Multi-Switch Office Network with VLANs

Segment a simulated office network into VLANs across two switches with trunks.

Introduction

30 Second Summary

In any office, different departments share the same physical network. Without proper segmentation, a broadcast from the Sales floor can reach HR's machines and IT's servers, creating noise, security risks, and confusion.

In this project, you will build a multi-switch office network in Cisco Packet Tracer that uses VLANs to isolate traffic between three departments. You will connect switches with trunk links and verify your connections using discovery protocols.

What You'll Build

A simulated three-department office network with two switches connected by 802.1Q trunk links, where each department (Sales, HR, IT) lives in its own VLAN.

By the end of this project, you'll have:

  • A working multi-switch network with three VLANs isolating traffic between departments, proven by ping tests.
  • 802.1Q trunk links connecting switches with a custom native VLAN and a restricted allowed-VLAN list.
  • Verified Layer 2 neighbor discovery using both CDP and LLDP commands.
  • Secret Mission: Add a third switch connected via EtherChannel (LACP) and observe Rapid PVST+ spanning-tree behavior.

Are there any prerequisites?

You should have basic familiarity with the Cisco Packet Tracer interface and IP addressing. If you have opened Packet Tracer before and know what an IP address looks like, you are ready to start.

Build Your Network Topology in Packet Tracer

Every office network starts with physical infrastructure. Before you can segment traffic into departments or configure trunk links, you need switches, PCs, and cables in place.

In this step, you will place two switches and six PCs into your Cisco Packet Tracer workspace, cable them together, and assign IP addresses so every device can talk to every other device. This baseline confirms your wiring works before you start layering on VLANs in the next step.

In this step, get ready to:
  • Place two 2960 switches and six PCs in the topology.
  • Connect all devices with the correct cable types.
  • Assign IP addresses and verify connectivity with a ping test.
Place switches and PCs in the workspace

Your blank topology is an empty canvas. You need two Catalyst 2960 switches (the standard switch model for CCNA labs) and six PCs representing employees in three departments.

  • In the bottom-left corner of Packet Tracer, click the Network Devices category (the icon that looks like a switch/router).
  • Click Switches in the subcategory row that appears.
  • Find the 2960 model in the device selection box and click it.
  • Click a spot on the left side of your workspace to place the first switch.
  • Click a second spot to the right of the first switch to place the second switch.
  • Click the first switch to open its configuration window.
  • Select the Config tab.
  • Type SW1 in the Display Name field, then close the window.
  • Click the second switch, select the Config tab, and type SW2 in the Display Name field.
  • Now click the End Devices category in the bottom-left corner.
  • Select PC from the device selection box.
  • Click on the workspace to place six PCs total. Place PC1, PC2, and PC3 near SW1. Place PC4, PC5, and PC6 near SW2.
  • Rename each PC by clicking it, selecting the Config tab, and updating the Display Name field to match (PC1 through PC6).

Now connect the devices using cables.

  • Click the Connections category in the bottom-left corner (the lightning bolt icon).
  • Select Copper Straight-Through (the solid black line).
  • Click PC1, choose FastEthernet0, then click SW1 and choose any available FastEthernet port (for example, FastEthernet0/1).
  • Repeat for PC2 to SW1 (for example, FastEthernet0/2) and PC3 to SW1 (for example, FastEthernet0/3).
  • Repeat for PC4 to SW2, PC5 to SW2, and PC6 to SW2 using available FastEthernet ports on SW2.
  • Now select Copper Cross-Over from the Connections category.
  • Click SW1 and choose GigabitEthernet0/1.
  • Click SW2 and choose GigabitEthernet0/1.

Why two different cable types?

Straight-through cables connect different device types (PC to switch). Crossover cables connect same device types (switch to switch).

The 2960 switch in Packet Tracer does not always enable auto-MDIX by default, so using the correct cable type avoids link failures.

Wait about 30 seconds for the link lights on all cables to turn green. They appear amber initially while the ports negotiate.

Link lights staying amber or red?

Make sure you used Copper Straight-Through between PCs and switches, and Copper Cross-Over between SW1 and SW2. Mismatched cables leave the link down.

You can also click the Fast Forward Time button (the clock icon in the yellow bar above the workspace) to speed up convergence.

Why are my cable link lights not turning green?

Assign IP addresses to each PC

Each department will eventually live in its own VLAN with its own subnet. You will assign IP addresses now that match this plan so testing is straightforward once VLANs are configured.

  • Click PC1 to open its configuration window.
  • Click the Desktop tab.
  • Click IP Configuration.
  • Enter 192.168.10.1 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field. Leave the default gateway blank.
  • Close the PC1 window.

Repeat the same process for the remaining five PCs using the addresses below.

  • PC2 (HR): 192.168.20.1 / 255.255.255.0.
  • PC3 (IT): 192.168.30.1 / 255.255.255.0.
  • PC4 (Sales): 192.168.10.2 / 255.255.255.0.
  • PC5 (HR): 192.168.20.2 / 255.255.255.0.
  • PC6 (IT): 192.168.30.2 / 255.255.255.0.

Why does the IP match the VLAN number?

Using 192.168.X.0/24 where X matches the VLAN number (10, 20, 30) makes it easy to identify which subnet belongs to which department. This is a common convention in networking labs.

Not sure if you typed the address correctly?

Click the PC, then click the Desktop tab, then click IP Configuration to verify the address shown. The subnet mask should always be 255.255.255.0 for all six PCs.

Help me check my IP addressing setup.

Verify connectivity with a ping test

Right now, all ports are in the default VLAN 1. This means PCs that share the same subnet can reach each other across the switch-to-switch link.

A successful ping between PC1 and PC4 proves your cabling and IP configuration are correct.

  • Click PC1 to open its configuration window.
  • Click the Desktop tab.
  • Click Command Prompt.
  • Run this ping command:
ping 192.168.10.2

What does this command do?

This sends ICMP echo requests from PC1 (192.168.10.1) to PC4 (192.168.10.2). Because both PCs share the 192.168.10.0/24 subnet and are both in default VLAN 1, the frames travel from PC1 through SW1, across the crossover cable to SW2, and out to PC4.

You should see four successful replies with 0% packet loss.

First ping may time out

The very first ping often fails because the switches need time to learn MAC addresses via ARP. If you see one timeout followed by three replies, that is normal. Run the ping a second time and all four should succeed.

Getting Request Timed Out on all four pings?

Check that both PCs have the correct IPs in the same subnet (192.168.10.1 and 192.168.10.2). Open each PC and click Desktop, then IP Configuration to verify.

Confirm the link lights between SW1 and SW2 are green. If they are red or absent, delete the cable and reconnect using a Copper Cross-Over cable on GigabitEthernet0/1 on each switch.

My ping between PC1 and PC4 is failing. Help me troubleshoot.

  • Save your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Give it a name like office-vlans.pkt.

Your physical topology is complete. Next up, you will create VLANs on both switches and assign each PC's port to the correct VLAN, which will immediately isolate department traffic.

Create VLANs and Assign Access Ports

Your topology is wired and every PC can talk to every other PC. That is actually the problem.

In a real office, Sales PCs should not see HR payroll traffic, and HR should not see IT admin sessions. VLANs solve this by splitting one physical switch into multiple isolated broadcast domains. In this step, you will create three VLANs and assign each PC to its department.

In this step, get ready to:
  • Create VLAN 10 (Sales), VLAN 20 (HR), and VLAN 30 (IT) on both switches.
  • Assign each PC's port to the correct VLAN using access mode.
  • Verify VLAN isolation with ping tests.
Create VLANs on SW1 and SW2

Before a switch can isolate traffic, you need to tell it which VLANs exist. You will create the same three VLANs on both switches so they share a common VLAN database.

  • Click on SW1 in your topology.
  • Select the CLI tab at the top of the device window.
  • Press Enter if the prompt is not visible yet.
  • Create the three VLANs by entering these commands:
enable
configure terminal
vlan 10
name Sales
vlan 20
name HR
vlan 30
name IT
end

What do these commands do?

Each vlan command creates a new VLAN entry in the switch's VLAN database. The name command gives it a human-readable label so you can tell departments apart when verifying later.

The enable command enters privileged EXEC mode, and configure terminal enters global configuration mode where changes are made. The end command exits back to privileged EXEC mode.

  • Confirm the VLANs were created by running:
show vlan brief

You should see VLAN 10 (Sales), VLAN 20 (HR), and VLAN 30 (IT) listed alongside the default VLAN 1. No ports are assigned to them yet.

Don't see your new VLANs?

  • Make sure you pressed Enter after each command. If the prompt still shows Switch> instead of Switch#, you forgot to type enable first.
  • If you see an error about an invalid VLAN ID, double-check you typed a number between 1 and 4094.
  • Why don't my VLANs appear in show vlan brief?

Now repeat the same VLAN creation on SW2.

  • Click on SW2 in your topology.
  • Select the CLI tab.
  • Press Enter if needed.
  • Create the same three VLANs by entering these commands:
enable
configure terminal
vlan 10
name Sales
vlan 20
name HR
vlan 30
name IT
end
  • Run show vlan brief on SW2 to confirm VLANs 10, 20, and 30 appear.

Why create the same VLANs on both switches?

Each switch maintains its own VLAN database independently. If SW2 does not know about VLAN 10, it cannot forward VLAN 10 traffic that arrives over a trunk link. Both switches must agree on which VLANs exist.

Assign access ports on SW1

Creating VLANs is like building rooms in a building. Assigning ports is like putting people in those rooms. Each access port belongs to exactly one VLAN.

Check which port each PC uses

Hover over the cable connecting a PC to its switch in your topology. Packet Tracer displays the interface name (for example FastEthernet0/1) on each end. Note which FastEthernet port connects to PC1, PC2, and PC3 on SW1.

The commands below use FastEthernet0/1, FastEthernet0/2, and FastEthernet0/3 as examples. Replace them with your actual port numbers if they differ.

  • Return to SW1's CLI tab.
  • Assign the three access ports by entering these commands:
enable
configure terminal
! Assign PC1 port to Sales VLAN
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
! Assign PC2 port to HR VLAN
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
! Assign PC3 port to IT VLAN
interface FastEthernet0/3
switchport mode access
switchport access vlan 30
end

What does this code do?

The switchport mode access command puts the interface into permanent nontrunking mode. This means the port carries traffic for exactly one VLAN.

The switchport access vlan 10 command assigns the port to VLAN 10. Any frame entering this port is tagged as VLAN 10 internally. The PC never sees the tag because access ports strip it before delivery.

  • Verify the assignment by running:
show vlan brief

You should see your PC1 port listed under VLAN 10, your PC2 port under VLAN 20, and your PC3 port under VLAN 30. They are no longer under VLAN 1.

Ports still showing under VLAN 1?

  • Check you used the correct interface name. If your PC1 is on FastEthernet0/4 but you configured FastEthernet0/1, the wrong port moved.
  • Make sure you typed switchport mode access before switchport access vlan 10. Both commands are required.
  • Why is my port still in VLAN 1?
Assign access ports on SW2 and verify isolation
  • Click on SW2 and open its CLI tab.
  • Note which FastEthernet ports connect to PC4, PC5, and PC6 (hover over the cables to check).
  • Assign the access ports by entering these commands:
enable
configure terminal
! Assign PC4 port to Sales VLAN
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
! Assign PC5 port to HR VLAN
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
! Assign PC6 port to IT VLAN
interface FastEthernet0/3
switchport mode access
switchport access vlan 30
end
  • Run show vlan brief on SW2 to confirm each port appears under its correct VLAN.

Now test VLAN isolation with some ping tests.

  • Click on PC1 in your topology.
  • Go to the Desktop tab and open Command Prompt.
  • Ping PC2 (different VLAN on the same switch) by running:
ping 192.168.20.1

This ping should fail (Request timed out or Destination host unreachable). PC1 is in VLAN 10 and PC2 is in VLAN 20. The switch no longer forwards traffic between them.

  • Now try pinging PC4 (same VLAN, different switch) by running:
ping 192.168.10.2

This ping also fails. PC4 is in VLAN 10, the same VLAN as PC1. However, the link between SW1 and SW2 is still a default access port in VLAN 1. It does not carry VLAN 10 traffic yet.

Why does the cross-switch ping fail?

The inter-switch link (GigabitEthernet0/1) has not been configured as a trunk. Without a trunk, the switch treats it as a regular access port in VLAN 1. VLAN 10 frames from PC1 never leave SW1 because there is no path for them to reach SW2.

You will fix this in the next step by configuring an 802.1Q trunk link.

Ping from PC1 to PC2 still succeeds?

  • Run show vlan brief on SW1 again. Confirm that the port connected to PC1 is under VLAN 10 and the port connected to PC2 is under VLAN 20. If both are still under VLAN 1, re-enter the access port commands using the correct interface names.
  • In Packet Tracer, make sure you are not in Realtime mode with a stale ARP cache. Click Fast Forward Time (the clock icon in the bottom bar) to clear any cached entries, then retry the ping.
  • Why can PC1 still ping PC2 after I assigned them to different VLANs?

✔️ Awesome, I've got everything!

Great. Double-check you have saved your topology file.

ⓧ I'd like to double check the full configuration

Here is what each switch should look like after this step.

SW1 configuration summary:

  • VLAN 10 named Sales, VLAN 20 named HR, VLAN 30 named IT created.
  • Port connected to PC1: switchport mode access, switchport access vlan 10.
  • Port connected to PC2: switchport mode access, switchport access vlan 20.
  • Port connected to PC3: switchport mode access, switchport access vlan 30.
  • GigabitEthernet0/1 still in default state (not yet configured as trunk).

SW2 configuration summary:

  • VLAN 10 named Sales, VLAN 20 named HR, VLAN 30 named IT created.
  • Port connected to PC4: switchport mode access, switchport access vlan 10.
  • Port connected to PC5: switchport mode access, switchport access vlan 20.
  • Port connected to PC6: switchport mode access, switchport access vlan 30.
  • GigabitEthernet0/1 still in default state (not yet configured as trunk).

Expected ping results:

  • PC1 to PC2 (cross-VLAN, same switch): FAILS.
  • PC1 to PC4 (same VLAN, cross-switch): FAILS (no trunk yet).
  • PC1 to PC3 (cross-VLAN, same switch): FAILS.

Your VLANs are isolating traffic perfectly within each switch. The next challenge is connecting those VLANs across the inter-switch link so PC1 can reach PC4. That is where trunk ports and 802.1Q tagging come in.

Configure 802.1Q Trunk Links

Your VLANs are created and your access ports are assigned. Right now, PCs in the same VLAN but on different switches still cannot communicate.

The missing piece is a trunk link between SW1 and SW2. A trunk carries traffic from multiple VLANs across a single physical connection by tagging each frame with its VLAN ID using the 802.1Q standard.

In this step, get ready to:
  • Configure GigabitEthernet0/1 on both switches as an 802.1Q trunk.
  • Set a custom native VLAN and restrict the allowed VLAN list.
  • Verify cross-switch VLAN connectivity with ping tests.
Configure the trunk on SW1

A trunk port needs three settings: the mode (trunk), a native VLAN for untagged traffic, and a list of which VLANs are allowed to cross.

  • Click on SW1 in your topology to open its configuration window.
  • Select the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode by running these commands:
enable
configure terminal
  • Configure GigabitEthernet0/1 as a trunk with native VLAN 99 and a restricted allowed-VLAN list by running these commands:
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,99
exit

What do these commands do?

  • switchport mode trunk puts the interface into permanent trunking mode so it carries tagged VLAN traffic.
  • switchport trunk native vlan 99 changes the native VLAN from the default (VLAN 1) to VLAN 99. Untagged frames on the trunk are placed into this VLAN.
  • switchport trunk allowed vlan 10,20,30,99 restricts the trunk to only carry your three department VLANs plus the native VLAN. All other VLANs are blocked from crossing this link.

Why change the native VLAN from 1 to 99?

Leaving the native VLAN as VLAN 1 (the default) is a known security risk. Attackers can exploit the default native VLAN to perform VLAN hopping attacks.

Moving it to an unused VLAN like 99 is a best practice that closes this vulnerability. You will see this pattern on production networks and in CCNA exam scenarios.

Configure the trunk on SW2

The native VLAN must match on both ends of the trunk link. If the values are mismatched, spanning-tree loops might result.

  • Click on SW2 in your topology to open its configuration window.
  • Select the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode by running these commands:
enable
configure terminal
  • Apply the identical trunk configuration on SW2's GigabitEthernet0/1 by running these commands:
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30,99
exit

Seeing a native VLAN mismatch message?

If you see a CDP or console message about a native VLAN mismatch, double-check that both SW1 and SW2 have switchport trunk native vlan 99 configured on GigabitEthernet0/1. The value must be identical on both ends.

help me fix a native VLAN mismatch on my trunk link

Verify the trunk and test cross-switch connectivity

With the trunk active on both switches, VLAN-tagged frames can now flow between SW1 and SW2. Time to confirm it works.

  • On SW1's CLI, exit to privileged EXEC mode and verify the trunk by running this command:
end
show interfaces trunk

What should I see?

The output shows GigabitEthernet0/1 with mode on, native VLAN 99, and an allowed VLAN list of 10,20,30,99. If you see VLAN 1 as the native VLAN or all VLANs in the allowed list, re-enter configuration mode and reapply the trunk commands.

  • Run the same verification on SW2. Click on SW2, open its CLI tab, and run:
show interfaces trunk
  • Confirm SW2 shows the same trunk settings: mode on, native VLAN 99, and allowed VLANs 10,20,30,99.

Now test connectivity across the trunk.

  • Click on PC1 and open the Desktop tab.
  • Open Command Prompt.
  • Ping PC4 across the trunk by running:
ping 192.168.10.2

You should see replies from 192.168.10.2. Both PCs share VLAN 10, and the trunk now carries VLAN 10 traffic between the switches.

  • Now confirm VLAN isolation still works. From PC1, ping PC2 (which is in a different VLAN) by running:
ping 192.168.20.1

This ping should fail (Request timed out or Destination host unreachable). PC1 is in VLAN 10 and PC2 is in VLAN 20. Without a router performing inter-VLAN routing, they cannot communicate.

  • Test one more cross-VLAN, cross-switch ping from PC1 to PC5 by running:
ping 192.168.20.2

This also fails. Even though the trunk carries VLAN 20 traffic, PC1 is not a member of VLAN 20 so it cannot reach PC5.

PC1 can't ping PC4?

  • Verify both switches show GigabitEthernet0/1 as a trunk with show interfaces trunk. If the port does not appear, the switchport mode trunk command was not applied.
  • Check that VLAN 10 appears in the allowed VLAN list on both switches. If it does not, re-run switchport trunk allowed vlan 10,20,30,99 on the trunk interface.
  • Try the ping a second time. In Packet Tracer, the first ping after a topology change often times out while ARP resolves. The second attempt should succeed.

help me troubleshoot why my trunk isn't passing VLAN traffic between switches

✔️ My pings match the expected results

Your trunk is working correctly. VLAN 10 traffic flows between switches, and different VLANs remain isolated.

ⓧ All my pings are failing

Return to both switch CLIs and run show interfaces trunk. Confirm GigabitEthernet0/1 appears in the output on both switches.

If the trunk shows up but pings still fail, verify the access port assignments with show vlan brief. Make sure PC1's port is in VLAN 10 and PC4's port is also in VLAN 10.

Your trunk links are live and your VLANs are fully segmented across both switches. Next up, you will use discovery protocols to verify the physical switch-to-switch connection from the CLI.

Verify Connections with CDP and LLDP

Your VLANs are working and traffic is flowing across the trunk link. But in a real office environment, how do you confirm which device is on the other end of a cable without physically tracing it?

Discovery protocols solve this problem. They let switches automatically announce themselves to their neighbors. In this step, you will use two discovery protocols to verify your switch-to-switch connection.

In this step, get ready to:
  • Verify CDP neighbor discovery on SW1.
  • Enable and verify LLDP on both switches.
  • Document the key differences between CDP and LLDP.
Run CDP neighbor discovery on SW1

CDP is a Cisco-proprietary Layer 2 protocol that lets Cisco devices automatically discover each other. It is enabled by default on all Cisco switches, so your switches have already been exchanging CDP advertisements since you powered them on.

  • Click on SW1 in your Packet Tracer topology.
  • Select the CLI tab.
  • Make sure you are in privileged EXEC mode (you should see the SW1# prompt). If you see SW1>, type enable and press Enter.
  • View your CDP neighbors by running this command:
show cdp neighbors

You should see SW2 listed as a neighbor. The output displays the Device ID (SW2), your local interface (Gig 0/1), the holdtime, capability code (S for Switch), platform (2960), and the remote Port ID (Gig 0/1).

What does this output tell you?

  • Device ID shows the hostname of the neighboring device.
  • Local Intrfce shows which of YOUR ports connects to that neighbor.
  • Capability uses letter codes. S means Switch, R means Router.
  • Port ID shows which port on the REMOTE device connects back to you.
  • Get more detail about SW2 by running this command:
show cdp neighbors detail

This output shows additional information including the IP address of SW2 (if configured), the full platform name, the IOS software version running on SW2, and the native VLAN.

Why use the detail version?

The basic show cdp neighbors gives you a quick summary table. The detail version adds network addresses, IOS version, and native VLAN information. In real networks, this helps you remotely identify what software a neighbor is running without logging into it.

Not seeing SW2 in the output?

  • Make sure the cable between SW1 and SW2 is properly connected. Check for green link lights on GigabitEthernet0/1 on both switches.
  • CDP advertisements are sent every 60 seconds. If you just connected the cable, wait up to 60 seconds and try the command again.
  • Confirm you are running the command on SW1, not on a PC.

help me troubleshoot why CDP is not showing my neighbor switch

Enable and verify LLDP on both switches

LLDP is a vendor-neutral discovery protocol defined by IEEE 802.1AB. Unlike CDP, LLDP works across devices from different manufacturers. It must be explicitly enabled on Cisco switches because it is not on by default.

  • On SW1, enter global configuration mode by running:
configure terminal
  • Enable LLDP globally on SW1 by running:
lldp run
  • Return to privileged EXEC mode by running:
end
  • Now repeat the same process on SW2. Click on SW2 in your topology, select the CLI tab, and run:
enable
configure terminal
lldp run
end

Why do you have to enable LLDP manually?

CDP is Cisco-proprietary and enabled by default on Cisco devices. LLDP is an open standard (IEEE 802.1AB) that Cisco supports but does not enable automatically. In a multi-vendor network with switches from different manufacturers, LLDP is the common language they all speak.

  • Wait about 30 seconds for the switches to exchange LLDP advertisements. LLDP needs time to discover neighbors after being enabled.
  • On SW1, verify LLDP neighbors by running:
show lldp neighbors

You should see SW2 listed as a neighbor with the local interface, hold time, capability, and port ID displayed.

  • Run the same command on SW2 to confirm it also sees SW1 as a neighbor.

LLDP showing no neighbors?

  • Confirm you ran lldp run on BOTH switches. LLDP requires both ends to be enabled.
  • Wait at least 30 seconds after enabling. LLDP advertisements take time to propagate.
  • Verify LLDP is active by running show lldp in privileged EXEC mode. It should show the transmission interval and holdtime.

help me troubleshoot why LLDP neighbors are not appearing

Document the differences between CDP and LLDP

You have now verified the same switch-to-switch link using two different discovery protocols. Both confirm that SW1 and SW2 are directly connected on GigabitEthernet0/1. The difference is in how they work and where they are useful.

What are the key differences between CDP and LLDP?

  • CDP is Cisco-proprietary. It is enabled by default on all Cisco devices. Its capability codes include R (Router) and S (Switch).
  • LLDP is an open standard (IEEE 802.1AB). It must be explicitly enabled with lldp run. Its capability codes include (B) Bridge and (R) Router.
  • Both protocols discover neighbors and confirm link status. CDP is the go-to in Cisco-only environments. LLDP is essential in multi-vendor networks.

On the CCNA exam, you need to know both protocols and when to use each. CDP for Cisco shops, LLDP for mixed-vendor environments.

Extra for Experts: Why does LLDP use (B) for Bridge instead of (S) for Switch?

LLDP uses IEEE terminology. In IEEE standards, a Layer 2 forwarding device is called a "bridge" regardless of port count. Cisco uses "switch" in its own CDP codes because that is the product marketing term. A bridge and a switch perform the same forwarding function at Layer 2.

Both discovery protocols confirm your trunk link is healthy and your switches can see each other. This is exactly what a network engineer checks first when troubleshooting connectivity between switches in a production network.

Secret mission

Add EtherChannel and Observe Rapid PVST+

Your two-switch network works great, but what happens when you need redundant links between switches? In this challenge, you'll add a third switch connected with multiple cables and bundle them into a single logical link using EtherChannel (LACP). Then you'll observe how Rapid PVST+ manages the resulting topology.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally inside Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your topology file for future practice, or delete it to free up disk space.

Resources you used:

  • Packet Tracer topology file (.pkt) saved on your local machine.
  • Switch configurations (SW1, SW2, SW3) stored inside the topology file.
  • PC configurations (PC1 through PC6) stored inside the topology file.

Keep everything running

No action needed. Choose this if you plan to keep practicing with this topology or want to extend it further.

  • Your .pkt file stays on your computer wherever you saved it.
  • You can reopen it anytime in Cisco Packet Tracer to review configurations or add more devices.
  • All switch and PC configurations persist inside the file.

Pause - I'll come back to this later

Since this project is a local Packet Tracer file, pausing is the same as keeping it. There are no running processes to stop.

  • Make sure you saved your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS) before closing Packet Tracer.
  • Your configurations will be intact when you reopen the file.

Delete - I don't want to use this again

Remove the topology file from your computer entirely.

  • Close the topology in Cisco Packet Tracer if it is still open.
  • Navigate to the folder where you saved your .pkt file.
  • Delete the .pkt file. On macOS, drag it to the Trash. On Windows, right-click and select Delete.
  • Empty your Trash (macOS) or Recycle Bin (Windows) to permanently remove the file.

Nice Work!

Nice Work!

You just built a real network from scratch. You now have a fully segmented multi-switch office network with three departments isolated by VLANs, connected by 802.1Q trunks, and verified with industry-standard discovery protocols.

You now understand the foundational Layer 2 concepts that make up 20% of the CCNA exam. Every enterprise network you will ever work on uses VLANs and trunks exactly like this.

What you learned:

  • Created and named VLANs to segment a network into isolated broadcast domains across multiple switches (Objective 2.1).
  • Configured 802.1Q trunk ports with a custom native VLAN and a restricted allowed-VLAN list to control inter-switch traffic (Objective 2.2).
  • Used both CDP and LLDP to discover and verify switch-to-switch connections (Objective 2.3).
  • Secret Mission: Configured EtherChannel using LACP to aggregate redundant links (Objective 2.4) and observed Rapid PVST+ spanning-tree port roles and states (Objective 2.5).

Ready to quiz yourself?