VLAN ID ranges and reserved IDs you cannot use
VLANs are identified by a numeric ID between 0 and 4095, but not all of these IDs are available for your use. Understanding which VLAN IDs are reserved, restricted, or unusable is critical for proper network design and avoiding configuration conflicts. This guide breaks down the full VLAN ID range, explains what each reserved block does, and shows you how to plan your numbering scheme.
The complete VLAN ID range: 0 to 4095
The VLAN ID field in the 802.1Q header is 12 bits, which allows for 4096 total possible values (2 to the power of 12). This gives you IDs from 0 to 4095. However, the IEEE 802.1Q standard and vendor implementations reserve certain ranges for specific purposes, leaving only a subset available for user-defined VLANs.
Most enterprise switches divide the usable range into two regions: the normal range (1-1005) and the extended range (1006-4094). The normal range is stored in NVRAM on older Catalyst switches and supports all VLAN features. The extended range is stored in the running configuration and has some feature limitations on legacy platforms, though modern switches handle both ranges identically.
Reserved and restricted VLAN IDs
- →VLAN 0: Reserved by 802.1Q standard; never used in practice.
- →VLAN 1: Default VLAN on all Cisco switches; cannot be created, deleted, or renamed. All ports belong to VLAN 1 by default.
- →VLANs 2-1005: Normal range; available for user configuration.
- →VLANs 1006-4094: Extended range; available for user configuration on most modern switches.
- →VLAN 4095: Reserved for 802.1Q tag protocol identifier (TPID); never use for data VLANs.
Additionally, some vendors reserve specific IDs within the normal range for internal use. Cisco reserves VLAN 1002-1005 for legacy Token Ring and FDDI support, though these are rarely needed in modern networks. Check your switch documentation for any vendor-specific reservations.
Best practices for VLAN numbering
- →Avoid VLAN 1: Do not use it for data traffic. Configure a management VLAN (e.g., VLAN 10) and disable VLAN 1 on user ports.
- →Document your scheme: Create a VLAN allocation table mapping IDs to departments, functions, or sites.
- →Use the normal range first: If your switches support it, keep user VLANs in the 2-1005 range for consistency.
- →Reserve blocks: Allocate contiguous blocks to each site or department (e.g., 10-19 for Finance, 20-29 for Engineering).
- →Avoid the extended range unless necessary: Stick to 1-1005 if all your switches support it, to ensure compatibility.
- →Plan for growth: Leave gaps in your numbering to accommodate future VLANs without renumbering.
Example VLAN allocation
VLAN 1 - Default (disabled for user traffic) VLAN 10 - Management VLAN 20 - Finance VLAN 30 - Engineering VLAN 40 - Sales VLAN 50 - Guest VLAN 100 - Voice VLAN 200 - Video VLAN 1000 - Reserved for future use VLAN 1001 - Reserved for future use
This allocation uses the normal range and leaves room for expansion. If you need more than 1004 user VLANs, move into the extended range (1006-4094), but verify that all your switches support it and that you understand any feature limitations.