Company: TechNova Corporation Situation: TechNova just moved into a new 3-floor office building. The IT team must build the entire network from scratch. You are the network engineer responsible for designing and implementing the complete Layer 2 infrastructure before the company moves in next week.
Requirements from management:
- Each department must be isolated in its own VLAN
- IP Phones must be on a separate voice VLAN
- WiFi Access Points need their own VLAN
- Uplinks between switches must be redundant and fast
- Network must be protected against rogue devices
- All switches must be manageable remotely via Telnet
---
\\\[CORE-SW]
Gi0/0 Gi0/1
Po1 / \\\\ / \\\\ Po2
Gi0/0 Gi0/1 Gi0/0 Gi0/1
\\\[DSW1] \\\[DSW2]
Gi0/2 Gi0/3 Gi0/2 Gi0/3
/ \\\\ / \\\\
\\\[ASW1] \\\[ASW2] \\\[ASW3] \\\[ASW4]
| | | | | | | |
PC Ph PC AP PC Ph PC AP
V10 V40 V20 V50 V20 V40 V30 V50
(Sales) (IT F1) (IT F2) (Mgmt)
EtherChannel:
CORE-SW ↔ DSW1 → Po1 (Gi0/0 + Gi0/1) LACP
CORE-SW ↔ DSW2 → Po2 (Gi0/2 + Gi0/3) LACP
Floors:
Floor 1 → ASW1 (Sales) + ASW2 (IT)
Floor 2 → ASW3 (IT)
Floor 3 → ASW4 (Management)
---
| VLAN | Name | Subnet | Purpose |
|---|---|---|---|
| 10 | SALES | 192.168.10.0/24 | Sales department PCs |
| 20 | IT | 192.168.20.0/24 | IT department PCs |
| 30 | MANAGEMENT | 192.168.30.0/24 | Management PCs |
| 40 | VOICE | 192.168.40.0/24 | IP Phones all floors |
| 50 | WIFI | 192.168.50.0/24 | Access Points |
| 99 | MGMT-SW | 192.168.99.0/24 | Switch management |
| 100 | SERVERS | 192.168.100.0/24 | Server room |
| 999 | BLACKHOLE | — | Unused ports |
---
| Switch | Role | Management IP |
|---|---|---|
| CORE-SW | Core L3 | 192.168.99.1/24 |
| DSW1 | Distribution | 192.168.99.2/24 |
| DSW2 | Distribution | 192.168.99.3/24 |
| ASW1 | Access F1 | 192.168.99.4/24 |
| ASW2 | Access F1 | 192.168.99.5/24 |
| ASW3 | Access F2 | 192.168.99.6/24 |
| ASW4 | Access F3 | 192.168.99.7/24 |
---
| Switch | Port | Device | Data VLAN | Voice VLAN |
|---|---|---|---|---|
| ASW1 | Gi0/1 | Sales PC | 10 | — |
| ASW1 | Gi0/2 | Sales Phone | 10 | 40 |
| ASW1 | Gi0/3 | Sales AP | 50 | — |
| ASW2 | Gi0/1 | IT PC | 20 | — |
| ASW2 | Gi0/2 | IT Phone | 20 | 40 |
| ASW2 | Gi0/3 | IT AP | 50 | — |
| ASW3 | Gi0/1 | IT PC Floor2 | 20 | — |
| ASW3 | Gi0/2 | IT Phone F2 | 20 | 40 |
| ASW3 | Gi0/3 | IT AP Floor2 | 50 | — |
| ASW4 | Gi0/1 | Mgmt PC | 30 | — |
| ASW4 | Gi0/2 | Mgmt Phone | 30 | 40 |
| ASW4 | Gi0/3 | Mgmt AP | 50 | — |
---
Step 1 — Add devices:
1x IOSv L3 Switch → CORE-SW
2x IOU L2 Switch → DSW1, DSW2
4x IOU L2 Switch → ASW1, ASW2, ASW3, ASW4
4x IOSv Router → PC-SALES, PC-IT, PC-MGMT, PC-VOICE
RAM per switch: 512 MB minimum
Step 2 — Connect cables:
EtherChannel CORE-SW ↔ DSW1:
CORE-SW Gi0/0 ──► DSW1 Gi0/0
CORE-SW Gi0/1 ──► DSW1 Gi0/1
EtherChannel CORE-SW ↔ DSW2:
CORE-SW Gi0/2 ──► DSW2 Gi0/0
CORE-SW Gi0/3 ──► DSW2 Gi0/1
Distribution to Access:
DSW1 Gi0/2 ──► ASW1 Gi0/0
DSW1 Gi0/3 ──► ASW2 Gi0/0
DSW2 Gi0/2 ──► ASW3 Gi0/0
DSW2 Gi0/3 ──► ASW4 Gi0/0
End devices:
ASW1 Gi0/1 ──► PC-SALES Gi0/0
ASW2 Gi0/1 ──► PC-IT Gi0/0
ASW3 Gi0/1 ──► PC-MGMT Gi0/0
ASW4 Gi0/1 ──► PC-VOICE Gi0/0
Step 3 — Follow tasks in order
Do NOT skip — each task builds on previous
---
PNetLab has no AP or IP Phone images — simulate with IOSv routers. This still tests VLAN separation, trunking, and port config fully.
! ── PC-SALES → connected to ASW1 Gi0/1 (access vlan 10)
interface GigabitEthernet0/0
ip address 192.168.10.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.10.1
! ── PC-IT-F1 → connected to ASW2 Gi0/1 (access vlan 20)
interface GigabitEthernet0/0
ip address 192.168.20.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.20.1
! ── PC-IT-F2 → connected to ASW3 Gi0/1 (access vlan 20)
interface GigabitEthernet0/0
ip address 192.168.20.11 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.20.1
! ── PC-MGMT → connected to ASW4 Gi0/1 (access vlan 30)
interface GigabitEthernet0/0
ip address 192.168.30.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.30.1
! ── PHONE-F1 → connected to ASW1 Gi0/2 (voice vlan 40)
interface GigabitEthernet0/0
ip address 192.168.40.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.40.1
! ── PHONE-F2 → connected to ASW3 Gi0/2 (voice vlan 40)
interface GigabitEthernet0/0
ip address 192.168.40.11 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.40.1
! ── AP-SIM-F1 → connected to ASW1 Gi0/3 (access vlan 50)
interface GigabitEthernet0/0
ip address 192.168.50.10 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.50.1
! ── AP-SIM-F2 → connected to ASW3 Gi0/3 (access vlan 50)
interface GigabitEthernet0/0
ip address 192.168.50.11 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.50.1
---
ip routing
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
interface vlan 30
ip address 192.168.30.1 255.255.255.0
no shutdown
interface vlan 40
ip address 192.168.40.1 255.255.255.0
no shutdown
interface vlan 50
ip address 192.168.50.1 255.255.255.0
no shutdown
interface vlan 99
ip address 192.168.99.1 255.255.255.0
no shutdown
interface vlan 100
ip address 192.168.100.1 255.255.255.0
no shutdown
---
---
Run on CORE-SW, DSW1, DSW2, ASW1, ASW2, ASW3, ASW4
vlan 10
name SALES
vlan 20
name IT
vlan 30
name MANAGEMENT
vlan 40
name VOICE
vlan 50
name WIFI
vlan 99
name MGMT-SW
vlan 100
name SERVERS
vlan 999
name BLACKHOLE
! Verify on every switch
show vlan brief
---
! On CORE-SW
interface range GigabitEthernet0/0 - 1
channel-group 1 mode active
no shutdown
interface Port-channel1
description TO-DSW1-LACP
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,99,100
switchport trunk native vlan 999
no shutdown
! On DSW1
interface range GigabitEthernet0/0 - 1
channel-group 1 mode active
no shutdown
interface Port-channel1
description TO-CORE-LACP
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,99,100
switchport trunk native vlan 999
no shutdown
! Verify
show etherchannel summary
→ Po1 SU (up) Gi0/0(P) Gi0/1(P) ✅
---
! On CORE-SW
interface range GigabitEthernet0/2 - 3
channel-group 2 mode active
no shutdown
interface Port-channel2
description TO-DSW2-LACP
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,99,100
switchport trunk native vlan 999
no shutdown
! On DSW2
interface range GigabitEthernet0/0 - 1
channel-group 2 mode active
no shutdown
interface Port-channel2
description TO-CORE-LACP
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,99,100
switchport trunk native vlan 999
no shutdown
! Verify
show etherchannel summary
→ Po2 SU (up) Gi0/0(P) Gi0/1(P) ✅
---
! On DSW1 toward ASW1 (Floor 1 Sales)
interface GigabitEthernet0/2
description TO-ASW1-FLOOR1-SALES
switchport mode trunk
switchport trunk allowed vlan 10,40,50,99
switchport trunk native vlan 999
no shutdown
! On DSW1 toward ASW2 (Floor 1 IT)
interface GigabitEthernet0/3
description TO-ASW2-FLOOR1-IT
switchport mode trunk
switchport trunk allowed vlan 20,40,50,99
switchport trunk native vlan 999
no shutdown
! On DSW2 toward ASW3 (Floor 2 IT)
interface GigabitEthernet0/2
description TO-ASW3-FLOOR2-IT
switchport mode trunk
switchport trunk allowed vlan 20,40,50,99
switchport trunk native vlan 999
no shutdown
! On DSW2 toward ASW4 (Floor 3 Management)
interface GigabitEthernet0/3
description TO-ASW4-FLOOR3-MGMT
switchport mode trunk
switchport trunk allowed vlan 30,40,50,99
switchport trunk native vlan 999
no shutdown
! On each ASW — uplink toward distribution
! ASW1 Gi0/0 toward DSW1
interface GigabitEthernet0/0
description UPLINK-TO-DSW1
switchport mode trunk
switchport trunk allowed vlan 10,40,50,99
switchport trunk native vlan 999
no shutdown
! ASW2 Gi0/0 toward DSW1
interface GigabitEthernet0/0
description UPLINK-TO-DSW1
switchport mode trunk
switchport trunk allowed vlan 20,40,50,99
switchport trunk native vlan 999
no shutdown
! ASW3 Gi0/0 toward DSW2
interface GigabitEthernet0/0
description UPLINK-TO-DSW2
switchport mode trunk
switchport trunk allowed vlan 20,40,50,99
switchport trunk native vlan 999
no shutdown
! ASW4 Gi0/0 toward DSW2
interface GigabitEthernet0/0
description UPLINK-TO-DSW2
switchport mode trunk
switchport trunk allowed vlan 30,40,50,99
switchport trunk native vlan 999
no shutdown
---
! Sales PC port
interface GigabitEthernet0/1
description SALES-PC-FLOOR1
switchport mode access
switchport access vlan 10
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Sales Phone port (data + voice)
interface GigabitEthernet0/2
description SALES-PHONE-FLOOR1
switchport mode access
switchport access vlan 10
switchport voice vlan 40
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Sales AP port
interface GigabitEthernet0/3
description SALES-AP-FLOOR1
switchport mode access
switchport access vlan 50
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Shutdown unused ports
interface range GigabitEthernet0/4 - 7
switchport mode access
switchport access vlan 999
shutdown
---
! IT PC port
interface GigabitEthernet0/1
description IT-PC-FLOOR1
switchport mode access
switchport access vlan 20
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! IT Phone port
interface GigabitEthernet0/2
description IT-PHONE-FLOOR1
switchport mode access
switchport access vlan 20
switchport voice vlan 40
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! IT AP port
interface GigabitEthernet0/3
description IT-AP-FLOOR1
switchport mode access
switchport access vlan 50
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Shutdown unused ports
interface range GigabitEthernet0/4 - 7
switchport mode access
switchport access vlan 999
shutdown
---
! IT PC Floor 2
interface GigabitEthernet0/1
description IT-PC-FLOOR2
switchport mode access
switchport access vlan 20
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! IT Phone Floor 2
interface GigabitEthernet0/2
description IT-PHONE-FLOOR2
switchport mode access
switchport access vlan 20
switchport voice vlan 40
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! IT AP Floor 2
interface GigabitEthernet0/3
description IT-AP-FLOOR2
switchport mode access
switchport access vlan 50
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Shutdown unused ports
interface range GigabitEthernet0/4 - 7
switchport mode access
switchport access vlan 999
shutdown
---
! Management PC
interface GigabitEthernet0/1
description MGMT-PC-FLOOR3
switchport mode access
switchport access vlan 30
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Management Phone
interface GigabitEthernet0/2
description MGMT-PHONE-FLOOR3
switchport mode access
switchport access vlan 30
switchport voice vlan 40
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Management AP
interface GigabitEthernet0/3
description MGMT-AP-FLOOR3
switchport mode access
switchport access vlan 50
spanning-tree portfast
spanning-tree bpduguard enable
no shutdown
! Shutdown unused ports
interface range GigabitEthernet0/4 - 7
switchport mode access
switchport access vlan 999
shutdown
---
! CORE-SW — primary root bridge all VLANs
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20,30,40,50,99,100 priority 4096
! DSW1 — secondary root bridge
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20,30,40,50,99,100 priority 8192
! DSW2 — tertiary
spanning-tree mode rapid-pvst
spanning-tree vlan 10,20,30,40,50,99,100 priority 12288
! ALL access switches
spanning-tree mode rapid-pvst
! Verify root bridge
CORE-SW# show spanning-tree vlan 10
→ This bridge is the root ✅
---
! CORE-SW
hostname CORE-SW
interface vlan 99
ip address 192.168.99.1 255.255.255.0
no shutdown
! DSW1
hostname DSW1
interface vlan 99
ip address 192.168.99.2 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
! DSW2
hostname DSW2
interface vlan 99
ip address 192.168.99.3 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
! ASW1
hostname ASW1
interface vlan 99
ip address 192.168.99.4 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
! ASW2
hostname ASW2
interface vlan 99
ip address 192.168.99.5 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
! ASW3
hostname ASW3
interface vlan 99
ip address 192.168.99.6 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
! ASW4
hostname ASW4
interface vlan 99
ip address 192.168.99.7 255.255.255.0
no shutdown
ip default-gateway 192.168.99.1
---
! Run on each switch — change hostname accordingly
username admin privilege 15 secret Admin@123
line vty 0 4
login local
transport input Telnet
exec-timeout 10 0
---
! On ALL access switches — PC ports only
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
switchport port-security mac-address sticky
! Verify
show port-security interface GigabitEthernet0/1
show port-security address
---
! ── ALL SWITCHES (global)
ip dhcp snooping
ip dhcp snooping vlan 10,20,30,40,50,99,100
! ── CORE-SW (no trust needed — is the server)
\  nothing extra
! ── DSW1 and DSW2 (trust uplink to CORE-SW)
interface Port-channel1
\ ip dhcp snooping trust
! ── ASW1 ASW2 ASW3 ASW4 (trust uplink to DSW)
interface Ethernet0/0
\ ip dhcp snooping trust
\ ← this is the ONLY trusted port
\ ← all other ports untrusted by default----
### Task 14 — ⭐ Extra Challenge: EtherChannel Failure Test
! Step 1 — Verify both links bundled CORE-SW# show etherchannel summary → Po1 SU Gi0/0(P) Gi0/1(P) ✅
! Step 2 — Shut one link CORE-SW(config)# interface GigabitEthernet0/0 CORE-SW(config-if)# shutdown
! Step 3 — Verify still forwarding on remaining link CORE-SW# show etherchannel summary → Po1 SU Gi0/1(P) ← one link still up ✅
! Step 4 — Bring back CORE-SW(config-if)# no shutdown
! Step 5 — Verify both rejoin CORE-SW# show etherchannel summary → Po1 SU Gi0/0(P) Gi0/1(P) ✅ ! Document recovery time
\\---
### Task 15 — ⭐ Extra Challenge: STP Failure Test
! Step 1 — Confirm root bridge CORE-SW# show spanning-tree vlan 10 → This bridge is the root ✅
! Step 2 — Shut EtherChannel on CORE-SW CORE-SW(config)# interface Port-channel1 CORE-SW(config-if)# shutdown
! Step 3 — Check which switch becomes root DSW1# show spanning-tree vlan 10 → DSW1 should become root (priority 8192) ✅
! Step 4 — Bring back CORE-SW(config-if)# no shutdown
! Step 5 — Verify CORE-SW reclaims root CORE-SW# show spanning-tree vlan 10 → This bridge is the root ✅ ! Document RSTP convergence time (should be < 2 sec)
\\---
## ✅ Final Verification Checklist
! VLANs on all switches show vlan brief → all 8 VLANs active ✅
! EtherChannel show etherchannel summary → Po1 SU Po2 SU ✅
! Trunks passing correct VLANs show interfaces trunk → VLANs in forwarding ✅
! Root bridge CORE-SW# show spanning-tree vlan 10 → This bridge is the root ✅
! Access ports correct VLAN show interfaces Gi0/1 switchport → Access VLAN 10 ✅ Voice VLAN 40 ✅
! Management reachable ping 192.168.99.1 from any switch ✅ ping 192.168.99.4 from CORE-SW ✅
! Port security show port-security ✅
! DHCP snooping show ip dhcp snooping ✅
\\---
## 🐛 Troubleshooting Log
### Problem 1 — EtherChannel Not Forming
Symptom : show etherchannel → interfaces show (I) individual Cause : Mode mismatch or config on member interfaces Fix : Both sides mode active Config trunk on Port-channel not on members No mismatch: speed duplex allowed VLANs
### Problem 2 — VLAN Not Passing on Trunk
Symptom : PCs same VLAN different switches cannot ping Cause : VLAN missing from trunk allowed list Fix : switchport trunk allowed vlan add [vlan-id] Verify: show interfaces trunk
### Problem 3 — Wrong Root Bridge
Symptom : ASW becomes root bridge Cause : CORE-SW priority not set Fix : spanning-tree vlan 10 priority 4096 on CORE-SW
### Problem 4 — BPDUGuard Err-Disabled Port
Symptom : Port goes err-disabled after connecting device Cause : BPDU received on portfast port Another switch connected to access port Fix : Remove switch → use end device only Re-enable: shutdown then no shutdown
Bundles multiple physical links into one logical link
Increases bandwidth and provides redundancy
LACP mode active + active = negotiates ✅
Config goes on Port-channel interface not members
Lower priority = root bridge
Default = 32768
CORE-SW = 4096 (wins election)
DSW1 = 8192 (backup root)
Priority must be multiple of 4096
switchport access vlan 10 ← PC data traffic
switchport voice vlan 40 ← phone voice traffic
Both on same physical port
CDP tells phone which VLAN to use
Phone tags voice with VLAN 40
PC behind phone gets VLAN 10 untagged
Blocks rogue DHCP servers on untrusted ports
Builds binding table: MAC IP VLAN port
Trust only uplinks toward real DHCP server
Protects against DHCP starvation attacks
---