Cisco AnyConnect VPN Client Software, which must be installed on the client PC being used to access the lab.
Note: If you are using a reserved DevNet CML lab, you will need to stop any preconfigured lab topologies before importing and running the VLAN lab topology. This will free up used environment resources, ensuring that your lab runs smoothly.
Note: If you are using the reserved DevNet CML lab, the lab topology may initially have objects like the dashed line borders offset like this image. To resolve this issue, resize your browser window temporarily, then adjust back to your liking.
Note: Be sure that you do not have any of the devices in the topology selected when starting the lab or you’ll only start the selected device.
VLANs segment a network on a per-port basis and can span across multiple switches. This allows network administrators to logically segment a switched network based on functions, project teams, or applications rather than on a physical or geographical basis.
By default, all switch port interfaces on a switch are configured as members of VLAN 1, the default VLAN on a Cisco switch. This configuration means that any user or device connected to any other port on the switch can freely communicate with each other. They are part of the same VLAN group. You can validate this.
Note: If your console screen does nothing when hitting the key, click the console screen several times and make sure that the white cursor is blinking on the console screen. Then try again.
enable
command.show vlan
command and review the output. You will notice that all four switch ports are members of VLAN 1.Based on this current switch configuration, all the PC users should be able to communicate with each other. You can validate this.
cisco
and cisco
.ping
command to test connectivity to all the other lab PCs, using the address information from the chart below. All ping tests should be successful.Remember, we are testing for reachability across a switch. That means everything is about Layer 2 connectivity, even though we are pinging Layer 3 IP addresses. Address Resolution Protocol (ARP) will resolve the Layer 3 addresses into their respective Layer 2 addresses.
Note: A basic ping
command, ping 10.10.10.1
on a Linux-based PC will be a continuous ping. To stop the ping, use the Control + C key combination. An alternative to the basic ping
command is to specify how many pings to send and automatically stop. For instance, ping -c 4 192.168.2.1
would only send a count of four pings, then return the test results and bring you automatically back to the prompt.
If you look at the topology diagram a little closer, you can see the design calls for two VLANs to be configured. PC1 and PC2 should be in the default VLAN, VLAN 1, while PC3 and PC4 should be in VLAN 2. By segmenting users or devices into different VLANs, communication is possible between members of the same VLAN while at the same time preventing communication between members of different VLANs. To implement this design, you first need to create VLAN 2.
The configure terminal
command moves your prompt into global configuration mode, where you have access to additional commands not found in user EXEC mode.
The vlan 2
command creates your second VLAN, VLAN 2, which is by default named “VLAN0002” by the switch. It also moves you into VLAN subconfiguration mode, where additional commands can be performed as necessary. It should be noted that if VLAN 2 had already existed, this command would simply move you into VLAN subconfiguration mode.
The final command, end
, returns you back to the privileged EXEC mode prompt.
show vlan
command again. This time, we see that VLAN 2 is now added to the list. However, there are no ports assigned to this VLAN.To segment our PC users into the appropriate VLANs, we will need to configure the switch interfaces that PC3 and PC4 are connected to in order to be members of VLAN 2. Remember, PC1 and PC2 are supposed to be in VLAN 1, which they are by default.
If you look at the topology diagram again, PC3 and PC4 connect to the switch on ports Gi0/2 and Gi0/3, respectively. These ports need to be configured as members of VLAN 2.
interface range GigabitEthernet 0/2 - 3
. The range
option allows the same configuration commands to be applied across a group of contiguous interfaces at the same time. “Contiguous” means one after another or together in sequence, like 1, 2, and 3 or 5, 6, and 7.switchport mode access
, followed by a second command, switchport access vlan 2
. These commands tell the switch that the two ports will be used by devices for network access and also that they are members of VLAN 2.Use the end
command to exit completely out of global configuration mode and return to the privileged EXEC prompt.
We can validate that the interfaces have been assigned to VLAN 2 by using the show vlan
command again. This time, ports Gi0/2 and Gi0/3 are assigned to VLAN 2. Any users or devices connected to these ports will be members of VLAN 2, and their communication will be managed accordingly.
With our new configuration in place, it’s time to see if the VLANs are functioning the way they should.
Access PC1 again.
From the prompt, use the ping
command again to test connectivity to all the other lab PCs. The ping test between PC1 and PC2 should be successful. However, the ping tests between PC1 and PC3 or PC4 should fail.
Note: When pinging from PC1 to PC2, you will see a response message displayed after each successful ping. However, for PC3 and PC4, there will be no response messages displayed because this communication is no longer permitted. If you are not using the ping -c
option, allow the ping test to run a few seconds before stopping,using the Control + C key combination. Then, you can verify that packets were sent, but none were received.
Access PC3’s console and log in using the same cisco
and cisco
credentials.
From the prompt, run the ping test again to all the other lab PCs.
As you would expect based on the new VLAN configuration, PC3 is not able to communicate with PC1 or PC2. However, PC3 can communicate with PC4 now that both are members of the same VLAN, VLAN 2.
Congrats on completing this training tutorial! Please continue your learning through our community’s many other resources, helping folks get started on their CCNA journey.