VLAN Configuration in Cisco Packet Tracer: Complete Practical Lab

For example:

• Engineering broadcasts remain within VLAN 10.
• HR broadcasts remain within VLAN 20.
• Sales broadcasts remain within VLAN 30.

This improves network organization and reduces unnecessary broadcast traffic.

• SW1 connects Engineering and Sales devices.
• SW2 connects Engineering and HR devices.
• VLAN 10 spans both switches.
• VLAN 20 exists on SW2.
• VLAN 30 exists on SW1.

This provides logical separation without requiring one physical network for every department.

• Rebuild the uploaded physical topology in Cisco Packet Tracer.
• Configure the seven PCs with the documented IP addressing plan.
• Create VLANs 10, 20, 30, and the dedicated native VLAN 999.
• Assign switch access ports to the correct departments.
• Configure the SW1–SW2 trunk.
• Configure the SW2–R1 trunk.
• Restrict each trunk to the VLANs it actually needs.
• Configure VLAN 999 as the native VLAN on both trunk ends.
• Configure router-on-a-stick subinterfaces on R1.
• Test same-VLAN communication.
• Test VLAN 10 across the switch boundary.
• Test inter-VLAN routing between Engineering, HR, and Sales.
• Verify VLAN membership, trunk state, native VLAN settings, router interfaces, and routing tables.
• Troubleshoot incorrect access VLANs, missing trunk VLANs, native VLAN mismatches, incorrect router tags, and wrong default gateways.
• Apply basic security hardening such as unused-port shutdown, port security, BPDU Guard, VLAN pruning, and native VLAN protection.

• Router R1 - one downlink interface, labeled G0/0.
• Switch SW1 - connects four PCs and one trunk uplink.
• Switch SW2 - connects three PCs, one trunk to SW1, and one trunk to R1.
• PC1 (.1) and PC2 (.2) on SW1, VLAN 10, network 10.0.0.0/26 - ports F0/1 and F0/2.
• PC3 (.129) and PC4 (.130) on SW1, VLAN 30, network 10.0.0.128/26 - ports F0/3 and F0/4.
• PC7 (.3) and PC6 (.4) on SW2, VLAN 10, same network 10.0.0.0/26 as the SW1 side - ports F0/3 and F0/2.
• PC5 (.65) on SW2, VLAN 20, network 10.0.0.64/26 - port F0/1.
• SW1 G0/0 ↔ SW2 G0/0 - switch-to-switch trunk.
• SW2 G0/1 ↔ R1 G0/0 - switch-to-router trunk.
• R1 has no direct link to SW1 - SW1 traffic bound for R1 must first cross the SW1–SW2 trunk.

Network Topology Overview

Role of each device:

• SW1 and SW2 switch frames within a VLAN using learned MAC addresses.
• SW1 and SW2 keep VLAN 10, 20, and 30 separated at Layer 2.
• R1 is the only Layer-3 device - the sole point where traffic can move between VLANs.
• Every access port faces a PC.
• Both switch-to-switch and switch-to-router links are trunks.
• The default gateway for every host lives on R1, once its subinterfaces exist.

Explaining the topology conceptually

Physical view

• SW1: four PCs (PC1, PC2, PC3, PC4) plus one uplink to SW2.
• SW2: three PCs (PC7, PC6, PC5) plus one uplink to SW1 and one uplink to R1.
• R1: touches only SW2 physically, but is the only routing point logically.

Logical view

• VLAN 10 (10.0.0.0/26) - members on both SW1 (PC1, PC2) and SW2 (PC7, PC6), connected by the SW1–SW2 trunk.
• VLAN 20 (10.0.0.64/26) - members only on SW2 (PC5).
• VLAN 30 (10.0.0.128/26) - members only on SW1 (PC3, PC4).
• VLAN 10 traffic stays inside VLAN 10 regardless of which switch the hosts sit on - the trunk handles it, R1 is never involve
• VLAN 10-to-VLAN 20, VLAN 10-to-VLAN 30, and VLAN 20-to-VLAN 30 traffic all has to leave its own VLAN and get routed by R1.

Why this design is used

• Three departments share two physical switches instead of one switch per department, cheaper, and realistic for a small site.
• VLANs give each department its own broadcast domain without dedicated hardware.
• Access ports are used for every PC because a PC's NIC doesn't understand 802.1Q tags, it needs untagged traffic.
• Trunk ports are used between SW1–SW2 and SW2–R1 because both links carry more than one VLAN.
• Inter-VLAN routing is required the moment two departments need to talk, since a Layer-2 switch alone never forwards between subnets.
• R1 becomes the default gateway for every VLAN because it's the only device positioned to make that Layer-3 decision.

• Cisco Packet Tracer - any release with subinterface support.
• Two switches - 2960-24TT, 2960+, or 3560 all provide enough FastEthernet and GigabitEthernet ports to match F0/1–F0/4 plus G0/1/G0/2. Pick a model, then verify its port names against this article.
• One router with subinterface support on its first Ethernet port: a 1941 or 2911 both work; subinterface support is an IOS feature, not tied to one router model.
• Seven PCs.
• Copper straight-through cabling for every link shown - no serial cables, since none appear in the image.

1. Place R1, SW1, SW2, and all seven PCs on the canvas.
2. Rename each device to match the image: R1, SW1, SW2.
3. Connect SW1 to PC1 (F0/1), PC2 (F0/2), PC3 (F0/3), and PC4 (F0/4).
4. Connect SW2 to PC7 (F0/3), PC6 (F0/2), and PC5 (F0/1).
5. Connect SW1 G0/1 to SW2 G0/1.
6. Connect SW2 G0/2 to R1 G0/0.
7. Wait for link lights to settle, amber to green in the first several seconds is normal spanning-tree behavior, not a fault.

IP addressing plan

• The image labels all seven host addresses directly: PC1 192.168.1.1, PC2 192.168.1.2, PC3 192.168.1.129, PC4 192.168.1.130, PC5 192.168.1.65, PC6 192.168.1.4, PC7 192.168.1.3.
• Subnet masks are not labeled, but the image shows the three networks as /26 subnets.

• Each VLAN gets its own /26 because a VLAN is its own broadcast domain and needs its own subnet.
• Hosts in the same VLAN share the same subnet because they're expected to talk directly at Layer 2, without a gateway.
• The default gateway matters only when a host needs to reach an address outside its own subnet.
• Every PC can have its gateway configured now, but nothing answers at those addresses until Stage 4, that's expected, not a fault.
• Don't assign 10.0.0.0 (network) or 10.0.0.63 / 10.0.0.127 / 10.0.0.191 (broadcast) of each /26 to any host or gateway.
• The last usable address in each block is used as the gateway specifically to avoid colliding with the .1 host address already shown in the image.

1. Click the PC.
2. Select Desktop.
3. Select IP Configuration.
4. Choose Static.
5. Enter the IP address from the table above.
6. Enter 255.255.255.192 as the subnet mask.
7. Enter the correct default gateway.
8. Close the configuration window.

• At this stage, expect both tests to behave unpredictably or fail.
• The switches haven't been told anything about VLAN 10, 20, or 30 yet.
• Every port is still sitting at the default access VLAN (VLAN 1), not the VLAN this topology actually needs.

• VLAN 10 and VLAN 30 belong on SW1.
• VLAN 10 and VLAN 20 belong on SW2.
• VLAN 10 must be created on both switches, a VLAN ID in one switch's database has no effect on any other switch until it's created there too.
• VLAN 999 (the native VLAN used for both trunks in this lab) must also be created on SW1 and SW2 before it can be assigned as a trunk's native VLAN.

• vlan 10 creates VLAN 10 in the switch's VLAN database.
• name Engineering assigns a descriptive name to the VLAN. IOS does not require a VLAN name, but using meaningful names makes the configuration easier to understand and troubleshoot.
• vlan 999 and name NATIVE-UNUSED create VLAN 999 without assigning any access ports to it. This VLAN is reserved for use as the trunk's native VLA
• Creating a VLAN does not assign it to any port. It only adds the VLAN to the switch's VLAN database.
• A VLAN will not carry endpoint traffic until an access port is assigned to that VLAN.

• The four SW1 ports have different roles. Two ports belong to VLAN 10 and the other two belong to VLAN 30. Configuring them individually avoids accidentally applying the same VLAN configuration to all four ports.
• Using interface range is useful when multiple ports need exactly the same configuration. In this case, the ports belong to different VLANs, so separate interface configurations are safer.
• switchport mode access forces the interface to operate as an access port. It prevents the port from being used as a trunk through dynamic trunk negotiation.
• If the port is left in a dynamic mode, it may negotiate trunking with a connected device when the conditions allow it. An unexpected trunk can create a security and segmentation problem.
• switchport access vlan 10 assigns the access port to VLAN 10. Untagged frames received on that port are associated with VLAN 10.
• If you configure the wrong VLAN number, IOS normally accepts the configuration without reporting an error. The port can remain operational, but the connected device will be placed in the wrong VLAN and therefore the wrong logical network.

Expected: Success.

• Both devices are in VLAN 10 and the same 10.0.0.0/26 subnet.
• SW1 switches the frame directly using the destination MAC address once it's learned.
• No trunk and no router are involved in this path.

Expected before inter-VLAN routing and before the trunk exists: Failure.

• The devices are in different VLANs, on different physical switches, using different IP networks.
• No trunk currently connects SW1 to SW2.
• Even after the trunk is configured, a Layer 2 switch cannot route traffic between VLAN 10 and VLAN 20. Communication between different VLANs requires a Layer 3 device such as a router or Layer 3 switch.
• This is the expected behavior, not a configuration error. VLANs provide Layer 2 isolation, so devices in different VLANs cannot communicate directly through the switch.
• The first ping may fail because the devices need to resolve the destination MAC address through ARP. If the next ping attempts succeed, the initial failure is normally expected and does not indicate a network problem.

What each part of this configuration does:

• A trunk allows multiple VLANs to use the same physical link. The switch adds an 802.1Q tag to identify the VLAN of each frame.
• The receiving switch reads the VLAN tag and forwards the frame within the correct VLAN.
• switchport trunk allowed vlan controls which VLANs are allowed to pass through the trunk.
• VLAN 20 is not allowed on the SW1–SW2 trunk because SW1 does not have any ports using VLAN 20.
• switchport trunk native vlan 999 sets VLAN 999 as the native VLAN. Frames from the native VLAN are sent without an 802.1Q tag.
• VLAN 999 is not assigned to any user or endpoint port. This keeps normal endpoint traffic away from the native VLAN.
• The native VLAN is configured on the trunk interface. It does not require another physical port or cable.
• Both ends of the trunk should use the same native VLAN. If they are different, Cisco IOS can show a native VLAN mismatch warning.
• switchport trunk encapsulation dot1q depends on the switch model. Some switches support only 802.1Q and do not have this command. If the command is rejected, configure the trunk without it.

Common mistakes this setup can prevent or reveal

• Create VLAN 999 before using it as the native VLAN. If the VLAN does not exist, IOS will not accept the native VLAN configuration.
• Make sure both ends of the trunk use the same native VLAN. For example, VLAN 999 on one side and VLAN 1 on the other side will cause a native VLAN mismatch warning.
• Do not assign VLAN 999 to a normal access port. A PC connected to that port would be placed in the unused native VLAN and normally would not have access to the intended network.

• VLAN 10 is the one VLAN in this topology that lives on two switches.
• A VLAN must exist in the VLAN database on every switch that has a member port.
• A VLAN must be carried across every trunk that separates those members.

Expected: Success.

• VLAN 10 is trunked between SW1 and SW2.
• This works without R1 doing anything.

Expected before routing: Failure.

• The trunk carries both VLAN 10 and (on the R1 side) VLAN 20.
• Trunking only extends VLAN membership, it does not provide a path between VLANs.
• That's still R1's job, and R1 hasn't been configured yet.

What each command does:

• interface GigabitEthernet0/0.10 creates a logical subinterface on the physical G0/0 interface. The .10 is just a label and does not automatically connect it to VLAN 10.
• encapsulation dot1Q 10 connects the subinterface to VLAN 10. It tells the router to process frames that have the VLAN 10 tag.
• ip address assigns the IP address used as the default gateway for devices in VLAN 10.
• The physical G0/0interface must be enabled with no shutdown for the subinterfaces to work.
• The SW2 interface connected to R1 must be configured as a trunk and must allow VLAN 10, VLAN 20, and VLAN 30.
• The parent interface cannot be shut down or configured as an access port. The subinterfaces depend on the physical interface for connectivity.
• VLAN 999 does not need a routed subinterface in this setup. It is the native VLAN on the trunk, so its traffic is sent without an 802.1Q tag. Since VLAN 999 is not being routed in this lab, R1 does not need an encapsulation dot1Q 999 native subinterface.

• If a subinterface shows up/down instead of up/up, check the physical parent interface first.
• Then check show interfaces trunk on SW2, a subinterface can't come up if the trunk isn't passing that VLAN.

1. PC5 compares 10.0.0.2 against its own subnet, 10.0.0.64/26, and determines the destination is remote.
2. It sends the frame to its default gateway, 10.0.0.126.
3. SW2 places the frame into VLAN 20 and forwards it out G0/1, tagged, toward R1.
4. R1's subinterface Gi0/0.20 receives the frame and strips the Layer-2 header.
5. R1 looks up 10.0.0.2 and finds 10.0.0.0/26 connected via Gi0/0.10.
6. R1 re-tags the packet for VLAN 10 and sends it back out the same physical link toward SW2.
7. SW2 forwards the VLAN-10-tagged frame across the SW2–SW1 trunk to SW1.
8. SW1 delivers it, untagged, out the VLAN 10 access port to the destination PC.
9. The return traffic follows the same path in reverse.

Layer 2 vs. Layer 3 in this flow

• Layer 2: Switches use MAC addresses and VLAN information to move Ethernet frames between ports. The frame stays within the same VLAN.
• Layer 3: A router uses IP addresses and routing to move traffic from one subnet/VLAN to another.
• R1: R1 performs the Layer 3 routing in this topology. Its subinterfaces act as the default gateways for VLAN 10, VLAN 20, and VLAN 30.
• Trunks: The switch-to-switch and switch-to-router links carry multiple VLANs. Traffic for VLAN 10, 20, and 30 is carried with 802.1Q tags.
• Native VLAN 999: It is not involved in this communication. VLAN 999 is the native VLAN, so its frames are sent untagged, but the Engineering and HR traffic in this flow is tagged

• The Engineering PC on SW1 F0/1 is silently placed into HR instead of Engineering.
• The port keeps a link light and shows no error.
• The PC loses reachability to the rest of VLAN 10.

• VLAN 10 traffic stops crossing this trunk.
• Engineering hosts on SW1 lose reachability to Engineering hosts on SW2.
• Engineering hosts on SW1 lose reachability to R1's Gi0/0.10 gateway.

• SW1 now treats VLAN 1 as native on this trunk while SW2 still treats VLAN 999 as native.
• IOS logs a native VLAN mismatch warning on this link.
• Untagged traffic on this trunk is now interpreted inconsistently by each side.

• The subinterface meant to be HR's gateway now listens for VLAN 30 tags instead of VLAN 20.
• HR loses its gateway.
• Sales unexpectedly has two subinterfaces competing for VLAN 30.

• The IP address is the Sales gateway, not VLAN 20's.
• Communication between devices in the same subnet will still work because it does not need the default gateway.
• Communication with other subnets will fail. The PC sends that traffic to the wrong gateway, and that gateway does not have a route back to the subnet (192.168.1.64/26).

• VLANs separate broadcast domains.
• VLANs are not, by themselves, a full security boundary.
• Anyone with access to a trunk port or a misconfigured access port can still reach more than intended.
• Everything below is hardening layered on top of the VLAN design, not a substitute for it.

• maximum 2 fits a port that might carry an IP phone and a PC daisy-chained together.
• maximum 1 is tighter, appropriate for a single PC with nothing else behind it.
• violation restrict drops offending traffic and logs it, without shutting down the whole port.
• The default shutdown violation mode is stricter but needs a manual re-enable if it trips on a legitimate device.

• Both trunks, SW1–SW2 and SW2–R1, use VLAN 999 as the native VLAN.
• No access ports are assigned to VLAN 999.
• Traffic from the native VLAN is sent without an 802.1Q tag.
• You can check the native VLAN with:

Cisco IOS CLI

show interfaces trunk

Check the Native vlan column for each trunk.

In this topology:

• SW1–SW2: VLANs 10 and 30
• SW2–R1: VLANs 10, 20, and 30

VLAN 20 is not allowed on the SW1–SW2 trunk because SW1 has no HR devices.

• DHCP Snooping.
• Dynamic ARP Inspection.
• A dedicated management VLAN kept off user-facing trunks.
• SSH instead of Telnet.
• ACLs between departments.
• Central logging.
• Configuration backups.
• Ongoing network monitoring

Also remember that a Packet Tracer configuration is only a lab setup. It does not automatically make the network secure enough for production use.

• The command you ran.
• The result you expected.
• The result you actually got.
• The root cause, if the two differ, traced through the troubleshooting table above.