Apply the concept of networking to understand Virtual LAN Networks and configure VLAN
Aim / Objective
To understand the principles of Virtual Local Area Networks (VLANs), broadcast domain segmentation, and IEEE 802.1Q frame tagging; configure Access ports and Trunk ports on a managed switch; and verify traffic isolation between different VLANs and inter-VLAN routing concepts.
Hardware & Software Requirements
Hardware Components
- Managed Layer-2 or Layer-3 Ethernet Switch (e.g., Cisco Catalyst 2960 / D-Link DGS-1210 / TP-Link JetStream)
- Three or four Desktop PCs / Laptops to connect to different switch ports
- Cat6 Ethernet Patch Cables
- Console Cable (RJ45 to USB / RS-232) for initial switch CLI configuration
Software, OS & Tools
- Terminal Emulator for Switch Console (PuTTY / Tera Term / Minicom @ 9600 baud, 8-N-1)
- Cisco Packet Tracer / GNS3 (for virtual lab simulation and packet inspection)
- Wireshark Network Protocol Analyzer (to inspect 802.1Q 4-byte VLAN tags on trunk links)
Teacher's Lab Delivery Guide
Essential briefing notes, pedagogy, and setup tips for lab instructors⏱ 5-Minute Pre-Lab Lecture Briefing:
Explain that a default switch is one big broadcast domain: when one PC sends an ARP broadcast, every single computer on the switch hears it. A VLAN breaks one physical switch into multiple isolated virtual switches logically. Use the apartment building analogy: different floors have separate secure keycard access even though they share the same physical building and plumbing.
📝 Key Concepts to Write on Whiteboard:
- Broadcast Domain vs Collision Domain
- Why VLANs? Traffic containment, security isolation, departmental segmentation, cost reduction
- VLAN ID Range: Normal Range (1 - 1005), Default VLAN 1 (cannot be deleted)
- Access Ports (connected to end-devices like PCs and printers; carries untagged frames)
- Trunk Ports (connected between switch-to-switch or switch-to-router; carries multiplexed tagged frames using IEEE 802.1Q standard)
- IEEE 802.1Q frame format: inserts a 4-byte Tag (TPID `0x8100` + 12-bit VLAN ID allowing 4094 VLANs)
- Native VLAN concept (untagged frames on a trunk)
- Inter-VLAN routing requirement (Layer 3 Switch or Router-on-a-Stick with sub-interfaces)
Step-by-Step Practical Procedure
Connect to Switch Console & Enter Privileged Mode
Connect the console cable from PC USB to the Switch Console port. Open PuTTY, select Serial connection at COM port, baud rate 9600. Press Enter to access the CLI prompt. Enter privileged EXEC mode.
Switch> enable\nSwitch# show vlan briefCreate VLAN 10 (Faculty) and VLAN 20 (Students)
Enter global configuration mode. Create VLAN 10 and assign the name "Faculty". Create VLAN 20 and assign the name "Students".
Switch# configure terminal\nSwitch(config)# vlan 10\nSwitch(config-vlan)# name Faculty\nSwitch(config-vlan)# vlan 20\nSwitch(config-vlan)# name Students\nSwitch(config-vlan)# exitAssign Switch Ports to VLANs (Access Mode)
Configure interface FastEthernet 0/1 as an Access port belonging to VLAN 10. Configure interface FastEthernet 0/11 as an Access port belonging to VLAN 20.
Switch(config)# interface fastEthernet 0/1\nSwitch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 10\nSwitch(config-if)# interface fastEthernet 0/11\nSwitch(config-if)# switchport mode access\nSwitch(config-if)# switchport access vlan 20\nSwitch(config-if)# endConfigure Trunk Link between Switches (802.1Q)
Configure GigabitEthernet 0/1 connecting to another switch as an 802.1Q Trunk port to carry traffic for both VLAN 10 and VLAN 20 across switches.
Switch(config)# interface gigabitEthernet 0/1\nSwitch(config-if)# switchport mode trunk\nSwitch(config-if)# switchport trunk allowed vlan 10,20\nSwitch(config-if)# endVerify Traffic Isolation & Broadcast Containment
Assign IP `192.168.10.2/24` to PC1 (Port Fa0/1 - VLAN 10) and `192.168.10.3/24` to PC2 (Port Fa0/2 - VLAN 10). Verify they can ping each other. Next, connect PC3 with IP `192.168.20.2/24` (Port Fa0/11 - VLAN 20). Attempt to ping PC1 from PC3 and observe 100% packet loss.
Test: ping 192.168.10.2 from PC3 (Request timed out)Interactive Hands-On Lab Simulator
Practice and test concepts virtually before or after performing on physical lab equipmentObservations & Student Lab Record
Students are required to record the following measured parameters, hardware specifications, and output status into their physical lab journals:
| Switch Port | Configured Port Mode | Assigned VLAN | Connected Device IP | Communication Capability |
|---|---|---|---|---|
| FastEthernet 0/1 | Access | VLAN 10 (Faculty) | PC-A (192.168.10.2/24) | Can communicate with PC-B (VLAN 10); CANNOT communicate with PC-C (VLAN 20) |
| FastEthernet 0/2 | Access | VLAN 10 (Faculty) | PC-B (192.168.10.3/24) | Can communicate with PC-A (VLAN 10); CANNOT communicate with PC-C (VLAN 20) |
| FastEthernet 0/11 | Access | VLAN 20 (Students) | PC-C (192.168.20.2/24) | Isolated in VLAN 20; broadcast frames from VLAN 10 do not reach PC-C |
| GigabitEthernet 0/1 | Trunk (802.1Q) | VLANs 10, 20 Allowed | Switch-2 Uplink | Multiplexes and tags frames for all allowed VLANs between switches |
Conclusions & Learning Outcome
Virtual Local Area Networks (VLANs 10 and 20) were configured on a managed switch. Access ports were assigned to isolate end-user stations into separate broadcast domains, and an 802.1Q trunk port was established for inter-switch transport. Complete traffic isolation between departments was validated; communication between VLANs requires Layer 3 routing.
Oral Exam & Viva Questions with Answers
Essential questions asked by external examiners and lab evaluators (Accordion UI)A VLAN (Virtual Local Area Network) is a logical grouping of network devices that behave as if connected to the same physical wire, regardless of physical switch topology. It solves the problem of excessive broadcast traffic by breaking a single large broadcast domain into multiple smaller, isolated broadcast domains, improving security, bandwidth efficiency, and manageability.