What you will build
This walkthrough was written from Cisco IOS documentation and Packet Tracer behaviour as generally described. It has not been run in Packet Tracer here, so port names and prompts can differ slightly on your version.
Two Catalyst 2960 switches, four PCs and one trunk. VLAN 10 (Sales) and VLAN 20 (Support) each have one PC on each switch. By the end, PCs in the same VLAN reach each other through the trunk, and PCs in different VLANs do not.
Step 1: place and cable the devices
- Add two 2960 switches and four PCs. Rename them SW1, SW2 and PC1 to PC4.
- Use copper straight-through cables from each PC to Fa0/1 or Fa0/2 as shown.
- Connect SW1 Gi0/1 to SW2 Gi0/1 with a copper straight-through cable too: the 2960 detects the cable type automatically (auto MDI-X).
- Wait for the link lights to turn green. They are amber for about 30 seconds while spanning tree settles.
Step 2: give the PCs their addresses
Click a PC, open Desktop, then IP Configuration, choose Static and enter the address and mask from the figure. Leave the gateway empty: there is no router in this lab.
Baseline: before any VLANs
All ports are in VLAN 1 right now. From PC1's Command Prompt, ping 192.168.10.12 should work (same subnet, through the trunk), and ping 192.168.20.21 should fail, because that is another subnet and nothing routes. Note the results; the VLANs will change the first.
Step 3: create VLANs and assign ports
On both switches, click the switch, open the CLI tab and enter:
enable
configure terminal
vlan 10
name SALES
vlan 20
name SUPPORT
exit
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
endVLANs are local to each switch until a trunk carries them, so create them on SW1 and on SW2. Fa0/1 goes to VLAN 10 and Fa0/2 to VLAN 20 on both.
Step 4: configure the trunk
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end
copy running-config startup-configRun on both switches. Limiting the allowed list to 10 and 20 is good practice; the default allows all VLANs.
If your Packet Tracer version rejects switchport mode trunk with a message about encapsulation, enter switchport trunk encapsulation dot1q first.
Step 5: verify
SW1#show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Fa0/3, Fa0/4, ... Gi0/2 10 SALES active Fa0/1 20 SUPPORT active Fa0/2
SW1#show interfaces trunk Port Mode Encapsulation Status Native vlan Gi0/1 on 802.1q trunking 1 Port Vlans allowed on trunk Gi0/1 10,20
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Step 6: break it and fix it
- On SW1, run
switchport trunk allowed vlan remove 10on Gi0/1. PC1 can no longer reach PC3, while VLAN 20 still works. - Find it with
show interfaces trunk: VLAN 10 is missing from the allowed list. - Fix with
switchport trunk allowed vlan add 10and ping again. - Optional: switch to Simulation mode, ping across the trunk and click the frame to see the 802.1Q tag added when it leaves SW1.
Common Packet Tracer problems
- Links stay amber for ages: wait for spanning tree, or use the fast-forward button.
- A PC is in the wrong VLAN: check
show vlan briefand the access port assignment. - Pings across the trunk fail: compare the allowed VLAN lists and the native VLAN on both ends.
- Nothing saved: use
copy running-config startup-configand save the .pkt file.
Test yourself
In this lab, why must the VLANs be created on both switches?
After the configuration, PC1 pings PC2 and fails. Why?
Which command lists which ports belong to which VLAN?
The ping across the trunk fails only for VLAN 10. What do you check?
Why do the link lights start amber?