First, the essential ideas
- Trunk
- An Ethernet trunk carries multiple VLANs over one physical or logical link. It keeps those Layer 2 domains distinct; it does not route between them.
- 802.1Q tag
- An 802.1Q tag adds VLAN information to an Ethernet frame on a trunk. The VLAN identifier is not an IP address and does not encrypt the frame.
- Native VLAN
- On this default untagged-native IOS configuration, an untagged frame received on a trunk is associated with that port's native VLAN. Native IDs must agree at both ends; native tagging options change behavior and are outside this lab.
- Allowed VLAN list
- This list restricts which VLANs may traverse a trunk. A VLAN must also exist and be active and have a forwarding path; appearing in the allowed list alone does not prove delivery.
- DTP
- Dynamic Trunking Protocol can negotiate trunking between compatible Cisco interfaces. Explicit trunk mode with nonegotiate avoids depending on that negotiation; both peers must be configured deliberately.
- SVI
- A switched virtual interface is the switch's logical IP attachment to one VLAN. Here VLAN 20 SVIs are same-subnet test endpoints, not inter-VLAN routers.
- STP
- Spanning Tree Protocol controls Layer 2 forwarding to prevent loops. Even an allowed, active VLAN can have a non-forwarding port because of spanning-tree state.
- Console and baseline
- Console gives direct management access to the selected virtual node. A baseline records operational trunk state and successful tests in each used VLAN before any allowed-list change.
A shared cable does not mean a shared broadcast domain. Keep one worksheet row per VLAN and compare both ends. The experiment intentionally preserves a working VLAN 20 path while breaking VLAN 10, demonstrating why link status is only the first check.
See the idea
A trunk has more than one gate
A VLAN must be allowed, active and forwarding; a green physical link proves none of those by itself.
Read allowed membership
VLAN 10 must be allowed on both trunk endpoints. Removing it on one side breaks the selected path.
What this model leaves out: This is a diagnostic checklist, not a physical packet path. It omits native mismatch and endpoint addressing, which need separate checks.
Full visual explanation and references
Three logical checks run from allowed membership to active VLAN existence to forwarding state. These are verification gates, not network devices.
This is a diagnostic checklist, not a physical packet path. It omits native mismatch and endpoint addressing, which need separate checks.
- Read allowed membership
VLAN 10 must be allowed on both trunk endpoints. Removing it on one side breaks the selected path.
www.cisco.com - Confirm VLAN existence
An allowed number is not proof of an active VLAN database entry. Check both switches.
www.cisco.com - Verify forwarding
Active VLANs still need a forwarding port state. Test the intended endpoints after checking the full trunk output.
www.cisco.com
One idea at a time
Start with something familiar.
Draw two switches joined by one cable, then write VLAN 10 and VLAN 20 beside that cable as separate logical memberships. Place H1 and H2 in VLAN 10 and two switch test addresses in VLAN 20.
Why learn this?
A trunk fault can affect only one department even while other traffic crosses the same cable. Keeping physical state separate from VLAN-specific evidence narrows the investigation quickly.
An everyday comparison
A delivery vehicle carries several separately labeled consignments on one road. The road being open says nothing about whether a particular consignment was permitted onto the vehicle.
What happens in a network
The road represents the physical link, the labels represent VLAN tags and the permitted consignments represent the allowed list. Each destination must interpret labels consistently.
Where the comparison stopsA trunk is not a router or a delivery scheduler. Native untagged classification and spanning-tree forwarding rules have no exact vehicle equivalent.
Follow one worked example
- Agree on both ends of the cable.
SW1 and SW2 explicitly use dot1q trunk mode, native VLAN 999 and the same allowed VLANs. DTP is not required.
Why: One peer cannot infer all intended policy from the other peer's configuration.
- Test each logical domain separately.
H1 tests H2 in VLAN 10; SW1 tests SW2's SVI in VLAN 20. These are different IP prefixes and different tests.
Why: A VLAN 20 reply cannot establish that VLAN 10 crosses the trunk.
- Compare a missing VLAN with a down link.
Removing VLAN 10 at SW2 should break the data test while VLAN 20 remains available. Restoration adds the exact missing membership.
Why: The selective symptom and observed lists provide a better explanation than a green link alone.
Your first small task
On paper, set the native VLAN to 999 on SW1 and 20 on SW2. Trace an untagged frame sent on that cable and state which VLAN SW2 associates with its reception. Do not implement this mismatch in a connected network.
Show a hint
An untagged frame does not carry the sender's native VLAN number; the receiving port supplies its local classification.
Check the expected result
SW2 associates the untagged arrival with its native VLAN 20, not SW1's intended 999.
Pause and explain it in your own words
The trunk is up and VLAN 20 pings work. Is VLAN 10 verified?
Show a hint
Ask which source and destination the successful test actually used.
Show the explanation
No. The result covers the VLAN 20 path only. Check VLAN 10 existence, allowed membership and forwarding state on both ends, then test its own endpoints.
Short answer
What should you understand today?
An 802.1Q trunk carries separate VLANs over a shared link. Most data VLAN frames are tagged; in this lab the native VLAN uses untagged carriage. Verify both ends' operational mode, native VLAN and allowed/active/forwarding VLAN lists. A physical link can remain up while one VLAN is missing. Trunking extends Layer 2 domains; routing between them is a separate function.
Before you begin
Learning targets
- Complete access VLANs and MAC learning before this chapter.
- Use four fresh nodes under an existing CML 2.10 entitlement.
- Know local /24 IPv4 tests and access to each named Console.
- Explain tagged and untagged-native frame classification.
- Configure matching trunk mode, native VLAN and allowed lists.
- Distinguish allowed, active and forwarding evidence.
- Repair a missing allowed VLAN without disabling unrelated traffic.
- Predict a native mismatch and state the limits of a single successful ping.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Trunk
An Ethernet trunk carries multiple VLANs over one physical or logical link. It keeps those Layer 2 domains distinct; it does not route between them.
802.1Q tag
An 802.1Q tag adds VLAN information to an Ethernet frame on a trunk. The VLAN identifier is not an IP address and does not encrypt the frame.
Native VLAN
On this default untagged-native IOS configuration, an untagged frame received on a trunk is associated with that port's native VLAN. Native IDs must agree at both ends; native tagging options change behavior and are outside this lab.
Allowed VLAN list
This list restricts which VLANs may traverse a trunk. A VLAN must also exist and be active and have a forwarding path; appearing in the allowed list alone does not prove delivery.
DTP
Dynamic Trunking Protocol can negotiate trunking between compatible Cisco interfaces. Explicit trunk mode with nonegotiate avoids depending on that negotiation; both peers must be configured deliberately.
SVI
A switched virtual interface is the switch's logical IP attachment to one VLAN. Here VLAN 20 SVIs are same-subnet test endpoints, not inter-VLAN routers.
STP
Spanning Tree Protocol controls Layer 2 forwarding to prevent loops. Even an allowed, active VLAN can have a non-forwarding port because of spanning-tree state.
Console and baseline
Console gives direct management access to the selected virtual node. A baseline records operational trunk state and successful tests in each used VLAN before any allowed-list change.
Tagging preserves separate local networks
A tag provides VLAN identity on a shared Ethernet link so the receiving switch can keep traffic in the intended local domain. Access-facing endpoint frames normally need no tag because the access port supplies membership. The switch adds or removes tagging as appropriate at the boundary; it does not route simply by changing the Ethernet representation.
- The complete data path ends at H2, not at the second switch.
- VLAN tags provide separation context, not confidentiality.
Native means a shared classification convention
Under the lab's default untagged-native behavior, native-VLAN frames leave untagged and received untagged frames enter the local native VLAN. Both sides therefore need the same native ID. Some platforms can tag native traffic explicitly; that is a separate setting and must not be silently assumed. Native VLAN and default access VLAN are distinct attributes.
- Compare native values on both sides rather than reading one configuration.
- Do not induce a native mismatch on a shared or production link.
Allowed is only one of several gates
The allowed list is a configured permission. VLAN existence and active state are separate, and spanning-tree state determines forwarding eligibility. IOS trunk output exposes these distinctions in separate lists. A VLAN may be allowed but absent, or active but not forwarding. Read the full output and correlate it with the selected port.
- Use add/remove when making a deliberate incremental change to an existing list.
- A bare allowed-vlan list sets the list rather than appending to it.
Choose explicit peer behavior
DTP negotiation is not necessary for a manually configured trunk. Two passive dynamic-auto peers do not actively initiate trunk formation. A router or another vendor's endpoint may not implement DTP at all. This lab explicitly configures each peer and suppresses negotiation, which makes the intended state easy to compare.
- Administrative mode and operational mode are not interchangeable evidence.
- Stop on rejected syntax rather than pasting the rest of the block blindly.
Keep the diagnosis VLAN-specific
The lab has a data test and a control test, not two different routes around the fault. VLAN 20 traverses the same physical cable but is independently allowed. This makes a useful comparison: a physical failure would affect both, while the intended allowed-list fault affects VLAN 10. Other real faults can still have selective symptoms, so the observed configuration is essential.
- Record actual before/fault/after output; no author runtime is claimed.
- A successful same-VLAN test does not establish routing between VLAN 10 and 20.
Real-world walkthrough
One department disappears across an otherwise healthy uplink
A hypothetical operator updates an allowed list to carry a new department and accidentally replaces the prior list. Existing devices retain link and another VLAN still works, so a cable fault is unlikely. The operator should inspect each side's lists and the change record before resetting the whole uplink.
- Identify the failed source/destination VLAN and preserve the precise test result.
- Compare operational trunk mode and native settings at both cable endpoints.
- Read allowed, active and forwarding lists rather than stopping at the first VLAN list.
- Restore the missing authorized VLAN without removing existing required members.
- Repeat the affected test and an unaffected control test, then document the limited recovery.
Guided GNS3 lab
A live trunk with a selectively missing data VLAN
Build VLAN 10 endpoint connectivity and VLAN 20 SVI connectivity across one trunk. Remove only VLAN 10 on SW2, observe the targeted failure and restore it. All results are predictions until the learner executes the isolated lab.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| H1 | Gi0/0 | 192.0.2.10/24 | VLAN 10 data source |
| H2 | Gi0/0 | 192.0.2.20/24 | VLAN 10 data destination |
| SW1 | Vlan20 | 198.51.100.1/24 | Control-test source |
| SW2 | Vlan20 | 198.51.100.2/24 | Control-test destination |
Set up the lab
- Create fresh entitled CML nodes with exactly three cables and no external connectors. Record image versions and preserve the starting lab.
- Decline initial configuration dialogs if present. Check each named Console and port mapping before typing; stop on unexpected passwords.
- Keep IP routing disabled on the switches; VLAN 20 SVIs test only one local prefix, not a gateway service.
- Use the paper native-mismatch exercise if practical access is unavailable. Do not claim paper output, capture or simulator throughput as a runtime measurement.
Create SW1 VLAN records
In CML, select SW1, open its Console tab and connect before typing. Inspect the fresh node and create the same three VLAN IDs on this switch. No automatic VLAN database distribution is assumed.
enable
show version
configure terminal
vlan 10
exit
vlan 20
exit
vlan 999
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
show version- Record the actual IOSvL2 software build.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
vlan 10- Create the endpoint data VLAN.
exit- Return from VLAN mode to global mode.
vlan 20- Create the independent control-test VLAN.
exit- Return to global configuration again.
vlan 999- Create the unused native VLAN with no endpoint ports.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- This switch contains VLANs 10, 20 and 999 as active lab VLANs.
- Why this step matters
- A trunk transports VLAN frames; it does not automatically create missing VLAN records on its peer.
Create SW2 VLAN records
In CML, select SW2, open its Console tab and connect before typing. Inspect the fresh node and create the same three VLAN IDs on this switch. No automatic VLAN database distribution is assumed.
enable
show version
configure terminal
vlan 10
exit
vlan 20
exit
vlan 999
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
show version- Record the actual IOSvL2 software build.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
vlan 10- Create the endpoint data VLAN.
exit- Return from VLAN mode to global mode.
vlan 20- Create the independent control-test VLAN.
exit- Return to global configuration again.
vlan 999- Create the unused native VLAN with no endpoint ports.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- This switch contains VLANs 10, 20 and 999 as active lab VLANs.
- Why this step matters
- A trunk transports VLAN frames; it does not automatically create missing VLAN records on its peer.
Build SW1 trunk endpoint
In CML, select SW1, open its Console tab and connect before typing. Gi0/1 is the only interswitch cable. IOSvL2 accepts an encapsulation selector; on fixed-dot1q hardware that line may be absent, so consult its documentation instead of forcing it.
configure terminal
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,999
no shutdown
end
show interfaces trunkWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select this switch's interswitch cable.
switchport trunk encapsulation dot1q- Select 802.1Q on the IOSvL2 interface.
switchport mode trunk- Make trunk mode explicit on this side.
switchport nonegotiate- Suppress DTP; the peer is configured manually.
switchport trunk native vlan 999- Classify untagged native traffic into VLAN 999.
switchport trunk allowed vlan 10,20,999- Set the complete intended allowed list for this fresh lab.
no shutdown- Enable the interswitch data interface.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces trunk- Inspect operational trunk, native VLAN and VLAN lists.
- What you should see
- Gi0/1 should become an operational 802.1Q trunk after both sides are configured.
- Why this step matters
- Both ends need compatible behavior; one side displaying a configured trunk is not sufficient.
Build SW2 trunk endpoint
In CML, select SW2, open its Console tab and connect before typing. Gi0/1 is the only interswitch cable. IOSvL2 accepts an encapsulation selector; on fixed-dot1q hardware that line may be absent, so consult its documentation instead of forcing it.
configure terminal
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
switchport trunk native vlan 999
switchport trunk allowed vlan 10,20,999
no shutdown
end
show interfaces trunkWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select this switch's interswitch cable.
switchport trunk encapsulation dot1q- Select 802.1Q on the IOSvL2 interface.
switchport mode trunk- Make trunk mode explicit on this side.
switchport nonegotiate- Suppress DTP; the peer is configured manually.
switchport trunk native vlan 999- Classify untagged native traffic into VLAN 999.
switchport trunk allowed vlan 10,20,999- Set the complete intended allowed list for this fresh lab.
no shutdown- Enable the interswitch data interface.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces trunk- Inspect operational trunk, native VLAN and VLAN lists.
- What you should see
- Gi0/1 should become an operational 802.1Q trunk after both sides are configured.
- Why this step matters
- Both ends need compatible behavior; one side displaying a configured trunk is not sufficient.
Attach SW1 local tests
In CML, select SW1, open its Console tab and connect before typing. Gi0/0 serves the local IOSv endpoint in VLAN 10. VLAN 20 gets an SVI solely for a separate same-subnet test; do not enable ip routing.
configure terminal
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
exit
interface Vlan20
ip address 198.51.100.1 255.255.255.0
no shutdown
end
show ip interface briefWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the local endpoint access cable.
switchport mode access- Set the endpoint interface to untagged data access.
switchport access vlan 10- Assign the endpoint to VLAN 10.
no shutdown- Enable the local access port.
exit- Return to global configuration before selecting an SVI.
interface Vlan20- Select the logical switch attachment to VLAN 20.
ip address 198.51.100.1 255.255.255.0- Assign this switch's distinct VLAN 20 test address.
no shutdown- Enable the test SVI administratively.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Inspect SVI state; it depends on an active forwarding VLAN path.
- What you should see
- The access port serves VLAN 10 and Vlan20 can become up/up through the trunk.
- Why this step matters
- Independent VLAN tests reveal selective carriage failures that a single green link indicator cannot.
Attach SW2 local tests
In CML, select SW2, open its Console tab and connect before typing. Gi0/0 serves the local IOSv endpoint in VLAN 10. VLAN 20 gets an SVI solely for a separate same-subnet test; do not enable ip routing.
configure terminal
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
exit
interface Vlan20
ip address 198.51.100.2 255.255.255.0
no shutdown
end
show ip interface briefWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the local endpoint access cable.
switchport mode access- Set the endpoint interface to untagged data access.
switchport access vlan 10- Assign the endpoint to VLAN 10.
no shutdown- Enable the local access port.
exit- Return to global configuration before selecting an SVI.
interface Vlan20- Select the logical switch attachment to VLAN 20.
ip address 198.51.100.2 255.255.255.0- Assign this switch's distinct VLAN 20 test address.
no shutdown- Enable the test SVI administratively.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Inspect SVI state; it depends on an active forwarding VLAN path.
- What you should see
- The access port serves VLAN 10 and Vlan20 can become up/up through the trunk.
- Why this step matters
- Independent VLAN tests reveal selective carriage failures that a single green link indicator cannot.
Address H1 data endpoint
In CML, select H1, open its Console tab and connect before typing. Use this IOSv node as one local test endpoint. Its only data interface connects to its switch's Gi0/0; no default route is needed.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.10 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the endpoint's sole switch cable.
ip address 192.0.2.10 255.255.255.0- Assign the endpoint's unique documentation address and /24 mask.
no shutdown- Enable the endpoint data interface.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint has its planned /24 address on the mapped cable.
- Why this step matters
- Both data endpoints share VLAN 10 and one IP subnet, while VLAN 20 is tested separately.
Address H2 data endpoint
In CML, select H2, open its Console tab and connect before typing. Use this IOSv node as one local test endpoint. Its only data interface connects to its switch's Gi0/0; no default route is needed.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.20 255.255.255.0
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the endpoint's sole switch cable.
ip address 192.0.2.20 255.255.255.0- Assign the endpoint's unique documentation address and /24 mask.
no shutdown- Enable the endpoint data interface.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- The endpoint has its planned /24 address on the mapped cable.
- Why this step matters
- Both data endpoints share VLAN 10 and one IP subnet, while VLAN 20 is tested separately.
Baseline the data VLAN
In CML, select H1, open its Console tab and connect before typing. Wait for forwarding state and local discovery, then repeat if an initial probe is lost. Do not introduce the fault until this test is repeatably successful.
ping 192.0.2.20What each command means
ping 192.0.2.20- Test H2 across both access links and the tagged VLAN 10 trunk path.
- What you should see
- Expect H2 replies after normal convergence and discovery.
- Why this step matters
- This confirms the complete intended data path, including both endpoints.
Baseline the independent control VLAN
In CML, select SW1, open its Console tab and connect before typing. Read the entire trunk display and use the distinct VLAN 20 destination. The test does not pass through H1 or H2.
show interfaces trunk
ping 198.51.100.2What each command means
show interfaces trunk- Read operational mode, native VLAN and all three VLAN-state lists.
ping 198.51.100.2- Test SW2's VLAN 20 SVI across the same physical trunk.
- What you should see
- Expect VLANs 10 and 20 forwarding and replies from SW2's SVI.
- Why this step matters
- The unaffected logical path will help distinguish a selective membership problem from a down cable.
Remove only VLAN 10
In CML, select SW2, open its Console tab and connect before typing. After both baselines work, remove one allowed member at this endpoint only. Leave native, access and IP settings unchanged and do not save.
configure terminal
interface GigabitEthernet0/1
switchport trunk allowed vlan remove 10
end
show interfaces trunk
ping 198.51.100.1What each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select SW2's single interswitch trunk.
switchport trunk allowed vlan remove 10- Remove only VLAN 10 while retaining 20 and 999.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces trunk- Record the missing VLAN and still-operational trunk.
ping 198.51.100.1- Verify the VLAN 20 control destination remains reachable.
- What you should see
- Expect VLAN 10 absent from SW2's allowed list while VLAN 20 still replies.
- Why this step matters
- The known change affects one logical domain, not the physical cable or every VLAN.
Test the affected VLAN during the fault
In CML, select H1, open its Console tab and connect before typing. Repeat the identical H2 destination while SW2 excludes VLAN 10. Do not move cables or change addresses to force a different outcome.
ping 192.0.2.20What each command means
ping 192.0.2.20- Repeat the VLAN 10 peer test with its trunk membership missing.
- What you should see
- Expect no successful H1-H2 echo exchange in this topology.
- Why this step matters
- An unchanged physical trunk state cannot compensate for missing VLAN permission.
Restore the missing allowed member
In CML, select SW2, open its Console tab and connect before typing. Add VLAN 10 back on the same port and inspect the full list. Do not replace the list with only 10.
configure terminal
interface GigabitEthernet0/1
switchport trunk allowed vlan add 10
end
show interfaces trunk
ping 198.51.100.1What each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/1- Select the exact trunk changed by the experiment.
switchport trunk allowed vlan add 10- Restore VLAN 10 without dropping the control/native members.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces trunk- Confirm 10,20,999 are allowed and the used VLANs become forwarding.
ping 198.51.100.1- Recheck the control VLAN remained intact after restoration.
- What you should see
- The intended list returns and the control peer still replies.
- Why this step matters
- The incremental inverse preserves working domains while restoring the failed one.
Retest the complete endpoint path
In CML, select H1, open its Console tab and connect before typing. Allow normal convergence, then repeat the original destination. Record actual results and compare with the first baseline.
ping 192.0.2.20
show arpWhat each command means
ping 192.0.2.20- Verify H2 is reachable again over VLAN 10.
show arp- Record the endpoint neighbor relationship after recovery.
- What you should see
- Expect peer replies again; native mismatch behavior and routing remain untested.
- Why this step matters
- Close the change using both membership evidence and the same end-to-end local test.
Verify
- Check both ends' operational trunk mode and native VLAN 999.
- Read allowed, active and forwarding VLAN lists independently.
- Require working VLAN 10 and VLAN 20 baselines before the controlled removal.
- Record the failed data test beside the still-working control test.
- After add 10, prove both paths and preserve the full restored list.
Troubleshoot
- If the trunk does not form, compare mode and encapsulation support on both peers; do not assume two passive dynamic-auto interfaces will negotiate.
- If a VLAN is allowed but inactive, inspect its database record on each switch. Do not use an IP change to repair an absent VLAN.
- If an active VLAN is not forwarding, inspect spanning-tree state rather than disabling spanning tree to force traffic.
- If native VLANs differ, document both values and correct an authorized mismatch deliberately. Do not conclude all tagged VLANs necessarily fail or test this on production.
Use an existing Cisco Modeling Labs 2.10 entitlement and its bundled reference images inside CML only. GNS3 does not provide Cisco images; use images there only when a separate applicable license permits that environment. Do not share or redistribute image files. A CML subscription alone does not authorize exporting its Cisco images to GNS3. Without entitlement, use the explicitly labeled paper exercises; they do not establish hands-on competence.
- Restore SW2's allowed list to 10,20,999 and verify both tests before stopping nodes.
- Preserve the original lab and private evidence. No native mismatch was introduced and no persistent fault should be saved.
Practice set
Answer before you reveal
01Does a trunk route between VLANs?
Inter-VLAN routing needs a router or Layer 3 switch function; shared transport alone does not provide it.
02Why must native IDs agree?
An untagged frame cannot convey the sender's intended VLAN number, so mismatched local classification is hazardous.
03Is allowed equivalent to forwarding?
Read all relevant operational lists and inspect the selected VLAN's actual forwarding path.
04What does an allowed list without add do?
On an existing trunk, an unintended replacement can remove working VLANs while the link remains up.
05Why use VLAN 20 as a control test?
A working control helps narrow the symptom, though the explicit changed setting is still needed to establish this lab's cause.
06Does nonegotiate configure the peer?
Both ends must still be configured compatibly; no command on SW1 guarantees SW2's intended policy.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- A trunk extends VLANs without routing between them.
- Native VLAN classification must agree at both ends.
- Allowed, active and forwarding are distinct checks.
- A link can stay up while one VLAN is unavailable.
- Use an incremental list change when preserving existing members.
- Test the affected VLAN and an independent control before closing recovery.