3.4 6 Lab Configure Vlans And Trunking

3.4 6 labconfigure vlans and trunking

Introduction
In this hands‑on lab you will learn how to create VLANs, assign ports, and establish trunk links on a Cisco‑style switch. The exercise is part of a broader module that covers VLAN design, trunking protocols, and verification techniques. By the end of the session you will be able to design a multi‑VLAN environment, configure trunk ports, and troubleshoot common mismatches. This article walks you through the entire process, from conceptual basics to practical verification, ensuring that the keyword 3.4 6 lab configure vlans and trunking appears naturally throughout the text for optimal SEO performance.

Understanding VLANs and Trunking
Before diving into the configuration steps, it is essential to grasp the two core concepts that this lab focuses on:

• VLAN (Virtual Local Area Network) – a logical segmentation of a physical switch that isolates broadcast domains.
• Trunking – a method that carries traffic for multiple VLANs across a single link, typically using 802.1Q tagging.

Why these matter? VLANs improve security and network manageability, while trunking enables communication between switches or between a switch and a router without requiring a separate physical link for each VLAN It's one of those things that adds up..

Lab Setup Overview
The lab topology consists of three switches (Switch‑A, Switch‑B, Switch‑C) and two end‑devices (PC‑1, PC‑2). Switch‑A connects to Switch‑B via a trunk link, while Switch‑B connects to Switch‑C through another trunk. PC‑1 resides in VLAN 10 (Sales) and PC‑2 resides in VLAN 20 (Engineering). The goal is to verify that each VLAN can communicate across the trunk while maintaining proper tagging Not complicated — just consistent..

Step‑by‑Step Configuration

1. Enter privileged EXEC mode

   Switch> enable  
   Switch# configure terminal  
   

2. Create the VLANs

   Switch(config)# vlan 10  
   Switch(config-vlan)# name Sales  
   Switch(config-vlan)# exit  
   
   Switch(config)# vlan 20  
   Switch(config-vlan)# name Engineering  
   Switch(config-vlan)# exit  
   

3. Assign access ports to VLANs

   • Switch‑A Switch-A(config)# interface range fa0/1 - 2 Switch-A(config-if-range)# switchport mode access Switch-A(config-if-range)# switchport access vlan 10 Switch-A(config-if-range)# exit
   • Switch‑B (port fa0/5 for VLAN 20)

     Switch-B(config-if)# switchport mode access  
     Switch-B(config-if)# switchport access vlan 20  
     Switch-B(config-if)# exit       ```
     
     

4. Configure trunk ports

   • Between Switch‑A and Switch‑B

     Switch-A(config)# interface gigabitEthernet0/1  
     Switch-A(config-if)# switchport mode trunk  
     Switch-A(config-if)# switchport trunk allowed vlan 10,20  
     Switch-A(config-if)# exit  
     
     Switch-B(config)# interface gigabitEthernet0/1  
     Switch-B(config-if)# switchport mode trunk  
     Switch-B(config-if)# switchport trunk allowed vlan 10,20  
     Switch-B(config-if)# exit  
     

   • Between Switch‑B and Switch‑C (similar commands, but only VLAN 10 is permitted on this link)

     Switch-B(config)# interface gigabitEthernet0/2  
     Switch-B(config-if)# switchport mode trunk  
     Switch-B(config-if)# switchport trunk allowed vlan 10  
     Switch-B(config-if)# exit  
     
     Switch-C(config)# interface gigabitEthernet0/1  
     Switch-C(config-if)# switchport mode trunk  
     Switch-C(config-if)# switchport trunk allowed vlan 10  
     Switch-C(config-if)# exit  
     

5. Set native VLAN (optional but recommended)

   Switch-A(config)# interface gigabitEthernet0/1  
   Switch-A(config-if)# switchport trunk native vlan 99  
   Switch-A(config-if)# exit  
   

6. Save the configuration

   Switch-B# write memory  
   Switch-C# write memory  
   

Verification of the Configuration

• Show VLAN database

  Switch# show vlan brief  
  ```    Verify that VLAN 10 and VLAN 20 appear with the correct port assignments.
  
  

• Check trunk status

  Switch# show interfaces trunk  
  

  The output should list the trunk ports, indicate trunking status, and display the allowed VLAN list.

• Ping across VLANs
  From PC‑1 (VLAN 10) ping the IP address of PC‑2 (VLAN 20). Successful replies confirm that the trunk is correctly forwarding tagged traffic Worth keeping that in mind..

• Debug native VLAN mismatch (if any)

  Switch# debug vlan packet  
  

  Look for messages indicating mismatched native VLANs; adjust the switchport trunk native vlan command accordingly.

Common Issues and Troubleshooting

     Switch-C# show vlan brief  
     ```  
     Confirm VLAN 10 exists and is active on the relevant ports.

| Symptom | Likely Cause | Fix |
|---------|--------------|-----|
| *Port shows "inactive" or "not connected"* | Physical layer issues (cable, port disabled) or incorrect interface configuration | Check physical connections, verify interface status with `show interfaces status`, and ensure the port is enabled (`no shutdown`). |
| *Access port not assigned to the correct VLAN* | Misconfigured `switchport access vlan` command | Reassign the port to the intended VLAN using `switchport access vlan [VLAN_ID]` and confirm with `show vlan`. |

---

**Final Notes**  
Proper VLAN segmentation and trunk configuration are critical for maintaining network security and performance. Always validate trunk settings and native VLAN alignment between connected switches to prevent VLAN hopping or traffic leakage. Regular audits of VLAN databases and trunk status using `show` commands help proactively identify misconfigurations. By following these steps, administrators can ensure seamless inter-VLAN communication while minimizing potential security risks. Documenting configurations and changes further streamlines troubleshooting and future maintenance efforts.

**Continuation of the Article**  

**Advanced Configuration Considerations**  
- **Trunk Port Optimization**: Limit trunk ports to only the necessary VLANs to reduce unnecessary broadcast traffic. Use `switchport trunk allowed vlan 10,20` to explicitly restrict VLANs instead of allowing all.  
- **Dynamic Trunking Protocol (DTP) Caution**: If using DTP, ensure both switches negotiate trunking. Disable DTP with `switchport nonegotiate` if static trunking is preferred for stability.  
- **Native VLAN Security**: Avoid using the default native VLAN (VLAN 1) unless necessary. Assign a dedicated VLAN (e.g., VLAN 99) for native traffic to mitigate security risks like VLAN hopping.  

**Automation and Scripting**  
Automate VLAN and trunk configurations using PowerShell or Python scripts. Example:  
```powershell
# PowerShell script to configure a trunk port  
$switch = Get-PSObject -ClassName CimInstance -Filter "CimInstance -ClassName Win32_SwitchPort"  
$switch | ForEach-Object {  
    $_.SetMethod("SetTrunkPort", @{ "AllowedVlans" = "10,20", "NativeVlan" = 99 })  
}  

apply tools like Cisco’s IOS CLI scripting or Ansible for large-scale deployments Turns out it matters..

Documentation and Compliance
Maintain a centralized network documentation repository with:

• VLAN-to-purpose mappings (e.g., VLAN 10 = Sales, VLAN 20 = HR).
• Trunk port assignments and native VLAN settings.
• Configuration snapshots before/after changes.
  Use tools like SolarWinds or PRTG to track VLAN health and compliance.

Security Best Practices

• Port Security: Limit MAC addresses on access ports with switchport port-security max 1 to prevent unauthorized devices.
• BPDU Guard: Enable spanning-tree bpduguard enable on trunk ports to block unauthorized switches.
• Private VLANs: For sensitive segments, use private VLANs to isolate hosts within the same VLAN.

Conclusion
Proper VLAN and trunk configuration is foundational to a secure, efficient network. By validating port assignments, trunk status, and native VLAN alignment, administrators ensure seamless inter-VLAN communication. Proactive troubleshooting, automation, and adherence to security practices minimize downtime and vulnerabilities. Regular audits and documentation further enhance network reliability. With these strategies, organizations can confidently scale their networks while maintaining reliable performance and security.

Final Command Summary

Switch# show vlan brief          # Verify VLAN existence and port assignments  
Switch# show interfaces trunk    # Confirm trunk status and allowed VLANs  
Switch# ping [PC2_IP]           # Test inter-VLAN connectivity  
Switch# debug vlan packet        # Diagnose native VLAN mismatches  
Switch# no shutdown [interface]  # Activate a port if inactive  
Switch# switchport access vlan [VLAN_ID]  # Correct misconfigured access ports  

By integrating these practices, network teams can resolve issues swiftly and future-proof their infrastructure against evolving demands.