This VLAN config generator writes the Cisco IOS commands for VLANs, access and trunk ports and SVIs, and the Linux commands to use those VLANs on a server connected to a trunk. It runs entirely in your browser: nothing you type is sent to our server.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
What the VLAN config generator writes
vlanentries with names (VLAN 1 is left alone; 1002-1005 are reserved).- Access ports with PortFast and BPDU Guard, optionally with a voice VLAN for IP phones; ranges become
interface range. - Trunks with an explicit allowed list and native VLAN, and DTP disabled (
switchport nonegotiate). - SVIs with addresses, and NetworkManager or iproute2 commands for a Linux server’s VLAN interfaces.
Good practice
- Do not use VLAN 1 for user traffic, and use an unused VLAN as the trunk native VLAN.
- Always list allowed VLANs on trunks instead of carrying all of them.
- Apply changes to a port you are not connected through, or from the console.
Using the VLAN config generator
- List the VLAN IDs (1 to 4094) and names. Keep user traffic off VLAN 1.
- Mark access ports with their data VLAN and, for IP phones, a voice VLAN; mark trunk ports with the allowed VLAN list and an unused native VLAN.
- Add an SVI for each VLAN the switch routes, with
ip helper-addressif the DHCP server is on another network. - Paste the commands in configuration mode, then check with
show vlan briefandshow interfaces trunk. On a Linux server on a trunk, apply the generated nmcli commands and check withip -d link.
Common mistakes:
- A native VLAN mismatch between two switches: traffic leaks between VLANs and CDP reports the mismatch.
- A VLAN missing from the allowed list on one end of a trunk: hosts in it reach nothing across the link.
- A voice VLAN the phone never learns: phones get it through CDP or LLDP-MED, or through a DHCP option, so check that one of these is enabled.
- Sending tagged traffic to a server that is not configured for VLAN tags.
Related tools and guides: VRRP config generator, Cisco ACL generator, subnet calculator, pfSense VLANs with a managed switch.
How we checked it
We checked the generated configuration on 11-12 October 2026 for ranges, voice VLANs, trunk allowed and native VLANs, SVIs and the Linux commands, and the validation of reserved and missing VLAN IDs.
Need a redundant gateway for those VLANs? Build it with the HSRP, VRRP and keepalived Configuration Generator.
Background on VLAN tagging: IEEE 802.1Q.
Frequently asked questions
How do I configure a trunk port on a Cisco switch?
switchport mode trunk, switchport trunk allowed vlan with your VLAN list, and switchport trunk native vlan. Older switches that support ISL also need switchport trunk encapsulation dot1q first.
What is a voice VLAN?
A second VLAN on an access port for IP phones: the phone tags its traffic with the voice VLAN, while the PC behind it uses the access VLAN.
How do I add a VLAN interface on Linux?
nmcli connection add type vlan con-name eth0.10 ifname eth0.10 dev eth0 id 10, then give it an address. The generator writes these for every VLAN.