Cisco VLAN and Inter-VLAN Routing Network Lab

Lab Overview

In this lab, I designed and configured a network for two physically separated buildings. Each building uses multiple VLANs to separate servers, data users, voice devices, and network management traffic.

I used VTP to manage VLANs across the Layer 2 switches, SVI-based inter-VLAN routing on the multilayer switch in Building A, and Router-on-a-Stick (ROAS) on the router in Building B. Static routing was used between the two buildings.

The design also includes DHCP and DNS services, a web server, dedicated management VLANs, native VLANs for trunk links, and voice VLANs for IP phones.

The main goal was to simulate an enterprise network where VLANs provide network segmentation while still allowing required communication with the server and management networks.

Objectives

The objectives of this lab were to:

1.   Create and organize the required VLANs for both buildings.

2.   Configure the multilayer switches as VTP servers and distribute VLAN information to Layer 2 switches.

3.   Configure Layer 2 switches as VTP clients or transparent switches according to their role.

4.   Configure SVI-based inter-VLAN routing on the Building A multilayer switch.

5.   Configure Router-on-a-Stick on the Building B router for inter-VLAN routing.

6.   Configure trunk links between multilayer switches, routers, and access switches.

7.   Configure VLAN 99 as the native VLAN for trunk links.

8.   Assign access ports to the appropriate data VLANs based on their port ranges.

9.   Configure voice VLANs on user access ports for IP phones.

10.  Configure the server switch in transparent VTP mode and manually create the VLANs required for the server network.

11.  Configure DHCP relay using “ip helper-address” so clients in different VLANs can obtain addresses from the central DHCP server.

12.  Configure a DNS server and create DNS records for network services.

13.  Configure a web server that can be accessed by users across the required VLANs.

14.  Configure dedicated management VLANs for network-device management.

15.  Configure static routing between the two building networks.

16.  Disable DTP negotiation on access ports and force them to remain in access mode.

17.  Verify VLAN, VTP, routing, DHCP, DNS, web, and device-management connectivity.

Lab Scenario

The lab contains two buildings: Building A and Building B.

Building A represents the original network and contains the central server network. Building B was later added as a separate network with its own data and voice VLANs.

The two buildings use different VLANs for their local users. Communication between user VLANs across the two buildings is restricted by the routing design, while the required server and management networks remain reachable.

All network devices also have management addresses in a dedicated management VLAN. This allows the devices to be accessed from the server side for administration and remote management.

Building A

VLAN  Purpose             Network             

10       Servers              10.10.10.0/28

20       Data-1                192.168.20.0/24

30       Data-2                192.168.30.0/24

40       Data-3                192.168.40.0/24

99       Native VLAN      No IP subnet

100     Management    192.168.100.0/25

200     Voice                  192.168.200.0/24

MLS-1 performs inter-VLAN routing for Building A using SVIs. It also operates as the VTP server for the Building A access switches.

SW-4 connects the server network to MLS-1. It operates in VTP transparent mode because the server switch only needs the VLANs required for its local connections and should not participate in the VTP client/server database.

The point-to-point connections are:

Router-1 to Router-2: 172.16.1.0/30

Router-1 to MLS-1: 172.16.1.4/30

Building B

VLAN  Purpose             Network                  

10       Servers              10.10.10.0/28

50       Data-1                192.168.50.0/24

60       Data-2                192.168.60.0/24

70       Data-3                192.168.70.0/24

99       Native VLAN      No IP subnet

100     Management    192.168.100.128/25

210     Voice                  192.168.210.0/24

MLS-2 operates as the VTP server for Building B and distributes VLAN information to the access switches.

Router-2 performs inter-VLAN routing for Building B using Router-on-a-Stick. It also provides the Layer 3 connection between Building B and Router-1.

Access Port Design

The access switches in both buildings use the same basic port structure:

Fa0/1–8 → first data VLAN

Fa0/9–16 → second data VLAN

Fa0/17–24 → third data VLAN

The ports are configured as access ports and also assigned a voice VLAN so that an IP phone can use the voice VLAN while the connected user device uses the assigned data VLAN.

Building A uses voice VLAN 200, while Building B uses voice VLAN 210.

Topology

The following simplified topology shows the logical structure of the lab.

               Router2 ————————————————— Router-1

                  |                        |

                MLS-2                   MLS-2 —————— SW-4       

             /   |   \                /   |   \  

          SW-1  SW-2  SW-3         SW-1  SW-2  SW-3

This is the network designed and deployed in Cisco Packet Tracer:

Requirements and Environment

The lab was implemented in Cisco Packet Tracer 9 using Cisco IOS devices and services. I used VTP version 2 because some of the Cisco device models available in Packet Tracer did not consistently support VTP version 3. Using the same VTP version across the devices kept the lab configuration consistent.

Lab Tasks

The main tasks performed in this lab were:

• Create the required VLANs on the VTP servers.

• Configure the VTP domain, password, and operating mode.

• Configure access switches as VTP clients.

• Configure the server switch as a VTP transparent switch.

• Configure trunk links and assign VLAN 99 as the native VLAN.

• Configure SVI-based routing on MLS-1.

• Configure Router-on-a-Stick on Router-2.

• Configure static routes between the two buildings.

• Configure management SVIs and default gateways on Layer 2 switches.

• Assign access ports to the required data and voice VLANs.

• Configure DHCP relay toward the central DHCP server.

• Configure DHCP, DNS, and web services.

• Test VLAN and VTP operation.

• Test routing and reachability between the required networks.

• Verify network-device management connectivity.

Configurations

The following sections contain the configurations used to build the lab. The configuration files were also exported from the devices and are provided in the GitHub repository linked in Resources section at the end of this page.

Building A

Router-1

Router-1 provides the Layer 3 connection between the two buildings. MLS-1 performs inter-VLAN routing for Building A, so Router-1 mainly provides the routing path between Building A and Building B.

en

conf t

hostname Router-1

interface gig0/0/0

 description To Router-2

 media-type sfp

 ip address 172.16.1.1 255.255.255.252

 no shutdown

 exit

interface gig0/0/1

 ip address 172.16.1.5 255.255.255.252

 no shutdown

 exit

ip route 192.168.50.0 255.255.255.0 172.16.1.2

ip route 192.168.60.0 255.255.255.0 172.16.1.2

ip route 192.168.70.0 255.255.255.0 172.16.1.2

ip route 192.168.210.0 255.255.255.0 172.16.1.2

ip route 192.168.100.128 255.255.255.128 172.16.1.2

ip route 10.10.10.0 255.255.255.240 172.16.1.6

ip route 192.168.20.0 255.255.255.0 172.16.1.6

ip route 192.168.30.0 255.255.255.0 172.16.1.6

ip route 192.168.40.0 255.255.255.0 172.16.1.6

ip route 192.168.100.0 255.255.255.128 172.16.1.6

ip route 192.168.200.0 255.255.255.0 172.16.1.6

MLS-1

MLS-1 is the Layer 3 switch for Building A. It provides the SVIs used for inter-VLAN routing and operates as the VTP server.

en

conf t

hostname MLS-1

interface gig1/0/1

 no switchport

 ip address 172.16.1.6 255.255.255.252

 no shutdown

 exit

vlan 99

 name Native

vlan 100

 name Management

vlan 10

 name Servers

vlan 20

 name Data-1

vlan 30

 name Data-2

vlan 40

 name Data-3

vlan 200

 name Voice

 exit

vtp mode server

vtp domain Building-A

vtp password 123

vtp version 2

interface range gig1/0/2-6

 switchport mode trunk

 switchport trunk native vlan 99

 no shutdown

 exit

interface vlan 10

 ip address 10.10.10.1 255.255.255.240

 no shutdown

 exit

interface vlan 20

 ip address 192.168.20.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface vlan 30

 ip address 192.168.30.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface vlan 40

 ip address 192.168.40.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface vlan 100

 description Management

 ip address 192.168.100.2 255.255.255.128

 exit

interface vlan 200

 ip address 192.168.200.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

ip routing

ip route 0.0.0.0 0.0.0.0 172.16.1.5

SW-4

SW-4 connects the server network to MLS-1. It is configured in VTP transparent mode so it does not receive or distribute VLAN information through the VTP domain. The required server, native, and management VLANs are created locally.

en

conf t

hostname SW-4

vtp mode transparent

vlan 10

 name Servers

vlan 99

 name Native

vlan 100

 name Management

 exit

interface vlan 100

 ip address 192.168.100.3 255.255.255.128

 exit

ip default-gateway 192.168.100.2

interface gig0/1

 switchport mode trunk

 switchport trunk native vlan 99

 exit

interface range fast0/1-24, gig0/2

 switchport mode access

 switchport nonegotiate

 switchport access vlan 10

 exit

Building B

MLS-2

MLS-2 provides Layer 2 connectivity for Building B and operates as the VTP server. Inter-VLAN routing is performed by Router-2 using Router-on-a-Stick.

en

conf t

hostname MLS-2

vlan 99

 name Native

vlan 100

 name Management

vlan 50

 name Data-1

vlan 60

 name Data-2

vlan 70

 name Data-3

vlan 210

 name Voice

 exit

vtp mode server

vtp domain Building-B

vtp password 123

vtp version 2

interface range gig1/0/1-4

 switchport mode trunk

 switchport trunk native vlan 99

 no shutdown

 exit

interface vlan 100

 ip address 192.168.100.130 255.255.255.128

 exit

ip default-gateway 192.168.100.129

Router-2

Router-2 performs inter-VLAN routing for Building B using Router-on-a-Stick. Each VLAN is configured as a sub-interface on the router.

en

conf t

hostname Router-2

interface gig0/0/0

 description To Router-1

 media-type sfp

 ip address 172.16.1.2 255.255.255.252

 no shutdown

 exit

interface gig0/0/1

 no shutdown

 exit

interface gig0/0/1.50

 encapsulation dot1q 50

 ip address 192.168.50.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface gig0/0/1.60

 encapsulation dot1q 60

 ip address 192.168.60.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface gig0/0/1.70

 encapsulation dot1q 70

 ip address 192.168.70.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface gig0/0/1.210

 description Voice

 encapsulation dot1q 210

 ip address 192.168.210.1 255.255.255.0

 ip helper-address 10.10.10.10

 exit

interface gig0/0/1.100

 description Management

 encapsulation dot1q 100

 ip address 192.168.100.129 255.255.255.128

 exit

ip route 10.10.10.0 255.255.255.240 172.16.1.1

ip route 192.168.200.0 255.255.255.0 172.16.1.1

Testing & Verification

After completing the configuration, I tested the main network functions using Cisco IOS commands and end-device tools.

VLANs

I first verified that the VTP configuration was working correctly. On MLS-1, as example, the output confirmed that the switch was operating as a VTP server in the Building-A domain.

MLS-1#show vtp status

VTP Version capable         : 1 to 2

VTP version running         : 2

VTP Domain Name             : Building-A

VTP Pruning Mode            : Disabled

VTP Traps Generation        : Disabled

Device ID                   : 0000.0CEA.9E70

Configuration last modified by 0.0.0.0 at 3-1-93 01:12:08

Local updater ID is 10.10.10.1 on interface Vl10 (lowest numbered VLAN interface found)

Feature VLAN :

--------------

VTP Operating Mode            : Server

Maximum VLANs supported locally   : 1005

Number of existing VLANs      : 12

Configuration Revision        : 64

MD5 digest                    : 0x07 0x95 0xCE 0x4C 0xBF 0x0B 0xEC 0x22

                                 0x29 0x7F 0x4C 0xAE 0x72 0x1F 0x9C 0x11

SW-5#show vtp status

SW-5#show vtp status

VTP Version capable         : 1 to 2

VTP version running         : 2

VTP Domain Name             : Building-A

VTP Pruning Mode            : Disabled

VTP Traps Generation        : Disabled

Device ID                   : 0000.0C3B.22D0

Configuration last modified by 0.0.0.0 at 3-1-93 01:12:08

Feature VLAN :

--------------

VTP Operating Mode            : Client

Maximum VLANs supported locally   : 255

Number of existing VLANs      : 12

Configuration Revision        : 64

MD5 digest                    : 0x07 0x95 0xCE 0x4C 0xBF 0x0B 0xEC 0x22

                                 0x29 0x7F 0x4C 0xAE 0x72 0x1F 0x9C 0x11

I used “show vlan brief” to verify that the required VLANs existed and that access ports were assigned correctly.

For example, MLS-2 showed the Building B VLANs:

MLS-2#show vlan brief

VLAN Name                         Status Ports

---- -------------------------------- --------- -------------------------------

1 default                      active Gig1/0/5, Gig1/0/6, Gig1/0/7, Gig1/0/8

                                                Gig1/0/9, Gig1/0/10, Gig1/0/11, Gig1/0/12

                                                Gig1/0/13, Gig1/0/14, Gig1/0/15, Gig1/0/16

                                                Gig1/0/17, Gig1/0/18, Gig1/0/19, Gig1/0/20

                                                Gig1/0/21, Gig1/0/22, Gig1/0/23, Gig1/0/24

                                                Gig1/1/1, Gig1/1/2, Gig1/1/3, Gig1/1/4

50   Data-1                       active

60   Data-2                       active

70   Data-3                       active

99   Native                       active

100  Management                   active

210  Voice                        active

SW-1#show vlan brief

VLAN Name                         Status Ports

---- -------------------------------- --------- -------------------------------

1 default                      active Gig0/2

50   Data-1                       active Fa0/1, Fa0/2, Fa0/3, Fa0/4

                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8

60   Data-2                       active Fa0/9, Fa0/10, Fa0/11, Fa0/12

                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16

70   Data-3                       active Fa0/17, Fa0/18, Fa0/19, Fa0/20

                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24

99   Native                       active

100  Management                   active

210  Voice                        active Fa0/1, Fa0/2, Fa0/3, Fa0/4

                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8

                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12

                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16

                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20

                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24

DHCP Test

I configured the clients to obtain their addresses automatically from the central DHCP server. The clients successfully received IP addresses from the DHCP server through the configured ip helper-address settings. This verified that DHCP relay was working across the different VLANs.

Reachability Test

Ping tests were performed from devices in different VLANs to the server network. The tests were successful, confirming that:

• VLAN gateways were working.

• Inter-VLAN routing was working.

• Static routes between the routers were working for the configured networks.

• The server network was reachable from the required VLANs.

Web & DNS Test

I configured an A record named web.local for the web server on the DNS server. I then entered the hostname in a client web browser. The DNS name was resolved successfully and the web page loaded, confirming that both DNS resolution and web-server connectivity were working.

Management VLAN Test

I also tested connectivity to the management addresses of the network devices from the server-side management network. The devices in both buildings responded successfully to ping requests, confirming that the management networks and required routing paths were working.

Results

The lab successfully provided a segmented network design for two buildings. Each building has separate data and voice VLANs, while VLAN 100 is used for network-device management. Building A uses MLS-1 for SVI-based inter-VLAN routing, while Building B uses Router-2 with Router-on-a-Stick.

VTP was used to distribute VLAN information to the Layer 2 access switches. SW-4 was kept in transparent mode and was configured locally for the VLANs required by the server network.

Access ports were assigned to specific data VLANs based on their port ranges, and voice VLANs were configured for IP phones. Trunk links use VLAN 99 as the native VLAN, while DTP negotiation was disabled on access ports to prevent them from dynamically negotiating trunking.

The central DHCP server successfully provided addresses to clients across the required VLANs through DHCP relay. DNS resolution and web-server access were also successfully tested.

Finally, connectivity tests confirmed that the required VLANs, servers, routing paths, and management networks were operational.

Resources

The completed Packet Tracer simulation and exported device configuration files are provided on my GitHub.