VLAN ID Ranges & Reserved IDs

Standard and extended VLAN ID ranges, reserved IDs, and the IDs you should avoid assigning.

The 12-bit VLAN tag in IEEE 802.1Q allows 4,096 VLAN IDs, but not all of them are freely assignable. ID 0 is reserved for priority tagging, 1002-1005 are preassigned to legacy FDDI and Token Ring networks on many platforms, 4095 is reserved for implementation use, and ID 1 is the default native VLAN that most switches use until you change it.

Beyond the reserved IDs, the assignable space is split into the normal range (2-1001), supported on every 802.1Q switch, and the extended range (1006-4094), which is available on modern platforms but behaves differently: on Cisco IOS, extended-range VLANs are not propagated by VTP, and some features do not apply to them. When you plan a VLAN numbering scheme, document which IDs are reserved and which range you standardize on - the VLAN & Subnet Naming table pairs with this one.

VLAN IDs	Range Type	Assignable	Notes
0	Reserved	No	Cannot be assigned; used for 802.1Q priority tagging
1	Default VLAN	Avoid	Default native VLAN on most switches; change it before deployment
2-1001	Normal range	Yes	Usable on all 802.1Q switches
1002-1005	Reserved	No	Default FDDI and Token Ring VLANs on Cisco IOS
1006-1024	Extended range	Platform-dependent	Not propagated by VTPv1/v2 on Cisco; check vendor support
1025-4094	Extended range	Yes	Usable with the 12-bit VLAN tag; confirm platform support
4095	Reserved	No	Reserved for implementation use per IEEE 802.1Q

Frequently Asked Questions

What VLAN IDs should I use?

Use IDs from the normal range (2-1001) for day-to-day VLANs, since every 802.1Q switch supports them. Reserve ID 1 for the native VLAN or change it away from the default, avoid 1002-1005 (reserved for FDDI and Token Ring on many platforms), and treat 0 and 4095 as reserved. The extended range (1006-4094) is available but platform-dependent.

Why is VLAN 1 not recommended?

VLAN 1 is the default native VLAN on most switches, and every untagged port belongs to it out of the box. Because it is so commonly used for management and control traffic, it is a frequent target for VLAN hopping attacks, and best practice is to change the native VLAN and move management traffic to a dedicated VLAN.

What is the difference between the normal and extended VLAN range?

The normal range (2-1001) is supported on all 802.1Q switches and interoperates with older protocols like VTP. The extended range (1006-4094) is only available on modern hardware and firmware, is not propagated by VTPv1/v2 on Cisco, and some switch features do not apply to it.

What is a VLAN ID?

A VLAN ID is the 12-bit number inside the 802.1Q tag that tells a switch which logical network a frame belongs to. Switches keep separate forwarding tables and broadcast domains per ID, so two devices with the same VLAN ID behave as if they share a switch even when they are on different hardware.

How many VLANs can I have?

4,094 usable VLANs, numbered 1 to 4094. The 12-bit field allows values up to 4095, but ID 0 is reserved for priority tagging and ID 4095 is reserved for implementation use. In practice you standardize on the normal range (2-1001) unless you need the extended range.

What is the default VLAN?

VLAN 1 is the default VLAN on most switches, and every untagged port belongs to it until you change it. Because it carries management and control traffic out of the box, best practice is to move real traffic to other VLANs and change the native VLAN away from 1.

Guides that go deeper on the same topic.