Goldfish Networks wordmark
IntermediatePublished 2026-06-30

Selective Inter-VLAN Reachability: Guest Isolation

Bundle lab

Build a router-on-a-stick design with three VLANs (SALES, HR, GUEST) on a single router and single access switch, then enforce guest isolation using a single extended ACL applied inbound on the Guest subinterface. SALES and HR can reach each other; GUEST can reach only its default gateway and is blocked from internal subnets. The lab focuses on correct 802.1Q tagging, trunking, access port assignments, ACL placement/order, and end-host verification.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Configure ROAS: create one 802.1Q subinterface per VLAN with the correct tags and gateway IPs.
  • Build the Layer-2 side: declare VLANs, assign access ports, and trunk the router uplink to carry routed VLANs.
  • Implement selective inter-VLAN policy: apply a single extended ACL inbound on the Guest subinterface to block access to internal VLANs.
  • Verify end-to-end from hosts: confirm Sales<->HR reachability and Guest isolation using ping/traceroute and IOS show commands.
  • Troubleshoot common ROAS pitfalls: VLAN/tag mismatches, missing VLANs, trunk allowed-list gaps, wrong ACL direction, and missing final permit.

Troubleshooting focus

  • Wrong 802.1Q tag on a subinterface (must match the VLAN ID).
  • Missing VLAN in the switch database or not allowed on the trunk.
  • Router Ethernet0/0 shutdown or mis-cabled trunk.
  • Access ports assigned to the wrong VLAN.
  • ACL applied to the wrong subinterface or in the wrong direction.
  • ACL missing final permit any any, black-holing Guest traffic including gateway reachability.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.