Domain 2 capstone — implement the branch you designed

capstone · 150 min · Objective 2.3

Task

Take the branch office design from the domain 1 capstone and build its switching, routing and wireless layers in the lab. This is the implementation domain, so the deliverable is a working configuration and evidence it behaves as specified — not another document.

Steps

  1. VLANs. Create the VLANs your design specified — staff, wireless, voice, cameras, servers, management — on a VLAN-aware bridge. Assign at least three namespaces as hosts in different VLANs.
  2. Trunk. Connect the switch bridge to the router over a single link carrying all VLANs tagged. Set the native VLAN to an unused ID and say in one line why.
  3. Inter-VLAN routing. Create a subinterface on the router for each VLAN (sudo ip link add link eth0 name eth0.10 type vlan id 10), address each as its VLAN's gateway, and enable forwarding. Prove that a host in the staff VLAN reaches a host in the server VLAN and that the route goes through the router.
  4. Spanning tree. Add a second switch bridge and connect it to the first twice. Confirm STP blocks one link and identify which bridge became root. Then deliberately set a low priority on the bridge that should be root and confirm the election changes.
  5. Routing. Add a second router and run OSPF between them so that each learns the other's subnets, rather than static routes. Confirm with show ip route ospf and prove convergence by shutting a link.
  6. Wireless. If you have an AP, configure it with WPA2 or WPA3 and map its SSID onto the wireless VLAN. If not, write the configuration you would apply and state the channel from the survey you did in the previous lab.
  7. Evidence. Collect the outputs listed under Verify into one file. That file is what a reviewer would ask for.

Verify

bridge vlan show
ip -br addr show | grep -E "\.[0-9]+"
bridge link show | grep -E "state (blocking|disabled|forwarding)"
ip route show
sudo vtysh -c "show ip ospf neighbor" 2>/dev/null || echo "OSPF not configured on this host"
sudo ip netns exec staff ping -c 2 10.50.4.10
sudo ip netns exec staff traceroute -n 10.50.4.10

The evidence that the design is implemented rather than merely typed: the VLAN table lists every VLAN with the right ports, the router shows one subinterface per VLAN, exactly one bridge port is blocking, the OSPF neighbour is Full, and the traceroute between two VLANs shows the router as an intermediate hop. One hop means you are bridging where you meant to route.

Notes

Three implementation mistakes this capstone is built to surface.

A trunk that works one way. If one side's native VLAN differs from the other's, the untagged traffic lands in the wrong VLAN and the symptom is a subset of hosts with strange connectivity. Check both ends, always.

Inter-VLAN routing that is not routing. If the traceroute shows one hop, the two VLANs are bridged together somewhere — usually a port left in the wrong VLAN, or vlan_filtering not enabled on the bridge. The traceroute is the test, not the ping.

The root bridge nobody chose. Left to defaults, the switch with the lowest MAC address wins, and that is usually the oldest device in the building. Your design should name the root and set its priority explicitly, and step 4 is where you prove you can.

Keep the evidence file. The domain 5 capstone asks you to troubleshoot faults injected into exactly this build.