Goldfish Networks wordmark
AdvancedPublished 2026-06-27

Branch Layer 2 Capstone: Build, Verify & Fix VLANs and Trunks

Archive lab

Advanced Layer-2 capstone, run as a fault hunt. A branch was cut over last night: one user VLAN has no gateway, another user sits in the wrong subnet, the management VLAN is unreachable from the distribution switch, and a port that should lock to one MAC no longer does. Nothing was recorded. You get symptoms and the required end state — no fault list. Faults span the router and both switches, and more than one of them presents as 'the trunk is broken'.

Track
Est. time
75 minutes
Difficulty
Advanced
Topics

Learning objectives

  • Diagnose a multi-VLAN branch failure from operational state alone, with no list of what was changed
  • Separate a native-VLAN mismatch from a pruned allowed-list — both break traffic across an up trunk
  • Trace a missing gateway to a router-on-a-stick subinterface tagged with the wrong VLAN
  • Verify that a security control still enforces what it claims after a change window
  • Repair faults across a router and two switches rather than assuming one device is at fault

Troubleshooting focus

  • Same-VLAN hosts cannot ping: check access VLAN assignment and VLAN existence on both switches
  • No inter-VLAN routing: verify router subinterfaces, 802.1Q encapsulation, and allowed VLANs on trunks
  • Port security err-disable: clear the violation, confirm sticky MAC and maximum values, and re-enable the port
  • Native VLAN mismatch: ensure the same native VLAN on both ends of every trunk and prune VLAN 1

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.