Goldfish Networks wordmark
IntermediatePublished 2026-06-25

CCNA: VLAN DB & Trunk Allow-List Drift Recovery

Bundle lab

Hands-on CCNA VLAN lab: build VLANs with names, assign access ports, harden and verify 802.1Q trunks, and troubleshoot a broken allow-list that prevents a VLAN from traversing the SW1–SW2 trunk. Includes router-on-a-stick gateways, management VLAN, and end-host validation.

Track
Est. time
65 minutes
Difficulty
Intermediate
Topics

Learning objectives

  • Create VLANs and assign descriptive names in the VLAN database.
  • Validate default VLAN 1 and the normal VLAN ID range on IOS switches.
  • Assign switch access ports to user-defined VLANs.
  • Configure and verify 802.1Q trunks with explicit allowed VLAN lists and a hardened native VLAN.
  • Inspect VLAN database and confirm interface membership and tagging.
  • Troubleshoot a connectivity outage caused by a missing allowed VLAN on a trunk.
  • Demonstrate how adding/removing VLANs affects port membership and the vlan.dat database state.

Troubleshooting focus

  • CLIENT20 reaches peers on its own switch but not its gateway 10.20.20.1: allow-list drift. show interfaces trunk on the SW-AC1 to SW-AC2 link will be missing VLAN 20 on one or both ends.
  • CDP/LLDP reports a native VLAN mismatch, or untagged traffic lands in the wrong VLAN: both ends of the trunk must use native VLAN 999. A mismatch makes control-plane frames behave erratically.
  • A host's ARP for its gateway never resolves: it is likely in the wrong access VLAN, leaving its IP and gateway on different segments. Confirm the port with show vlan brief and show interfaces switchport.
  • A subinterface on RTR-BR-EDGE reads down/down: the VLAN is absent on the switch or the trunk does not allow it. Check show vlan brief and show interfaces trunk.
  • The SW-AC1 to RTR-BR-EDGE link never comes up as a trunk: routers do not speak DTP. Hard-set trunking on that switch port with negotiation turned off.
  • Traffic for one VLAN never reaches its gateway while others do: each router subinterface must declare the VLAN tag it expects, and the matching switch ports must actually be trunking.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.