6.2 Lab – Implement VLANs And Trunking: See How Fast Your Network Can Actually Grow

Ever wondered how a simple switch can become a multi‑tenant data center in just a few minutes?
Picture a classroom full of routers and switches, each blinking with green LEDs. You’re handed a lab manual—“3.6.2: Implement VLANs and Trunking”—and the goal is to separate traffic, keep it safe, and make the network look like a clean, organized office. It sounds like a textbook exercise, but the tricks you learn here translate straight into real‑world deployments.

What Is 3.6.2 Lab – Implement VLANs and Trunking

The 3.Consider this: 2 lab is a hands‑on exercise that walks you through configuring Virtual Local Area Networks (VLANs) and trunk links on Cisco switches. Think of VLANs as invisible walls that keep devices in separate broadcast domains. 6.Trunking is the bridge that lets those walls talk to each other across a single physical link Worth knowing..

In practice, the lab usually involves:

• Three switches (one core, two access switches)
• Four VLANs (e.g., Sales, Engineering, HR, Management)
• A trunk link between the core and each access switch
• Port‑based VLAN assignment on access ports
• VLAN‑aware routing (often using a Layer‑3 switch or router)

The goal? Show that you can isolate traffic, route between VLANs, and keep the network scalable Most people skip this — try not to..

Why It Matters / Why People Care

You might ask, “Why bother with VLANs and trunking when I can just connect everything to one switch?”
Because real networks grow, and so do their security and performance needs. A few key reasons:

1. Segmentation for Security
   If a hacker compromises a device in the Sales VLAN, they can’t snoop on HR traffic.
2. Broadcast Control
   VLANs limit the size of broadcast domains, keeping ARP storms and multicast traffic in check.
3. Simplified Management
   Grouping devices by function or department lets you apply policies, QoS, or ACLs in one place.
4. Scalable Architecture
   Trunk links let you connect multiple switches without adding extra cables for each VLAN.

In short, mastering this lab means you can design a network that’s both efficient and secure.

How It Works (or How to Do It)

Let’s break the lab into bite‑size steps. I’ll walk you through the core concepts and the exact commands you’ll need Not complicated — just consistent..

### 1. Plan Your VLAN Landscape

Before you dive into the console, sketch a quick table:

Keep VLAN IDs in the 10‑99 range for user traffic; reserve 100‑199 for management if you need.

### 2. Configure VLANs on the Core Switch

enable
configure terminal

# Create VLANs
vlan 10
 name Sales
exit
vlan 20
 name Engineering
exit
vlan 30
 name HR
exit
vlan 99
 name Management
exit

Tip: If you’re using a switch that supports VLAN pruning, you can limit which VLANs appear on each trunk later Still holds up..

### 3. Assign Access Ports

On each access switch, set the ports that connect to end devices to the appropriate VLAN:

interface range fa0/1 - 12
 switchport mode access
 switchport access vlan 10
exit

Repeat for other ranges and VLANs. Remember: access ports carry only one VLAN.

### 4. Set Up Trunk Links

Trunking is the magic that lets multiple VLANs travel over a single link. On the core switch, define the trunk ports:

interface gig0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
exit

On the access switches, mirror the trunk configuration:

interface gig0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
exit

You can also use dynamic trunking protocol (DTP) to negotiate automatically, but for lab clarity, static trunks are cleaner.

### 5. Verify Trunk Status

show interfaces trunk

You should see the trunk ports listed, with the allowed VLANs matching your config.

### 6. Enable Routing Between VLANs

If your core switch is a Layer‑3 switch, enable IP routing:

ip routing

Create sub‑interfaces for each VLAN:

interface gig0/1.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
exit
interface gig0/1.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
exit
...

If you’re using a separate router, connect it to the trunk and configure sub‑interfaces there.

### 7. Test Connectivity

From a device in the Sales VLAN, ping a device in Engineering. 10.Consider this: 1) – it should succeed. It should fail. 168.Then ping the VLAN interface on the core (192.Finally, ping across VLANs via the router – it should work Practical, not theoretical..

Common Mistakes / What Most People Get Wrong

1. Forgetting to set access ports to access mode
   If you leave a port in trunk mode, it will double‑hop traffic and create loops No workaround needed..

2. Mixing VLAN IDs across switches
   Using VLAN 10 on the core but VLAN 20 on an access switch will break communication. Keep a consistent mapping Surprisingly effective..

3. Leaving VLAN 1 (default) in use
   Many labs leave devices on VLAN 1, which is a security risk. Move everything off it Which is the point..

4. Not pruning trunks
   A trunk that carries unused VLANs wastes bandwidth and can expose unnecessary traffic.

5. Misconfiguring encapsulation
   On a Cisco 3560, you must use encapsulation dot1Q. Forgetting this on a sub‑interface will break routing.

Practical Tips / What Actually Works

• Use a VLAN naming convention that reflects business units. It makes troubleshooting a breeze.
• Document every change in a shared sheet. A single mis‑typed VLAN ID can trip up a whole team.
• Test with a single device first before flooding the network.
• apply VTP (VLAN Trunking Protocol) in larger environments, but disable it in labs to avoid accidental propagation.
• Enable STP (Spanning Tree Protocol) on all switches to prevent loops if you add redundant links.
• Keep a backup config after the lab. You’ll save hours if you need to restore the lab later.

FAQ

Q1: Can I use the same VLAN ID on different switches?
A1: Yes, but they must be coordinated. All switches that need to communicate over a trunk should have the same VLAN ID for that traffic Nothing fancy..

Q2: Why is VLAN 1 a bad idea?
A2: VLAN 1 is the default VLAN and is used for management traffic. Leaving user devices on it exposes them to unnecessary broadcast traffic and potential security risks Took long enough..

Q3: What’s the difference between a trunk and a trunked link?
A3: A trunk is a port that carries multiple VLANs. A trunked link refers to the physical connection that uses trunking Simple as that..

Q4: How do I troubleshoot a trunk that’s not passing VLAN 20?
A4: Check show interfaces trunk, confirm the allowed VLAN list, and ensure both ends of the trunk have matching configurations.

Q5: Can I use 802.1Q trunking on fiber?
A5: Absolutely. 802.1Q is the standard for VLAN tagging on both copper and fiber.

Closing

Getting your hands dirty with VLANs and trunking in the 3.Also, 6. 2 lab isn’t just an academic exercise; it’s the foundation of any modern network. You learn how to slice traffic, keep the network tidy, and scale as your organization grows. The next time you’re setting up a new office or expanding an existing one, you’ll remember these steps and avoid the pitfalls most people stumble over. Happy switching!

6. Validate the End‑to‑End Path

After you’ve built the VLANs, assigned ports, and enabled trunking, the final—and often overlooked—step is to verify that traffic really makes it from source to destination Worth knowing..

If any of those checks fail, go back to the relevant configuration block. A missing switchport mode trunk or an extra space in the VLAN list (allowed vlan 10, 20 instead of 10,20) can be the culprit.

7. Automate the Repetitive Bits

In a lab environment you’ll often spin up the same topology multiple times. Rather than typing the same commands over and over, consider one of the following:

• Cisco IOS macros (alias or macro name) – great for a handful of devices.
• Ansible playbooks – write a YAML file that pushes the VLAN and trunk configuration to any number of switches with a single ansible-playbook run.yml.
• Python + Netmiko – a short script can loop through a CSV of switch names, applying the same VLAN map to each.

Even a simple copy‑and‑paste template saved in a text file can shave minutes off each lab iteration and reduce human error.

8. Document the Lab for Future Use

When the lab is up and running, capture a snapshot of the “as‑built” state:

1. Export the running config – show running-config → save to a file.
2. Take a topology diagram – tools like draw.io, Visio, or even the Cisco Packet Tracer Export function help visual learners.
3. Write a brief “lab notes” section – include:
   • VLAN IDs and purpose
   • Port assignments (access vs. trunk)
   • Any non‑default settings (e.g., VTP mode, STP priority)
   • Known limitations (e.g., “Only VLAN 10‑30 are allowed on trunk X”).

Store these artifacts in a shared repository (Git, Google Drive, or a team Confluence page). When the next cohort walks into the lab, they’ll have a clear roadmap and won’t repeat the same missteps you made.

9. What to Do When Things Still Don’t Work

Even after careful validation, you might encounter stubborn issues. Here’s a quick decision tree:

1. Is the problem Layer‑2 or Layer‑3?

   • Layer‑2: Check VLAN membership, trunk allowed list, and STP.
   • Layer‑3: Verify sub‑interface IPs, routing tables, and that no shutdown is applied to the router interfaces.

2. Are you seeing “native VLAN mismatch” messages?

   • Ensure both ends of the trunk have the same native VLAN (default is VLAN 1, but you can set switchport trunk native vlan 99 on both sides).

3. Do you get “Port-channel is down” errors? (if you’re using EtherChannel)

   • Confirm that all member ports share the same mode (all trunk or all access) and the same allowed VLAN list.

4. Is there a physical layer issue?

   • Swap the cable, check link LEDs, and run show interface status to confirm the link is connected.

5. Still stuck?

   • Capture a packet trace with a span port or a lightweight tool like Wireshark on a host in the VLAN. Look for untagged frames where you expect tags, or duplicate tags that indicate a mis‑configured trunk.

10. Scaling the Lab for Real‑World Scenarios

Once you’ve mastered the basics, you can start layering more advanced concepts on top of the same foundation:

Each addition reinforces the core lesson: consistent, documented VLAN design is the backbone of any scalable network.

Conclusion

VLANs and trunking may seem like a handful of commands, but they embody the principle of traffic segregation that underpins every modern enterprise network. By methodically creating VLANs, assigning ports, configuring trunks, and then rigorously validating each step, you avoid the common pitfalls that trip up even seasoned engineers.

Remember the three pillars that will keep your lab—and any production rollout—running smoothly:

1. Consistency – identical VLAN IDs and trunk settings across every device.
2. Documentation – a single source of truth for IDs, naming, and port roles.
3. Verification – use the built‑in Cisco show commands, ping tests, and, when needed, packet captures.

Armed with these habits, you’ll transition from a “lab‑only” mindset to a confidence‑driven approach that scales from a single office to a global campus. So fire up your switches, spin those trunks, and watch the traffic flow exactly where you want it—clean, secure, and under your control. Happy switching!

11. Automating the Build with Ansible

Manually typing the same ten‑line VLAN block on every switch is a recipe for drift. Ansible’s network modules let you push a single YAML playbook to dozens of devices, guaranteeing that the VLAN database is identical everywhere.

---
- name: Deploy VLANs to Cisco IOS switches
  hosts: core_sw
  gather_facts: no
  connection: network_cli
  vars:
    vlan_list:
      - { id: 10, name: "HR" }
      - { id: 20, name: "ENG" }
      - { id: 30, name: "FIN" }
      - { id: 40, name: "GUEST" }
  tasks:
    - name: Ensure VLANs exist
      ios_vlan:
        vlan_id: "{{ item.id }}"
        name: "{{ item.name }}"
        state: present
      loop: "{{ vlan_list }}"

    - name: Configure trunk ports
      ios_interface:
        name: "{{ item }}"
        mode: trunk
        trunk_allowed_vlans: "10,20,30,40"
        description: "Uplink to {{ inventory_hostname }}"
      loop:
        - Gig0/1
        - Gig0/2

A few take‑aways:

If you prefer a GUI‑driven approach, Cisco DNA Center or Aruba Central provide similar “template‑push” capabilities, but the Ansible method remains vendor‑agnostic and works equally well with virtual switches in GNS3 or EVE‑NG Still holds up..

12. Monitoring VLAN Health in Production

Once the lab graduates to a production environment, you’ll need ongoing visibility. Below are three lightweight, open‑source tools that complement the Cisco native stack:

1. LibreNMS – SNMP‑based discovery automatically maps VLANs, shows port‑by‑port membership, and raises alerts when a trunk goes down or an unexpected VLAN appears.
2. Grafana + Prometheus – Export cisco_telemetry metrics (e.g., cisco_if_vlan_membership) and build dashboards that highlight “VLAN churn” – a sudden rise in MAC‑address moves that could indicate a loop or a rogue device.
3. NetBox – Acts as a source of truth for VLAN IDs, names, and descriptions. Integrate it with Ansible to keep your automation and documentation perfectly aligned.

A quick sanity‑check script you can run nightly from a management server:

#!/bin/bash
for sw in $(cat switches.txt); do
  echo "=== $sw ==="
  ssh -q admin@$sw "show vlan brief" | grep -E '10|20|30|40' | awk '{print $1,$2,$3}'
done > vlan_snapshot_$(date +%F).log

Compare the daily snapshots with diff or feed them into a log‑analysis tool; any deviation triggers a ticket. This “eyes‑on‑the‑ground” approach catches mis‑configurations before they cascade into outages.

13. Common Pitfalls and How to Avoid Them

Being aware of these patterns lets you diagnose problems in seconds rather than minutes—a crucial advantage when you’re supporting a live network That's the part that actually makes a difference..

14. Next‑Level Lab Ideas

If you want to push the envelope further, consider integrating these advanced concepts:

• VXLAN EVPN: Overlay a virtualized L2 fabric across your VLAN‑segmented underlay. Great for data‑center leaf‑spine labs.
• Zero‑Touch Provisioning (ZTP): Use a DHCP‑option‑66 server to hand out a script that pulls the Ansible playbook automatically when a new switch boots.
• Network‑as‑Code pipelines: Hook your Git repository to a CI/CD tool (GitLab CI, Jenkins) so any merge request automatically validates the VLAN config with a linting tool (cisco‑cfg‑lint) before deployment.
• Security testing: Deploy a rogue DHCP server or a “VLAN hopping” attack in a sandbox to see how your VACLs and port‑security settings hold up.

These extensions turn a simple VLAN lab into a full‑blown testbed for modern network engineering, giving you the confidence to design, automate, and secure real enterprise environments.

Final Thoughts

VLANs and trunking are the foundation upon which every segmented, secure, and scalable network is built. By:

1. Defining a clear VLAN taxonomy,
2. Applying consistent port modes,
3. Verifying with both CLI commands and packet captures,
4. Automating the rollout, and
5. Continuously monitoring health,

you transform a collection of switches into a disciplined, predictable fabric. The lab exercises described here are more than academic—they mirror the day‑to‑day realities of a network engineer tasked with keeping traffic on its intended path while preventing accidental leaks.

Take the time to document, automate, and validate; those few extra minutes now save hours (or days) when the network grows or when a change request lands on your desk. With a solid VLAN strategy in place, you’ll find that scaling, troubleshooting, and securing your infrastructure become not just manageable, but routine Less friction, more output..

Now, fire up your switches, push that Ansible playbook, and watch the VLANs line up like perfectly stacked bricks. The network you’ve built today will be the reliable platform that supports tomorrow’s applications, users, and innovations. Happy building!

15. Putting It All Together – A Real‑World Checklist

Running through this checklist after every major change—whether it’s adding a new data‑center server or re‑assigning a VLAN to a new floor—keeps the fabric clean and reduces the time spent hunting down elusive bugs.

Conclusion

Designing, deploying, and maintaining VLANs is a blend of art and engineering. It starts with a clear naming convention and a disciplined approach to port configuration, and it ends with automated verification and continuous monitoring. By treating VLANs as first‑class citizens in your configuration management system, you gain:

• Predictability – Every switch behaves the same way, making large‑scale changes painless.
• Security – Proper tagging, trunk isolation, and native‑VLAN hygiene close common attack vectors.
• Scalability – Adding new sites or services becomes a matter of assigning a VLAN ID and letting Ansible roll it out.
• Visibility – NetBox and SNMP dashboards give you a single pane of glass into the health of the entire fabric.

The lab exercises outlined above are deliberately lightweight yet powerful. They let you experiment with real switches, real traffic, and real automation, turning abstract concepts into tangible skills. Once you’re comfortable, extend the lab with VXLAN, ZTP, or CI/CD pipelines, and you’ll have a sandbox that mirrors a production data center Worth knowing..

So, pull up a terminal, spin up that virtual switch, and start tagging! The VLANs you configure today will serve as the backbone for the applications, users, and services that will run tomorrow. With a solid foundation, the rest of your network will rise on a rock‑solid, segmented, and secure platform. Happy switching!

People argue about this. Here's where I land on it.

8. A Real‑World Scenario: Migrating a Legacy Subnet

Imagine a mid‑size enterprise that has a legacy 192.Which means 10. 0/24 subnet running on a redundant pair of access switches. That said, 168. Day to day, the subnet is heavily used by legacy VoIP phones, but the network team wants to move the phones to a new campus‑wide VoIP VLAN (VLAN 50) to centralise QoS policies. The migration must avoid downtime, preserve call quality, and keep the existing DHCP scope intact.

Step‑by‑step migration

1. Create the new VLAN

   - name: Add VLAN 50
     cisco.ios.ios_vlan:
       vlan_id: 50
       name: VOIP-Campus
       state: present
   

2. Add a new interface template for VoIP ports

   - name: Configure VoIP ports
     ios_interface:
       name: GigabitEthernet0/{{ item }}
       description: "VoIP Phone – Campus"
       switchport_mode: access
       switchport_access_vlan: 50
       shutdown: no
     loop: [ 1, 2, 3, 4 ]
   

3. Create a “migration” VLAN (VLAN 10) with a limited port list
   The migration VLAN will temporarily host the phones while the old subnet is re‑addressed Worth keeping that in mind..

   - name: Add migration VLAN
     ios_vlan:
       vlan_id: 10
       name: VOIP-Old
       state: present
   

4. Re‑tag the existing ports
   Instead of pulling the phones out, we change the access VLAN of the four ports to the migration VLAN Simple, but easy to overlook..

   - name: Move phones to migration VLAN
     ios_interface:
       name: GigabitEthernet0/{{ item }}
       switchport_access_vlan: 10
     loop: [ 1, 2, 3, 4 ]
   

5. Verify connectivity
   Use a simple ping sweep from a server in the same subnet or run cisco‑cfg‑lint to ensure no accidental port mis‑configuration.

6. Update DHCP
   The DHCP server is re‑scoped:

   • 192.168.10.0/24 → VLAN 10 (migration)
   • 192.168.50.0/24 → VLAN 50 (new campus)

   The DHCP relay on the switch is updated accordingly.

7. Switch the phones
   With the phones still powered, they will automatically re‑discover the new VLAN via DHCP and re‑join the campus network. Because the phones are on the migration VLAN, the original subnet traffic remains isolated until the final cut.

8. Cutover
   Once all phones are confirmed on VLAN 50, the old subnet is decommissioned. The migration VLAN is removed, and the access ports are re‑tagged to VLAN 50. All DHCP scopes are consolidated Surprisingly effective..

9. Post‑migration validation
   Run netbox-sync to confirm the database reflects the new VLAN assignments. Use snmpwalk to ensure ifInOctets and ifOutOctets remain within expected ranges. Finally, trigger a cisco‑cfg‑lint check to guarantee no stray access‑VLANs remain.

This incremental approach guarantees zero‑downtime for the VoIP service, keeps the network documentation accurate, and demonstrates how Ansible can orchestrate a complex, multi‑step migration with minimal manual intervention.

Extending the Framework

8.1. Introducing VXLAN for Data‑Center Fabric

When the network grows beyond a single campus, overlay networks like VXLAN allow you to extend Layer‑2 segments across multiple sites. By adding a VXLAN Tunnel Endpoint (VTEP) role to your Ansible playbooks, you can:

• Dynamically allocate VXLAN IDs that map to existing VLANs.
• Configure l2vni and l3vni on Cisco Nexus devices.
• Automate the creation of VTEP interfaces and their associated sub‑interfaces.

The same principles that govern VLAN tagging—consistent naming, automated validation, and NetBox integration—apply to VXLAN. Store the mapping VLAN → VXLAN in NetBox’s custom fields, and use a simple lookup table in your playbooks.

8.2. Zero Touch Provisioning (ZTP)

For new switch deployments, ZTP can bootstrap the device with a minimal configuration, including the VLAN database and trunk ports. By hosting a PXE‑boot script that pulls the Ansible inventory and role from a Git repository, you can:

1. Boot the switch.
2. Pull the VLAN configuration role.
3. Apply the configuration automatically.
4. Register the device in NetBox via an API call at the end of the playbook.

ZTP eliminates manual configuration errors and speeds up rack‑to‑rack deployment.

8.3. Continuous Integration / Continuous Deployment (CI/CD)

A Git‑based workflow can tie every change to a pull request that triggers automated tests:

1. Static linting – cisco‑cfg‑lint checks for syntax and policy violations.
2. Unit tests – ansible-test verifies role idempotency.
3. Integration tests – A virtual lab (e.g., GNS3 or EVE‑OS) runs the playbook and validates connectivity.
4. Approval gate – Only after passing all checks can the change be merged and pushed to production.

This pipeline ensures that every VLAN tweak is reviewed, tested, and documented before it touches live switches.

Key Takeaways

By weaving together these elements, you transform VLAN management from a reactive, error‑prone process into a proactive, repeatable operation. The result is a network that scales with your business, resists misconfiguration, and provides clear visibility into its own health That alone is useful..

Final Thought

VLANs are more than just a way to segment traffic—they are the backbone of modern network architecture. When you treat them as first‑class citizens in your automation stack, you get to the full potential of your infrastructure: predictable performance, rapid change, and a resilient foundation for future innovations. Plus, embrace the tools, follow the patterns, and let your VLANs evolve with your organization—one well‑tagged frame at a time. Happy switching!

Looking Ahead

The landscape of network automation is evolving faster than ever. As SD‑WANs, intent‑based networking, and edge‑cloud services mature, the same principles that made VLAN automation reliable today will extend to any logical construct—be it VRFs, firewall policies, or service‑chain templates. By keeping the data‑driven, code‑centric mindset that this guide promotes, you’ll be ready to lift the next layer of abstraction without rewriting your entire stack.

Final Thought

VLANs are more than just a way to segment traffic—they are the backbone of modern network architecture. Because of that, embrace the tools, follow the patterns, and let your VLANs evolve with your organization—one well‑tagged frame at a time. When you treat them as first‑class citizens in your automation stack, you tap into the full potential of your infrastructure: predictable performance, rapid change, and a resilient foundation for future innovations. Happy switching!