Connect. Secure. Manage.
Cisco VLAN and Trunk Configuration
Configure VLANs and trunks on Cisco switches, resolving native VLAN, tagging and allowed-list inconsistencies before they disrupt users or applications.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco VLAN and trunk configuration defines which devices can communicate at Layer 2 and how traffic moves between switches, routers, firewalls and virtualisation hosts. A VLAN is not, by itself, a complete security boundary. The outcome depends on gateway placement, allowed trunk lists, authentication, routing and the policies applied between networks. MCI Network Services designs and reviews these arrangements for Cisco Catalyst and compatible environments, with a focus on maintainability and controlled change.
Cisco-focused engineering
Design around the platform, traffic and failure behaviour you actually operate.
Change with evidence
Use pre-checks, acceptance criteria and a documented route back.
Operational handover
Keep the configuration, diagrams and responsibilities understandable after delivery.
Start with the purpose of each network
We begin by mapping the endpoints, applications and operational owners of the proposed segments. Corporate workstations, guest wireless, voice systems, building controls and management interfaces may need different access rules and support processes. Creating a separate VLAN for every department is not necessarily useful; the separation should correspond to a requirement that can be explained, enforced and tested.
We document the VLAN identifier, name, addressing plan, default gateway, DHCP scope and permitted traffic for each segment. We also identify where the network crosses into a firewall or routed boundary. If a customer expects a guest VLAN to be isolated from internal applications, that isolation must be demonstrated by routing and policy tests rather than inferred from different VLAN numbers.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Choose access and trunk port behaviour deliberately
Access ports generally carry traffic for one configured access VLAN, subject to any voice or other supported features. Trunk ports can carry multiple VLANs and therefore deserve tighter change control. We review which connections genuinely require trunks: uplinks between switches, some firewall connections, hypervisor hosts and other explicitly designed interfaces.
Allowed VLAN lists should reflect the intended service, not default to every VLAN everywhere. We check native VLAN conventions, tagging expectations and any interoperability requirements. A mismatch can cause confusing reachability failures or expose traffic in unexpected places. Interface descriptions, diagrams and switchport templates make these choices easier to audit during later incidents.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Avoid uncontrolled Layer 2 expansion
Extending the same VLAN across buildings or data centres can simplify an application migration, but it also enlarges the fault domain. Broadcast traffic, spanning-tree events and accidental loops can then affect more users than intended. We review whether a routed boundary would provide a safer and more scalable alternative.
Where Layer 2 extension is necessary, we establish its endpoints, resilience design and operational owner. We check that the existing topology and hardware support the proposed arrangement. Temporary extensions should have an explicit review or retirement point, because temporary network designs have a habit of becoming permanent dependencies.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Coordinate with spanning tree and link aggregation
Trunk changes interact with spanning-tree topology and EtherChannel configuration. Removing a VLAN from one member of a bundle, or enabling it on an unintended path, can produce asymmetric behaviour that is difficult to diagnose from a single interface. We validate bundle consistency, spanning-tree participation and the expected forwarding path for important segments.
Protection features must match port roles. BPDU Guard can be valuable on genuine edge ports, but a deliberate switch-to-switch trunk requires different treatment. We do not copy security settings blindly across all interfaces. The correct policy follows the design, with exceptions documented and periodically reviewed.
Build migration and rollback into the change
Before modifying production trunks, we capture the existing configuration and identify the services that depend on each VLAN. We check management reachability and arrange an alternative access method where practical. The implementation plan states the intended command changes, verification checks and conditions that would trigger rollback.
During the change we verify VLAN presence, trunk status, MAC learning, gateway reachability and representative application paths. We also check DHCP, DNS and authentication where those services are affected. A successful ping between two devices is useful evidence, but it does not establish that every application or security policy is working as intended.
Troubleshoot with forwarding evidence
When VLAN connectivity fails, we trace the traffic from the endpoint through its access port, uplinks, switching tables and gateway. We compare the intended design with the actual operational state, including allowed VLANs, port-channel membership, spanning-tree forwarding and address resolution. This helps distinguish a tagging error from an authentication failure, routing problem or upstream firewall rule.
We avoid broad temporary changes that may restore one connection while weakening segmentation for everyone else. Any emergency workaround should be approved, recorded and removed when the underlying cause is fixed. The incident record should make it clear what failed, how it was verified and whether similar ports or sites could be affected.
Keep segmentation understandable
A maintainable Cisco network has a current VLAN register, meaningful naming conventions and clear ownership of gateway and firewall policy. New VLAN requests should include the business purpose, permitted traffic, monitoring requirements and a retirement plan where appropriate. This prevents years of accumulated unused segments and undocumented trunk allowances.
MCI supports Cisco and Meraki network services throughout the UK, with particular emphasis on London, Kent, Sussex, Essex and Berkshire. If your network has grown through successive office moves, acquisitions or urgent changes, we can review the existing VLAN and trunk design, identify avoidable risk and agree a controlled improvement plan.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.