> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/network-labs/packet-tracer/vlan-trunk-lab.md). # VLAN Trunk Lab ### Objectives * Have 4 PCs be able to talk to each other across two switches and separate VLANs * Configure VLANs and access ports on two switches * Form a manual 802.1Q trunk between switches * Restrict allowed VLANs on a trunk * Configure Router-on-a-Stick (ROAS) for inter-VLAN routing *** ### Devices to Place | Device | Model | Qty | | ------ | ---------- | ------------ | | Switch | Cisco 2960 | 2 (SW1, SW2) | | Router | Cisco 2911 | 1 (R1) | | PC | Generic | 4 (PC1–PC4) | *** ### Topology ``` PC0 (VLAN 10) ---Fa0/1--- SW0 ---Gi0/1 TRUNK Gi0/1--- SW1 ---Fa0/1--- PC2 (VLAN 10) PC1 (VLAN 20) ---Fa0/2--- SW0 SW1 ---Fa0/2--- PC3 (VLAN 20) SW0 ---Gi0/2--- R0 Gi0/0 (ROAS) ``` ![Network layout for the lab prior to any configuration.](/files/wxk5oNK1eTmRr2JUX5mx) *** ### IP Plan | Host | VLAN | IP Address | Default Gateway | | ---- | ---- | ---------------- | --------------- | | PC0 | 10 | 192.168.10.10/24 | 192.168.10.1 | | PC2 | 10 | 192.168.10.20/24 | 192.168.10.1 | | PC1 | 20 | 192.168.20.10/24 | 192.168.20.1 | | PC3 | 20 | 192.168.20.20/24 | 192.168.20.1 | Configure PC IPs in the Desktop > IP Configuration tab in Packet Tracer. ![Selecting the IP Configuration box in Desktop for PC0](/files/sQbkX6t0tkjUYIfRlCSD) ![Setting the static IP, SN and Gateway](/files/x8P4akEVwPesxVV8NqYO) *** ### Create VLANs (remember to do both switches) Run on **SW1 *****(Switch 0 from here on out)***** and SW2 *****(Switch 1 from here on out)***: ``` SW(config)# vlan 10 SW(config-vlan)# name SALES SW(config-vlan)# vlan 20 SW(config-vlan)# name SERVERS SW(config-vlan)# vlan 99 SW(config-vlan)# name NATIVE SW(config-vlan)# end ``` Here is the output from one of the switches: {% code overflow="wrap" expandable="true" %} ``` Press RETURN to get started! %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up %LINK-5-CHANGED: Interface FastEthernet0/2, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up %LINK-5-CHANGED: Interface FastEthernet0/4, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up Switch>enable Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#vlan 10 Switch(config-vlan)#name SALES Switch(config-vlan)#vlan 20 Switch(config-vlan)#name SERVERS Switch(config-vlan)#vlan 99 Switch(config-vlan)#name NATIVE Switch(config-vlan)#end Switch# %SYS-5-CONFIG_I: Configured from console by console Switch#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4 Fa0/5, Fa0/6, Fa0/7, Fa0/8 Fa0/9, Fa0/10, Fa0/11, Fa0/12 Fa0/13, Fa0/14, Fa0/15, Fa0/16 Fa0/17, Fa0/18, Fa0/19, Fa0/20 Fa0/21, Fa0/22, Fa0/23, Fa0/24 Gig0/1, Gig0/2 10 SALES active 20 SERVERS active 99 NATIVE active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active Switch# Switch# ``` {% endcode %} {% hint style="info" %} Make sure you type in `enable` first, otherwise you’ll not be able to configure (`conf t`) anything {% endhint %} Verify: ``` SW# show vlan brief ``` You should see SALES, SERVERS, and NATIVE in the list with no ports assigned yet. *** ### Configure Access Ports **SW1:** ``` SW1(config)# interface Fa0/1 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 10 SW1(config-if)# exit SW1(config)# interface Fa0/2 SW1(config-if)# switchport mode access SW1(config-if)# switchport access vlan 20 SW1(config-if)# end ``` **Here is the output from one of the switches:** {% code overflow="wrap" expandable="true" %} ``` Switch# Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#interface Fa0/1 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 10 Switch(config-if)#exit Switch(config)#interface fa0/2 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 20 Switch(config-if)#end Switch# %SYS-5-CONFIG_I: Configured from console by console Switch# ``` {% endcode %} **SW2** (you are going to do the same pattern): ``` SW2(config)# interface Fa0/1 SW2(config-if)# switchport mode access SW2(config-if)# switchport access vlan 10 SW2(config-if)# exit SW2(config)# interface Fa0/2 SW2(config-if)# switchport mode access SW2(config-if)# switchport access vlan 20 SW2(config-if)# end ``` Verify: ``` SW# show vlan brief ``` Fa0/1 should appear under VLAN 10, Fa0/2 under VLAN 20. ![Showing the full list of commands to get both switch interfaces configured](/files/4WP98APTfKSFDriJ0TFO) *** ### Configure the Trunk Between SW1 and SW2 Both switches default to `dynamic auto`, which means a trunk will NOT form unless at least one side actively negotiates. Configure both sides as static trunks: **SW1:** ``` SW1(config)# interface Gi0/1 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport nonegotiate SW1(config-if)# end ``` **SW2:** ``` SW2(config)# interface Gi0/1 SW2(config-if)# switchport mode trunk SW2(config-if)# switchport nonegotiate SW2(config-if)# end ``` Output from Switch 2: {% code overflow="wrap" expandable="true" %} ``` Switch# %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down %LINK-5-CHANGED: Interface GigabitEthernet0/1, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up Switch#%SPANTREE-2-RECV_PVID_ERR: Received 802.1Q BPDU on non trunk GigabitEthernet0/1 VLAN1. %SPANTREE-2-BLOCK_PVID_LOCAL: Blocking GigabitEthernet0/1 on VLAN0001. Inconsistent port type. Switch#conf t Enter configuration commands, one per line. End with CNTL/Z. Switch(config)#interface Gi0/1 Switch(config-if)#switchport mode trunk Switch(config-if)# %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up Switch(config-if)#switchport nonegotiate Switch(config-if)#end Switch# %SYS-5-CONFIG_I: Configured from console by console Switch#show interfaces trunk Port Mode Encapsulation Status Native vlan Gig0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gig0/1 1-1005 Port Vlans allowed and active in management domain Gig0/1 1,10,20,99 Port Vlans in spanning tree forwarding state and not pruned Gig0/1 none Switch# ``` {% endcode %} Verify on both switches: ``` SW# show interfaces trunk ``` You should see Gi0/1 listed as trunking with encapsulation 802.1q. VLANs 1, 10, 20, and 99 should appear under "VLANs allowed and active." ![Showing the proper VLANs allowed and active](/files/47ZHuBPhHOD7mz6xA0uK) Also confirm the mode on a specific interface: ``` SW# show interfaces Gi0/1 switchport ``` Output from the Switch: {% code overflow="wrap" expandable="true" %} ``` Switch#show interfaces Gi0/1 switchport Name: Gig0/1 Switchport: Enabled Administrative Mode: trunk Operational Mode: trunk Administrative Trunking Encapsulation: dot1q Operational Trunking Encapsulation: dot1q Negotiation of Trunking: Off Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Voice VLAN: none Administrative private-vlan host-association: none Administrative private-vlan mapping: none Administrative private-vlan trunk native VLAN: none Administrative private-vlan trunk encapsulation: dot1q Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: none Trunking VLANs Enabled: All Pruning VLANs Enabled: 2-1001 Capture Mode Disabled Capture VLANs Allowed: ALL Protected: fa ``` {% endcode %} Look for `Operational Mode: trunk` and `Trunking Native Mode VLAN: 1 (default)`. *** ## Testing ping from PC0 ```jsx Cisco Packet Tracer PC Command Line 1.0 C:\\>ipconfig /all FastEthernet0 Connection:(default port) Connection-specific DNS Suffix..: Physical Address................: 00E0.B072.15E9 Link-local IPv6 Address.........: FE80::2E0:B0FF:FE72:15E9 IPv6 Address....................: :: IPv4 Address....................: 192.168.10.10 Subnet Mask.....................: 255.255.255.0 Default Gateway.................: :: 192.168.10.1 DHCP Servers....................: 0.0.0.0 DHCPv6 IAID.....................: DHCPv6 Client DUID..............: 00-01-00-01-45-DD-6B-6D-00-E0-B0-72-15-E9 DNS Servers.....................: :: 0.0.0.0 Bluetooth Connection: Connection-specific DNS Suffix..: Physical Address................: 0001.637D.A698 Link-local IPv6 Address.........: :: C:\\>ping 192.168.10.20 Pinging 192.168.10.20 with 32 bytes of data: Reply from 192.168.10.20: bytes=32 time<1ms TTL=128 Reply from 192.168.10.20: bytes=32 time<1ms TTL=128 Reply from 192.168.10.20: bytes=32 time<1ms TTL=128 Ping statistics for 192.168.10.20: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms Control-C ^C C:\\>ping 192.168.20.10 Pinging 192.168.20.10 with 32 bytes of data: Ping statistics for 192.168.20.10: Packets: Sent = 1, Received = 0, Lost = 1 (100% loss), Control-C ^C C:\\> C:\\> ``` {% hint style="info" %} Testing to see if I can ping on my VLAN 10, but not VLAN 20 {% endhint %} *** ### Restrict Allowed VLANs on the Trunk By default the trunk carries VLANs 1–1005. We can limit it to only what's needed to keep things less cluttered: **SW1 and SW2:** ``` SW(config)# interface Gi0/1 SW(config-if)# switchport trunk allowed vlan 10,20,99 SW(config-if)# end ``` Verify: ``` SW# show interfaces trunk ``` The "Vlans allowed on trunk" line should now show only `10,20,99` instead of `1-1005`. I'm going to test this configuration by trying to ping PC3 from PC1. It should still work because VLAN 10 is allowed. If I removed VLAN 10, that ping would fail. ![Testing the ping on VLAN10 after specifying the allowed VLANs on the trunk port](/files/XwbvPAX082XZtI1Z9BIj) ![Seeing the ping fail when I take VLAN10 out of the allowed trunk VLAN list](/files/qqmzIo31QvN2m7UC8S7Y) ![Adding the VLAN10 back to the allowed list and testing ping once more.](/files/lQjXtpDoJa0SjQ9gbOBO) *** ## What if I wanted to talk to VLAN 20 from VLAN 10? ### Router-on-a-Stick (Inter-VLAN Routing) I have already connected the first switch's Gi0/2 interface to the router's Gi0/0 interface with a straight-through cable. **SW1: Set the uplink to R1 as a trunk** ``` SW1(config)# interface Gi0/2 SW1(config-if)# switchport mode trunk SW1(config-if)# switchport trunk allowed vlan 10,20,99 SW1(config-if)# switchport trunk native vlan 99 SW1(config-if)# switchport nonegotiate SW1(config-if)# end ``` **R1: Create subinterfaces for each VLAN** ``` R1(config)# interface Gi0/0 R1(config-if)# no shutdown R1(config-if)# exit R1(config)# interface Gi0/0.10 R1(config-subif)# encapsulation dot1Q 10 R1(config-subif)# ip address 192.168.10.1 255.255.255.0 R1(config-subif)# exit R1(config)# interface Gi0/0.20 R1(config-subif)# encapsulation dot1Q 20 R1(config-subif)# ip address 192.168.20.1 255.255.255.0 R1(config-subif)# exit R1(config)# interface Gi0/0.99 R1(config-subif)# encapsulation dot1Q 99 native R1(config-subif)# end ``` Here's how to verify R1 interfaces are up: ``` R1# show ip interface brief ``` Gi0/0.10 and Gi0/0.20 will show up/up with their IP addresses. Check the routing table: ``` R1# show ip route ``` You should see connected routes for 192.168.10.0/24 and 192.168.20.0/24. ```jsx Router>enable Router#conf t Enter configuration commands, one per line. End with CNTL/Z. Router(config)#interface gi0/0 Router(config-if)#no shutdown Router(config-if)# %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up Router(config-if)#exit Router(config)#interface gi0/0.10 Router(config-subif)# %LINK-3-UPDOWN: Interface GigabitEthernet0/0.10, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0.10, changed state to up Router(config-subif)#encapsulation dot1Q 10 Router(config-subif)#ip address 192.168.10.1 255.255.255.0 Router(config-subif)#exit Router(config)#interface gi0/0.20 Router(config-subif)# %LINK-3-UPDOWN: Interface GigabitEthernet0/0.20, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0.20, changed state to up Router(config-subif)#encapsulation dot1q 20 Router(config-subif)#ip address 192.168.20.1 255.255.255.0 Router(config-subif)#exit Router(config)#interface gi0/0.99 Router(config-subif)# %LINK-3-UPDOWN: Interface GigabitEthernet0/0.99, changed state to down %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0.99, changed state to up Router(config-subif)#encapsulation dot1q 99 native Router(config-subif)#end Router# %SYS-5-CONFIG_I: Configured from console by console Router#show ip interfaces brief ^ % Invalid input detected at '^' marker. Router#show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES unset up up GigabitEthernet0/0.10 192.168.10.1 YES manual up up GigabitEthernet0/0.20 192.168.20.1 YES manual up up GigabitEthernet0/0.99 unassigned YES unset up up GigabitEthernet0/1 unassigned YES unset administratively down down GigabitEthernet0/2 unassigned YES unset administratively down down Vlan1 unassigned YES unset administratively down down Router#show ip route Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set 192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.10.0/24 is directly connected, GigabitEthernet0/0.10 L 192.168.10.1/32 is directly connected, GigabitEthernet0/0.10 192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks C 192.168.20.0/24 is directly connected, GigabitEthernet0/0.20 L 192.168.20.1/32 is directly connected, GigabitEthernet0/0.20 Router# ``` *** ### Testing Communication From **PC0** (VLAN 10, 192.168.10.10): ``` ping 192.168.10.20 -- PC2, same VLAN across the trunk -- should work ping 192.168.20.10 -- PC1, different VLAN via ROAS -- should work ping 192.168.20.20 -- PC3, different VLAN via ROAS -- should work ``` If inter-VLAN pings fail, check: * PC default gateways point to the router sub-interface IP for their VLAN * The trunk from SW1 to R1 has both VLANs allowed * `show ip route` on R1 shows both subnets as connected * ***That you hit ENTER after completing a command, as was my case*** ```jsx C:\\>ping 192.168.10.20 Pinging 192.168.10.20 with 32 bytes of data: Reply from 192.168.10.20: bytes=32 time<1ms TTL=128 Reply from 192.168.10.20: bytes=32 time<1ms TTL=128 Ping statistics for 192.168.10.20: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms Control-C ^C C:\\>ping 192.168.20.20 Pinging 192.168.20.20 with 32 bytes of data: Request timed out. Reply from 192.168.20.20: bytes=32 time<1ms TTL=127 Reply from 192.168.20.20: bytes=32 time<1ms TTL=127 Reply from 192.168.20.20: bytes=32 time<1ms TTL=127 Ping statistics for 192.168.20.20: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms C:\\> C:\\> ``` Time to troubleshoot! The ping to 20.20 should have worked ![Fun fact: While troubleshooting the lab, I didn’t see the Switch# prompt. Once I hit enter…](/files/yN22krcJy8DAbPxoss0t) ![Voila!](/files/6lJhQ3KGcGbVPdHAtuXy)