Goldfish Networks wordmark
AdvancedPublished 2026-06-25

Multi-VLAN Segmentation: 3 VLANs & Trunk Alignment

Bundle lab

Hands-on CCNA campus switching lab with two Layer-2 switches and three VLANs (Users 10, Servers 20, Management 99) extended over a single 802.1Q trunk. Learners deploy VLANs and access ports, harden the trunk (native VLAN 999, explicit allow-list, nonegotiate), and validate isolation. The lab ships with a trunk-carried outage: VLAN 10 traffic reaches its gateway successfully, but VLAN 20 traffic does not. You will diagnose from end hosts, confirm switch states, and correct the trunk so that same-VLAN traffic to the gateway SVI succeeds while inter-VLAN forwarding remains absent.

Track
Est. time
75 minutes
Difficulty
Advanced
Topics

Learning objectives

  • Design a three-VLAN segmentation (Users 10, Servers 20, Management 99) across two Layer-2 switches.
  • Configure access ports and correctly place one host in each VLAN.
  • Build and harden an 802.1Q trunk with an explicit allow-list and non-default native VLAN 999.
  • Detect and resolve outages caused by incomplete trunk allow-lists and native VLAN mismatches.
  • Verify VLAN isolation (no inter-VLAN forwarding) and end-to-end same-VLAN reachability to the gateway SVI.

Troubleshooting focus

  • ping 10.20.20.1 from SRV20 fails while CLIENT10's ping 10.10.10.1 succeeds: one VLAN crossing the trunk and another not is a per-VLAN allow-list omission, not cabling.
  • The trunk reports a native VLAN mismatch: the two ends disagree. On its own it does not break VLAN 20, whose frames are tagged, but it leaves the trunk unhardened.
  • A host cannot reach its own gateway at all: confirm its access interface is up/up and assigned to the intended VLAN, and that VLANs 10, 20, 99 and 999 exist on both switches.
  • ping 10.20.20.10 from CLIENT10 fails: that is the designed behaviour. Inter-VLAN routing is intentionally absent — do not chase Layer-3 that this lab never configures.
  • show port-security interface <interface> reports Port Security: Disabled though the sticky, violation and maximum lines are present: the interface accepts those options with the feature off.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.