Lab: VLANs and 802.1Q trunks between two switches

Aim and what you need

The aim is to separate staff and student devices into their own virtual LANs (VLANs) across two switches, and to carry both VLANs over one link using IEEE 802.1Q tagging. Without a router, the two VLANs must not be able to reach each other; that is the proof the separation works.

• Packet Tracer or two Cisco switches in your own lab.
• Four PCs: one per VLAN on each switch.
• A crossover or straight-through cable for the trunk (modern switches auto-detect).

Topology and addressing

Steps

1. Address the four PCs as shown. No gateway is needed yet.
2. On both switches, create and name the VLANs. VLANs are local to each switch unless you use VLAN Trunking Protocol (VTP), so set VTP to transparent to keep control.
3. Assign the access ports and turn off trunk negotiation on them.
4. Configure G0/1 on both switches as a static trunk with native VLAN 99 and an allowed list.
5. Shut down unused ports and put them in an unused VLAN.

configure terminal
vtp mode transparent
vlan 10
 name STAFF
vlan 20
 name STUDENTS
vlan 99
 name NATIVE
vlan 999
 name PARKING
exit
interface range fa0/1 - 10
 switchport mode access
 switchport access vlan 10
interface range fa0/11 - 20
 switchport mode access
 switchport access vlan 20
interface g0/1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,99
 switchport nonegotiate
interface range fa0/21 - 24
 switchport mode access
 switchport access vlan 999
 shutdown
end
copy running-config startup-config

Tip: on multilayer switches such as the 3560, you may need switchport trunk encapsulation dot1q before switchport mode trunk. The 2960 supports only 802.1Q, so the command does not exist there.

Verify

Run these on each switch. Success looks like this: show vlan brief lists VLANs 10 and 20 with the right ports; show interfaces trunk shows G0/1 trunking, native VLAN 99, and VLANs 10, 20 and 99 allowed and forwarding.

show vlan brief
show interfaces trunk
show interfaces fa0/1 switchport
show interfaces g0/1 switchport

Then test from the PCs. PC-A must reach PC-C (same VLAN, across the trunk). PC-A must not reach PC-B or PC-D, because they are in a different VLAN and subnet with no router.

ping 192.168.10.12
ping 192.168.20.11

Troubleshooting and clean-up

• Same-VLAN ping across switches fails: the VLAN may not exist on the second switch, or it is missing from the allowed list. Both show up in show interfaces trunk.
• Native VLAN mismatch messages: one side still uses VLAN 1. Native VLANs must match on both ends.
• Port shows as inactive in show vlan brief: it was assigned to a VLAN that has not been created.
• Trunk will not form: with nonegotiate on, both ends must be set to trunk manually.

To clean up a real switch, remove the VLAN database and startup configuration and reload. Keep the Packet Tracer file: the next lab, inter-VLAN routing, builds directly on it. A dedicated, unused native VLAN and a parking VLAN for unused ports are the two habits examiners and auditors look for first.

delete flash:vlan.dat
write erase
reload