Managed Switch VLAN Misconfiguration — Devices Isolated or Landing on Wrong VLAN
A VLAN configuration change, new switch deployment, or trunk reconfiguration leaves devices unable to communicate, isolated in their subnet, or receiving an IP from the wrong DHCP scope. Diagnosis centres on port mode, VLAN database presence, trunk allowed VLAN lists, and native VLAN consistency.
Indicators
- Devices receive IP from wrong VLAN DHCP scope after port or switch change
- Devices on a port get no DHCP response and fall back to APIPA
- Inter-VLAN routing stops for a specific VLAN after trunk reconfiguration
- New switch installed but traffic only passes on native VLAN
- STP topology change log entries coinciding with connectivity loss
Likely causes
- Port configured as trunk instead of access (or access mode missing VLAN assignment)
- VLAN not created in VLAN database on one or more switches in the path
- Trunk allowed VLAN list does not include the required VLAN
- Native VLAN mismatch between the two ends of a trunk link
- VLAN pruning removing the VLAN from a trunk
- STP blocking the inter-switch link carrying the VLAN
Diagnostic steps
-
Check port mode and assigned VLAN: Cisco: show interfaces <port> switchport; ProCurve: show port <port> detail; Juniper: show interfaces <port> detail
-
Verify VLAN exists in database on all switches in path: show vlan brief — if VLAN missing, create it: vlan <id> name <name>
-
Check trunk allowed VLAN list: show interfaces trunk — confirm VLAN appears in 'VLANs allowed and active in management domain' column
-
Verify native VLAN matches on both ends of trunk: native VLAN mismatch produces syslog error 'Native VLAN mismatch discovered' and drops untagged traffic
-
Check STP port state: show spanning-tree interface <port> — port should be in Forwarding state; if Blocking, investigate root bridge election
-
Trace MAC address: show mac address-table vlan <id> — confirm switch is learning the device MAC on the expected port
Resolution path
- Confirm port mode (access vs. trunk) matches device type
- Create missing VLAN in database on all switches in path
- Add VLAN to trunk allowed list on all inter-switch links
- Correct native VLAN mismatch on both ends of trunk
- Verify STP converges with port in Forwarding state
Prevention
- Document port-to-VLAN mapping in IPAM and update after every change
- Use change control tickets for all VLAN and trunk modifications
- Enable VTP transparent mode or VLAN manual configuration to prevent accidental VLAN database propagation
- Monitor trunk utilisation and CDP/LLDP adjacency via SNMP — alert on adjacency loss
Tools
- Switch CLI (Cisco IOS/NX-OS, HPE ProCurve, Juniper EX, Brocade)
- show interfaces trunk / show vlan brief / show spanning-tree
- SNMP network management (SolarWinds, PRTG, LibreNMS)
- CDP/LLDP neighbour discovery
- MAC address table (show mac address-table)