configuration, so two ports on the same switch in different VLANs are isolated and a broadcast in one VLAN never reaches another. The win is segmentation without rewiring: smaller broadcast domains, traffic isolation, and a security boundary you set per port. Because each VLAN is its own broadcast domain, moving traffic between VLANs always takes a Layer 3 hop.

1 question tests this
Adding a VLAN separates departments; connecting them needs Layer 3

VLANs exist to keep broadcast domains apart, so you cannot 'connect' two departments by giving them VLANs; that is the opposite of what VLANs do. To let two VLANs communicate you need inter-VLAN routing on a router (a tagged subinterface per VLAN, 'router on a stick') or, far more commonly, a Layer 3 switch routing between them in hardware. When a stem says two VLANs cannot reach each other, the fix is a Layer 3 device.

Trap Creating another VLAN to make two VLANs communicate; VLANs separate broadcast domains, only a router or Layer 3 switch joins them.

Access ports carry one VLAN untagged; trunks carry many tagged

An access port belongs to exactly one VLAN and faces an end device that knows nothing of VLANs, so its frames are untagged. A trunk port carries many VLANs over one link between switches (or to a router) and tags each frame so the far end can sort it back. Pick access for a single host, trunk for an inter-switch link that must carry several VLANs.

3 questions test this
802.1Q inserts a 4-byte tag with a 12-bit VLAN ID (1 to 4094)

IEEE 802.1Q is the VLAN tagging standard: a trunk inserts a 4-byte tag into the Ethernet header carrying a 12-bit VLAN ID, giving a usable range of 1 to 4094 (0 and 4095 are reserved). The tag lets one trunk cable carry dozens of VLANs without mixing them, and it is stripped again as a frame exits onto an access port. Memorize that 802.1Q equals VLAN tagging on the exam.

5 questions test this
The native VLAN crosses a trunk untagged and both ends must match

On an 802.1Q trunk, one VLAN, the native VLAN, has its frames sent untagged; everything else is tagged. Both trunk ends must agree on the native VLAN, because a mismatch drops untagged frames into the wrong VLAN, leaking traffic and enabling double-tagging VLAN-hopping attacks. Best practice is to set the native VLAN explicitly to an unused VLAN rather than leaving it as VLAN 1.

Trap Leaving the native VLAN mismatched between trunk ends; untagged frames land in the wrong VLAN and open a VLAN-hopping path.

5 questions test this
VLAN 1 is the default VLAN and should not carry user or management traffic

Every switch port belongs to VLAN 1 out of the box, so VLAN 1 is the default VLAN. Best practice is to move user traffic to other VLANs and never use VLAN 1 for management, because an attacker who reaches an unconfigured port lands in VLAN 1 by default. Assign ports to purpose-built VLANs and keep VLAN 1 unused.

A voice VLAN keeps phone traffic separate on a shared access port

A voice VLAN is a dedicated VLAN for IP phones so voice traffic is separated from the data of a PC sharing the same access port. The separation lets QoS prioritize voice and keeps a compromised PC off the voice segment. It is the standard answer when a stem wants phone traffic isolated and prioritized without a second cable run.

Spanning Tree blocks redundant links so a Layer 2 loop can't form

Ethernet frames have no TTL, so a single frame in a switching loop circulates forever and a broadcast storm saturates every link in seconds. Spanning Tree Protocol (STP, IEEE 802.1D) prevents this by electing a root bridge and putting redundant paths into a blocking state, leaving exactly one active path. The blocked link stays cabled for failover but logically off until needed, so the answer to a storm after adding a redundant link is STP, not removing redundancy.

Trap Removing the redundant link to stop a broadcast storm; the correct fix is to enable Spanning Tree, which keeps the backup link for failover while blocking the loop.

Lowest bridge ID wins the root election; default priority is 32768

STP elects one root bridge by comparing each switch's bridge ID, which is its bridge priority (default 32768) followed by its MAC address; the lowest bridge ID wins. With equal priorities the switch with the lowest MAC becomes root, so to control which switch is root you lower its priority below 32768. Every other switch then selects its lowest-cost root port toward the root.

5 questions test this
Switches elect the root and detect loops using BPDUs

BPDUs (Bridge Protocol Data Units) are the control frames Spanning Tree switches exchange to elect the root bridge, compute path costs, and detect loops. A port that should face only a host but starts receiving BPDUs signals that a switch was plugged in where it should not be. BPDU Guard uses exactly that signal to error-disable a PortFast port.

Classic STP ports walk blocking, listening, learning, forwarding

An 802.1D port passes through four states before carrying data: blocking (BPDUs only), listening (works out the topology, no data, no MAC learning), learning (builds the MAC table, still no data), and forwarding (fully active). Walking listening then learning is why a change takes roughly 30 to 50 seconds to converge and why an access port can sit dark for half a minute after a host boots.

6 questions test this
RSTP (802.1w) converges in about 1 to 2 seconds, not 30 to 50

Rapid Spanning Tree (RSTP, IEEE 802.1w) does the same loop-prevention job as 802.1D but converges in about one to two seconds instead of 30 to 50. It collapses the port states to three (discarding, learning, forwarding) and adds explicit port roles so a standby path is promoted almost instantly. RSTP is the modern default and is backward compatible with 802.1D, so it is the answer when slow STP convergence is the complaint.

7 questions test this
RSTP port roles add an alternate as a pre-computed backup to the root

RSTP defines four port roles: root (best path to the root bridge), designated (forwarding port on a segment), alternate (a pre-computed backup path to the root), and backup (a backup to a designated port on the same segment). The alternate role is what lets RSTP fail over in seconds: the standby path is already chosen, so it activates without re-running a long timer. This is the structural reason RSTP beats 802.1D on convergence.

4 questions test this
MSTP (802.1s) maps VLAN groups to separate spanning-tree instances

Multiple Spanning Tree (MSTP, IEEE 802.1s) runs several spanning-tree instances and maps groups of VLANs to different instances. That lets traffic load-share across redundant links, because one instance can forward on a link that another instance blocks, instead of a single tree blocking the same port for every VLAN. It is the answer for a large multi-VLAN network that wants to use its redundant links rather than park them.

9 questions test this
PortFast skips the STP delay on host ports without disabling STP

On an access port facing a single host there is no switch behind it to form a loop, so the listening/learning wait is pure delay. PortFast moves such an edge port straight to forwarding, eliminating the ~30-second wait, while Spanning Tree keeps protecting the rest of the topology. The right fix for a host port that takes 30 seconds to come up is PortFast, never turning STP off network-wide.

Trap Disabling Spanning Tree to cure a slow-to-link host port; that strips loop protection from the whole topology when PortFast solves it on the one safe port.

BPDU Guard error-disables a PortFast port that receives a BPDU

BPDU Guard is the safety catch for PortFast: if a port set for PortFast ever receives a BPDU, meaning a switch was plugged in where only a host should be, BPDU Guard error-disables the port. That protects the loop-free topology from a shortcut introduced at the edge. PortFast plus BPDU Guard belong only on edge/host ports, never on a switch-to-switch uplink.

Trap Enabling PortFast on a switch-to-switch uplink; it skips the loop-prevention states on a link where a loop can form, inviting the storm STP exists to stop.

A duplex mismatch leaves the link up but slow with late collisions

If one end of a link is hard-coded full duplex and the other is left on auto-negotiation, the auto side cannot detect the partner and defaults to half duplex, creating a duplex mismatch. The link stays up, but you see late collisions, CRC/FCS errors, and throughput that craters under load, not a loss of carrier. The fix is to set both ends the same way, ideally both back to auto.

Trap Reading a duplex mismatch as a down link or bad cable; the carrier stays up and the tells are late collisions and falling throughput, not loss of link.

Standard Ethernet MTU is 1500 bytes; a jumbo frame raises it to 9000

The maximum transmission unit (MTU) is the largest payload a frame carries; standard Ethernet MTU is 1500 bytes. A jumbo frame raises the payload to as much as 9000 bytes to cut per-frame overhead and CPU interrupts for high-volume traffic like iSCSI/NAS storage and backups. Remember the two numbers: 1500 standard, up to 9000 jumbo.

Jumbo frames must be set to the same MTU on every device in the path

Jumbo frames only work if every switch, NIC, and router along the path is configured for the same larger MTU. A single 1500-byte device in the middle drops the oversized frames, and the symptom looks like intermittent loss or stalled large transfers rather than an obvious error. So enable jumbo frames end to end or not at all.

Trap Setting a 9000-byte MTU on the server but not on the switches between it and the peer; the mismatched middle device silently drops the big frames.

Auto-negotiation on both ends is the recommended speed/duplex default

Auto-negotiation lets the two ports advertise their speed and duplex capabilities and settle on the best common pair, and leaving both ends on auto is the recommended default. Hard-coding only one end is what creates a duplex mismatch, so the safe practice is matching configuration: both auto, or both manually set to the same speed and duplex.

Link aggregation with LACP (802.3ad) bonds links without an STP block

Link aggregation under IEEE 802.3ad uses LACP (Link Aggregation Control Protocol) to bond several parallel physical links into one logical link, adding their bandwidth and surviving the loss of a member link. Crucially, STP treats the bundle as one logical port, so the parallel links are not blocked as a loop, which is what would happen if you cabled them without aggregation. It is the answer for more bandwidth between switches without redundancy being blocked.

Trap Cabling two parallel switch links for bandwidth without aggregating them; STP blocks the second as a loop, so you must bundle them with LACP to use both.

1 question tests this
A switch forwards by its MAC address table (CAM table)

A switch forwards frames using its MAC address table (also called the CAM table, for content-addressable memory): it learns the source MAC of each frame and the port it arrived on, then forwards later frames only out the matching port instead of flooding. Entries age out after a timeout. The table is also the target of a MAC flooding attack, which overflows it so the switch fails open and floods all traffic.

Classic 802.1D STP takes ~50 seconds: 20s max-age plus 15s listening plus 15s learning

With default timers, a blocked port in traditional 802.1D Spanning Tree waits out the 20-second max-age timer after an indirect failure, then transitions through the listening state (15 seconds) and the learning state (15 seconds) before it forwards, totaling about 50 seconds. The listening-plus-learning portion alone (twice the 15-second forward delay) is 30 seconds. This slow convergence is why RSTP (802.1w) was introduced.

Trap Counting only the 30-second forward delay and forgetting the 20-second max-age wait that precedes it after an indirect failure.

5 questions test this
Port-security shutdown mode err-disables the port; restrict and protect just drop frames

Port security caps how many (or which) MAC addresses a switch port accepts, defeating MAC-flooding attacks that try to overflow the CAM table from one port. On a violation, shutdown mode error-disables the port and requires manual re-enablement, while restrict and protect modes keep the port up and simply drop the offending traffic (restrict also logs and counts it).

Trap Expecting the default violation action to merely drop traffic, when the default shutdown mode err-disables the entire port.

2 questions test this
Sticky MAC learning auto-records allowed addresses and saves them to the config

Sticky MAC address learning lets port security dynamically learn the MAC of whatever device connects and write it into the running configuration, so an administrator does not have to type each allowed address by hand. Once the configuration is saved, the learned addresses persist through a reboot.

Trap Confusing sticky learning with statically typed secure MACs; sticky is the hands-off option that learns addresses automatically.

2 questions test this

References

  1. IEEE 802.1Q — Bridges and Bridged Networks (VLANs) Whitepaper
  2. Cisco Switches — inter-VLAN routing on a multilayer (Layer 3) switch
  3. IEEE 802.1D — MAC Bridges (Spanning Tree Protocol) Whitepaper
  4. Network MTU for your EC2 instance — jumbo frames (9001 MTU)
  5. IEEE 802.3 Ethernet Working Group (link aggregation: 802.3ad / 802.1AX) Whitepaper