Layer 2 Access Hardening: PortFast, BPDU Guard & Sticky MAC

Archive lab

Hands-on CCNA Layer 2 switching lab: build VLANs, access ports, hardened 802.1Q trunks, and basic port-security across two access switches and an L2 core. Verify segmentation end-to-end from real hosts and practice troubleshooting native-VLAN and port/VLAN mismatches.

Learning objectives

• Create and name VLANs for Users, Servers, Management, and a secure native VLAN.
• Assign switchports to access VLANs and enable PortFast, BPDU Guard, and sticky port security.
• Build 802.1Q trunks with explicit allowed-vlan lists and a non-default native VLAN.
• Verify VLAN membership and trunk status and observe MAC learning behavior.
• Troubleshoot VLAN misassignments and trunk/native VLAN mismatches using symptoms from end hosts.

Troubleshooting focus

• Pings between PC-USER01 and SRV-APP01 unexpectedly succeed: both ports may sit in the same VLAN, or the trunk carries only one VLAN and both hosts landed there. Check access port VLANs with show vlan brief and the allow-lists with show interfaces trunk.
• The VLAN 99 SVI is down/down on a switch: confirm VLAN 99 exists and is allowed on the trunks, and that at least one trunk carrying VLAN 99 is up — an SVI needs an active member port in that VLAN.
• Native VLAN mismatch messages appear on the console: confirm all trunk ends use native VLAN 999. A mismatch can cause untagged traffic to be misdelivered or blackholed.
• A host port flaps or goes err-disabled: port-security or BPDU Guard has triggered. Investigate with show port-security interface <interface> and show errdisable recovery, then clear by shutting/no shutting the interface once the cause is fixed.
• The port-security check fails even though every port-security line is present: show port-security interface <interface> must report Port Security: Enabled. An interface accepts the options (violation mode, sticky learning, maximum addresses) while the feature itself is switched off.