| VLAN | Name | Subnet | Purpose |
|---|---|---|---|
| 10 | SALES | 192.168.10.0/24 | Sales PCs |
| 20 | IT | 192.168.20.0/24 | IT PCs |
| 30 | MANAGEMENT | 192.168.30.0/24 | Mgmt PCs |
| 40 | VOICE | 192.168.40.0/24 | IP Phones |
| 50 | WIFI | 192.168.50.0/24 | APs |
| 99 | MGMT-SW | 192.168.99.0/24 | Switch mgmt |
| 100 | SERVERS | 192.168.100.0/24 | Servers |
| 999 | BLACKHOLE | — | Unused |
| Switch | Role | IP |
|---|---|---|
| CORE-SW | Core | 192.168.99.1/24 |
| DSW1 | Distribution | 192.168.99.2/24 |
| DSW2 | Distribution | 192.168.99.3/24 |
| ASW1 | Access | 192.168.99.4/24 |
| ASW2 | Access | 192.168.99.5/24 |
| ASW3 | Access | 192.168.99.6/24 |
| ASW4 | Access | 192.168.99.7/24 |
---
show vlan brief
show vlan id 10
show interfaces switchport
show etherchannel summary
show etherchannel detail
show etherchannel port
show interfaces port-channel 1
show lacp neighbor
show lacp counters
show interfaces trunk
show interfaces Gi0/0 trunk
show interfaces Gi0/0 switchport
show spanning-tree
show spanning-tree vlan 10
show spanning-tree summary
show spanning-tree detail
show spanning-tree interface Gi0/0 detail
show port-security
show port-security interface Gi0/1
show port-security address
show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping statistics
show interfaces vlan 99
show ssh
show users
---
| What to verify | Command |
|---|---|
| EtherChannel up | show etherchannel summary (SU + P) |
| VLANs active | show vlan brief |
| Trunks passing VLANs | show interfaces trunk |
| Correct root bridge | show spanning-tree vlan 10 |
| Access port VLAN | show interfaces Gi0/1 switchport |
| Port security | show port-security interface |
| DHCP snooping | show ip dhcp snooping binding |
| Switch reachable | ping 192.168.99.x |
---
╔═══════════╦════════╦═════════╦════╗
║ ║ active ║ passive ║ on ║
╠═══════════╬════════╬═════════╬════╣
║ active ║ YES ✅ ║ YES ✅ ║ NO ║
║ passive ║ YES ✅ ║ NO ❌ ║ NO ║
║ on ║ NO ❌ ║ NO ❌ ║YES ║
╚═══════════╩════════╩═════════╩════╝
---
Lower priority = preferred root bridge
4096 → CORE-SW (primary root) ✅
8192 → DSW1 (secondary root)
12288 → DSW2 (tertiary)
32768 → default (all other switches)
---
vlan 10
name SALES
vlan 20
name IT
vlan 30
name MANAGEMENT
vlan 40
name VOICE
vlan 50
name WIFI
vlan 99
name MGMT-SW
vlan 100
name SERVERS
vlan 999
name BLACKHOLE
interface range Gi0/0 - 1
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
switchport trunk allowed vlan 10,20,30,40,50,99,100
switchport trunk native vlan 999
interface Gi0/1
switchport mode access
switchport access vlan \[VLAN-ID]
spanning-tree portfast
spanning-tree bpduguard enable
switchport port-security
switchport port-security maximum 2
switchport port-security violation restrict
switchport port-security mac-address sticky
no shutdown