Build a Multi-VLAN Office Network

Segment a office network with VLANs, 802.1Q trunks, and inter-VLAN routing.

Introduction

30 Second Summary

In any office, you don't want the sales team's noisy broadcast traffic slowing down the engineering team's file transfers. Network segmentation keeps departments separate, secure, and efficient.

In this project, you will build a multi-switch office network in Cisco Packet Tracer that separates departments into VLANs, connects switches with 802.1Q trunks, and routes between VLANs using a router-on-a-stick configuration.

What You'll Build

Picture opening your terminal, pinging from a Sales PC to an Engineering PC on a completely different switch and VLAN, and watching the packets route through your configured router before arriving at their destination.

By the end of this project, you'll have:

A working multi-switch VLAN topology where Sales, Engineering, and Voice traffic stays separated on its own broadcast domain.
Inter-VLAN routing through a router-on-a-stick setup, proving hosts in different VLANs can communicate through a router.
CDP and LLDP discovery showing every neighbor, platform, and port connection in your topology.
Secret Mission: Secure the native VLAN by changing it from VLAN 1 to VLAN 99 on all trunks and verify the security improvement.

Are there any prerequisites?

You should have basic Cisco IOS CLI familiarity (setting hostnames, navigating interface configuration mode) and Cisco Packet Tracer installed on your computer.

Before We Start

Before we dive into configuring switches and routers, let's lock in what you're about to build and why it matters.

Set Up the Topology in Packet Tracer

You need devices on the canvas before you can configure anything. Choosing the right device models and cable types now avoids rework later when you start configuring VLANs and trunks.

In this step, you will place two switches, a router, four PCs, and an IP phone on the Packet Tracer canvas. Then you will cable them together, set hostnames, and assign IP addresses to each PC.

In this step, get ready to:

Place all network devices on the canvas and cable them together.
Set hostnames on both switches and the router.
Assign static IP addresses and default gateways to all PCs.

Build the physical topology

Start by placing the network infrastructure devices. Switches and the router form the backbone of the office network you are building.

In the bottom toolbar, click the Network Devices icon (looks like a hub/router).
Click the Switches submenu icon.
Locate the 2960 switch icon and drag it onto the canvas.
Drag a second 2960 switch onto the canvas to the right of the first one.
Click the Routers submenu icon in the same toolbar section.
Locate the 2911 router icon and drag it onto the canvas above the first switch.

Now place the end devices that will generate traffic in your network.

Click the End Devices icon in the bottom toolbar.
Drag four PC icons onto the canvas, placing two below each switch.
Drag one IP Phone icon onto the canvas near the first switch.

What is the layout so far?

You should see 8 device icons on your canvas: 2 switches in the middle row, 1 router above the left switch, 4 PCs spread below the switches, and 1 IP phone near the left switch. No cables yet.

Next, cable the devices together using the Connections tool in the bottom toolbar.

Click the Connections icon in the bottom toolbar (the orange lightning bolt).
Select the Copper Cross-Over cable (dashed line icon).
Click on the first switch, select GigabitEthernet0/1, then click on the second switch and select GigabitEthernet0/1.

Why a crossover cable between switches?

A crossover cable connects two devices of the same type (switch-to-switch). Packet Tracer also has an auto-detect option, but choosing the correct cable type builds the habit you need for the CCNA exam.

Now select the Copper Straight-Through cable (solid line icon).
Click R1 (the router), select GigabitEthernet0/0, then click the first switch and select GigabitEthernet0/2.
Click the first PC below the left switch, select FastEthernet0, then click the left switch and select FastEthernet0/1.
Click the second PC below the left switch, select FastEthernet0, then click the left switch and select FastEthernet0/2.
Click the IP phone, select FastEthernet0, then click the left switch and select FastEthernet0/3.
Click the first PC below the right switch, select FastEthernet0, then click the right switch and select FastEthernet0/1.
Click the second PC below the right switch, select FastEthernet0, then click the right switch and select FastEthernet0/2.

After a few seconds, most link indicator lights should turn green. The router link to the switch may stay red or amber until you enable the interface later.

Rename your devices on the canvas

Click the text label below each device on the canvas to rename it. Name the left switch SW1, the right switch SW2, the router R1, and the PCs PC-Sales1, PC-Eng1, PC-Sales2, PC-Eng2. Name the phone Phone1.

Don't see green link lights?

Orange or amber lights on switch ports are normal for the first 30 seconds while Spanning Tree Protocol converges. Wait for them to turn green.

If a link stays red, you may have selected the wrong port. Delete the cable by clicking it and pressing the Delete key, then reconnect to the correct port.

Why are my link lights red after connecting a cable?

Set hostnames on all devices

Setting hostnames makes every show command output identifiable so you always know which device you are looking at.

Click on the left switch (SW1) to open its properties window.
Click the CLI tab.
If the switch asks "Would you like to enter the initial configuration dialog?", type no and press Enter.
Press Enter to get to the Switch> prompt.
Set the hostname on SW1 by entering the commands below:

enable
configure terminal
hostname SW1
end

What do these commands do?

enable enters privileged EXEC mode (the # prompt).
configure terminal enters global configuration mode where you can change device settings.
hostname SW1 changes the device prompt to SW1 so you can identify it in future outputs.
end exits back to privileged EXEC mode.

Your CLI prompt should now show SW1# instead of Switch#.

Close the SW1 window.
Click on the right switch (SW2) and open its CLI tab.
Repeat the same process, but use hostname SW2 instead.
Confirm the prompt now shows SW2#.
Close the SW2 window.
Click on the router (R1) and open its CLI tab.
Enter the same sequence, but use hostname R1.
Confirm the prompt now shows R1#.

Prompt still shows Switch or Router?

Make sure you typed configure terminal before the hostname command. The hostname command only works in global configuration mode.

Help me fix my hostname in Packet Tracer

Assign IP addresses to PCs

Each PC needs a static IP address and a default gateway. The gateway addresses match the router subinterfaces you will configure in a later step.

Click on PC-Sales1 (first PC connected to SW1 FastEthernet0/1).
Click the Desktop tab in the properties window.
Click IP Configuration.
Make sure the Static radio button is selected.
Enter the following values:

IP Address: 10.10.10.10
Subnet Mask: 255.255.255.0
Default Gateway: 10.10.10.1

Close the PC-Sales1 window.

Repeat the same process for the remaining three PCs using these values:

PC-Eng1 (connected to SW1 FastEthernet0/2): IP 10.10.20.10, Subnet Mask 255.255.255.0, Gateway 10.10.20.1.
PC-Sales2 (connected to SW2 FastEthernet0/1): IP 10.10.10.20, Subnet Mask 255.255.255.0, Gateway 10.10.10.1.
PC-Eng2 (connected to SW2 FastEthernet0/2): IP 10.10.20.20, Subnet Mask 255.255.255.0, Gateway 10.10.20.1.

Why two different subnets?

Sales PCs use the 10.10.10.0/24 subnet and Engineering PCs use 10.10.20.0/24. Each subnet maps to a different VLAN you will create in the next step.

The gateway address is the router subinterface that will route traffic between them.

After configuring all four PCs, click on PC-Sales1 again and verify the IP Configuration shows 10.10.10.10 with gateway 10.10.10.1.

IP address not saving on the PC?

Make sure the Static radio button is selected in the IP Configuration window, not DHCP. If DHCP is selected, the PC will ignore the values you type and try to get an address from a server that does not exist.

Help me fix my PC IP configuration in Packet Tracer

Before you move on, do you expect all of your link lights to be green right now?

Look at your canvas. All switch-to-PC and switch-to-switch links should show green lights. The router-to-switch link will likely show red or amber because you have not enabled the router interface yet.

Your topology is built and ready for configuration. Next up, you will create VLANs on both switches and assign ports so that Sales and Engineering traffic stays separated.

Create VLANs and Assign Access Ports

Your topology is cabled and every device has a hostname and IP address. Now it is time to carve this flat network into separate broadcast domains.

Every device currently sits in VLAN 1, the default VLAN. That means a broadcast from PC-Sales1 reaches PC-Eng2, wasting bandwidth and exposing traffic that should stay within its department.

In this step, get ready to:

Create VLANs 10, 20, and 50 on both switches.
Assign access ports to the correct VLANs, including a voice VLAN.
Test connectivity and discover what fails without a trunk link.

Create VLANs on both switches

A VLAN is a logical broadcast domain that groups ports together regardless of physical location. You need three: Sales (VLAN 10), Engineering (VLAN 20), and Voice (VLAN 50).

Click on SW1 in the Packet Tracer canvas, then select the CLI tab.
Create all three VLANs by entering these commands:

configure terminal
vlan 10
 name Sales
vlan 20
 name Engineering
vlan 50
 name Voice
exit

What do these commands do?

configure terminal enters global configuration mode where you can make changes to the switch.
vlan 10 creates a new VLAN with ID 10 and drops you into VLAN configuration mode.
name Sales gives that VLAN a human-readable label. Without it, the switch would call it VLAN0010.
exit returns you to privileged EXEC mode so you can run show commands.

Verify the VLANs were created on SW1 by running:

show vlan brief

You should see VLAN 10 (Sales), VLAN 20 (Engineering), and VLAN 50 (Voice) listed with status active. No ports appear next to them yet because you have not assigned any.

VLANs not showing up?

Make sure you typed exit after creating the last VLAN. The VLAN database updates when you leave VLAN configuration mode.
Confirm you are in privileged EXEC mode (prompt shows SW1#) before running show vlan brief.

Why aren't my VLANs appearing in show vlan brief?

Now click on SW2 and select the CLI tab.
Enter the same VLAN creation commands on SW2:

configure terminal
vlan 10
 name Sales
vlan 20
 name Engineering
vlan 50
 name Voice
exit

Verify on SW2 by running:

show vlan brief

You should see the same three VLANs listed as active on SW2.

Assign access ports to VLANs (data and voice)

Creating VLANs is only half the job. You need to assign each switch port to its correct VLAN so that traffic from a connected device enters the right broadcast domain.

Return to SW1's CLI tab.
Assign the three access ports by entering these commands:

configure terminal
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 50

What does this configuration do?

switchport mode access forces the port to carry traffic for a single VLAN only. It will never negotiate a trunk.
switchport access vlan 10 places the port into VLAN 10 (Sales). All untagged frames arriving on this port are treated as Sales traffic.
switchport voice vlan 50 on Fa0/3 tells the switch to send tagged voice traffic on VLAN 50 while the data VLAN remains VLAN 10. The IP phone uses the voice VLAN and passes PC traffic through on the data VLAN.

Exit configuration mode and confirm the port assignments by running:

end
show vlan brief

You should now see Fa0/1 listed under VLAN 10, Fa0/2 under VLAN 20, and Fa0/3 under VLAN 10. VLAN 50 will not show Fa0/3 in the Ports column because show vlan brief only lists the data VLAN assignment for each access port.

Port still showing under VLAN 1?

Check that you entered switchport mode access before switchport access vlan. The mode must be set first.
Make sure you typed end to exit configuration mode before running show vlan brief.

My port is still in VLAN 1 even though I configured it for VLAN 10. What went wrong?

Now switch to SW2's CLI tab.
Assign the access ports on SW2 by entering:

configure terminal
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20

Exit and verify the assignments on SW2:

end
show vlan brief

Fa0/1 should appear under VLAN 10 and Fa0/2 under VLAN 20.

Test and observe the designed failure

Your VLANs are created and ports are assigned. Time to test whether devices can actually reach each other.

Click on PC-Sales1 in the canvas, then select the Desktop tab, then Command Prompt.

Before you run anything, predict: do you think PC-Sales1 (VLAN 10 on SW1) can ping PC-Eng1 (VLAN 20 on SW1)?

Test a cross-VLAN ping from PC-Sales1 by running:

ping 10.10.20.10

The ping fails with "Request timed out" messages. This is expected. VLANs are Layer 2 boundaries. Traffic in VLAN 10 cannot reach VLAN 20 without a router.

Now predict: can PC-Sales1 (VLAN 10 on SW1) ping PC-Sales2 (VLAN 10 on SW2)? They are in the same VLAN, after all.

Test a same-VLAN, cross-switch ping by running:

ping 10.10.10.20

This also fails. PC-Sales1 and PC-Sales2 are both in VLAN 10, but the link between SW1 and SW2 (GigabitEthernet0/1) is still a default access port in VLAN 1. VLAN 10 traffic has nowhere to cross between switches.

Why does same-VLAN traffic fail across switches?

The inter-switch link is an access port in VLAN 1. It only carries VLAN 1 frames. Your VLAN 10 frames never leave SW1 because the physical path between switches does not carry them.

To fix this, you need a trunk link that tags frames with 802.1Q headers so multiple VLANs can share a single physical cable. That is exactly what the next step covers.

✔️ Awesome, I've got everything!

Great. Make sure both SW1 and SW2 have VLANs 10, 20, and 50 created with their port assignments matching what you verified above.

ⓧ I'd like to double check the full code

Here is a summary of the configuration you should have on each switch at this point.

SW1 VLANs and access ports:

! VLANs created:
! VLAN 10 - Sales
! VLAN 20 - Engineering
! VLAN 50 - Voice
!
! Access port assignments:
! Fa0/1: access VLAN 10
! Fa0/2: access VLAN 20
! Fa0/3: access VLAN 10, voice VLAN 50

SW2 VLANs and access ports:

! VLANs created:
! VLAN 10 - Sales
! VLAN 20 - Engineering
! VLAN 50 - Voice
!
! Access port assignments:
! Fa0/1: access VLAN 10
! Fa0/2: access VLAN 20

Both Gi0/1 links remain in default VLAN 1 (not yet trunked). Pings across switches and across VLANs are expected to fail at this point.

You have proven two things: VLANs successfully isolate traffic between departments on the same switch, and same-VLAN traffic cannot cross between switches without a trunk. Next up, you will configure 802.1Q trunks to solve that cross-switch problem.

Configure 802.1Q Trunks

Your VLANs exist and your access ports are assigned, but the ping from PC-Sales1 to PC-Sales2 still failed. The reason is simple: the link between SW1 and SW2 is still a default access port in VLAN 1, so it refuses to carry your VLAN 10, 20, or 50 traffic.

You need a trunk. A trunk is a single physical link that carries traffic for multiple VLANs by tagging each frame with an 802.1Q header identifying which VLAN it belongs to. In this step, you will configure trunks on both the inter-switch link and the link toward R1 so your VLAN traffic can flow where it needs to go.

In this step, get ready to:

Configure the inter-switch trunk between SW1 and SW2.
Configure the trunk from SW1 to R1 for the router-on-a-stick setup.
Verify trunk status and test same-VLAN connectivity across switches.

Configure the inter-switch trunk (SW1 to SW2)

Both sides of the link need to be configured as trunks. You will start with SW1, then configure the matching side on SW2.

Click on SW1 in your Packet Tracer canvas.
Select the CLI tab.
Configure GigabitEthernet0/1 as a trunk port by entering these commands:

configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,50
end

What do these commands do?

switchport mode trunk converts the port from an access port into a trunk port that tags frames with 802.1Q headers.
switchport trunk allowed vlan 10,20,50 restricts the trunk to carry only VLANs 10, 20, and 50. This is a security best practice. Without it, all VLANs would traverse the trunk.

Why no encapsulation command?

On 2960 switches, 802.1Q is the only trunking encapsulation available. The switchport trunk encapsulation dot1q command is not needed (or supported) because there is no ISL alternative to choose from.

Now configure the matching trunk on the other side of the link.

Click on SW2 in your canvas.
Select the CLI tab.
Configure GigabitEthernet0/1 as a trunk port by entering these commands:

configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,50
end

Return to SW1's CLI and confirm the trunk is operational by running:

show interfaces trunk

You should see GigabitEthernet0/1 listed as a trunk with encapsulation dot1q and VLANs 10, 20, 50 in the allowed list.

Trunk not showing up?

Make sure you ran the commands on the correct interface. GigabitEthernet0/1 is the inter-switch link, not FastEthernet0/1.
Confirm you typed end to exit configuration mode before running the show command.
Check that the cable between SW1 and SW2 is connected to GigabitEthernet0/1 on both devices.

Why isn't my trunk showing up in show interfaces trunk?

Configure the trunk from SW1 to R1

The link from SW1 to R1 also needs to be a trunk. In the next step, R1 will use subinterfaces to route between VLANs. Those subinterfaces expect tagged 802.1Q frames arriving on a trunk port.

In SW1's CLI, configure GigabitEthernet0/2 as a trunk by entering these commands:

configure terminal
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,50
end

What does this set up for the router?

This trunk carries VLAN-tagged frames to R1. When you configure router-on-a-stick in the next step, R1 will create a subinterface for each VLAN and use the 802.1Q tag to decide which subinterface receives the frame.

Verify trunks and test same-VLAN cross-switch connectivity

Both trunk links are configured. Time to confirm the trunk details and test whether same-VLAN traffic can now cross between switches.

In SW1's CLI, view the full trunk status by running:

show interfaces trunk

You should see both GigabitEthernet0/1 and GigabitEthernet0/2 listed as trunks with encapsulation dot1q.

Examine the switchport details for GigabitEthernet0/1 by running:

show interfaces GigabitEthernet0/1 switchport

Confirm that the Operational Mode shows trunk and the Operational Trunking Encapsulation shows dot1q.

Now for the real test. Before you run the ping, predict: do you think PC-Sales1 can reach PC-Sales2 now that the trunk is in place?

Click on PC-Sales1 in your canvas.
Select the Desktop tab, then open Command Prompt.
Ping PC-Sales2 by running:

ping 10.10.10.20

The ping succeeds. VLAN 10 traffic from PC-Sales1 now crosses the 802.1Q trunk to reach PC-Sales2 on SW2.

Now try pinging PC-Eng1 from the same command prompt. What do you think will happen?

Ping PC-Eng1 by running:

ping 10.10.20.10

This ping fails. PC-Sales1 is in VLAN 10 (subnet 10.10.10.0/24) and PC-Eng1 is in VLAN 20 (subnet 10.10.20.0/24). Switches are Layer 2 devices. They forward frames within a VLAN but cannot route between different VLANs or subnets.

Why does cross-VLAN ping fail?

A trunk carries multiple VLANs, but it does not connect them. Each VLAN is still its own broadcast domain with its own subnet. For traffic to move between VLANs, you need a Layer 3 device (a router) to route between the subnets.

That is exactly what you will solve in the next step with router-on-a-stick.

Your trunks are carrying VLAN traffic between switches. Same-VLAN hosts can now communicate regardless of which switch they are on. Next up, you will configure router-on-a-stick so hosts in different VLANs can finally reach each other.

Configure Router-on-a-Stick for Inter-VLAN Routing

Your trunks are carrying VLAN traffic between switches, and same-VLAN pings now succeed across the link.

But try pinging from a Sales PC to an Engineering PC and it still fails. Switches are Layer 2 devices. They forward frames within a VLAN but cannot route packets between different subnets. To connect VLANs, you need a router that acts as the default gateway for every VLAN.

The solution is router-on-a-stick. R1 receives the trunk from SW1 on a single physical interface, then uses subinterfaces to tag and route traffic for each VLAN separately. Each subinterface gets an IP address that becomes the default gateway for its VLAN.

In this step, get ready to:

Configure subinterfaces on R1 with 802.1Q encapsulation and IP addresses.
Verify the routing table shows connected routes for all three VLAN subnets.
Test inter-VLAN connectivity and trace the packet path through R1.

Configure subinterfaces on R1

A subinterface is a virtual interface that lives on top of a physical interface. Each subinterface is assigned a VLAN ID and an IP address, so the router knows which VLAN a packet belongs to and where to forward it.

Click on R1 in your Packet Tracer canvas, then go to the CLI tab.
Enter privileged EXEC mode and then global configuration mode by running these commands:

enable
configure terminal

Bring up the physical interface and configure all three subinterfaces by entering this configuration:

interface GigabitEthernet0/0
 no shutdown
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 10.10.20.1 255.255.255.0
interface GigabitEthernet0/0.50
 encapsulation dot1Q 50
 ip address 10.10.50.1 255.255.255.0

What does this configuration do?

no shutdown activates the physical GigabitEthernet0/0 interface, which is shut down by default on routers.
Each GigabitEthernet0/0.XX creates a subinterface. The number after the dot is just a label, but matching it to the VLAN ID keeps things readable.
encapsulation dot1Q <vlan-id> tells the router which VLAN tag to expect on incoming frames and which tag to add to outgoing frames.
The ip address on each subinterface becomes the default gateway for that VLAN's hosts.

Return to privileged EXEC mode by running:

end

Verify the subinterfaces came up by running:

show ip interface brief

You should see GigabitEthernet0/0.10, GigabitEthernet0/0.20, and GigabitEthernet0/0.50 all showing up in both the Status and Protocol columns, with their assigned IP addresses.

Subinterfaces showing down/down?

Make sure you included no shutdown on the physical GigabitEthernet0/0 interface. Subinterfaces inherit the physical interface state.
Check that the cable from SW1 Gi0/2 to R1 Gi0/0 shows a green link light. If the light is red, verify you connected to the correct ports.

Why are my subinterfaces still down?

Verify routing and test inter-VLAN connectivity

When the subinterfaces come up, the router automatically creates connected routes for each subnet. These routes tell R1 how to forward packets between VLANs.

Confirm the routing table has entries for all three VLAN subnets by running this on R1:

show ip route

You should see three connected routes marked with a C prefix: 10.10.10.0/24, 10.10.20.0/24, and 10.10.50.0/24.

What are connected routes?

A connected route appears automatically when an interface with an IP address comes up. It tells the router that a given subnet is directly reachable through that interface. No static routes or routing protocols are needed here because all three subnets are local to R1's own subinterfaces.

Now for the real test. In the last step, pinging from Sales to Engineering failed because there was no routing. The router is configured now.

Before you run this ping, what do you think will happen? Will PC-Sales1 be able to reach PC-Eng2 across VLANs now that R1 has subinterfaces?

Click on PC-Sales1 in your canvas, go to the Desktop tab, and open Command Prompt.
Test inter-VLAN routing by pinging PC-Eng2:

ping 10.10.20.20

The ping succeeds. Traffic from PC-Sales1 in VLAN 10 is now reaching PC-Eng2 in VLAN 20 by routing through R1. This is inter-VLAN routing in action.

Ping still failing?

Confirm PC-Sales1's default gateway is set to 10.10.10.1. Without the correct gateway, the PC does not know to send cross-subnet traffic to R1.
Run show ip interface brief on R1 again. All three subinterfaces must show up/up.
Verify that the trunk on SW1 Gi0/2 allows VLANs 10, 20, and 50. If a VLAN is pruned from the trunk, R1 never receives its tagged frames.

Help me troubleshoot my inter-VLAN ping failure.

Trace the path and understand the flow

A successful ping proves connectivity, but it does not show you the path the packet takes. A traceroute reveals every hop between source and destination, confirming the router is in the middle.

On PC-Sales1's Command Prompt, trace the route to PC-Eng2 by running:

tracert 10.10.20.20

You should see two hops. The first hop is 10.10.10.1 (R1's subinterface for VLAN 10). The second hop is 10.10.20.20 (PC-Eng2 itself).

Why does the traffic go through R1?

PC-Sales1 sees that 10.10.20.20 is in a different subnet from its own 10.10.10.0/24. It sends the packet to its default gateway (10.10.10.1 on R1).

R1 receives the frame on subinterface Gi0/0.10, strips the VLAN 10 tag, looks up the destination in its routing table, and forwards it out subinterface Gi0/0.20 with a VLAN 20 tag. The frame arrives at SW1 tagged for VLAN 20 and reaches PC-Eng2.

Why router-on-a-stick instead of a Layer 3 switch?

A Layer 3 switch with SVIs (Switch Virtual Interfaces) can also route between VLANs. Router-on-a-stick uses a separate router connected via a trunk. This approach is more heavily tested on the CCNA exam because it forces you to configure 802.1Q encapsulation on subinterfaces, which is a distinct skill from configuring SVIs.

Your network is fully routable. Every VLAN can reach every other VLAN through R1's subinterfaces. Next up, you will use discovery protocols to map this topology automatically, just like a real engineer walking into an unfamiliar network.

Configure and Verify CDP and LLDP

Your network routes traffic between VLANs perfectly. If you handed this topology to another engineer, though, they would have no quick way to discover which devices connect to which ports.

Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) solve this by letting devices advertise themselves to their neighbors. In this step, you will verify both protocols and compare what each discovers. This covers CCNA exam objective 2.3.

In this step, get ready to:

Examine CDP neighbor output on SW1 to identify connected devices.
Enable LLDP on all devices and compare its output to CDP.
Disable CDP on a single interface to demonstrate per-interface control.

Verify CDP and examine neighbor output

CDP is enabled by default on all Cisco IOS devices. Your switches and router have been advertising themselves to each other since the moment you powered them on.

Click on SW1 in Packet Tracer and open the CLI tab.
View the CDP neighbor table by running this command:

show cdp neighbors

You should see a table with R1 and SW2 listed as neighbors. Each row shows the Device ID, Local Interface, Holdtime, Capability, Platform, and Port ID.

What do the CDP columns mean?

Device ID is the hostname of the neighbor (R1, SW2).
Local Intrfce is the port on SW1 that connects to that neighbor.
Capability tells you what the device is. R = Router, S = Switch, H = Host, P = Phone.
Platform shows the hardware model (e.g., 2911, 2960).
Port ID is the interface on the neighbor device that connects back to SW1.

Now view the detailed version for additional information by running:

show cdp neighbors detail

The detail output adds the neighbor's IP address and IOS software version. This is how you would find a device's management IP without physically tracing cables.

Not seeing any neighbors?

Make sure all link lights between devices are green in Packet Tracer. If a link shows red, the cable is disconnected or the interface is administratively shut down.

Confirm CDP is enabled globally by running show cdp on SW1. You should see a message confirming CDP is enabled with a timer and holdtime value.

Help me troubleshoot why show cdp neighbors is empty on SW1

Enable LLDP and verify neighbor discovery

Unlike CDP, LLDP is not enabled by default on Cisco devices. LLDP is an industry-standard protocol (IEEE 802.1AB), so it works between devices from different vendors.

Enable LLDP on SW1 by entering global configuration mode and running these commands:

configure terminal
lldp run
end

Repeat the same commands on SW2. Click on SW2, open the CLI tab, and run:

configure terminal
lldp run
end

Repeat on R1. Click on R1, open the CLI tab, and run:

configure terminal
lldp run
end

Why enable LLDP on all three devices?

LLDP requires both sides of a link to participate. If you only enable it on SW1, it will transmit advertisements but receive nothing back from devices that are not running LLDP.

LLDP sends advertisements every 30 seconds by default. In Packet Tracer, discovery may appear faster due to simulation.

Return to SW1's CLI and view the LLDP neighbor table by running:

show lldp neighbors

You should see R1 and SW2 listed as LLDP neighbors, similar to the CDP table but with different capability codes.

View the detailed LLDP output by running:

show lldp neighbors detail

How do LLDP capability codes differ from CDP?

LLDP uses different letters than CDP. A switch shows as (B) for Bridge instead of S. A router shows as (R) in both protocols. A phone shows as (T) for Telephone instead of P.

This matters on the exam. If you see (B) in a neighbor table, you know you are reading LLDP output, not CDP.

LLDP neighbors table is empty?

Confirm you ran lldp run on all three devices (SW1, SW2, and R1). LLDP only discovers neighbors that are also running LLDP.

If you just enabled LLDP, wait 30 seconds for the first advertisement exchange. In Packet Tracer, you can switch to Simulation mode and advance time, then switch back to Realtime.

Help me figure out why show lldp neighbors is empty on SW1

Disable CDP on a specific interface and observe the difference

CDP and LLDP are independent protocols. You can control each one on a per-interface basis. Disabling CDP on one interface does not affect LLDP on that same interface.

On SW1, disable CDP on the interface facing R1 by running these commands:

configure terminal
interface GigabitEthernet0/2
 no cdp enable
end

What does no cdp enable do?

This disables CDP on a single interface while leaving it enabled globally and on all other interfaces. It stops SW1 from sending or processing CDP advertisements on GigabitEthernet0/2 specifically.

Before you check the neighbor tables, predict: which protocol will still show R1 as a neighbor?
Verify by running the CDP neighbor table:

show cdp neighbors

R1 has disappeared from the CDP table. SW2 remains because its link (GigabitEthernet0/1) still has CDP enabled.

Now check the LLDP neighbor table:

show lldp neighbors

R1 still appears in the LLDP table. The two protocols operate independently. Disabling one has no effect on the other.

Re-enable CDP on the interface so your topology is fully discoverable again:

configure terminal
interface GigabitEthernet0/2
 cdp enable
end

Confirm R1 returns to the CDP table by running:

show cdp neighbors

R1 reappears alongside SW2. Both discovery protocols now show the full topology from SW1's perspective.

R1 not reappearing after re-enabling CDP?

CDP has a holdtime (usually 180 seconds) and an advertisement interval (60 seconds). In Packet Tracer, the neighbor may reappear after a short delay. Run show cdp neighbors again after a few seconds.

Help me understand why R1 is not reappearing in my CDP neighbors table

Before you wrap up, predict: will your inter-VLAN pings still work after all the CDP and LLDP changes you made?

Test by pinging from PC-Sales1 to PC-Eng2 (10.10.20.20). Click on PC-Sales1, open the Desktop tab, then Command Prompt, and run:

ping 10.10.20.20

The ping succeeds. CDP and LLDP are Layer 2 discovery protocols. They do not affect data forwarding or routing in any way.

Why don't discovery protocols affect traffic?

CDP and LLDP send special multicast frames that switches and routers process locally. These frames are never forwarded to end hosts or routed between subnets. Enabling, disabling, or changing discovery settings has zero impact on your data path.

Secret mission

Secure the Native VLAN

Your network works, but it has a well-known security hole. The default native VLAN (VLAN 1) is vulnerable to VLAN hopping attacks. In this mission, you will change the native VLAN to an unused VLAN across all trunks and prove connectivity still works.

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your topology file for exam review, close Packet Tracer to free up memory, or delete the project files entirely.

Resources you used:

Packet Tracer topology file (.pkt file saved on your computer).
Cisco Packet Tracer application (prerequisite, already installed before this project).

Keep everything running

No action needed. Choose this if you are still actively reviewing your VLAN configurations or preparing for the CCNA exam.

Your .pkt file stays saved wherever you stored it.
You can reopen it anytime in Packet Tracer to practice show commands or test new configurations.
Packet Tracer remains installed on your machine for future labs.

Pause - I'll come back to this later

Close Packet Tracer to free up system memory. Your files stay on disk so you can pick up where you left off.

Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.
Close Packet Tracer completely to free up RAM.
Your .pkt file remains on your computer. Reopen it whenever you want to resume.

Delete - I don't want to use this again

Remove all project files from your computer. You can always rebuild the topology from scratch using the steps in this project.

Close Packet Tracer if it is still open.
Locate your saved .pkt file on your computer (check your Desktop or Documents folder).
Delete the .pkt file by moving it to the Trash (macOS) or Recycle Bin (Windows), then empty it.
If you created any documentation files (such as a README.md or topology screenshots), delete those as well.

What about Packet Tracer itself?

Packet Tracer was a prerequisite for this project. If you want to keep it installed for future CCNA labs, leave it as is. If you want to remove it, use your operating system's standard app uninstall process (Apps & features on Windows, or drag to Trash from Applications on macOS).

Nice Work!

You just built a fully functional multi-VLAN office network from scratch in Cisco Packet Tracer. Your topology segments traffic by department, trunks frames across switches, and routes between VLANs through a router.

You learned how to:

Built a multi-switch VLAN topology with Sales (VLAN 10), Engineering (VLAN 20), and Voice (VLAN 50) segments connected by 802.1Q trunks.
Configured router-on-a-stick with subinterfaces to enable inter-VLAN routing, proving hosts in different VLANs can reach each other through R1.
Used CDP and LLDP to discover and verify every neighbor, platform, and port connection in your topology.
Secret Mission: Secured the native VLAN by changing it from VLAN 1 to VLAN 99 on all trunks to mitigate VLAN hopping attacks.

Ready to quiz yourself?