🔧 Lab 3.1: VLAN Segmentation & Access Port Configuration

📋 Lab Overview

This laboratory focuses on implementing VLAN segmentation and configuring access ports in a multi-department enterprise network. You will create multiple Virtual Local Area Networks (VLANs) to establish logical broadcast domains, segment network traffic, and configure access ports for end-user devices.

🎯 Lab Objectives

• Create and configure VLANs (normal range: 2-1001, extended range: 1006-4094)
• Assign access ports to specific VLANs for end devices
• Understand and implement broadcast domain isolation
• Configure port security to restrict MAC addresses on access ports
• Verify VLAN configuration and membership using CLI commands
• Troubleshoot VLAN and access port connectivity issues
• Apply security best practices for layer 2 access ports

🏢 Real-World Scenario

ABC Corporation requires network segmentation across three departments: Human Resources, Information Technology, and Finance. Each department operates in a different VLAN to enforce security policies, improve performance, and maintain compliance with organizational standards. You will design and implement this segmentation using Cisco Catalyst switches.

📦 Equipment & Prerequisites

Hardware Requirements

Software & Knowledge Requirements

• Cisco IOS or IOS-XE version 15.0 or later
• Basic understanding of OSI model and Layer 2 switching
• Familiarity with Cisco CLI command structure
• Knowledge of MAC addressing and broadcast domains
• Understanding of VLAN concepts and benefits

🌐 Network Topology & Lab Picture

Figure 1: Lab 3.1 - Multi-Department VLAN Segmentation with ABC Corporation Network Setup

VLAN Configuration Summary

⚙️ Step-by-Step Configuration Guide

✅ Configuration Verification & Testing

Verification Commands

Command: show vlan brief

Command: show interfaces switchport

Command: show interface status

Command: show port-security

🧪 Connectivity Testing & Validation

Test Intra-VLAN Communication

Test Case 1.1: HR-to-HR Communication

Test Inter-VLAN Isolation

Test Case 2.1: HR-to-IT Communication (Should Fail)

📋 Lab Completion Checklist

Configuration Verification

• ☐ All three VLANs (10, 20, 30) created successfully
• ☐ VLAN names configured correctly
• ☐ Access ports assigned to correct VLANs
• ☐ All ports configured as switchport access mode
• ☐ Port descriptions added to all access ports
• ☐ Port security enabled on all access ports
• ☐ Port security violation action set to shutdown
• ☐ MAC address maximum limits configured appropriately
• ☐ Configuration saved to startup-config

Connectivity Testing

• ☐ Intra-VLAN communication successful
• ☐ Inter-VLAN communication blocked
• ☐ MAC addresses learned in correct VLANs
• ☐ Port status shows "connected" for all active devices
• ☐ No port-security violations detected
• ☐ All interfaces operational and error-free

💡 Key Takeaways & Learning Outcomes

• VLAN segmentation creates logical broadcast domains on a single physical switch, improving security and network performance
• Access ports carry untagged traffic for a single VLAN and are the primary connection point for end-user devices
• Broadcast domain isolation requires Layer 3 routing; Layer 2 alone cannot route traffic between VLANs
• Port security provides Layer 2 protection by restricting MAC addresses on specific ports
• Proper VLAN naming and port descriptions are essential for network documentation and troubleshooting
• Configuration verification commands are critical for validating that changes were applied correctly
• Cisco switches support normal (2-1001) and extended (1006-4094) VLAN ranges for scalability

🏆 Best Practices & Security Recommendations

VLAN Configuration Best Practices

• Always document VLAN allocation and port assignments in a network diagram
• Use meaningful VLAN names that reflect department or function
• Reserve VLAN 1 for administrative/management purposes only
• Implement consistent VLAN numbering scheme across all switches
• Regularly audit VLAN assignments to ensure compliance with security policies
• Remove unused VLANs to maintain a clean configuration

Port Security Best Practices

• Enable port security on all access ports connected to untrusted devices
• Set port security violation action to "shutdown" for high-security environments
• Use "restrict" or "protect" for production environments where port shutdown may cause business disruption
• Configure appropriate maximum MAC address limits based on device requirements
• Regularly monitor port security violations for security incidents
• Use sticky MAC address learning to persistently record authorized MAC addresses

Layer 2 Security Best Practices

• Avoid creating VLANs 1002-1005 as they are reserved legacy VLANs
• Implement STP or Rapid PVST+ to prevent Layer 2 loops
• Use VLAN access control lists (VACLs) for additional traffic filtering within VLANs
• Monitor MAC address table for signs of spoofing or flooding attacks
• Document all MAC address assignments for inventory and compliance purposes

🔧 Troubleshooting Guide