Lab 07 — VLAN Configuration and Inter-VLAN Connectivity

Mission Information

Item	Details
Lab	07
Lab Name	VLAN Configuration and Inter-VLAN Connectivity
Track	CompTIA Network+
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Role	Network Technician / Junior Network Administrator
Environment	Network+ Switching and Routing Lab
Primary Systems	NETPLUS-ADMIN, NETPLUS-CLIENT01, NETPLUS-SERVER01, NETPLUS-SW01, NETPLUS-RTR01
Primary Tools	Managed Switch CLI, Router CLI, Wireshark, ping, traceroute, ARP tools
Skills	VLANs, Access Ports, 802.1Q Trunking, Broadcast Domains, Router-on-a-Stick, Default Gateways, Inter-VLAN Routing, VLAN Troubleshooting

Mission Objective: Segment a switched Ethernet network into multiple VLANs, configure access and trunk ports, implement inter-VLAN routing, verify end-to-end connectivity, and troubleshoot common VLAN and trunking problems.

Mission Scenario

You are working as a Junior Network Technician at GHC Enterprise.

The existing network uses one switched LAN:

ADMIN
CLIENT01
SERVER01
      ↓
NETPLUS-SW01
      ↓
One Broadcast Domain

The networking team now wants better separation between user, server, management, and guest systems.

The target design is:

VLAN 10 — Users

VLAN 20 — Servers

VLAN 30 — Management

VLAN 40 — Guest

The requirement is:

Separate Layer 2 Broadcast Domains
            ↓
Maintain Controlled Layer 3 Connectivity

You must configure VLANs, assign switch ports, create a trunk, configure a router for inter-VLAN routing, and validate communication.

Mission Objectives

By completing this lab, you will be able to:

explain why VLANs are used
understand VLAN IDs
create VLANs
configure access ports
assign ports to VLANs
understand broadcast-domain separation
explain 802.1Q tagging
configure trunk links
understand native VLAN concepts
verify allowed VLANs on trunks
configure router-on-a-stick
configure router subinterfaces
assign default gateways
verify same-VLAN connectivity
verify inter-VLAN connectivity
inspect ARP across VLANs
analyze tagged Ethernet frames
troubleshoot VLAN mismatches
troubleshoot trunk failures
troubleshoot incorrect gateways
document a segmented enterprise network

1. Build the Target Topology

Use:

                     NETPLUS-RTR01
                           |
                           |
                        TRUNK
                           |
                     NETPLUS-SW01
                  +--------+--------+
                  |        |        |
                  |        |        |
             Port 1    Port 2    Port 3
                |          |          |
                |          |          |
           CLIENT01     SERVER01     ADMIN

Logical VLAN design:

CLIENT01
VLAN 10 — Users

SERVER01
VLAN 20 — Servers

ADMIN
VLAN 30 — Management

Reserve:

VLAN 40 — Guest

for later use.

2. Define the VLAN Addressing Plan

Use:

VLAN	Purpose	IPv4 Network	Default Gateway
10	Users	10.10.10.0/24	10.10.10.1
20	Servers	10.10.20.0/24	10.10.20.1
30	Management	10.10.30.0/24	10.10.30.1
40	Guest	10.10.40.0/24	10.10.40.1

Host addressing:

NETPLUS-CLIENT01
10.10.10.20/24

NETPLUS-SERVER01
10.10.20.30/24

NETPLUS-ADMIN
10.10.30.10/24

3. Understand Why VLANs Are Used

Without VLANs:

One Switch
   ↓
One Broadcast Domain

With VLANs:

One Physical Switch
      ↓
Multiple Logical Networks

Conceptually:

VLAN 10
=
Broadcast Domain 1

VLAN 20
=
Broadcast Domain 2

VLAN 30
=
Broadcast Domain 3

4. Understand VLAN IDs

IEEE 802.1Q VLAN IDs use a 12-bit VLAN field.

Operationally, common usable VLAN IDs are:

1–4094

with some values reserved or platform-specific.

For this lab:

are used because they are easy to identify.

5. Understand VLAN 1

Many switches place ports in:

VLAN 1

by default.

For enterprise designs, user and server traffic should generally not remain dependent on the default VLAN.

In this lab, you will explicitly assign required access VLANs.

6. Access the Switch CLI

On NETPLUS-SW01, verify basic status.

Cisco-like example:

show interfaces status

Then:

show vlan brief

Initially, most interfaces may appear in:

VLAN 1

7. Create VLAN 10

Cisco-like configuration:

configure terminal

vlan 10
 name USERS
exit

8. Create VLAN 20

vlan 20
 name SERVERS
exit

9. Create VLAN 30

vlan 30
 name MANAGEMENT
exit

10. Create VLAN 40

vlan 40
 name GUEST
exit

11. Verify VLAN Creation

Run:

show vlan brief

Expected entries:

10   USERS

20   SERVERS

30   MANAGEMENT

40   GUEST

12. Understand Access Ports

An access port normally belongs to:

One VLAN

and connects to an endpoint.

Conceptually:

Endpoint
   ↓
Access Port
   ↓
Single VLAN

The endpoint typically does not need to understand 802.1Q tagging.

13. Configure CLIENT01 Access Port

Assume CLIENT01 is connected to:

Port 1

Configure:

interface <port1>
 switchport mode access
 switchport access vlan 10
 no shutdown
exit

14. Configure SERVER01 Access Port

Assume SERVER01 uses:

Port 2

Configure:

interface <port2>
 switchport mode access
 switchport access vlan 20
 no shutdown
exit

15. Configure ADMIN Access Port

Assume ADMIN uses:

Port 3

Configure:

interface <port3>
 switchport mode access
 switchport access vlan 30
 no shutdown
exit

16. Verify Access Port Membership

Run:

show vlan brief

Expected:

VLAN 10
Port 1

VLAN 20
Port 2

VLAN 30
Port 3

17. Reconfigure Host IPv4 Addresses

Configure CLIENT01:

IP:
10.10.10.20

Mask:
255.255.255.0

Gateway:
10.10.10.1

Configure SERVER01:

IP:
10.10.20.30

Mask:
255.255.255.0

Gateway:
10.10.20.1

Configure ADMIN:

IP:
10.10.30.10

Mask:
255.255.255.0

Gateway:
10.10.30.1

18. Test Same-VLAN Logic

At this stage, if each VLAN has only one host, there may be no peer host in the same VLAN.

The important point is:

CLIENT01
10.10.10.20

belongs to:

VLAN 10

and should only receive broadcasts from VLAN 10.

SERVER01 belongs to a different broadcast domain.

19. Test Cross-VLAN Connectivity Before Routing

From CLIENT01:

ping 10.10.20.30

Expected:

Failure

From ADMIN:

ping 10.10.20.30

Expected:

Failure

This is normal.

20. Explain Why the Ping Fails

CLIENT01 determines:

10.10.20.30
=
Remote Network

Therefore it sends traffic to:

10.10.10.1

But the gateway has not yet been configured.

Thus:

VLAN Segmentation
      ↓
Layer 3 Routing Required

21. Understand VLAN Separation

A switch does not normally forward Layer 2 broadcasts between VLANs.

Conceptually:

ARP Broadcast
from VLAN 10

      ↓

NETPLUS-SW01

      X

VLAN 20

This is why VLANs create separate broadcast domains.

22. Understand Trunk Ports

A trunk carries:

Multiple VLANs

over one physical or virtual link.

Conceptually:

VLAN 10 \
VLAN 20  \
VLAN 30   > 802.1Q Trunk
VLAN 40  /

23. Understand 802.1Q Tagging

802.1Q inserts VLAN information into Ethernet frames.

Conceptually:

Ethernet Header
      ↓
802.1Q VLAN Tag
      ↓
Payload

The VLAN tag tells trunk devices:

Which VLAN does this frame belong to?

24. Configure the Router Trunk Port on the Switch

Assume the router connects to:

Port 24

Configure:

interface <port24>
 switchport mode trunk
 no shutdown
exit

25. Limit Allowed VLANs

Where supported:

interface <port24>
 switchport trunk allowed vlan 10,20,30,40
exit

This means only these VLANs should traverse the trunk.

26. Verify the Trunk

Run:

show interfaces trunk

Verify:

Trunk Status:
Up

Allowed VLANs:
10,20,30,40

27. Understand Access vs Trunk Ports

Feature	Access	Trunk
Typical device	Endpoint	Switch/Router/AP
VLANs carried	Usually one	Multiple
802.1Q tagging	Usually hidden from endpoint	Yes
Common use	PC/server	Infrastructure link

28. Understand Native VLAN

On an 802.1Q trunk, the:

Native VLAN

is traditionally the VLAN whose frames may cross the trunk untagged, depending on platform configuration.

For this lab, keep the default unless the platform requires otherwise.

In production, ensure native VLAN configuration matches on both sides.

29. Understand Native VLAN Mismatch

If:

Switch Side:
Native VLAN 10

and:

Other Side:
Native VLAN 20

traffic can be placed into the wrong logical network.

This is a configuration error.

30. Introduce Router-on-a-Stick

You now need a Layer 3 device to route between:

VLAN 10

VLAN 20

VLAN 30

VLAN 40

One router physical interface can carry all VLANs using:

802.1Q Subinterfaces

This design is known as:

Router-on-a-Stick

31. Router-on-a-Stick Topology

                 NETPLUS-RTR01
                     |
             Physical Interface
                     |
        +------------+------------+
        |            |            |
   Subinterface   Subinterface  Subinterface
      .10            .20          .30
        |            |            |
     VLAN 10       VLAN 20      VLAN 30

32. Configure Router Physical Interface

Cisco-like example:

configure terminal

interface <router-interface>
 no shutdown
exit

Do not assign the VLAN gateway address directly to the parent physical interface in this router-on-a-stick design.

33. Configure VLAN 10 Router Subinterface

interface <router-interface>.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
exit

This becomes the default gateway for VLAN 10.

34. Configure VLAN 20 Router Subinterface

interface <router-interface>.20
 encapsulation dot1Q 20
 ip address 10.10.20.1 255.255.255.0
exit

35. Configure VLAN 30 Router Subinterface

interface <router-interface>.30
 encapsulation dot1Q 30
 ip address 10.10.30.1 255.255.255.0
exit

36. Configure VLAN 40 Router Subinterface

interface <router-interface>.40
 encapsulation dot1Q 40
 ip address 10.10.40.1 255.255.255.0
exit

37. Verify Router Interfaces

Run:

show ip interface brief

Expected:

<interface>.10
10.10.10.1

<interface>.20
10.10.20.1

<interface>.30
10.10.30.1

<interface>.40
10.10.40.1

All relevant interfaces should be:

up/up

38. Verify Directly Connected Routes

Run:

show ip route

You should see connected routes for:

10.10.10.0/24

10.10.20.0/24

10.10.30.0/24

10.10.40.0/24

39. Test Default Gateway from CLIENT01

Run:

ping 10.10.10.1

Expected:

Success

40. Test Default Gateway from SERVER01

Run:

ping -c 3 10.10.20.1

Expected:

Success

41. Test Default Gateway from ADMIN

Run:

ping -c 3 10.10.30.1

Expected:

Success

42. Test Inter-VLAN Connectivity

From CLIENT01:

ping 10.10.20.30

Expected:

Success

Then:

ping 10.10.30.10

Expected:

Success

provided no firewall blocks ICMP.

43. Test SERVER01 to ADMIN

On SERVER01:

ping -c 3 10.10.30.10

This validates:

VLAN 20
      ↓
Router
      ↓
VLAN 30

44. Understand the Inter-VLAN Packet Path

CLIENT01 wants to reach:

10.10.20.30

CLIENT01 belongs to:

10.10.10.0/24

It determines the destination is remote.

The sequence is:

CLIENT01
10.10.10.20
      ↓
Default Gateway
10.10.10.1
      ↓
Router
      ↓
10.10.20.1
      ↓
SERVER01
10.10.20.30

45. Understand the Layer 2 Path

CLIENT01 does not ARP for:

10.10.20.30

Instead it ARPs for:

10.10.10.1

The router then resolves:

10.10.20.30

inside VLAN 20.

46. Inspect CLIENT01 ARP Table

Run:

arp -a

You should see an entry for:

10.10.10.1

You should not normally see:

10.10.20.30

as a directly resolved local MAC because it belongs to a different subnet.

47. Inspect SERVER01 Neighbor Table

Run:

ip neigh

You should see:

10.10.20.1

as the router/gateway neighbor.

48. Understand MAC Rewriting Across Routers

For a routed packet:

Source IP:
10.10.10.20

Destination IP:
10.10.20.30

the IP addresses remain conceptually end-to-end.

But Ethernet MAC addresses change at each routed segment.

First segment:

Source MAC:
CLIENT01

Destination MAC:
Router VLAN 10 MAC

Second segment:

Source MAC:
Router VLAN 20 MAC

Destination MAC:
SERVER01

49. Capture Inter-VLAN Traffic

Start Wireshark on a suitable interface.

Generate:

CLIENT01 → SERVER01

traffic.

If using a mirrored trunk capture or simulator, inspect:

802.1Q

tagging.

50. Wireshark VLAN Filter

Use:

vlan

or:

eth.type == 0x8100

where applicable.

You may observe:

802.1Q Virtual LAN

inside the frame.

51. Identify VLAN ID in Wireshark

Expand:

802.1Q Virtual LAN

Record:

VLAN ID:

Priority:

EtherType:

Observe frames from:

VLAN 10

and:

VLAN 20

where your capture position allows it.

52. Understand Why Endpoint Captures May Not Show Tags

On an access port, the endpoint normally receives:

Untagged Ethernet Frame

The switch handles VLAN membership internally.

Therefore:

Endpoint Wireshark

may not display an 802.1Q tag.

To observe tags, capture on:

Trunk Link

or use:

SPAN / Port Mirror

or a simulator’s packet inspection mode.

53. Verify Switch MAC Table by VLAN

Run:

show mac address-table

You should see MAC entries associated with VLANs.

Example concept:

VLAN	MAC	Port
10	CLIENT MAC	Port 1
20	SERVER MAC	Port 2
30	ADMIN MAC	Port 3

This demonstrates that MAC learning occurs within VLAN context.

54. Understand Same MAC Table, Separate VLAN Context

Switch forwarding logic effectively evaluates:

VLAN
+
Destination MAC

A MAC entry belongs to a VLAN context.

This keeps Layer 2 forwarding separated between VLANs.

55. Verify VLAN Broadcast Isolation

Generate an ARP request in VLAN 10.

Conceptually:

ARP Broadcast
      ↓
VLAN 10

It should not appear as a Layer 2 broadcast in VLAN 20.

This confirms:

VLAN
=
Broadcast Domain

56. Troubleshooting Scenario 1 — Wrong Access VLAN

Move CLIENT01’s switch port accidentally to:

VLAN 20

while CLIENT01 still uses:

10.10.10.20/24

Test:

ping 10.10.10.1

Expected:

Failure

57. Investigate Wrong VLAN Membership

Check:

show vlan brief

You should discover:

CLIENT01 Port
=
VLAN 20

but:

CLIENT01 IP
=
VLAN 10 subnet

Root cause:

Layer 2 VLAN
and
Layer 3 Addressing
Do Not Match

58. Correct the Access VLAN

Restore:

switchport access vlan 10

Then verify:

show vlan brief

and:

ping 10.10.10.1

59. Troubleshooting Scenario 2 — Missing VLAN on Trunk

Remove VLAN 20 from the trunk’s allowed list.

Example:

switchport trunk allowed vlan 10,30,40

Now SERVER01 may lose communication with the router.

Test:

ping -c 3 10.10.20.1

60. Investigate the Trunk

Run:

show interfaces trunk

You should discover:

VLAN 20
Not Allowed

Root cause:

Access Port Correct
+
Host IP Correct
+
Trunk Does Not Carry VLAN

61. Restore VLAN 20 to Trunk

Configure:

switchport trunk allowed vlan 10,20,30,40

Verify:

show interfaces trunk

Then retest connectivity.

62. Troubleshooting Scenario 3 — Trunk Configured as Access

Change the router-facing switch port into access mode temporarily.

Expected effect:

Multiple VLANs
      ↓
Cannot Traverse Link Correctly

Investigate:

show interfaces switchport

or equivalent.

Restore trunk mode afterward.

63. Troubleshooting Scenario 4 — Wrong Router VLAN Tag

Suppose router subinterface:

<interface>.20

is mistakenly configured:

encapsulation dot1Q 30

instead of:

SERVER01 will be unable to communicate correctly with its gateway.

Investigate:

show running-config interface <interface>.20

64. Correct the Router Tag

Configure the subinterface with:

encapsulation dot1Q 20

Verify again.

65. Troubleshooting Scenario 5 — Wrong Default Gateway

Configure SERVER01 temporarily:

IP:
10.10.20.30/24

Gateway:
10.10.10.1

This gateway is outside SERVER01’s local subnet.

Test:

ping 10.10.10.20

Expected:

Failure

66. Correct the Default Gateway

Restore:

10.10.20.1

Then:

ping -c 3 10.10.10.20

67. Troubleshooting Scenario 6 — Wrong Host IP

Suppose ADMIN is:

VLAN 30

but configured:

10.10.20.10/24

It now uses an address from the server subnet while physically/logically attached to VLAN 30.

Symptoms:

Gateway Failure

ARP Problems

No Routed Connectivity

Correct:

10.10.30.10/24

68. Troubleshooting Scenario 7 — Native VLAN Mismatch

Conceptually configure inconsistent native VLAN values on each end of a trunk.

Observe any switch warning generated by your platform.

Root cause:

Trunk Ends
Disagree About Untagged Traffic

Restore matching native VLAN configuration.

69. Troubleshooting Scenario 8 — VLAN Does Not Exist

Assign an access port to a VLAN that has not been created or activated, depending on platform behavior.

Observe:

Port VLAN Assignment

VLAN State

Connectivity

Correct by creating and enabling the required VLAN.

70. Build the VLAN Troubleshooting Workflow

Use:

Host Interface Up?
      ↓
Correct IP Address?
      ↓
Correct Prefix?
      ↓
Correct Default Gateway?
      ↓
Switch Port Up?
      ↓
Correct Access VLAN?
      ↓
VLAN Exists?
      ↓
MAC Learned in Correct VLAN?
      ↓
Trunk Up?
      ↓
Required VLAN Allowed?
      ↓
802.1Q Tag Correct?
      ↓
Router Subinterface Up?
      ↓
Gateway Address Correct?
      ↓
Routing Table Correct?

71. Understand Layer 3 Switches

Instead of router-on-a-stick, enterprise switches may perform routing directly using:

Switch Virtual Interfaces

or:

SVIs

Conceptually:

VLAN 10
   ↓
SVI 10
10.10.10.1

VLAN 20
   ↓
SVI 20
10.10.20.1

The Layer 3 switch then routes between VLANs.

72. Router-on-a-Stick vs Layer 3 Switch

Feature	Router-on-a-Stick	Layer 3 Switch
VLAN routing	Router subinterfaces	SVIs
Trunk required	Yes	Often internal switching/routing
Performance	Limited by router link	Usually higher
Good for lab/small network	Yes	Yes
Common enterprise use	Smaller designs	Large campus networks

73. Understand VLAN Security Value

VLANs help provide:

Segmentation

but VLANs alone are not complete security controls.

To control communication between VLANs, organizations commonly use:

ACLs

Firewalls

Routing Policies

Zero Trust Controls

Without filtering, inter-VLAN routing may allow broad communication.

74. Build the Final Logical Topology

                     NETPLUS-RTR01
                         |
                    802.1Q Trunk
                         |
                     NETPLUS-SW01
        +----------------+----------------+
        |                |                |
        |                |                |
      VLAN 10          VLAN 20          VLAN 30
       USERS            SERVERS        MANAGEMENT
        |                |                |
     CLIENT01         SERVER01           ADMIN
   10.10.10.20      10.10.20.30      10.10.30.10
        |                |                |
   GW 10.10.10.1    GW 10.10.20.1    GW 10.10.30.1

75. Mission Challenge — Verify VLAN Membership

Document:

VLAN 10:
Ports:

VLAN 20:
Ports:

VLAN 30:
Ports:

VLAN 40:
Ports:

76. Mission Challenge — Verify the Trunk

Document:

Trunk Interface:

Mode:

Allowed VLANs:

Active VLANs:

Native VLAN:

Status:

77. Mission Challenge — Verify Inter-VLAN Routing

Complete:

Source	Destination	Expected
CLIENT01	10.10.10.1	Pass
SERVER01	10.10.20.1	Pass
ADMIN	10.10.30.1	Pass
CLIENT01	SERVER01	Pass
CLIENT01	ADMIN	Pass
SERVER01	ADMIN	Pass

78. Mission Challenge — Trace a Packet

Explain the packet journey:

CLIENT01
10.10.10.20

to:

SERVER01
10.10.20.30

Your answer should include:

Destination is remote
      ↓
CLIENT01 ARPs for 10.10.10.1
      ↓
Frame sent to router MAC
      ↓
Switch associates frame with VLAN 10
      ↓
802.1Q trunk carries VLAN 10
      ↓
Router receives on VLAN 10 subinterface
      ↓
Router checks routing table
      ↓
Routes toward VLAN 20
      ↓
Router resolves SERVER01 MAC
      ↓
Frame returns over trunk tagged for VLAN 20
      ↓
Switch forwards to SERVER01 access port
      ↓
SERVER01 receives packet

79. Mission Challenge — Diagnose the Fault

The network reports:

CLIENT01 can reach 10.10.10.1

SERVER01 can reach 10.10.20.1

CLIENT01 cannot reach SERVER01

Investigate:

Router Routes

Host Firewalls

Inter-VLAN Policy

IP Addressing

Since both hosts can reach their gateways, access-port and trunk basics are probably working.

80. Create the Lab Workspace

On NETPLUS-ADMIN:

mkdir -p ~/NetworkPlus-Labs/LAB07/{Captures,Screenshots,Configs,Notes}

Create:

touch ~/NetworkPlus-Labs/LAB07/Notes/lab07-notes.md

81. Save Switch Configuration Evidence

Capture outputs such as:

show vlan brief

show interfaces trunk

show interfaces status

show mac address-table

Store under:

~/NetworkPlus-Labs/LAB07/Configs/

82. Save Router Configuration Evidence

Capture:

show ip interface brief

show ip route

show running-config

Store relevant outputs safely.

83. Save Packet Captures

Where your lab platform supports trunk capture, save:

LAB07-VLAN10.pcapng

LAB07-VLAN20.pcapng

LAB07-8021Q-TRUNK.pcapng

LAB07-INTERVLAN.pcapng

84. Document Your Findings

Use:

# LAB07 — VLAN Configuration and Inter-VLAN Connectivity

## VLAN Design

### VLAN 10 — Users

Network:
10.10.10.0/24

Gateway:
10.10.10.1

Ports:

### VLAN 20 — Servers

Network:
10.10.20.0/24

Gateway:
10.10.20.1

Ports:

### VLAN 30 — Management

Network:
10.10.30.0/24

Gateway:
10.10.30.1

Ports:

### VLAN 40 — Guest

Network:
10.10.40.0/24

Gateway:
10.10.40.1

Ports:

## Host Configuration

### CLIENT01

IP:
Gateway:
VLAN:

### SERVER01

IP:
Gateway:
VLAN:

### ADMIN

IP:
Gateway:
VLAN:

## Trunk

Interface:

Allowed VLANs:

Native VLAN:

Status:

## Router Subinterfaces

VLAN 10:

VLAN 20:

VLAN 30:

VLAN 40:

## Same-VLAN Testing

Document findings.

## Inter-VLAN Testing

CLIENT → SERVER:

CLIENT → ADMIN:

SERVER → ADMIN:

## ARP Analysis

CLIENT Gateway MAC:

SERVER Gateway MAC:

## 802.1Q Capture

Observed VLAN IDs:

## Troubleshooting

### Wrong Access VLAN

Problem:

Root Cause:

Fix:

### Missing VLAN on Trunk

Problem:

Root Cause:

Fix:

### Wrong Default Gateway

Problem:

Root Cause:

Fix:

## Final Assessment

Summarize how VLAN segmentation and inter-VLAN routing were implemented.

85. Evidence to Capture

Capture:

01-vlan-topology.png

02-vlan-database.png

03-vlan10-access-port.png

04-vlan20-access-port.png

05-vlan30-access-port.png

06-host-ip-configurations.png

07-cross-vlan-failure-before-routing.png

08-trunk-configuration.png

09-trunk-verification.png

10-router-subinterfaces.png

11-router-interface-status.png

12-router-connected-routes.png

13-client-gateway-ping.png

14-server-gateway-ping.png

15-admin-gateway-ping.png

16-inter-vlan-client-server.png

17-inter-vlan-client-admin.png

18-mac-table-by-vlan.png

19-arp-gateway-entry.png

20-8021q-tag.png

21-wrong-access-vlan.png

22-missing-trunk-vlan.png

23-wrong-default-gateway.png

24-restored-connectivity.png

25-final-vlan-topology.png

86. Validation Checklist

VLAN Configuration

VLAN 10 created
VLAN 20 created
VLAN 30 created
VLAN 40 created
VLAN names assigned
VLAN database verified

Access Ports

CLIENT01 assigned to VLAN 10
SERVER01 assigned to VLAN 20
ADMIN assigned to VLAN 30
Access mode verified
Port status verified

Addressing

CLIENT01 configured in 10.10.10.0/24
SERVER01 configured in 10.10.20.0/24
ADMIN configured in 10.10.30.0/24
Correct default gateways configured

VLAN Isolation

Cross-VLAN failure observed before routing
Broadcast-domain separation understood
ARP isolation between VLANs understood

Trunking

Router-facing port configured as trunk
VLANs 10,20,30,40 allowed
Trunk status verified
802.1Q tagging understood
Native VLAN concept understood
Native VLAN mismatch understood

Inter-VLAN Routing

Router physical interface enabled
VLAN 10 subinterface configured
VLAN 20 subinterface configured
VLAN 30 subinterface configured
VLAN 40 subinterface configured
Connected routes verified
All default gateways reachable
Inter-VLAN connectivity verified

Packet Analysis

Gateway ARP entries reviewed
VLAN-aware MAC table reviewed
802.1Q frame observed where supported
VLAN ID identified
Routed MAC-address changes understood

Troubleshooting

Wrong access VLAN scenario completed
Missing VLAN on trunk scenario completed
Trunk-as-access problem understood
Incorrect router VLAN tag investigated
Wrong default gateway investigated
Wrong host subnet investigated
Native VLAN mismatch understood
VLAN existence checked

Documentation

VLAN addressing plan documented
Port map documented
Trunk configuration documented
Router subinterfaces documented
Connectivity matrix completed
Screenshots captured
Lab notes completed

87. Mission Review

In this mission, you transformed:

One Switch
      ↓
One Broadcast Domain

into:

One Physical Switch
      ↓
Multiple VLANs
      ↓
Multiple Broadcast Domains

The Layer 2 design became:

VLAN 10 — Users

VLAN 20 — Servers

VLAN 30 — Management

VLAN 40 — Guest

You then connected those Layer 2 networks using:

802.1Q Trunk
      ↓
Router Subinterfaces
      ↓
Layer 3 Routing

The complete communication flow is:

Endpoint
   ↓
Access VLAN
   ↓
Switch
   ↓
802.1Q Trunk
   ↓
Router
   ↓
Routing Decision
   ↓
802.1Q Trunk
   ↓
Destination VLAN
   ↓
Destination Endpoint

The key lesson is:

VLANs create logical Layer 2 boundaries, while inter-VLAN routing provides Layer 3 connectivity between those boundaries. A working design requires the VLAN assignment, IP subnet, trunk configuration, and default gateway to agree with one another.

Skills Developed

After completing this mission, you should be able to:

explain VLAN segmentation
create VLANs
configure access ports
assign switch ports to VLANs
understand VLAN broadcast domains
explain 802.1Q tagging
configure and verify trunk ports
understand allowed VLAN lists
understand native VLANs
explain router-on-a-stick
configure router subinterfaces
assign VLAN default gateways
verify inter-VLAN routing
inspect VLAN-aware MAC tables
analyze gateway ARP behavior
explain MAC rewriting across routed networks
identify tagged frames in Wireshark
troubleshoot wrong VLAN assignments
troubleshoot trunk failures
troubleshoot incorrect VLAN tags
troubleshoot incorrect default gateways
understand Layer 3 switch alternatives

What’s Next?

Lab 08 — Spanning Tree and Layer 2 Redundancy

Your network now contains multiple VLANs and trunk links.

The next challenge is redundancy.

Adding multiple switch links improves resilience, but it can also create dangerous Layer 2 loops.

In the next mission, you will investigate:

redundant switch links
Layer 2 loops
broadcast storms
MAC-table instability
Spanning Tree Protocol
root bridge selection
bridge IDs
root ports
designated ports
alternate/blocked paths
STP path cost
topology changes
link failure
reconvergence
Rapid Spanning Tree concepts
STP troubleshooting

The progression becomes:

Single Switch
      ↓
VLANs
      ↓
Multiple Switches
      ↓
Redundant Links
      ↓
Layer 2 Loop Risk
      ↓
Spanning Tree
      ↓
Loop-Free Redundancy

➡️ Next: Lab 08 — Spanning Tree and Layer 2 Redundancy