Compact Branch LAN: Two VLANs, ROAS & Sticky Port Security

Archive lab

Configure a compact branch LAN with router-on-a-stick inter-VLAN routing, two access switches, and two user VLANs. Implement VLANs, 802.1Q trunks with a hardened native VLAN, secure user-facing ports with port-security, and verify end-to-end reachability from the hosts. Includes realistic troubleshooting of VLAN assignment, trunk allow-lists, and port-security violations.

Learning objectives

• Create and name VLANs and map them to IP subnets in a branch LAN
• Configure access and trunk ports, including native VLAN hardening and allowed VLAN lists
• Implement sticky MAC port-security on user-facing access ports with proper violation handling
• Verify and troubleshoot VLAN, trunk, and port-security issues from end hosts

Troubleshooting focus

• A host cannot reach its gateway: Check the access port VLAN on the connected switchport. A VLAN mismatch (e.g. Users PC on VLAN 20) isolates the host.; Verify the trunk allow-list includes the host's VLAN end-to-end.
• Verify the trunk native VLAN matches across router and switch, and that VLAN 1 is pruned.
• A secured access port shuts down: show port-security interface confirms the violation. Clear it with shut/no shut, and remove the sticky MAC if you intentionally moved devices.; Ensure only one device/MAC is present behind each secured port.
• The management SVI stays down: ensure VLAN 100 is created and allowed on all trunks. The SVI stays down until the VLAN is active on the switch.
• show port-security interface <interface> reports Port Security: Disabled although the options are all configured: An interface accepts violation mode, sticky learning and maximum addresses even when port security itself is off, so a port reads as configured while it is not protected.; Add the command that turns the feature on; the grading check fails without Port Security: Enabled.