Fix the VLAN error by unifying the access port number on every switch, verify that the trunk links are sending the right VLAN number, and create a Layer 3 interface for inter-VLAN routing. A mismatched native VLAN, no 802.1Q tag, and blocked STP are always the bad guys when you suddenly drop.
Symptoms
- One VLAN cannot reach the default gateway while other VLANs still work fine.
- Hosts on the same VLAN talk locally but drop packets across a trunk link.
- DHCP requests time out on newly patched switch ports and hosts fall back to APIPA.
- Cisco logs show '%CDP-4-NATIVE_VLAN_MISMATCH' warnings every minute.
- Broadcast storms or STP topology changes appear right after a config push.
Common Causes
Wrong access VLAN on a port
Someone typed vlan 10 instead of vlan 20, or a new patch cable landed in a lab port. The host now sits in a subnet with no route to its intended gateway.
Trunk allowed-VLAN list missing an ID
Trunks default to all VLANs, but any switchport trunk allowed vlan add or remove edit can leave a gap. Traffic works on one switch and dies on the next hop.
Native VLAN mismatch on a trunk
One side untags VLAN 1, the other untags VLAN 99. Frames on the native VLAN get dropped or leak between segments, and CDP flags the mismatch within a minute.
No Layer 3 gateway for the VLAN
An SVI was never created, was left shutdown, or a router subinterface lacks encapsulation dot1Q. Hosts inside the VLAN reach each other, yet nothing routes out.
VTP pruning or database overwrite
A switch joined the domain with a higher VTP revision number and pruned VLANs from every peer. Access ports still list an ID with no active VLAN behind it.
Step-by-Step Fix
- Isolate the fault domain first:
Before interacting with config, ask: which VLAN is broken; where does traffic die? On the host having the issue, run ipconfig /all, verify the IP is within the correct subnet, and ping the gateway. APIPA = no DHCP was received, and access port one is the target. - Check access port membership on the switch
Log into the switch. Run show vlan brief and compare the port list against your VLAN plan. A port sitting in VLAN 1 by default is the classic silent failure. Fix it with: interface Gi0/5, switchport mode access, switchport access vlan 20, then verify with show interfaces Gi0/5 switchport. - Audit the trunk allowed-VLAN list
Between switches, run show interfaces trunk. Every VLAN that needs to cross the link must appear under 'Vlans allowed and active in management domain'. Add missing IDs with switchport trunk allowed vlan add 30. Avoid leaving trunks on the default 'all' setting in production, because it hides pruning mistakes. - Troubleshooting Native VLAN Mismatches:
CDP can indicate '%CDP-4-NATIVEVLANMISMATCH' if the devices at each end of a trunk cannot negotiate the same native or untagged VLAN. Equalize the native VLAN on both switches (an unused one like 999) and don't keep user frames untagged. Command: switchport trunk native vlan 999. Save on both peers. - Bring back inter-VLAN routing:
Traffic between VLANs requires Layer 3. With a multilayer switch, build an SVI: interface Vlan20 ip address 10.0.20.1 255.255.255.0 no shutdown With a router on a stick, use subinterfaces with encapsulation dot1Q 20 Verify the route is in show ip route and then ping the SVI from a host. - Rule out STP blocking and storm control
Run show spanning-tree vlan 20. A port stuck in BLK state on the path to the root bridge will quietly kill VLAN traffic. Look for recent TCN events after the change window. If storm control fired, show interfaces will show suppressed packets and input drops climbing. - Check ACLs and firewall policy between subnets
Even a correctly routed VLAN goes nowhere if an ACL on the SVI or a rule on the perimeter firewall drops the return path. Test with a temporary permit ip any any at the top of the list, watch hit counters, then rebuild the policy with explicit rules once traffic flows cleanly. - Save the config and record the change
Run copy running-config startup-config on every switch you touched. Log the ticket number, the change window, and the exact commands in your CMDB or wiki. VLAN mistakes love to reappear after a reboot when someone forgot to write the config to NVRAM.
Common VLAN symptoms mapped to the likely cause and first fix
| Symptom | Likely cause | First fix |
|---|---|---|
| Host receives an APIPA address | Access port in wrong VLAN or missing DHCP relay | show vlan brief, reassign port, verify ip helper-address |
| Ping works locally, fails across a switch | VLAN missing from trunk allowed list | switchport trunk allowed vlan add <id> |
| CDP native VLAN mismatch log entry | Different native VLAN on trunk peers | Set matching switchport trunk native vlan on both ends |
| Two VLANs cannot reach each other | No SVI or router subinterface exists | Create interface Vlan<id> with ip address, or dot1Q subinterface |
| Random flapping after a config push | STP recalculation or a Layer 2 loop | show spanning-tree, check for BPDU guard trips |
| Traffic dies at the gateway | ACL or firewall rule blocking the subnet | show access-lists, review hit counts, adjust policy |
Prevention
- Keep a single source of truth for VLAN IDs, subnets, and purpose, versioned in Git.
- Snapshot switch configs nightly with RANCID, Oxidized, or a similar tool.
- Require peer review for any trunk or native VLAN change on production links.
- Alert on CDP native VLAN mismatch and STP topology change SNMP traps.
FAQ
How do I check if a switch port is untagged or tagged?
Check the status of the port. Find the port by the port number in the Device ID list and verify whether the port's VID field is 0. 1 indicates that the switch port is untagged. On Cisco, switchport mode access transmits untagged frames for a single VLAN. Trunk ports will tag all VLANS but the "native" VLAN, which is untagged. Run show interfaces <port> switchport, and you will see the admin mode, access VLAN, trunking native VLAN, and allowed VLAN in one command.
Why did a VLAN Think disappear from a Frequently remote in during the Night?
VTP server/client mode shares VLAN databases at the domain level. You add a switch with a higher revision number to the domain, which will erase VLANs on all peers. Use transparent mode when adding switches, upgrade the VTP version to VTPv3, and assign a primary server.
Does each VLAN require its own subnet?
Yes. A VLAN is a Layer 2 broadcast domain, and routing between broadcast domains requires Layer 3. Overlapping subnets on two VLANs break ARP resolution and produce intermittent, one-way connectivity that is painful to trace. Assign one /24 or smaller per VLAN and keep the mapping in your IPAM.