Goldfish Networks wordmark
IntermediatePublished 2026-06-25

Trunk Allowed-VLAN Pruning Across L2 Switches

Bundle lab

Configure VLANs and access ports on two Layer-2 switches, build 802.1Q trunks (with hardened native VLAN and an explicit allowed list), validate end-to-end reachability, intentionally prune a VLAN from the inter-switch trunk to observe segmentation, then restore the correct allow-list. Includes realistic router-on-a-stick gateways for VLAN 10/20/99 and switch management on VLAN 99.

Track
Est. time
55 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Configure and verify VLANs and access ports on Layer-2 switches
  • Implement and verify 802.1Q trunks between switches
  • Control trunked VLANs using 'switchport trunk allowed vlan' and a hardened native VLAN
  • Detect and resolve connectivity loss caused by trunk allow-list misconfiguration
  • Validate intra-VLAN and inter-VLAN reachability with host tests
  • Use show interfaces trunk, VLAN/SVI verification, and host pings for troubleshooting

Troubleshooting focus

  • PC-ENG20 cannot reach its gateway 10.20.20.1: the allowed lists on the inter-switch trunk disagree. A VLAN pruned on one side only is effectively blocked — compare allowed and active VLANs on both ends with show interfaces trunk.
  • Native VLAN mismatch warnings and other L2 oddities: standardize both ends on VLAN 999 and keep VLAN 1 off the trunks.
  • A VLAN is on the allowed list but still does not forward: it was never created on that switch. Verify with show vlan brief.
  • A switch's VLAN 99 SVI is down: an SVI needs an active port or trunk in that VLAN. Confirm VLAN 99 is present and allowed across the trunks.
  • If one side is left dynamic, the trunk may not form.
  • A host fails every reachability test while the switch side looks correct: confirm the host's IP, mask and default gateway — 10.10.10.1 for PC-USER10, 10.20.20.1 for PC-ENG20.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.