Goldfish Networks wordmark
IntermediatePublished 2026-06-25

Hardened Trunks & ROAS: Allowed VLAN Lists, Native VLAN 999

Archive lab

Implement VLANs, 802.1Q trunking, router-on-a-stick inter-VLAN routing, and access-layer port security on a compact branch network with two access switches and two endpoints. You will configure segmentation (VLANs 10, 20, 99), hardened trunks with a dedicated native VLAN 999, Layer 3 gateways on a core router, and sticky MAC port security on user-facing ports. Verify end-to-end reachability and remediate common misconfigurations like missing allowed VLANs, native VLAN mismatches, and unauthorized endpoint moves.

Track
Est. time
68 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Create VLANs and assign switch access ports to the correct VLANs
  • Build hardened 802.1Q trunks that explicitly allow VLANs 10, 20, and 99 with native VLAN 999
  • Implement inter-VLAN routing via router-on-a-stick subinterfaces on the core router
  • Enable and verify sticky MAC port security on access ports with a single allowed device
  • Detect and correct Layer 2 errors including wrong VLAN assignment, missing allowed VLANs on trunks, and native VLAN mismatches
  • Validate end-to-end host reachability and default gateway behavior from the endpoints

Troubleshooting focus

  • PC-ENG01 cannot reach its gateway 10.10.10.1 and the ARP entry stays incomplete: the access port is in the wrong VLAN. Put SW-BR-ACC1 e0/2 in VLAN 10, then re-test the ping to the gateway.
  • One VLAN fails across the switches while the others work: that VLAN is missing from a trunk allow-list. Add it on both ends and confirm native VLAN 999 matches on both sides.
  • CDP/LLDP reports a native VLAN mismatch, or untagged traffic lands where you did not expect: align both trunk ends to native VLAN 999. Do not leave VLAN 1 in use anywhere.
  • show port-security shows rising violation counters or a port in err-disabled: confirm the intended host's MAC is the one on the port, clear or adjust the sticky address, and re-enable the interface if it was shut down.
  • On-subnet pings succeed but PC-ENG01 cannot reach 10.10.20.10: the host's default gateway is wrong. Correct it to the.1 address of the host's own VLAN.
  • show port-security interface <interface> reads Port Security: Disabled while sticky, maximum and violation lines are all present: the interface is missing the bare command that switches the feature on. A grading check for it fails until you add it.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.