Join a multilayer switch, an access switch and a router: routed port, LACP trunk and SVIs

Steps

1. Place the five devices and cable them exactly as the Links table lists: Copper Cross-Over for the two links between DSW1 and S1, Copper Straight-Through for the rest. Packet Tracer places the 3650-24PS with its power supply bay empty, so it stays dark. Click the switch, open the Physical tab, drag the AC-POWER-SUPPLY module into the empty bay on the back panel, and the switch boots. When a router first boots, Packet Tracer asks Would you like to enter the initial configuration dialog? [yes/no]:. Answer no and press Enter to reach the Router> prompt. Expect the two links between DSW1 and S1 to come up with one of them amber for a while: until they are bundled, spanning tree sees two parallel links and blocks one.
2. Name R1 and address the end of the routed link that faces DSW1:

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 10.0.0.2 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# end

Router interfaces are Layer 3 and administratively down until no shutdown. The /30 mask 255.255.255.252 leaves a block of four, 10.0.0.0 to 10.0.0.3, so the only two usable addresses are 10.0.0.1 and 10.0.0.2: one for each end. 3. On DSW1, create the VLANs, turn on routing, and make Gi1/0/24 a routed port. The order matters: a switchport refuses ip address, so no switchport comes first.

Switch> enable
Switch# configure terminal
Switch(config)# hostname DSW1
DSW1(config)# vlan 10
DSW1(config-vlan)# name STAFF
DSW1(config-vlan)# exit
DSW1(config)# vlan 20
DSW1(config-vlan)# name SALES
DSW1(config-vlan)# exit
DSW1(config)# vlan 99
DSW1(config-vlan)# name NATIVE-MGMT
DSW1(config-vlan)# exit
DSW1(config)# ip routing
DSW1(config)# interface GigabitEthernet1/0/24
DSW1(config-if)# description Routed link to R1 G0/0/0
DSW1(config-if)# no switchport
DSW1(config-if)# ip address 10.0.0.1 255.255.255.252
DSW1(config-if)# no shutdown
DSW1(config-if)# end
DSW1# ping 10.0.0.2

Expect at least four ! in the ping result (the first echo may show . while ARP resolves). no switchport changed one port to Layer 3; ip routing is the separate, global command that lets DSW1 route between its Layer 3 interfaces at all. 4. Give DSW1 an SVI for each VLAN, then look at their state before any port carries those VLANs:

DSW1# configure terminal
DSW1(config)# interface Vlan10
DSW1(config-if)# ip address 192.168.10.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan20
DSW1(config-if)# ip address 192.168.20.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# interface Vlan99
DSW1(config-if)# ip address 192.168.99.1 255.255.255.0
DSW1(config-if)# no shutdown
DSW1(config-if)# end
DSW1# show ip interface brief

Write down the Status and Protocol columns for Vlan10, Vlan20 and Vlan99. The SVIs are not shut down and their VLANs exist, but no up port on DSW1 carries VLAN 10, 20 or 99 yet, so expect the protocol column to read down. That is lesson 8's up/down case, and it is not a routing fault. 5. Bundle DSW1's two links to S1 with LACP and make the port channel a trunk. The trunk settings go on the Port-channel1 interface, which passes them to both members. The 3650 takes switchport trunk encapsulation dot1q before switchport mode trunk.

DSW1# configure terminal
DSW1(config)# interface range GigabitEthernet1/0/1 - 2
DSW1(config-if-range)# channel-group 1 mode active
DSW1(config-if-range)# exit
DSW1(config)# interface Port-channel1
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 99
DSW1(config-if)# switchport trunk allowed vlan 10,20,99
DSW1(config-if)# switchport nonegotiate
DSW1(config-if)# end

6. Configure S1: the same three VLANs, two access ports, the matching LACP trunk, and a management SVI in VLAN 99. A Layer 2 switch does not route, so it reaches other subnets for its own management traffic through ip default-gateway.

Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# vlan 10
S1(config-vlan)# name STAFF
S1(config-vlan)# exit
S1(config)# vlan 20
S1(config-vlan)# name SALES
S1(config-vlan)# exit
S1(config)# vlan 99
S1(config-vlan)# name NATIVE-MGMT
S1(config-vlan)# exit
S1(config)# interface FastEthernet0/1
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 10
S1(config-if)# exit
S1(config)# interface FastEthernet0/2
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 20
S1(config-if)# exit
S1(config)# interface range GigabitEthernet0/1 - 2
S1(config-if-range)# channel-group 1 mode active
S1(config-if-range)# exit
S1(config)# interface Port-channel1
S1(config-if)# switchport mode trunk
S1(config-if)# switchport trunk native vlan 99
S1(config-if)# switchport trunk allowed vlan 10,20,99
S1(config-if)# switchport nonegotiate
S1(config-if)# exit
S1(config)# interface Vlan99
S1(config-if)# ip address 192.168.99.2 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.99.1
S1(config)# end

7. Give PC1 and PC2 the addresses and gateways in the Addressing table (Desktop > IP Configuration, Static). Wait about 30 seconds for the bundle and spanning tree to settle, then read the bundle, the trunk and the SVIs again:

S1# show etherchannel summary
S1# show interfaces trunk
DSW1# show ip interface brief

Po1 should now be SU (Layer 2, in use) with both members P (bundled). In show interfaces trunk, the last block, VLANs in spanning tree forwarding state and not pruned, is the one that says what really crosses the trunk. The three SVIs on DSW1 should have moved from up/down to up/up, because the trunk now carries their VLANs. From PC1, test routing between the VLANs through DSW1:

C:\> ping 192.168.20.10

8. Break it the way lesson 8 warns about. On S1, someone means to add VLAN 20 to the trunk and types the command without add:

S1# configure terminal
S1(config)# interface Port-channel1
S1(config-if)# switchport trunk allowed vlan 20
S1(config-if)# end

No error appears. Now from PC1 run ping 192.168.10.1 and expect Request timed out. Find the cause without looking at the configuration: run show interfaces trunk on S1 and on DSW1 and compare the allowed lists. S1 now allows only 20, while DSW1 still allows 10,20,99, so VLAN 10 frames from PC1 never leave S1. VLAN 99 went too, so S1's own management SVI has lost its gateway as well. Repair the list by extending it, not by replacing it again:

S1# configure terminal
S1(config)# interface Port-channel1
S1(config-if)# switchport trunk allowed vlan add 10,99
S1(config-if)# end

9. Run show interfaces trunk on S1 once more and confirm the allowed list reads 10,20,99 again, then repeat PC1's pings to 192.168.10.1 and 192.168.20.10. Finish by writing one sentence each, in your own words, on the difference between no switchport and ip routing, and between allowed vlan and allowed vlan add.