Setting up VLANs on a used managed switch (practical guide)

Buying a used managed switch is the easy part. The part that actually trips people up is the first VLAN config - especially if the switch came factory-reset with zero documentation and you're reverse-engineering the CLI from forum posts. Here's a practical walkthrough that works across most enterprise-grade used gear (Cisco IOS syntax shown, with notes for HP/Aruba and Netgear where it differs meaningfully).

Why bother with VLANs at all

A flat network means your IP cameras, your NAS, your guest laptop, and your work VPN endpoint are all in the same broadcast domain and can all see each other. VLANs give you logical separation on physical switch hardware you already own - no extra cables, no extra switches. Typical home lab / small office split:

• VLAN 10 - trusted (workstations, servers)
• VLAN 20 - IoT / cameras / smart home
• VLAN 30 - guest Wi-Fi
• VLAN 99 - management (switch/AP/router admin interfaces only)

Step 1: Factory reset and get console access first

Don't trust a "reset to defaults" claim from a seller. On Cisco IOS:

erase startup-config
delete /force vlan.dat
reload

vlan.dat is the hidden file where VLAN database info lives separately from the running config - erasing startup-config alone won't touch it, and you'll inherit whatever VLANs the previous owner configured. This is the single most common gotcha with used switches: you set up VLAN 10 and 20 cleanly, then discover VLAN 50 "PrevCorp-DMZ" is still lurking in the database.

Console into it with a USB-to-RJ45 rollover cable at 9600 8N1 - don't rely on the switch already having a management IP reachable over the network, since you don't know its prior config.

Step 2: Create the VLANs

vlan 10
 name TRUSTED
vlan 20
 name IOT
vlan 30
 name GUEST
vlan 99
 name MGMT
exit

On HP/Aruba (ProCurve/Comware CLI), it's:

vlan 10
 name TRUSTED

same idea, slightly different config-mode nesting.

Step 3: Assign access ports

Ports where a single device connects (a PC, an AP's LAN uplink acting purely as an access port, a camera) get access mode - untagged, one VLAN only.

interface GigabitEthernet0/5
 switchport mode access
 switchport access vlan 20
 description "Camera - driveway"

Repeat per port. Don't skip switchport mode access - some Cisco IOS versions default to dynamic desirable trunking negotiation (DTP), which is a real security gap: an attacker (or a curious device) can sometimes negotiate a trunk and see traffic it shouldn't. Hard-set access mode explicitly on every access port.

Step 4: Set up the trunk to your router/firewall

The uplink to whatever does inter-VLAN routing (a router-on-a-stick, a firewall like a used FortiGate, or an L3 switch) needs to carry all VLANs tagged:

interface GigabitEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 switchport trunk native vlan 99

Set the native VLAN deliberately - don't leave it at VLAN 1. Untagged traffic on a trunk lands in the native VLAN, and VLAN 1 is the default on essentially every switch out of the box, which makes it a predictable target. Match the native VLAN on both ends of the trunk, or you'll get VLAN mismatch errors (Cisco logs these loudly; other vendors sometimes fail silently).

Step 5: Inter-VLAN routing

If your switch is L2-only (like a Catalyst 2960 or most budget-tier used switches), routing happens upstream - your router or firewall does the work with subinterfaces:

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 10.10.20.1 255.255.255.0

If your switch is L3-capable (3750X, 3850, or similar), you can do it on the switch itself with SVIs:

ip routing
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
interface Vlan20
 ip address 10.10.20.1 255.255.255.0

Don't forget ip routing globally - it's off by default even on L3-licensed hardware, and it's the #1 reason "my SVIs have IPs but nothing routes" threads exist.

Step 6: Lock down the management VLAN

Put the switch's own management IP on VLAN 99, not VLAN 1 and not the same VLAN as your general workstations:

interface Vlan99
 ip address 10.10.99.2 255.255.255.0

Then restrict which VLANs can reach it - either with an ACL on the SVI or, better, only allowing management VLAN traffic through your firewall rules. A used switch with a defaulted admin/admin login sitting reachable from your IoT VLAN is a bad combination.

Common pitfalls checklist

• Stale vlan.dat - always wipe it explicitly, erase startup-config isn't enough.
• DTP left on - set every access port to switchport mode access explicitly, don't rely on auto-negotiation.
• Native VLAN mismatch - both ends of a trunk must agree, and it shouldn't be VLAN 1.
• Forgetting ip routing on an L3 switch - SVIs with IPs but no forwarding.
• PVID vs tagged VLAN confusion on non-Cisco gear - on Netgear/TP-Link "smart" switches, the terminology is often "PVID" for untagged/native and a separate tagged-members table; the concepts map to Cisco's model but the UI hides it differently. Read the specific model's VLAN doc before assuming Cisco terms translate directly.
• License gaps - some used L3 switches (3750X, 3850) need IP Base or IP Services licensing for full routing feature sets; verify with show license before planning your topology around a feature that isn't actually unlocked.

Buying advice for VLAN-capable used gear

If you're shopping for a switch specifically to do this, confirm before buying: does it support 802.1Q tagging (basically all "managed" switches from the last 15 years do), is it L2-only or L3-capable, and does the license tier on that specific unit include what you need. Sellers who test and document configuration state before shipping - resellers like IT and Office list functional-tested, factory-reset managed switches with the model/license spelled out - save you the guesswork of finding out mid-setup that the unit you bought is LAN Lite instead of LAN Base.

What's your VLAN layout look like, and did you hit any surprises with used gear that still had a previous owner's config baked in?