Switching

Course at a glance

• 70 lessons in 9 units.
• Format: self-paced lessons with Cisco IOS switch configurations, debugs, packet captures, and video.
• Last updated: October 2026.

What is Switching?

Switching is how devices in a LAN communicate with each other. A switch operates on layer 2 of the OSI model and forwards Ethernet frames based on their destination MAC address. It learns where each device is by looking at the source MAC address of incoming frames and storing it in its MAC address table. When the destination is unknown, or the frame is a broadcast, the switch floods it out of all interfaces in the same VLAN, except the one where it came from.

A switch on its own creates one big broadcast domain. VLANs split a physical switch into multiple logical switches, so you can separate departments, voice traffic, and guests, and trunks carry multiple VLANs over a single link with 802.1Q tags. To keep the network up when a link or switch fails, we add redundant links. Spanning tree prevents the loops that redundant links cause, and EtherChannel, StackWise, and VSS let you use those links instead of blocking them.

Every network has switches: home and small office networks, enterprise campus networks with access, distribution, and core layers, and data centers. Multilayer switches also route between VLANs at hardware speed, which is why you’ll find them in the distribution and core layers. Because users connect directly to the access layer, it’s also where we enforce security with features like port security, DHCP snooping, and 802.1X.

Switching Learning Roadmap

This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.

Switching Basics

Ethernet is the dominant protocol in our LANs. A switch learns MAC addresses from the source address of each frame, and floods frames when it doesn’t know the destination yet. You can add a static entry to the MAC address table yourself, and asymmetric routing can cause a switch to keep flooding unicast frames. Multilayer switches can also route, and they use CEF and the TCAM to forward packets at hardware speed. On Cisco Catalyst switches, SDM templates decide how the TCAM memory is divided between MAC addresses, routes, and other entries. When an interface shows errors or doesn’t come up, you’ll learn how to troubleshoot it.

VLANs and Trunking

Without VLANs, a broadcast reaches every device in the network. VLANs create separate broadcast domains on the same physical switches, and each switch port is its own collision domain. In this unit you configure VLANs and trunks. A trunk carries multiple VLANs between switches, and 802.1Q adds a 4-byte tag to each frame to tell the receiving switch which VLAN it belongs to. Frames in the native VLAN are not tagged, so the native VLAN has to match on both sides. DTP can negotiate trunks automatically, but that’s a security risk, so we disable it. When something doesn’t work, you’ll learn how to troubleshoot VLANs and trunks.

InterVLAN Routing and Advanced VLAN Topics

Devices in different VLANs can only communicate through a router or multilayer switch. InterVLAN routing works with a router on a stick, with SVIs on a multilayer switch, or with routed ports, and when it doesn’t work, you’ll learn how to troubleshoot it. Besides regular VLANs, there are a few special cases: the voice VLAN for IP phones, private VLANs that isolate hosts within the same subnet, and 802.1Q tunneling (Q-in-Q), which service providers use to carry customer VLANs with a second tag. It can even carry an EtherChannel between customer switches.

VTP (VLAN Trunking Protocol)

Creating the same VLANs on 20 switches by hand takes time. VTP lets you create VLANs on a VTP server, and the VTP clients in the same domain synchronize themselves, based on a revision number that increases with every change. Switches in transparent mode don’t synchronize, but they do forward VTP advertisements. VTP version 3 adds a primary server, so you can no longer wipe all VLANs by accident, and it can synchronize extended range VLANs, private VLANs, and the MST configuration.

Spanning Tree

Redundant links between switches cause loops, and since Ethernet frames have no TTL, a loop quickly becomes a broadcast storm. Spanning tree elects a root bridge and blocks redundant ports so there is only one active path, and each port goes through several port states before it forwards frames. We cover classic STP, PVST, Rapid Spanning Tree, MST, features like portfast, BPDU guard, and root guard, and Flex Links, an alternative to spanning tree for redundant uplinks. For the complete course, including MST and PVST+ interoperability, STP dispute, and bridge assurance, see our dedicated spanning tree course.

EtherChannel and Switch Virtualization

EtherChannel bundles multiple physical links into a single logical link. Spanning tree sees the bundle as one interface, so no links are blocked, and traffic is load balanced over the physical links. You can negotiate it with LACP or PAgP, or configure it statically, as a layer 2 or layer 3 interface, and when the bundle doesn’t come up, you’ll learn how to troubleshoot it. To get rid of blocked links between layers altogether, switch virtualization with StackWise, chassis aggregation, and VSS turns two or more physical switches into a single logical switch.

Switch Security

Users connect directly to your access layer switches, so that’s where many attacks start, like VLAN hopping. Port security limits which and how many MAC addresses are allowed on an interface. DHCP snooping stops rogue DHCP servers and builds a database of IP and MAC bindings, which Dynamic ARP Inspection and IP source guard use to stop ARP poisoning and spoofing. With 802.1X and MAB, devices have to authenticate before they get access to the network.

Filtering, Monitoring and Other Switch Features

A few more features complete the picture. Protected ports, VLAN access-lists, and storm control filter traffic within a VLAN. SPAN and RSPAN copy traffic from an interface or VLAN to a port where you can capture it, and RMON collects statistics on your interfaces. Power over Ethernet powers IP phones, cameras, and access points through the same cable that carries their data. To manage a switch remotely, you also give it an IPv4 address.

Ready to master switching?

Get access to all 70 switching lessons and every other course on NetworkLessons.com.

Sign up