Goldfish Networks wordmark
BeginnerPublished 2026-06-25

VLAN Segmentation: Broadcast-Domain Isolation

Bundle lab

Build VLANs across two access switches with an 802.1Q trunk and a router uplink. Verify that hosts in the same VLAN can communicate (even across switches) while hosts in different VLANs cannot. Then troubleshoot a failure caused by a trunk allow-list misconfiguration.

Track
Est. time
55 minutes
Difficulty
Beginner
Topics

Learning objectives

  • Create VLANs to segment a Layer-2 network into separate broadcast domains.
  • Assign access ports to the correct VLANs and harden them with edge features.
  • Configure 802.1Q trunks, native VLANs, and explicit allow-lists between switches and to a router-on-a-stick uplink.
  • Verify intra-VLAN reachability across switches and demonstrate inter-VLAN isolation without routing.
  • Troubleshoot cross-switch VLAN failures caused by missing VLANs in trunk allow-lists.

Troubleshooting focus

  • CLIENT-A cannot ping 10.10.10.20 with both hosts in VLAN 10: confirm each access port's VLAN with show vlan brief, and that it is not negotiating as a trunk — operational mode must read "static access".
  • The cross-switch ping still fails: show interfaces trunk must list VLAN 10 as allowed and active on both switches, with native VLAN 999 on both sides.
  • A trunk reports a native VLAN mismatch: correct both sides to 999. It may not block data, but it is a red flag and can cause unexpected behaviour.
  • ping 10.10.10.1 from CLIENT-A fails: confirm RTR-BR-EDGE1's VLAN 10 subinterface exists with the correct encapsulation and IP address.
  • ARP for the peer fails or stays incomplete after CLIENT-B moves to VLAN 20: normal, and it confirms broadcast isolation. VLAN 20 has no gateway.

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn VLANs, Trunking & Inter-VLAN RoutingWhat Is a VLAN? VLANs Explained for Beginners

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.