← Network+ Hub

VLAN Configuration Lab

75 minutes Intermediate 6 Scenarios
1

Topology & VLAN Planning

Beginner
Scenario: You are configuring VLANs for a small office with 3 departments. Each department needs network isolation for security, but all departments must reach a central server.
[Router-on-a-Stick] | (Trunk: Gi0/1) | [Core-Switch] / | \ Fa0/1-8 Fa0/9-16 Fa0/17-24 | | | [Sales] [Engineering] [Servers] VLAN 10 VLAN 20 VLAN 30

VLAN Assignment Table

VLAN IDNamePortsSubnetGateway
10SALESFa0/1 - Fa0/8192.168.10.0/24192.168.10.1
20ENGINEERINGFa0/9 - Fa0/16192.168.20.0/24192.168.20.1
30SERVERSFa0/17 - Fa0/24192.168.30.0/24192.168.30.1
1defaultNone assignedManagement-

Tasks

  • Review the VLAN assignment table above
  • Identify which ports belong to each VLAN
  • Understand why the trunk link connects to the router
2

Create VLANs on the Switch

Beginner

VLAN Creation Commands

Switch> enable Switch# configure terminal Switch(config)# hostname Core-Switch ! Create VLAN 10 for Sales Core-Switch(config)# vlan 10 Core-Switch(config-vlan)# name SALES Core-Switch(config-vlan)# exit ! Create VLAN 20 for Engineering Core-Switch(config)# vlan 20 Core-Switch(config-vlan)# name ENGINEERING Core-Switch(config-vlan)# exit ! Create VLAN 30 for Servers Core-Switch(config)# vlan 30 Core-Switch(config-vlan)# name SERVERS Core-Switch(config-vlan)# exit

Verify VLANs

Core-Switch# show vlan brief VLAN Name Status Ports ---- ---- ------ ----- 1 default active Fa0/1-24, Gi0/1 10 SALES active 20 ENGINEERING active 30 SERVERS active 1002 fddi-default act/unsup 1003 trcrf-default act/unsup 1004 fddinet-default act/unsup 1005 trbrf-default act/unsup
Key Insight: Creating a VLAN does not automatically assign ports to it. All ports start in VLAN 1 (default). You must explicitly assign each port to the correct VLAN.
3

Assign Access Ports to VLANs

Intermediate

Port Assignment Commands

! Assign Fa0/1-8 to VLAN 10 (Sales) Core-Switch(config)# interface range FastEthernet0/1-8 Core-Switch(config-if-range)# switchport mode access Core-Switch(config-if-range)# switchport access vlan 10 Core-Switch(config-if-range)# exit ! Assign Fa0/9-16 to VLAN 20 (Engineering) Core-Switch(config)# interface range FastEthernet0/9-16 Core-Switch(config-if-range)# switchport mode access Core-Switch(config-if-range)# switchport access vlan 20 Core-Switch(config-if-range)# exit ! Assign Fa0/17-24 to VLAN 30 (Servers) Core-Switch(config)# interface range FastEthernet0/17-24 Core-Switch(config-if-range)# switchport mode access Core-Switch(config-if-range)# switchport access vlan 30 Core-Switch(config-if-range)# exit

Verify Port Assignments

Core-Switch# show vlan brief VLAN Name Status Ports ---- ---- ------ ----- 1 default active Gi0/1 10 SALES active Fa0/1-8 20 ENGINEERING active Fa0/9-16 30 SERVERS active Fa0/17-24
Why No Connectivity? VLANs create separate broadcast domains. For traffic to cross VLANs, you need a Layer 3 device (router or L3 switch) to route between them. This is called inter-VLAN routing.
4

Configure Trunk Link

Intermediate
Key Concept: A trunk port carries traffic from multiple VLANs using 802.1Q tagging. Each frame is tagged with its VLAN ID so the receiving device knows which VLAN it belongs to.

Trunk Configuration (Switch Side)

! Configure Gi0/1 as a trunk to the router Core-Switch(config)# interface GigabitEthernet0/1 Core-Switch(config-if)# switchport mode trunk Core-Switch(config-if)# switchport trunk allowed vlan 10,20,30 Core-Switch(config-if)# switchport trunk native vlan 99 Core-Switch(config-if)# exit ! Create the native VLAN (security best practice) Core-Switch(config)# vlan 99 Core-Switch(config-vlan)# name NATIVE

Verify Trunk

Core-Switch# show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 99 Port Vlans allowed on trunk Gi0/1 10,20,30 Port Vlans allowed and active in management domain Gi0/1 10,20,30
Security Best Practice: Change the native VLAN from the default (VLAN 1) to an unused VLAN (like 99). This prevents VLAN hopping attacks where an attacker double-tags frames to escape their VLAN.
5

Router-on-a-Stick (Inter-VLAN Routing)

Advanced
Key Concept: Router-on-a-stick uses a single physical interface with sub-interfaces, one per VLAN. Each sub-interface has its own IP address serving as the default gateway for that VLAN.

Router Sub-interface Configuration

Router> enable Router# configure terminal Router(config)# hostname GW-Router ! Enable the physical interface (no IP on it) GW-Router(config)# interface GigabitEthernet0/1 GW-Router(config-if)# no shutdown GW-Router(config-if)# exit ! Sub-interface for VLAN 10 (Sales) GW-Router(config)# interface GigabitEthernet0/1.10 GW-Router(config-subif)# encapsulation dot1Q 10 GW-Router(config-subif)# ip address 192.168.10.1 255.255.255.0 GW-Router(config-subif)# exit ! Sub-interface for VLAN 20 (Engineering) GW-Router(config)# interface GigabitEthernet0/1.20 GW-Router(config-subif)# encapsulation dot1Q 20 GW-Router(config-subif)# ip address 192.168.20.1 255.255.255.0 GW-Router(config-subif)# exit ! Sub-interface for VLAN 30 (Servers) GW-Router(config)# interface GigabitEthernet0/1.30 GW-Router(config-subif)# encapsulation dot1Q 30 GW-Router(config-subif)# ip address 192.168.30.1 255.255.255.0 GW-Router(config-subif)# exit
6

Verification & Troubleshooting

Advanced

Connectivity Tests

FromToExpectedWhy
Sales PC (VLAN 10)Sales PC (VLAN 10)SuccessSame VLAN, switched locally
Sales PC (VLAN 10)Engineering PC (VLAN 20)SuccessInter-VLAN via router sub-interfaces
Sales PC (VLAN 10)Server (VLAN 30)SuccessInter-VLAN via router sub-interfaces
Sales PC (VLAN 10)Gateway 192.168.10.1SuccessRouter sub-interface Gi0/1.10

Troubleshooting Commands

! Check VLAN assignments Core-Switch# show vlan brief ! Check trunk status Core-Switch# show interfaces trunk ! Check specific port VLAN membership Core-Switch# show interfaces Fa0/1 switchport ! Check router sub-interfaces GW-Router# show ip interface brief ! Verify routing table GW-Router# show ip route
Troubleshooting Checklist: (1) VLANs created? (2) Ports assigned to correct VLANs? (3) Trunk link up and allowing correct VLANs? (4) Router sub-interfaces configured with correct encapsulation and IPs? (5) PCs have correct gateway addresses?