Selective Inter-VLAN Reachability: Guest Isolation

Bundle lab · $29.99

Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.

Learning objectives

• Configure ROAS: create one 802.1Q subinterface per VLAN with the correct tags and gateway IPs.
• Build the Layer-2 side: declare VLANs, assign access ports, and trunk the router uplink to carry routed VLANs.
• Implement selective inter-VLAN policy: apply a single extended ACL inbound on the Guest subinterface to block access to internal VLANs.
• Verify end-to-end from hosts: confirm Sales<->HR reachability and Guest isolation using ping/traceroute and IOS show commands.
• Troubleshoot common ROAS pitfalls: VLAN/tag mismatches, missing VLANs, trunk allowed-list gaps, wrong ACL direction, and missing final permit.

Troubleshooting focus

• Wrong 802.1Q tag on a subinterface (must match the VLAN ID).
• Missing VLAN in the switch database or not allowed on the trunk.
• Router Ethernet0/0 shutdown or mis-cabled trunk.
• Access ports assigned to the wrong VLAN.
• ACL applied to the wrong subinterface or in the wrong direction.
• ACL missing final permit any any, black-holing Guest traffic including gateway reachability.