Goldfish Networks wordmark
BeginnerPublished 2026-06-21

Campus Layer 2: VLANs, a Management VLAN & Port Security

Archive lab

Build and harden a small branch campus Layer 2 network with a distribution switch and two access switches. Implement VLANs, trunking, and basic port security, then verify from the end hosts and troubleshoot common L2 mistakes.

Track
Est. time
75 minutes
Difficulty
Beginner
Topics

Learning objectives

  • Create and name multiple VLANs and a dedicated management VLAN
  • Assign access ports to the correct VLANs for each host
  • Configure 802.1Q trunks with explicit allowed VLAN lists and a hardened native VLAN
  • Implement basic port security with sticky MAC on access ports
  • Verify VLAN and port-security operation from hosts and switches
  • Troubleshoot incorrect VLAN assignments, trunk mismatches, and port-security violations

Troubleshooting focus

  • PC-STAFF-01 cannot ping 10.10.10.1, or PC-SALES-01 cannot ping 10.20.20.1: check the access port VLAN with show interfaces switchport e0/1 on ACC1 and ACC2, then the host IP, mask and gateway. Wrong VLAN or wrong host addressing is the usual cause.
  • An SVI on DIST is down/down, or no host reaches its gateway: suspect a trunk mismatch. Run show interfaces trunk on both ends and confirm identical allowed VLAN lists (10,20,99) and the same native VLAN 999.
  • An edge port is err-disabled: it hit a port-security violation. Investigate with show port-security and show interface status, fix the cause, then shutdown/no shutdown the port; clear the sticky entries if the wrong MAC was learned.
  • A VLAN shows inactive on a trunk: it does not exist on that switch. Create it locally — trunks only forward VLANs that exist on both ends.
  • Untagged traffic behaves unexpectedly on a trunk: the native VLAN is leaking. Keep native VLAN 999 on both ends, never VLAN 1, and assign no access ports to 999.
  • IOS accepts the options with the feature off, and the grading check fails.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.