COMMAND REFERENCE

Switching Command List

VLAN, trunk, discovery, EtherChannel, and spanning-tree configuration at a glance.

VLANs and access ports

vlan 20
name USERS
interface gi0/1
switchport mode access
switchport access vlan 20
show vlan brief

Trunks

switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,99
show interfaces trunk

EtherChannel

interface range gi0/1-2
channel-group 1 mode active
show etherchannel summary

Spanning tree

spanning-tree vlan 10 root primary
spanning-tree portfast
spanning-tree bpduguard enable
show spanning-tree vlan 10

Command decisions

CommandWhat it doesWhy it mattersswitchport mode accessForces the port to operate as a Layer 2 access port.It prevents the port from negotiating an unintended trunk.switchport access vlan 20Places untagged endpoint traffic into VLAN 20.The VLAN defines the endpoint's Layer 2 broadcast domain.switchport mode trunkMakes the link carry multiple VLANs using tags.Inter-switch links commonly need several VLANs on one physical connection.channel-group 1 mode activeStarts LACP negotiation for EtherChannel 1.Multiple matching links become one logical link with redundancy and added capacity.spanning-tree portfastMoves an edge port rapidly to forwarding.Endpoints avoid normal STP delay; use it only where a switch is not expected.spanning-tree bpduguard enableError-disables the edge port if it receives a BPDU.It protects the topology from an unexpected switch on an access port.

Verification mindset

show vlan brief proves access VLAN membership but does not prove trunk allowance.

show interfaces trunk proves operational trunking, native VLAN, and allowed VLANs.

show etherchannel summary uses flags to show whether links are bundled or merely configured.

show spanning-tree vlan 10 identifies the root bridge, port roles, costs, and blocked paths.

Real scenarios you'll actually face

"There's a broadcast storm and the whole floor just went down." CPU utilization spikes, port lights strobe solid, and everything on that VLAN grinds to a halt. This is almost always a physical loop — someone plugged both ends of a cable into the same switch, or into two switches with no STP protecting the link — and every broadcast frame now circulates forever, duplicating itself at every pass. `show spanning-tree vlan <id>` should show a blocking port breaking the loop; if it doesn't, or if the loop is between an access port and a rogue unmanaged switch a user plugged in, that's what BPDU Guard exists to prevent in the first place. The actual fix in the moment is physically finding and pulling the extra cable — `show interfaces counters errors` and rapidly incrementing input counts on a specific port is how you locate which cable to pull without shutting down half the closet guessing.

"I created the VLAN and it still won't pass traffic to the other switch." Creating a VLAN and putting a port in it doesn't automatically let that VLAN's traffic cross an existing trunk — `switchport trunk allowed vlan` is an explicit allow-list, and a new VLAN isn't on it until you add it. `show interfaces trunk` shows exactly which VLANs are actually allowed across a given trunk versus which ones merely exist somewhere on the switch — the two are not the same question, and conflating them is the most common reason a brand-new VLAN "doesn't work" on day one.

"The EtherChannel won't bundle — show etherchannel summary shows the ports as individual, not part of a Po." LACP requires every member link to agree on speed, duplex, access/trunk mode, and allowed VLANs before it'll bundle them — a single mismatched setting on one physical port (often because someone configured the two ends at different times) leaves that port suspended outside the channel instead of joining it. Fix the mismatched setting to match its siblings, don't just keep re-adding the port to the channel-group — the channel-group command isn't what's failing.

OFFLINE OPTION

Want a printable copy?

This complete guide is also available as a professionally formatted PDF.

Download PDF ↓