Practice Lab · 07 · Cisco / Networking
VLAN & Routing Troubleshooting
Troubleshoot a fictional inter-VLAN connectivity failure by moving from physical state to VLAN membership, trunking, subinterfaces, routes, ARP, and mission-based reachability.
The goal is disciplined fault isolation. Do not rewrite the configuration simply because traffic is failing somewhere.
Lab Snapshot
Mission briefing
Restore student connectivity without disturbing working paths
This fictional Cisco network supports a school media lab with two user VLANs and one management VLAN.
VLAN 10 is STAFF, VLAN 20 is STUDENTS, and VLAN 99 is MANAGEMENT.
Switch SW1 connects endpoint devices and an uplink trunk to router R1.
R1 provides inter-VLAN routing using router-on-a-stick subinterfaces.
STAFF and STUDENTS must both reach the internal file server at 10.10.30.25 through the routed network.
Only the MANAGEMENT VLAN should be used for switch and router administration.
Do not erase configurations, shut down uplinks, or rebuild VLANs until you identify the actual fault.
Preserve interface, VLAN, trunk, routing, ARP, and reachability evidence before remediation.
Topology
Know what each device is supposed to do
SW1
Access switch
Fa0/1-12 serve STAFF, Fa0/13-23 serve STUDENTS, Gi0/1 is the trunk to R1, VLAN 99 is used for management.
R1
Inter-VLAN router
Gi0/0 uses subinterfaces for VLANs 10, 20, and 99. Each subinterface acts as the default gateway for its VLAN.
FILE-SRV
Internal service
The file server is reachable through the routed network at 10.10.30.25 and must remain available.
STAFF-PC
Test endpoint
Connected to SW1 Fa0/4 and expected to receive connectivity through VLAN 10.
STUDENT-PC
Test endpoint
Connected to SW1 Fa0/16 and expected to receive connectivity through VLAN 20.
Troubleshooting rule
Start at the closest dependency and move outward
A failed end-to-end ping does not tell you where the problem is. Confirm the local interface, access VLAN, trunk, gateway, route, and required destination in order.
Layer 1
Confirm interfaces before configuration
Interface summary
Start with interface state so you do not troubleshoot routing when the real problem is a down or err-disabled port.
show ip interface brief
show interfaces status
Inspect an access port
Confirm line protocol state, errors, duplex/speed clues, and whether the endpoint-facing interface is actually up.
show interfaces fa0/4
show interfaces fa0/16
Inspect the uplink
Verify the physical uplink and the Layer 2 mode before assuming the trunk is correct.
show interfaces gi0/1
show interfaces gi0/1 switchport
Check err-disabled state
Identify interfaces that were automatically disabled because of a protection feature or fault.
show interfaces status err-disabled
Access VLANs
Confirm where endpoint traffic enters the switch
VLAN database
Confirm VLANs 10, 20, and 99 exist and review which access ports belong to each VLAN.
show vlan brief
Access-port assignment
Verify that STAFF-PC and STUDENT-PC are assigned to the expected access VLANs.
show interfaces fa0/4 switchport
show interfaces fa0/16 switchport
MAC address learning
Check whether the switch is learning endpoint MAC addresses on the ports and VLANs you expect.
show mac address-table
show mac address-table interface fa0/4
show mac address-table interface fa0/16
Management SVI
Confirm the switch management interface belongs to VLAN 99 and has the intended address state.
show ip interface brief
show running-config interface vlan 99
Trunking
Verify every required VLAN can cross the uplink
Trunk summary
Confirm Gi0/1 is trunking and inspect native VLAN, encapsulation context, and VLANs allowed across the link.
show interfaces trunk
Uplink switchport details
Check administrative mode, operational mode, native VLAN, and allowed VLANs.
show interfaces gi0/1 switchport
Running configuration
Compare the intended uplink configuration with what is actually configured.
show running-config interface gi0/1
Spanning-tree state
Confirm the trunk is forwarding for the relevant VLANs rather than being blocked unexpectedly.
show spanning-tree vlan 10
show spanning-tree vlan 20
show spanning-tree vlan 99
Layer 3
Confirm gateways, routes, and ARP
Subinterface state
Verify each VLAN has the expected 802.1Q subinterface, gateway address, and operational state.
show ip interface brief
show running-config interface gi0/0.10
show running-config interface gi0/0.20
show running-config interface gi0/0.99
Routing table
Confirm directly connected VLAN networks and other required routes are actually present.
show ip route
show ip route connected
ARP table
Check whether R1 is learning endpoint or next-hop addresses on the expected subinterfaces.
show ip arp
Interface counters
Look for encapsulation, input, output, or error clues when VLAN traffic appears to reach the router incorrectly.
show interfaces gi0/0
show interfaces gi0/0.10
show interfaces gi0/0.20
Reachability
Test the path in increasing distance
Endpoint to gateway
ping <default-gateway>
If this fails, focus first on local addressing, access VLAN, trunking, and the router subinterface.
Gateway to endpoint
ping <endpoint-ip>
A reverse test from R1 helps confirm whether ARP and Layer 2 return traffic are working.
Inter-VLAN test
ping <host-in-other-vlan>
If local gateway reachability works but inter-VLAN communication fails, examine routing, policy, and return path.
Internal service test
ping 10.10.30.25
Use the required file server as a mission-based verification target rather than testing random destinations.
Path check
traceroute 10.10.30.25
Use path information to determine where forwarding stops when the route should span multiple Layer 3 hops.
Fictional evidence set
Narrow the fault domain before changing configuration
Fa0/4 and Fa0/16 are connected. Gi0/1 is connected and not err-disabled.
Investigation prompt
Which broad category of failure becomes less likely based on this evidence?
VLANs 10, 20, and 99 exist. Fa0/4 is listed in VLAN 10. Fa0/16 is listed in VLAN 20.
Investigation prompt
What does this prove about access-port assignment, and what does it not prove about the uplink?
Gi0/1 is trunking. Allowed VLANs are 10 and 99. VLAN 20 is missing from the allowed list.
Investigation prompt
Which user group would be affected, and why?
STAFF-PC can ping its default gateway and can reach 10.10.30.25.
Investigation prompt
How does this evidence narrow the fault domain?
STUDENT-PC cannot ping its default gateway. Local IP settings are correct.
Investigation prompt
Which Layer 2 path should you inspect next?
Gi0/0.10, Gi0/0.20, and Gi0/0.99 are all up/up with expected gateway addresses.
Investigation prompt
Why does this make the trunk's VLAN filtering more important than rebuilding the router configuration?
SW1 learns the STUDENT-PC MAC on Fa0/16 in VLAN 20.
Investigation prompt
What does this say about the access port and local Layer 2 learning?
Gi0/1 is forwarding for VLAN 10 and 99. VLAN 20 does not appear because it is not active on the trunk.
Investigation prompt
How does this evidence reinforce the trunk hypothesis?
Troubleshooting order
Use a repeatable network path
Physical state
Confirm ports and uplinks are up, not err-disabled, and free of obvious physical errors.
Access VLAN
Verify endpoint ports are assigned to the expected VLAN and the switch learns the endpoint MAC.
Trunk
Confirm the uplink is trunking and carries every VLAN required by the mission.
Layer 3 gateway
Verify router subinterfaces, 802.1Q tags, and gateway addresses.
Routing
Confirm required connected and remote routes are present and point in the expected direction.
Reachability
Test from nearest dependency outward: host to gateway, gateway to host, inter-VLAN, then required service.
Preserve first
Record the working and failing state before remediation
Record show ip interface brief on SW1 and R1.
Record show vlan brief before changing access VLAN assignments.
Record show interfaces trunk and the uplink running configuration before changing allowed VLANs.
Record MAC address learning for the affected endpoint.
Record router subinterface configuration and state.
Record the routing table and ARP table.
Record ping or traceroute results before remediation.
Change one network variable at a time, then repeat the exact failed test.
Authorized remediation examples
Change only the configuration the evidence identifies
These examples are for an authorized training topology. Do not apply a change merely because it appears in the lab.
Add a missing VLAN to an existing trunk
Use only when evidence confirms VLAN 20 is required and missing from the trunk's allowed list.
configure terminal
interface gi0/1
switchport trunk allowed vlan add 20
end
Correct an access VLAN
Use only when the endpoint-facing port is actually assigned to the wrong VLAN.
configure terminal
interface fa0/16
switchport mode access
switchport access vlan 20
end
Re-enable an administratively shut interface
Use only when the interface is administratively down and the mission requires it.
configure terminal
interface gi0/1
no shutdown
end
Preserve configuration after a verified fix
Save only after verification confirms the change is correct and required functionality remains intact.
copy running-config startup-config
Verification
Prove the student path works without breaking staff connectivity
Interfaces
Required access ports and uplinks remain operational.
show ip interface brief
show interfaces status
VLANs
Endpoint ports remain assigned to their intended VLANs.
show vlan brief
show interfaces fa0/4 switchport
show interfaces fa0/16 switchport
Trunk
VLANs 10, 20, and 99 are carried as required without unnecessarily widening the trunk.
show interfaces trunk
show interfaces gi0/1 switchport
Router
Subinterfaces remain up, required routes are present, and endpoint addressing is being learned.
show ip interface brief
show ip route
show ip arp
Reachability
The originally failing student path now works and the required internal service remains reachable.
ping <student-default-gateway>
ping 10.10.30.25
Reflection
Debrief the network fault isolation
Why should interface state be checked before VLAN or routing configuration?
What is the difference between a VLAN existing in the VLAN database and that VLAN being allowed across a trunk?
Why did successful STAFF connectivity help narrow the failure to the STUDENTS path?
Why is learning the STUDENT-PC MAC on Fa0/16 useful evidence?
Why would rebuilding R1's VLAN 20 subinterface be an unnecessarily risky change in this scenario?
What is the advantage of testing from the nearest dependency outward?
Why should you use 'add 20' rather than replacing the entire allowed-VLAN list when fixing a trunk?
What evidence should be collected before saving the running configuration?
Completion checklist
Finish only after the required path is verified
I confirmed physical and line-protocol state first.
I verified the VLAN database and endpoint access-port assignments.
I checked MAC address learning for the affected endpoint.
I reviewed the trunk allowed-VLAN list and native VLAN information.
I verified router subinterfaces and gateway addresses.
I checked the routing and ARP tables.
I used mission-based reachability tests rather than random pings.
I made only the smallest configuration change supported by evidence.
I re-ran the exact failed test after remediation.
I saved configuration only after the fix was verified.