First, the essential ideas
- Evidence chain
- A sequence of observations connecting a named source, local VLAN, forwarding path, gateway and destination. A conclusion should explain all observations, including facts that remain healthy during a failure.
- Layer 2 and Layer 3 ports
- A Layer 2 switchport carries frames within an access VLAN or trunk. A routed Layer 3 port owns an IP attachment. Here SW2 Gi0/0 is Layer 2 while the connected R1 Gi0/0 is a routed interface.
- ARP and MAC table
- Address Resolution Protocol maps a local IPv4 next hop to its MAC address. A switch MAC table maps learned source MAC addresses to VLANs and ports. The two tables answer different questions.
- LACP and logical port-channel
- Link Aggregation Control Protocol negotiates physical members of one logical interface. Both physical members must participate; spanning tree treats the channel as one logical link.
- Extended ping
- A ping with controlled parameters such as a selected local source, count and size. A successful test needs an echo request and its reply path; it does not prove every application works.
- Traceroute and TTL
- Traceroute probes with increasing Time To Live values to expose responding routed hops. Layer 2 switches do not consume IP TTL merely while switching, so they do not appear as ordinary routed hops.
- Packet capture and observation point
- A capture records traffic visible on one selected link during a bounded interval. Missing packets can reflect the wrong point, timing or filter, not just a forwarding failure.
- Baseline and rollback
- The baseline records a working test with its exact source and destination. Rollback restores the changed setting, then repeats those same checks rather than replacing them with an easier test.
A packet crosses several boundaries, and each tool exposes only part of that journey. The exercise keeps the bundle healthy while moving one access port into the wrong VLAN. That lets you learn why a green uplink and a failed remote ping are not contradictory.
See the idea
Trace the whole path, then fix one boundary
The trunk bundle can remain healthy while SW2's router-facing access port breaks the VLAN 10 path.
Working complete flow
H1 reaches H2 through VLAN 10, the two-member Po1 trunk and R1. H2 returns through 198.51.100.1.
What this model leaves out: All five nodes and five cables are shown. H1 and H2 are IOSv endpoint models. Both member edges show the bundle, not a claim that each single flow uses both.
Full visual explanation and references
H1 connects through SW1, two Po1 member cables, SW2 and router R1 to H2. The tested fault is SW2 Gi0/0's VLAN assignment, not the trunk bundle.
All five nodes and five cables are shown. H1 and H2 are IOSv endpoint models. Both member edges show the bundle, not a claim that each single flow uses both.
- Working complete flow
H1 reaches H2 through VLAN 10, the two-member Po1 trunk and R1. H2 returns through 198.51.100.1.
www.cisco.com - Wrong access VLAN
Only SW2 Gi0/0 moves to VLAN 20. Po1 remains healthy, but the intended source VLAN no longer reaches its gateway.
www.cisco.com - Repair and retest
Restore SW2 Gi0/0 to VLAN 10. Repeat the same source-controlled probes and access-link capture to verify the complete path.
developer.cisco.com
One idea at a time
Start with something familiar.
Write the test as 192.0.2.10 to 198.51.100.10, then trace its local next hop 192.0.2.1. Label each cable before reading any command output.
Why learn this?
Without a fixed source and destination, a different successful ping can accidentally test another VLAN or return path. A consistent test makes before-and-after evidence comparable.
An everyday comparison
To find a misdelivered parcel, check the sender, local collection point, transfer route and final address instead of replacing every vehicle on the route.
What happens in a network
The source address, gateway, switching path and remote endpoint provide checkpoints. A verified healthy checkpoint narrows the remaining possibilities.
Where the comparison stopsPackets can take asymmetric paths and control messages can be filtered. The analogy does not make one observation proof of the entire route.
Follow one worked example
- Establish working service and local forwarding facts.
The endpoint reaches its gateway and remote peer while both LACP members and VLAN 10's tree are healthy.
Why: A known working baseline identifies what the deliberate fault actually changes.
- Inspect the boundary that disagrees with the design.
SW2's router-facing Gi0/0 moves into VLAN 20 while the trunk still correctly carries VLAN 10.
Why: The physical link can stay up even though the intended broadcast domain is broken.
- Correct and repeat the same tests.
Returning Gi0/0 to VLAN 10 restores the intended relationship; the original probes and capture then verify service.
Why: Changing several settings at once would hide which hypothesis was correct.
Your first small task
On paper, assume both LACP members are bundled and VLAN 10 is allowed on Po1, but SW2 Gi0/0 reports access VLAN 20. Explain why H1 cannot reach R1's 192.0.2.1 address despite both devices using a /24 mask.
Show a hint
IP addresses do not override a switch's VLAN classification.
Check the expected result
The address plan expects one VLAN 10 segment, but the access-port assignment places R1 in a different Layer 2 domain.
Pause and explain it in your own words
Should a normal IP traceroute list SW1 and SW2 as routed hops?
Show a hint
Ask which devices decrement the probe's IP TTL.
Show the explanation
No. These two switches forward at Layer 2 in this design. R1 is the transit router; a missing switch name in traceroute does not mean the frame bypassed that switch.
Short answer
What should you understand today?
Troubleshoot a named flow by correlating evidence at each boundary. Confirm physical and logical interface state, access VLAN, trunk carriage, MAC learning, LACP participation and the VLAN's spanning tree before blaming routing. Use a controlled-source ping and traceroute, then a capture at a stated link. A healthy trunk does not prove the router-facing access port belongs to the correct VLAN. Restore one proven mismatch and repeat the original test.
Before you begin
Learning targets
- Complete access VLAN, trunk, LACP and Rapid PVST+ practice.
- Understand local versus remote IPv4 destinations and a default next hop.
- Use an existing CML 2.10 entitlement with IOSvL2 and IOSv reference images.
- Document every physical link and both IP endpoints.
- Correlate access, trunk, MAC, LACP and STP state on the same VLAN.
- Distinguish a switchport from the routed port on the other end of its cable.
- Use extended ping, traceroute and actual capture fields without overclaiming their meaning.
- Repair one deliberate VLAN mismatch and repeat the full baseline.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
Evidence chain
A sequence of observations connecting a named source, local VLAN, forwarding path, gateway and destination. A conclusion should explain all observations, including facts that remain healthy during a failure.
Layer 2 and Layer 3 ports
A Layer 2 switchport carries frames within an access VLAN or trunk. A routed Layer 3 port owns an IP attachment. Here SW2 Gi0/0 is Layer 2 while the connected R1 Gi0/0 is a routed interface.
ARP and MAC table
Address Resolution Protocol maps a local IPv4 next hop to its MAC address. A switch MAC table maps learned source MAC addresses to VLANs and ports. The two tables answer different questions.
LACP and logical port-channel
Link Aggregation Control Protocol negotiates physical members of one logical interface. Both physical members must participate; spanning tree treats the channel as one logical link.
Extended ping
A ping with controlled parameters such as a selected local source, count and size. A successful test needs an echo request and its reply path; it does not prove every application works.
Traceroute and TTL
Traceroute probes with increasing Time To Live values to expose responding routed hops. Layer 2 switches do not consume IP TTL merely while switching, so they do not appear as ordinary routed hops.
Packet capture and observation point
A capture records traffic visible on one selected link during a bounded interval. Missing packets can reflect the wrong point, timing or filter, not just a forwarding failure.
Baseline and rollback
The baseline records a working test with its exact source and destination. Rollback restores the changed setting, then repeats those same checks rather than replacing them with an easier test.
Start with a flow and an exact physical map
Name both endpoint addresses, masks, gateways and interface MAC addresses. On the source-side LAN the remote packet is addressed in Ethernet to the gateway's MAC, not to the remote endpoint's MAC. Across the routed boundary, Ethernet headers change while the original IP source and destination remain, absent translation.
- The lab's source-side capture should be interpreted against actual H1 and R1 MAC addresses.
- Both endpoint default routes are part of the baseline, not an optional afterthought.
Separate wire health from VLAN and channel health
show interfaces reports physical state and counters, while show interfaces switchport and show vlan brief explain access classification. show interfaces trunk exposes VLAN carriage, and show etherchannel summary with show lacp neighbor proves participating members. A configured channel is not necessarily a complete operational bundle.
- Check both ends of each actual link and read the command's flag legend.
- A single successful flow can hide a missing bundle member, so verify both members explicitly.
Use MAC and spanning-tree evidence in the same VLAN
MAC entries include a VLAN and interface, so a matching address in the wrong VLAN is not proof of the intended path. Dynamic entries may remain until aging or may be relearned after changes. Check the actual root ID and port roles for VLAN 10; the LACP bundle is one logical STP link.
- Record MAC addresses from actual interfaces instead of inventing them.
- Do not disable STP or clear every table just to make evidence easier to read.
Control the source and understand traceroute limits
Extended ping lets the learner choose an address actually owned by the source device and keep count, size and timeout stable. Cisco IOS traceroute commonly uses UDP probes and ICMP responses with increasing TTL. Asterisks mean no response within the interval; they do not uniquely identify a dead router.
- A source address cannot be borrowed from another node to create a meaningful endpoint test.
- A working ICMP probe does not establish TCP, DNS or application health.
A capture must have a stated observation point
Use CML's running-link capture on H1 Gi0/0--SW1 Gi0/0. Bound it by 100 packets or 20 seconds, preserve it before starting another capture, and inspect actual Ethernet/IP/ICMP fields. IOSvL2 does not support SPAN, so do not invent a monitor-session result. The access-side observation does not include trunk tags.
- Capture timing and cached ARP change what is visible.
- Seeing a request leave H1 proves only that observation point, not arrival at H2.
Repair only the contradiction and retain honest evidence
Compare the current state to the recorded design, change one proven mismatch and repeat all affected checks. Read actual logs, but a VLAN reassignment need not produce a physical link-down message. A quiet buffer does not establish an unchanged data path. Keep the channel, root and router settings stable during the controlled fault.
- The supplied lesson is an authored procedure; no author runtime or performance result is claimed.
- This integrates selected switching objectives rather than claiming all campus troubleshooting cases.
Real-world walkthrough
The gateway cable is up, but the VLAN is wrong
A hypothetical change moves a router-facing access port into a different VLAN. The endpoint loses remote connectivity, while the uplink bundle and router interfaces still look physically healthy. An engineer proposes rebuilding EtherChannel before checking where the router's untagged frames are classified.
- Fix the test identity: H1's source address, R1's gateway and H2's destination.
- Confirm the routed interfaces and both endpoint return paths are still configured correctly.
- Verify both LACP members and the VLAN 10 trunk/STP path without changing them.
- Compare SW2 Gi0/0's actual access VLAN with the design and locate the contradiction.
- Restore that one assignment and repeat the original source-controlled probe plus capture.
Guided GNS3 lab
Correlate a campus path before repairing one VLAN
Build five named nodes, capture a working flow, introduce one router-facing VLAN error, and restore the original path. All observations below are expected conditions for the learner to measure, not executed author evidence.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| H1 | Gi0/0 | 192.0.2.10/24 | Source; default via 192.0.2.1 |
| R1 | Gi0/0 | 192.0.2.1/24 | Source VLAN gateway |
| R1 | Gi0/1 | 198.51.100.1/24 | Destination gateway |
| H2 | Gi0/0 | 198.51.100.10/24 | Destination; default via 198.51.100.1 |
Set up the lab
- Create exactly five fresh entitled CML nodes and the five stated cables, isolated from all external connectors.
- On every node open Console, enter enable, show version and show running-config. Record builds and verify there are no existing routes, guards, channel groups or endpoint addresses that conflict.
- Keep one learner-owned baseline/fault/restored capture each; captures can contain sensitive data, so use only this synthetic isolated traffic and do not publish raw files.
- If IOSvL2 or capture support is unavailable, use the clearly labeled paper inference exercise. It does not establish packet delivery or measured recovery.
Configure H1 test endpoint
In CML, select H1, open its Console tab and connect before typing. This IOSv router stands in for one single-interface endpoint. The default route deliberately models its gateway; do not add a second link or a dynamic routing protocol.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.10 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 192.0.2.1
end
show interfaces GigabitEthernet0/0What each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select this endpoint's only cable.
ip address 192.0.2.10 255.255.255.0- Assign the exact endpoint address and /24 mask.
no shutdown- Enable this endpoint's physical interface.
exit- Return to global mode for its gateway route.
ip route 0.0.0.0 0.0.0.0 192.0.2.1- Send nonlocal destinations to the declared directly connected gateway.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/0- Record actual link state and MAC address for later capture comparison.
- What you should see
- The endpoint has one connected subnet and a default next hop.
- Why this step matters
- This is an explicit router-as-endpoint model, not an unconfigured imaginary desktop.
Configure H2 test endpoint
In CML, select H2, open its Console tab and connect before typing. This IOSv router stands in for one single-interface endpoint. The default route deliberately models its gateway; do not add a second link or a dynamic routing protocol.
enable
configure terminal
interface GigabitEthernet0/0
ip address 198.51.100.10 255.255.255.0
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 198.51.100.1
end
show interfaces GigabitEthernet0/0What each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select this endpoint's only cable.
ip address 198.51.100.10 255.255.255.0- Assign the exact endpoint address and /24 mask.
no shutdown- Enable this endpoint's physical interface.
exit- Return to global mode for its gateway route.
ip route 0.0.0.0 0.0.0.0 198.51.100.1- Send nonlocal destinations to the declared directly connected gateway.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/0- Record actual link state and MAC address for later capture comparison.
- What you should see
- The endpoint has one connected subnet and a default next hop.
- Why this step matters
- This is an explicit router-as-endpoint model, not an unconfigured imaginary desktop.
Configure the routed boundary
In CML, select R1, open its Console tab and connect before typing. R1's physical ports are routed interfaces, unlike SW2's connected access switchport. No subinterfaces, tagging or static transit routes are required between these directly connected networks.
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.0
no shutdown
interface GigabitEthernet0/1
ip address 198.51.100.1 255.255.255.0
no shutdown
end
show ip interface brief
show ip route connected
show interfaces GigabitEthernet0/0What each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the source-side routed interface facing SW2.
ip address 192.0.2.1 255.255.255.0- Assign H1's gateway address.
no shutdown- Enable the source-side routed port.
interface GigabitEthernet0/1- Select the direct link to H2.
ip address 198.51.100.1 255.255.255.0- Assign H2's gateway address.
no shutdown- Enable the destination-side routed port.
end- Return to privileged EXEC without saving or reversing the configuration.
show ip interface brief- Verify both addressed physical interfaces are operational.
show ip route connected- Confirm the two directly connected /24 routes.
show interfaces GigabitEthernet0/0- Record the actual gateway MAC and physical counters.
- What you should see
- R1 owns both gateway addresses and their connected routes.
- Why this step matters
- A working Layer 2 path still needs correct Layer 3 attachments and a return route.
Prepare SW1 access boundary
In CML, select SW1, open its Console tab and connect before typing. Create both VLANs now, but keep the working access link in VLAN 10. VLAN 20 exists only for the later reversible misassignment; it has no gateway or trunk allowance.
enable
configure terminal
spanning-tree mode rapid-pvst
vlan 10
exit
vlan 20
exit
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
spanning-tree mode rapid-pvst- Use a consistent rapid spanning-tree mode.
vlan 10- Create the intended source-side VLAN.
exit- Return to global configuration.
vlan 20- Create the isolated fault VLAN before the baseline.
exit- Return to global mode for the physical access port.
interface GigabitEthernet0/0- Select the endpoint-facing or router-facing access cable.
switchport mode access- Keep this boundary untagged and single-VLAN.
switchport access vlan 10- Assign the working VLAN 10 membership.
no shutdown- Enable the access link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- Gi0/0 is a VLAN 10 access port on each switch.
- Why this step matters
- Both VLANs are present so the later failure is a wrong broadcast-domain assignment, not an absent-VLAN artifact.
Prepare SW2 access boundary
In CML, select SW2, open its Console tab and connect before typing. Create both VLANs now, but keep the working access link in VLAN 10. VLAN 20 exists only for the later reversible misassignment; it has no gateway or trunk allowance.
enable
configure terminal
spanning-tree mode rapid-pvst
vlan 10
exit
vlan 20
exit
interface GigabitEthernet0/0
switchport mode access
switchport access vlan 10
no shutdown
endWhat each command means
enable- Enter privileged EXEC on the named lab node; stop if authorization is unavailable.
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
spanning-tree mode rapid-pvst- Use a consistent rapid spanning-tree mode.
vlan 10- Create the intended source-side VLAN.
exit- Return to global configuration.
vlan 20- Create the isolated fault VLAN before the baseline.
exit- Return to global mode for the physical access port.
interface GigabitEthernet0/0- Select the endpoint-facing or router-facing access cable.
switchport mode access- Keep this boundary untagged and single-VLAN.
switchport access vlan 10- Assign the working VLAN 10 membership.
no shutdown- Enable the access link.
end- Return to privileged EXEC without saving or reversing the configuration.
- What you should see
- Gi0/0 is a VLAN 10 access port on each switch.
- Why this step matters
- Both VLANs are present so the later failure is a wrong broadcast-domain assignment, not an absent-VLAN artifact.
Build SW1 trunk aggregate
In CML, select SW1, open its Console tab and connect before typing. Gi0/1 and Gi0/2 go only to the matching ports on the other switch. Configure the disabled members consistently before enabling them.
configure terminal
interface range GigabitEthernet0/1 - 2
shutdown
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10
channel-group 1 mode active
no shutdown
end
show etherchannel summaryWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface range GigabitEthernet0/1 - 2- Select exactly the two parallel switch-to-switch cables.
shutdown- Hold the two members down while constructing the bundle.
switchport trunk encapsulation dot1q- Select 802.1Q encapsulation on this IOSvL2 image.
switchport mode trunk- Make both members static trunk ports.
switchport trunk allowed vlan 10- Carry only the intended VLAN 10 data service.
channel-group 1 mode active- Negotiate both members into Port-channel1 using LACP.
no shutdown- Enable the prepared members.
end- Return to privileged EXEC without saving or reversing the configuration.
show etherchannel summary- Read the actual logical and member participation state.
- What you should see
- Both members should bundle once the peer is configured.
- Why this step matters
- Never force static on mode to conceal a mismatch; require participation before proceeding.
Build SW2 trunk aggregate
In CML, select SW2, open its Console tab and connect before typing. Gi0/1 and Gi0/2 go only to the matching ports on the other switch. Configure the disabled members consistently before enabling them.
configure terminal
interface range GigabitEthernet0/1 - 2
shutdown
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk allowed vlan 10
channel-group 1 mode active
no shutdown
end
show etherchannel summaryWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface range GigabitEthernet0/1 - 2- Select exactly the two parallel switch-to-switch cables.
shutdown- Hold the two members down while constructing the bundle.
switchport trunk encapsulation dot1q- Select 802.1Q encapsulation on this IOSvL2 image.
switchport mode trunk- Make both members static trunk ports.
switchport trunk allowed vlan 10- Carry only the intended VLAN 10 data service.
channel-group 1 mode active- Negotiate both members into Port-channel1 using LACP.
no shutdown- Enable the prepared members.
end- Return to privileged EXEC without saving or reversing the configuration.
show etherchannel summary- Read the actual logical and member participation state.
- What you should see
- Both members should bundle once the peer is configured.
- Why this step matters
- Never force static on mode to conceal a mismatch; require participation before proceeding.
Set and inspect the switching baseline
In CML, select SW1, open its Console tab and connect before typing. Set SW1's known root priority, then inspect its side. Afterward repeat the read-only show commands on SW2 through its own Console; expect Po1 as SW2's root port.
configure terminal
spanning-tree vlan 10 priority 8192
end
show interfaces status
show interfaces GigabitEthernet0/0 switchport
show interfaces trunk
show etherchannel summary
show lacp neighbor
show spanning-tree vlan 10
show mac address-table dynamic vlan 10
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
spanning-tree vlan 10 priority 8192- Make SW1 the intended VLAN 10 root against the fresh peer default.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces status- Check all three connected physical ports.
show interfaces GigabitEthernet0/0 switchport- Verify the access role and VLAN assignment.
show interfaces trunk- Require Po1 to carry VLAN 10.
show etherchannel summary- Require both physical members bundled in Po1.
show lacp neighbor- Verify the actual peer association.
show spanning-tree vlan 10- Read root identity and the logical port-channel role.
show mac address-table dynamic vlan 10- Record learned entries after traffic exists.
show logging- Preserve actual messages without expecting a fault yet.
- What you should see
- The two switches should agree on a healthy VLAN 10 logical path.
- Why this step matters
- Read the same VLAN and actual interfaces on both ends before introducing a fault.
Establish controlled-source probes
In CML, select H1, open its Console tab and connect before typing. For ping prompts enter protocol ip, target 198.51.100.10, count 5, size 100, timeout 2, extended commands y, source 192.0.2.10; accept defaults for remaining options, including no sweep. For traceroute enter protocol ip, target 198.51.100.10, source 192.0.2.10, numeric y, timeout 1, probes 1, minimum TTL 1, maximum TTL 4, port 33434 and no IP options. Read prompts individually; do not paste answers blindly.
ping 192.0.2.1
ping
tracerouteWhat each command means
ping 192.0.2.1- First test the declared local gateway.
ping- Run the interactive extended ping using the stated source and parameters.
traceroute- Run the interactive bounded trace using the stated prompts.
- What you should see
- Require gateway and remote success before continuing; record actual routed-hop responses.
- Why this step matters
- The chosen source and return path stay constant across the later comparison.
Capture the working access-side flow
In CML, select H1, open its Console tab and connect before typing. Keep H1's Console connected. In Workbench right-click H1 Gi0/0--SW1 Gi0/0, choose Packet Capture, Settings, Max Packets 100 and Max Time 20, leave BPF empty, Save, Start. Return to H1 Console and run the ping below. Stop if needed, select actual request/reply rows, inspect Ethernet and IP fields, then Download before starting another capture.
ping 198.51.100.10What each command means
ping 198.51.100.10- Generate a small baseline ICMP exchange from H1's sole interface.
- What you should see
- Look for matching request/reply IP endpoints and compare Ethernet addresses with the recorded H1/R1 interfaces.
- Why this step matters
- CML link capture observes this access cable in both directions; it is not unsupported IOSvL2 SPAN.
Move only the router-facing access VLAN
In CML, select SW2, open its Console tab and connect before typing. Proceed only after the baseline works. Gi0/0 is outside Po1; do not touch the bundle members or R1's addresses. This is the sole deliberate fault.
configure terminal
interface GigabitEthernet0/0
switchport access vlan 20
end
show interfaces GigabitEthernet0/0 switchport
show vlan brief
show etherchannel summary
show spanning-tree vlan 10
show loggingWhat each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select only the access cable to R1.
switchport access vlan 20- Temporarily classify R1's untagged traffic into the wrong VLAN.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/0 switchport- Observe the actual VLAN 20 assignment.
show vlan brief- Confirm both VLANs exist and Gi0/0 is misplaced.
show etherchannel summary- Verify the separate Po1 bundle can remain healthy.
show spanning-tree vlan 10- Check the still-valid logical root path for VLAN 10.
show logging- Note actual messages, including an absence of physical-link change.
- What you should see
- Expect the physical link and LACP bundle to stay up while the intended gateway path fails.
- Why this step matters
- A VLAN classification error need not produce a cable-down event.
Correlate the failed probe and capture
In CML, select H1, open its Console tab and connect before typing. Download the baseline first. Start a new 100-packet/20-second capture on the same access cable, then use the probes below. Download this fault capture. Compare actual rows: cached ARP can yield unanswered echo requests; expired ARP can yield unanswered gateway requests. No single transcript is guaranteed.
ping 192.0.2.1
ping
traceroute
show ip arpWhat each command means
ping 192.0.2.1- Test whether even the local gateway is reachable.
ping- Repeat the exact extended-ping parameters from the baseline step.
traceroute- Repeat the bounded trace parameters, without treating timeout as a unique diagnosis.
show ip arp- Read actual gateway resolution state, including any still-cached entry.
- What you should see
- Expect failed gateway and remote tests with evidence consistent with the broken VLAN boundary.
- Why this step matters
- The capture's local request does not prove delivery across SW2, and stale ARP is not live reachability.
Restore the one proven mismatch
In CML, select SW2, open its Console tab and connect before typing. Return the router-facing access port to VLAN 10. Leave the functioning channel, root priority and router addresses unchanged.
configure terminal
interface GigabitEthernet0/0
switchport access vlan 10
end
show interfaces GigabitEthernet0/0 switchport
show interfaces trunk
show etherchannel summary
show spanning-tree vlan 10
show mac address-table dynamic vlan 10What each command means
configure terminal- Enter global configuration mode from privileged EXEC; changes apply as accepted.
interface GigabitEthernet0/0- Select the same port altered by the fault.
switchport access vlan 10- Restore the recorded working broadcast-domain assignment.
end- Return to privileged EXEC without saving or reversing the configuration.
show interfaces GigabitEthernet0/0 switchport- Verify the restored access VLAN.
show interfaces trunk- Confirm VLAN 10 still traverses the trunk.
show etherchannel summary- Verify both members remain bundled.
show spanning-tree vlan 10- Confirm the original root and logical forwarding roles.
show mac address-table dynamic vlan 10- Inspect relearning after the following fresh probes.
- What you should see
- The intended VLAN path is restored without unrelated configuration changes.
- Why this step matters
- A narrow correction preserves the evidence supporting the root cause.
Repeat the complete original test
In CML, select H1, open its Console tab and connect before typing. Download the fault capture, start a fresh bounded capture at the same link, and repeat the exact baseline extended-ping and trace parameters. Download the restored capture before stopping the lab. Finally revisit SW2 Console to reread its VLAN 10 MAC table after this traffic.
ping 192.0.2.1
ping
traceroute
show ip arpWhat each command means
ping 192.0.2.1- Require the local gateway test to recover.
ping- Repeat the same selected source, destination, count, size and timeout.
traceroute- Compare actual routed-hop responses using the same bounded settings.
show ip arp- Confirm the current gateway mapping against the recorded R1 MAC.
- What you should see
- Expect gateway/remote recovery with matching capture evidence; record any actual exceptions.
- Why this step matters
- Rollback is complete only when the original full test works, not just when a configuration line changes.
Verify
- Require baseline gateway and remote success before creating the VLAN fault.
- Verify actual MAC addresses, VLAN IDs and port names instead of using invented transcript values.
- Require both Po1 members and correct LACP neighbors throughout the intended experiment.
- Check actual VLAN 10 root identity and SW2's logical root port.
- Interpret R1's routed interfaces separately from SW2's Layer 2 access port.
- Preserve baseline/fault/restored captures with observation point and probe parameters.
- Repeat all source-controlled tests after restoring Gi0/0 to VLAN 10.
Troubleshoot
- If baseline fails, stop before introducing a fault; inspect endpoint masks/default routes and R1 connected interfaces first.
- If only one bundle member participates, resolve that actual mismatch before proceeding; a partial bundle is not the required baseline.
- If a capture is empty, verify the running link, capture timing and limits before diagnosing packet loss.
- If no ARP appears, inspect cached ARP; fresh ICMP may use the cached gateway MAC without a new broadcast.
- If a traceroute prints stars, correlate with gateway ping, source/return routes and ICMP behavior rather than declaring the last responding router faulty.
- If virtual features are unsupported, record the exact limitation and use paper interpretation without claiming a practical pass.
Use an existing Cisco Modeling Labs 2.10 entitlement and its bundled reference images inside CML only. GNS3 does not provide Cisco images; use images there only when a separate applicable license permits that environment. Do not share or redistribute image files. A CML subscription alone does not authorize exporting its Cisco images to GNS3. Without entitlement, use the explicitly labeled paper exercises; they do not establish hands-on competence.
- Restore SW2 Gi0/0 to VLAN 10 and verify the original path before stopping the lab.
- Download each required capture before replacing it or stopping its link; keep it private and remove any unwanted learner-owned capture using normal local policy.
- Leave no production, external connector or social state involved; the exercise is an isolated author candidate.
Practice set
Answer before you reveal
01Can the bundle be healthy while H1 cannot reach its gateway?
Po1 participation verifies only the aggregated link, not every edge classification in the path.
02Whose MAC is the source-side Ethernet destination for a remote packet?
The IP destination remains H2, but the source LAN's Ethernet delivery is to the gateway.
03Why is a stale MAC or ARP row insufficient proof?
Correlate current membership and fresh packet tests instead of treating cached state as end-to-end delivery.
04Why are SW1 and SW2 absent from normal routed traceroute hops?
R1 is the transit Layer 3 hop; traceroute is not a full physical cable discovery tool.
05Does no new log prove the access VLAN stayed unchanged?
Logs depend on event type, configuration and retention, while current switchport state directly exposes the assignment.
06Why capture on the same link before and after?
Different points can see different headers or traffic, making an apparent difference ambiguous.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Start with a named flow and a complete physical map.
- A healthy channel does not prove every access VLAN is correct.
- Correlate MAC and STP evidence within the same VLAN.
- Treat source-controlled probes and captures as bounded evidence.
- Router interfaces and switchports can meet on one cable with different roles.
- Repair the proven mismatch and repeat the original end-to-end test.