| RANGE | CLASSIFICATION | NOTES |
|---|---|---|
| 0 | Reserved | Priority tagging only, not a real VLAN |
| 1 | Default VLAN | Factory default native VLAN on most switches — avoid for real traffic |
| 2 – 1001 | Normal range | Standard usable range, VTP-storable on Cisco gear |
| 1002 – 1005 | Reserved (legacy) | Historical Token Ring / FDDI translation — avoid |
| 1006 – 4094 | Extended range | Usable, but needs VTP v3 or transparent mode on older gear |
| 4095 | Reserved | Reserved by the 802.1Q standard — never usable |
VLAN ID (802.1Q) Reference
The 802.1Q VLAN tag carries a 12-bit VLAN ID, giving a range of 0–4095 — but not all 4,096 values are actually usable, and a few of the reserved or legacy ranges trip people up during VLAN planning. Look up any ID to see what range it falls in and whether it's safe to assign.
The ranges that actually matter
- 0 — not a real VLAN at all. A frame tagged with VLAN 0 is using 802.1p priority tagging only; the VLAN ID field is explicitly ignored.
- 1 — the default native VLAN on most switches out of the box. It works, but leaving real traffic on it is a well-known bad practice — VLAN 1 is the default everywhere, which makes it a predictable target and a common source of accidental cross-talk between devices nobody explicitly assigned.
- 2–1001 — the normal usable range, and the one that covers the vast majority of real-world VLAN deployments. This range is also what classic VTP (VLAN Trunking Protocol) versions 1 and 2 can actually propagate between switches.
- 1002–1005 — reserved for legacy Token Ring and FDDI VLAN translation, a Cisco-specific holdover from technology nobody's actually running anymore. Still reserved on modern gear even though the reason no longer applies to almost anyone.
- 1006–4094 — the extended range. Fully usable on modern equipment, but if you're dealing with older Cisco switches still running VTP v1 or v2 (not v3, and not transparent mode), they flatly cannot propagate VLANs above 1005 — a classic cause of "the VLAN exists on one switch but won't show up on the next one."
- 4095 — reserved by the 802.1Q standard itself, full stop, on every vendor's equipment.
Why this actually causes real outages
The VTP version mismatch above is the one that catches people out in practice: someone extends a network into the 1006+ range assuming it'll propagate the same way VLANs always have, and on an older switch still running VTP v1/v2 in server or client mode, it simply doesn't — the VLAN exists locally where it was created and nowhere else on the VTP domain. Switching that switch to VTP transparent mode, or upgrading it to VTP v3, is the actual fix — not re-checking the VLAN configuration for a typo that isn't there.