Troubleshoot a Branch ROAS: VLANs, Trunks & Port Security

Archive lab

Deploy and troubleshoot VLANs, 802.1Q trunks, and port security in a realistic small-branch ROAS design. You will stand up VLANs 10/20/99 with a hardened trunk native VLAN 999, configure sticky port security on access ports, correct a misassigned VLAN, and resolve an err-disabled port caused by a port security violation. Finish by verifying end-to-end host connectivity across VLANs.

Learning objectives

• Create and verify VLANs on Cisco Layer 2 switches and assign access ports
• Configure secure 802.1Q trunks with an explicit allowed VLAN list and a hardened native VLAN
• Implement and verify port security (sticky MAC, max MAC count, violation actions) on access ports
• Detect and remediate common Layer 2 issues including misassigned VLANs and port security errdisable
• Verify inter-VLAN connectivity using router-on-a-stick gateways and host-based testing

Troubleshooting focus

• A host cannot reach its gateway: Confirm its access port is in the correct VLAN and not err-disabled.; Ensure the trunks allow that VLAN end-to-end back to RTR-BR-EDGE.
• A port shows err-disabled: run show port-security interface <port> to see the violation. Remove incorrect static MACs, then shutdown / no shutdown. Keep maximum at 1 and use sticky so the real MAC is relearned.
• Check for trunk allow-list mismatches or native VLAN mismatch warnings.
• A VLAN 99 SVI stays down: VLAN 99 must exist and be permitted on the trunks, and at least one interface in VLAN 99 must be up before the SVI comes up on an L2 switch.
• show port-security interface <interface> reports Port Security: Disabled while violation mode, sticky and maximum all appear in the config: an interface accepts those options with the feature off.