Answers

Figure 1: Small Network with Two VLANs

vlan 10
vlan 20
!
interface GigabitEthernet1/0/1
 switchport mode access
 switchport access vlan 10
!
interface GigabitEthernet1/0/2
 switchport mode access
 switchport access vlan 10
!
interface GigabitEthernet1/0/3
 switchport mode access
 switchport access vlan 20
!
interface GigabitEthernet1/0/4
 switchport mode access
 switchport access vlan 20

Example 2: SW1 Config

Commentary

Almost all switches (Cisco and other vendors) place interfaces into Virtual Local Area Network (VLAN) 1 by default. Using a default with all ports in one known VLAN helps you quickly place a new switch into a network, but that convention can also be a security risk. Any individual with physical access to one of these switches can connect to a switch port and gain access to the network. Many enterprises use a best practice to place all unused interfaces into an unused VLAN to prevent easy unauthorized access. Any user who connects to a formerly unused port connects to a VLAN that has been configured so that no traffic can enter or leave the VLAN.

For each interface, this lab asked you to perform two configuration tasks on each interface: to configure each interface to be in access mode and for each interface to be placed into their respective VLANs. Specifically, that PC1 and PC2 be placed into VLAN 10, and PC3 and PC4 be placed into VLAN 20.

Additionally, the lab’s wording asked you to explicitly create the VLANs – that is, to first configure the VLANs with the vlan 10 and vlan 20 commands. As it turns out, you could have omitted these two commands, and IOS would have automatically created them when you added the first switchport access vlan command for each VLAN.

Known Issues in this Lab

This section of each Config Lab Answers post hopes to help with those issues by listing any known issues with Packet Tracer related to this lab. In this case, the issues are:

Why Would Cisco Packet Tracer Have Issues?

(Note: The below text is the same in every Config Lab.)

Cisco Packet Tracer (CPT) simulates Cisco routers and switches. However, CPT does not run the same software that runs in real Cisco routers and switches. Instead, developers wrote CPT to predict the output a real router or switch would display given the same topology and configuration – but without performing all the same tasks, an actual device has to do. On a positive note, CPT requires far less CPU and RAM than a lab full of devices so that you can run CPT on your computer as an app. In addition, simulators like CPT help you learn about the Cisco router/switch user interface – the Command Line Interface (CLI) – without having to own real devices.

CPT can have issues compared to real devices because CPT does not run the same software as Cisco devices. CPT does not support all commands or parameters of a command. CPT may supply output from a command that differs in some ways from what an actual device would give. Those differences can be a problem for anyone learning networking technology because you may not have experience with that technology on real gear – so you may not notice the differences. So this section lists differences and issues that we have seen when using CPT to do this lab.

Beyond comparing your answers to this lab’s Answers post, you can test in Cisco Packet Tracer (CPT) or Cisco Modeling Labs (CML). In fact, you can and should explore the lab once configured. For this lab, once you have completed the configuration, try these verification steps. 

1. Test with IP pings once you complete the PC configurations as follows:
   1. Create configuration on PC1 and PC2 to place them in the same subnet.
   2. Ping PC2’s address from PC1, and vice versa. If the ping works, the ports must be in the same VLAN in this case.
   3. Likewise, configure PC3 and PC4 with IP addresses in a second subnet.
   4. Ping PC4’s address from PC3, and vice versa. If the ping works, the ports must be in the same VLAN in this case.
2. Note that because this lab uses no routers or layer 3 switches or routers, the PCs in the same VLAN should be able to ping each other, but they should not be able to ping PCs in other VLANs.