Cisco VLAN & Trunk Generator

Generate Cisco IOS VLAN, access port, trunk and SVI configuration with the safety settings that keep a switched network stable.

Config generator Cisco Runs in your browser
Range or list, IOS syntax.
Use an unused VLAN, never 1.
Try:

Result

VLAN
100 (USERS)
SVI
10.100.0.1/24
Allowed on trunk
100,200,300
Native VLAN
999
unused and shut down
Cisco IOS configuration
vlan 100
 name USERS
!
vlan 999
 name NATIVE-UNUSED
 shutdown
!
interface Vlan100
 description USERS gateway
 ip address 10.100.0.1 255.255.255.0
 no shutdown
!
interface range Gi1/0/1-24
 description USERS access
 switchport mode access
 switchport access vlan 100
 switchport nonegotiate
 spanning-tree portfast
 spanning-tree bpduguard enable
 storm-control broadcast level 5.00
 no shutdown
!
interface range Gi1/0/47-48
 description 802.1Q trunk
 switchport mode trunk
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 999
 switchport trunk allowed vlan 100,200,300
 switchport nonegotiate
 spanning-tree guard loop
 no shutdown
!
Verification
show vlan brief
show interfaces trunk
show spanning-tree vlan 100
show ip interface brief | include Vlan100
show interfaces status | include USERS
Prune your trunks
An explicit allowed-VLAN list on every trunk is the difference between a switched network you can reason about and one where a VLAN appears everywhere by accident. "switchport trunk allowed vlan all" is the default and it is rarely what you want.
Native VLAN hygiene
Native VLAN 999 is defined, unused and shut down. Leaving the native VLAN as 1 exposes you to VLAN hopping via double tagging, and mismatched native VLANs between two switches silently merges two broadcast domains.

About Cisco VLAN & Trunk Generator

VLAN configuration is easy to write and easy to write badly. This generates the full set - VLAN definition, access ports, trunk with a pruned allowed list, an unused native VLAN, and an SVI - with the spanning-tree and storm-control settings that keep an access layer out of trouble.

Spanning tree on an access layer

Enable PortFast on access ports so a host does not wait 30 seconds through listening and learning, and pair it with BPDU Guard so a switch plugged into that port is shut down rather than allowed to influence the topology. Use Root Guard on ports facing other switches you do not control, and set the root bridge priority explicitly on your distribution pair — leaving root election to default priorities and MAC addresses means the oldest access switch in the building can end up as root.

Why the native VLAN matters

Frames on the native VLAN cross a trunk untagged. If two switches disagree about which VLAN that is, traffic leaks between broadcast domains with no error message. Worse, leaving it as VLAN 1 alongside untagged access ports enables double-tagging attacks. Define an unused VLAN, set it as native on every trunk, and shut it down.

Common use cases

  • Provisioning a new access switch to a standard build.
  • Adding a VLAN across an existing switched estate consistently.
  • Producing configuration a reviewer can check line by line before a change window.

Edge cases and gotchas

  • Do not enable BPDU guard on ports facing another switch - it will disable the port on the first BPDU.
  • VLANs 1002-1005 are reserved on legacy platforms; the extended range above 1005 requires VTP transparent or off mode on older IOS.

Frequently asked questions

Do I need switchport nonegotiate?
It disables DTP, which prevents a port unexpectedly becoming a trunk. On any port whose role you have declared explicitly, yes - it removes a whole class of surprise.
Access VLAN or voice VLAN for a phone with a PC behind it?
Both: the access VLAN carries the PC traffic untagged, and the voice VLAN carries phone traffic tagged. The phone handles the separation.