LogoفارسیFA

Hands-On Lab: Configuring Standard VLANs on Catalyst Switches

This hands-on lab covers creating standard-range VLANs, assigning access ports to them, and verifying that devices in different VLANs are properly isolated from each other at Layer 2.

VLAN CreationAccess Port AssignmentVLAN Verification

~2 min read · Updated Sep 12, 2026

Lab Objective

Create two standard-range VLANs on a Catalyst switch, assign specific access ports to each, and verify that devices in different VLANs cannot communicate directly while devices in the same VLAN can.

Lab Purpose

Creating and assigning VLANs is one of the single most common configuration tasks performed on any Cisco switch, forming the basis for network segmentation in virtually every enterprise deployment.

Lab Topology

Switch1
  Gi1/0/1 ---- PC-A (VLAN 10 - Accounting)
  Gi1/0/2 ---- PC-B (VLAN 10 - Accounting)
  Gi1/0/3 ---- PC-C (VLAN 20 - Marketing)

PC-A: 192.168.10.10/24
PC-B: 192.168.10.11/24
PC-C: 192.168.20.10/24

Task 1: Create the VLANs

Create VLAN 10 named Accounting and VLAN 20 named Marketing.

Task 2: Assign Ports to VLANs

Configure Gi1/0/1 and Gi1/0/2 as access ports in VLAN 10, and Gi1/0/3 as an access port in VLAN 20.

Task 3: Verify VLAN Assignment

Confirm each port shows the correct VLAN membership.

Task 4: Verify Connectivity Within the Same VLAN

Confirm PC-A can ping PC-B, since both are in VLAN 10.

Task 5: Verify Isolation Between VLANs

Confirm PC-A cannot ping PC-C, since they are in different VLANs with no inter-VLAN routing configured.

Solution and Verification

Switch1(config)# vlan 10
Switch1(config-vlan)# name Accounting
Switch1(config-vlan)# exit
Switch1(config)# vlan 20
Switch1(config-vlan)# name Marketing
Switch1(config-vlan)# exit

Switch1(config)# interface range gigabitethernet1/0/1-2
Switch1(config-if-range)# switchport mode access
Switch1(config-if-range)# switchport access vlan 10
Switch1(config-if-range)# exit

Switch1(config)# interface gigabitethernet1/0/3
Switch1(config-if)# switchport mode access
Switch1(config-if)# switchport access vlan 20

Switch1# show vlan brief

VLAN Name       Status    Ports
---- ---------- --------- ---------------------
10   Accounting active    Gi1/0/1, Gi1/0/2
20   Marketing  active    Gi1/0/3

PC-A> ping 192.168.10.11

Reply from 192.168.10.11: bytes=32 time=1ms
Reply from 192.168.10.11: bytes=32 time=1ms

PC-A> ping 192.168.20.10

Request timed out.
Request timed out.
-- No route exists between VLAN 10 and VLAN 20
-- without inter-VLAN routing configured, and
-- Layer 2 alone never bridges separate VLANs

Key Takeaway

Devices in the same VLAN communicate freely at Layer 2 regardless of which physical port they connect to, while devices in different VLANs are completely isolated from each other until a Layer 3 device is configured to route between them — VLAN creation alone provides segmentation, not connectivity.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Final Comprehensive CCNP Troubleshooting Challenge (BGP, DMVPN, and QoS Integration)

This hands-on lab presents a complex multi-layer failure across an integrated BGP-over-DMVPN topology combined with QoS marking, requiring systematic diagnosis of a route reflector misconfiguration, an NHRP registration failure, and an incorrectly applied QoS policy simultaneously affecting the same network.

Continue

Hands-On Lab: Configuring BGP over DMVPN

This hands-on lab runs iBGP as the routing protocol across the same DMVPN hub-and-spoke topology used in the two previous labs, configuring the hub as a route reflector so spokes learn each other's routes without a full iBGP mesh, combining two previously separate concepts into one integrated design.

Continue

Hands-On Lab: Configuring OSPF over DMVPN

This hands-on lab runs OSPF as the dynamic routing protocol across the same DMVPN hub-and-spoke topology, configuring the tunnel interface as an OSPF point-to-multipoint network type to correctly handle the hub-and-spoke adjacency pattern without requiring the broadcast network type's DR/BDR election.

Continue

Hands-On Lab: Configuring EIGRP over DMVPN

This hands-on lab runs EIGRP as the dynamic routing protocol across the DMVPN hub-and-spoke topology built in earlier labs, verifying neighbor relationships form correctly across the multipoint tunnel and routes propagate without requiring per-spoke static configuration on the hub.

Continue

Hands-On Lab: Configuring HSRP MD5 Authentication

This hands-on lab configures MD5 authentication on an HSRP group, verifying two routers with matching authentication strings form a normal active/standby relationship while a router with a mismatched string is excluded from the group entirely.

Continue

Hands-On Lab: Configuring Cisco Umbrella-Style DNS Security via DNS Forwarding Redirection

This hands-on lab configures a router to redirect all client DNS queries toward a security-focused DNS resolver using DNS forwarding interception, approximating cloud-delivered DNS security enforcement without requiring per-client configuration changes.

Continue
Previous ArticleNext Article