VLANs for Two Departments: Trunking & Sticky MAC Security

Archive lab

Hands-on CCNA lab: build VLANs for Sales and Engineering, implement 802.1Q trunks with a hardened native VLAN, assign access ports, and apply sticky MAC port-security on access interfaces. The design uses a compact, realistic branch topology with a router-on-a-stick gateway, a distribution L2 switch, one access L2 switch, and two end hosts. Students deploy, verify, and troubleshoot VLAN reachability, trunk integrity, and port-security violations.

Learning objectives

• Configure and verify VLANs and switchport modes on Cisco switches
• Implement and test IEEE 802.1Q trunks with an explicit allowed VLAN list and a secured native VLAN
• Assign access ports to VLANs and connect endpoint devices
• Configure, verify, and troubleshoot basic sticky MAC port-security on access ports

Troubleshooting focus

• CLIENT-SALES01 pings its gateway 10.10.10.1 but not 10.20.20.10: check the access port VLANs on SW-SITE-ACC1, that trunks allow VLANs 10 and 20, and that RTR-SITE-ROAS has Ethernet0/0.10 and Ethernet0/0.20.
• The console logs a native VLAN mismatch, or traffic is intermittent: confirm every trunk uses native VLAN 999 on both ends and that VLAN 1 is pruned from the allowed lists. show interfaces trunk shows both.
• A user port went err-disabled: port-security caught a violation. Shut and no-shut the interface to clear it, and clear the sticky learned MAC if the host's MAC changed. Confirm with show port-security interface.
• 10.100.100.2 and 10.100.100.3 are unreachable: verify VLAN 100 is on the trunks, RTR-SITE-ROAS has Ethernet0/0.100, and both switches have ip default-gateway set to 10.100.100.1.
• show port-security interface <interface> reports Port Security: Disabled although the violation, sticky and maximum lines are all present: the interface accepts those options with the feature switched off.; The graded check needs Port Security: Enabled, and it fails while the report reads Disabled.