Goldfish Networks wordmark
IntermediatePublished 2026-06-30

Scaling to Three VLANs: Adding a Department

Bundle lab

Extend a working two-VLAN router-on-a-stick design to a third VLAN (Guest) without breaking Sales and Engineering. Add one router subinterface, one switch VLAN + access port, and update the switch trunk’s allowed-VLAN list safely using 'add' so existing VLANs remain transported.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Extend an existing router-on-a-stick configuration to support an additional VLAN
  • Create VLANs on a Layer-2 switch and place host access ports into the correct VLANs
  • Safely extend an 802.1Q trunk's allowed-VLAN list by appending the new VLAN rather than replacing the entire list
  • Validate end-to-end inter-VLAN connectivity from hosts and with IOS show commands
  • Recognize and correct common change-related faults: missing VLAN, trunk allow-list omissions

Troubleshooting focus

  • VLAN 30 exists but PC-GUEST traffic still fails: show interfaces trunk on SW-ACC1 must list 30 as allowed and active.
  • show vlan brief does not show Ethernet0/3 under VLAN 30: configure that port as an access port, place it in VLAN 30, and make sure it is enabled.
  • PC-SALES or PC-ENG stopped working after the change: the allowed-VLAN list was replaced, not appended. Confirm the trunk still carries 10 and 20 and their subinterfaces are unchanged.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.