Packet Tracer lab: two VLANs, a trunk and inter-VLAN routing

This lab covers three CCNA topics in one go: VLANs, trunks and routing between VLANs. It takes about 45 minutes in Cisco Packet Tracer. If you have not installed it yet, see our Packet Tracer setup note.

The topology

• Two 2960 switches, SW1 and SW2, connected on Gi0/1.
• One 2911 router, R1, connected from Gi0/0 to SW1 Gi0/2.
• Four PCs: PC1 (VLAN 10) on SW1 Fa0/1, PC2 (VLAN 20) on SW1 Fa0/2, PC3 (VLAN 10) on SW2 Fa0/1, PC4 (VLAN 20) on SW2 Fa0/2.

Addressing: VLAN 10 uses 192.168.10.0/24 with gateway .1; VLAN 20 uses 192.168.20.0/24 with gateway .1. Give the PCs .11 to .14 in their VLAN's range and set the gateway.

Step 1: create the VLANs on both switches

enable
configure terminal
vlan 10
 name STAFF
vlan 20
 name GUEST
exit

Step 2: assign access ports

interface fa0/1
 switchport mode access
 switchport access vlan 10
interface fa0/2
 switchport mode access
 switchport access vlan 20

Repeat on SW2 for PC3 and PC4.

Step 3: configure the trunks

On both switches, the link between them:

interface gi0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

On SW1, the link to the router:

interface gi0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20

At this point PC1 can ping PC3 (same VLAN, across the trunk) but not PC2. That is the point of VLANs.

Step 4: router-on-a-stick

interface gi0/0
 no shutdown
interface gi0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gi0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

Each sub-interface handles one VLAN's tagged traffic and acts as that VLAN's default gateway.

Step 5: verify

• show vlan brief on each switch: ports in the right VLANs.
• show interfaces trunk: Gi0/1 (and Gi0/2 on SW1) trunking, VLANs 10 and 20 allowed and active.
• show ip interface brief on R1: sub-interfaces up/up.
• From PC1, ping its gateway, then PC2 and PC4. All should now succeed.

Troubleshooting checklist

• Ping to gateway fails: wrong VLAN on the access port, wrong gateway on the PC, or Gi0/0 still shut down.
• Same-VLAN ping across switches fails: trunk not formed or VLAN missing from the allowed list or from one switch.
• Only one VLAN routes: typo in a sub-interface VLAN number.

Take it further

Replace the router with a Layer 3 switch using SVIs, add a DHCP pool per VLAN, then add an ACL so GUEST cannot reach STAFF. Our notes VLANs and trunks, inter-VLAN lab and ACL lab continue from here.