Multi-Switch Network with VLANs

Build a Layer 2 campus network with VLANs, EtherChannel, and trunk hardening.

Introduction

30 Second Summary

In a real office, departments like Sales, HR, and IT share the same physical network cables and switches. Keeping their traffic separate and secure requires careful Layer 2 configuration that network engineers set up every day.

In this project, you will build a two-switch office network in Cisco Packet Tracer that uses VLANs, an LACP EtherChannel trunk, and access port security features. You will document everything for your GitHub portfolio.

What You'll Build

A two-switch campus network covering the entire CCNA 200-301 Network Access domain (topics 2.1 through 2.5) with real Cisco IOS CLI commands.

By the end of this project, you'll have:

  • A working multi-switch VLAN topology with three department VLANs spanning two Cisco 2960 switches connected by a redundant 802.1Q trunk.
  • A hardened LACP EtherChannel trunk with a dedicated native VLAN and explicit allowed VLAN list, plus PortFast and BPDU Guard on all access ports.
  • Verified Layer 2 discovery with CDP and observed Spanning Tree root bridge election across your topology.
  • Secret Mission: Intentionally break and repair an EtherChannel, then document the troubleshooting process as a portfolio-ready artifact.

Are there any prerequisites?

You need Cisco Packet Tracer installed (free from Cisco Networking Academy) and a GitHub account. No prior VLAN or switching experience is required.

Create the GitHub Repository and Open Packet Tracer

Everything you configure in this lab will become a portfolio artifact. Employers and LinkedIn connections want to see real hands-on evidence, not just a certification badge.

In this step, you will set up the two foundations for your portfolio: a public GitHub repository to host your documentation, and a fresh Cisco Packet Tracer workspace where you will build the network.

In this step, get ready to:
  • Create a public GitHub repository for your lab documentation.
  • Open Cisco Packet Tracer and save a new blank workspace.
Create a new GitHub repository

Your GitHub repository will store the topology screenshot, switch configurations, and verification outputs that prove your CCNA skills to anyone who views your profile.

  • Open your browser and navigate to github.com.
  • Sign in to your GitHub account.
  • In the upper-right corner of the page, click the + icon.
  • Select New repository from the dropdown menu.
  • In the Repository name field, type ccna-network-access-lab.
  • In the Description field, type CCNA 200-301 Network Access lab: VLANs, EtherChannel (LACP), trunk hardening, STP, and CDP across two switches.
  • Under visibility, select Public so employers and connections can view your work.
  • Check the box labelled Add a README file.
  • Click Create repository.

GitHub redirects you to your new repository page. You should see the repository name ccna-network-access-lab at the top and a README.md file listed below.

Why a public repository?

A public repository lets hiring managers, recruiters, and LinkedIn connections view your lab without needing special access. It transforms a practice exercise into a shareable credential.

Don't see the new repository?

Make sure you clicked Create repository at the bottom of the form. If the page shows a 404 error, check that you are signed in to the correct GitHub account.

Help me troubleshoot my GitHub repository

Open Cisco Packet Tracer and save a new workspace

Cisco Packet Tracer is where you will build the entire multi-switch topology. Saving the file now ensures you never lose progress.

  • Press Cmd+Space (macOS) or the Windows key (Windows) to open your search bar.
  • Type Packet Tracer and press Enter to open it.

First time opening Packet Tracer?

On the first launch, Packet Tracer may ask "Would you like to run multi-user when the application starts?" Click No. You may also see a Windows Security Alert asking about network access. Allow access if prompted.

  • Once Packet Tracer opens, click File in the top menu bar.
  • Click New to create a blank workspace.
  • Click File again, then click Save As.
  • In the Save dialog, navigate to your Desktop.
  • Create a new folder called ccna-network-access-lab and open it.
  • In the file name field, type ccna-network-access-lab.pkt and click Save.

You should see the filename ccna-network-access-lab.pkt appear in the Packet Tracer title bar. The workspace is blank with no devices yet.

Why save to a dedicated folder?

Later you will add a topology screenshot, verification outputs, and a README to this same folder. Keeping everything together makes it easy to push the entire folder to your GitHub repository.

Packet Tracer won't open?

Confirm that Cisco Packet Tracer is installed. You can download it for free from the Cisco Networking Academy site at netacad.com/resources/lab-downloads. You will need a Networking Academy account to download.

Help me troubleshoot Packet Tracer

Your portfolio foundation is in place. Next up, you will build the two-switch topology by adding switches, PCs, and cables to your workspace.

Build the Two-Switch Topology

Your GitHub repository and Packet Tracer workspace are ready. Now it's time to build the physical network topology that forms the foundation of your lab.

In a real office, you'd have switches in a server closet connected to PCs at employee desks. You'll recreate this layout with two Cisco 2960 switches and six PCs representing three departments.

In this step, get ready to:
  • Place two Cisco 2960 switches and six PCs on the workspace.
  • Cable each PC to its assigned switch port using straight-through copper.
  • Connect the two switches with a pair of inter-switch links for the future EtherChannel.
Add network devices to the workspace

Every network starts with the physical devices. You need two switches to simulate a multi-switch office floor, and six PCs to represent employees in three departments.

  • In the bottom-left device panel of Packet Tracer, click the Network Devices category (the icon that looks like a router/switch).
  • Click the Switches subcategory in the row below.
  • Find 2960 in the device list and drag it onto the left side of your workspace.
  • Drag a second 2960 switch onto the right side of your workspace.
  • Click the label text below the left switch and rename it to SW1.
  • Click the label text below the right switch and rename it to SW2.

Now add the PCs that will represent end-user devices.

  • In the bottom-left device panel, click the End Devices category (the icon that looks like a computer).
  • Drag a PC onto the workspace below SW1. Repeat twice more so you have three PCs near SW1.
  • Drag three more PCs onto the workspace below SW2.
  • Rename the PCs by clicking their labels. The three near SW1 become PC1, PC2, and PC3. The three near SW2 become PC4, PC5, and PC6.

Your workspace should now show two switches side by side with three PCs below each one.

Can't find the 2960 switch?

Make sure you clicked Network Devices first (not End Devices or Connections), then the Switches subcategory. The 2960 appears in the list as a small switch icon with the label "2960" below it.

help me find the Cisco 2960 switch in Packet Tracer's device panel

Cable the PCs to switches

Straight-through copper cables connect PCs to switches. Each PC plugs into a specific FastEthernet port that you'll later assign to a VLAN.

  • In the bottom-left panel, click the Connections category (the lightning bolt icon).
  • Select the Copper Straight-Through cable (solid black line icon).
  • Click on PC1 and select FastEthernet0 from the port list.
  • Click on SW1 and select FastEthernet0/1 from the port list.
  • Repeat for PC2: connect PC2's FastEthernet0 to SW1's FastEthernet0/2.
  • Repeat for PC3: connect PC3's FastEthernet0 to SW1's FastEthernet0/3.
  • Now cable the PCs on the right side. Connect PC4's FastEthernet0 to SW2's FastEthernet0/1.
  • Connect PC5's FastEthernet0 to SW2's FastEthernet0/2.
  • Connect PC6's FastEthernet0 to SW2's FastEthernet0/3.

After a few seconds, the link indicators (circles at each end of the cable) should turn green. This confirms the physical connection is active.

Why these specific port numbers?

Using Fa0/1 through Fa0/3 for PCs keeps the low-numbered ports reserved for access devices. You'll reserve the high-numbered ports (Fa0/23 and Fa0/24) for the inter-switch trunk links. This separation mirrors how enterprise networks organize their port assignments.

Seeing orange or red circles on the cables?

Orange circles mean the port is still initializing. Wait about 30 seconds for Spanning Tree Protocol to finish and the links to go green. If circles stay red, double-check that you selected the correct port on both the PC and the switch.

help me troubleshoot cable connection indicators in Packet Tracer

Cable the inter-switch links

Two parallel links between the switches will later become your EtherChannel bundle. Having two physical cables provides both extra bandwidth and redundancy.

  • In the Connections category, select the Copper Cross-Over cable (dashed line icon).
  • Click SW1 and select FastEthernet0/23.
  • Click SW2 and select FastEthernet0/23.
  • Repeat for the second link: connect SW1's FastEthernet0/24 to SW2's FastEthernet0/24.

Why crossover cables between switches?

Traditionally, switch-to-switch connections use crossover cables because both devices transmit on the same pins. Modern switches with Auto-MDIX can auto-detect and work with straight-through cables too. Using crossover here follows the classic convention you'll see on the CCNA exam.

Wait for the link indicators on all four inter-switch cable ends to turn green. One of the two links may show orange because Spanning Tree is blocking it to prevent loops. That's expected behaviour.

  • Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS).

One inter-switch link stays orange?

This is normal. Spanning Tree Protocol blocks one of the two redundant links to prevent a switching loop. You'll see this in detail when you inspect STP later in the project. As long as at least one link is green, your topology is correct.

help me understand why one of my inter-switch links is orange in Packet Tracer

Your physical topology is complete. Next up, you'll configure VLANs on both switches and assign each PC to its department.

Create VLANs on Both Switches and Assign Ports

Your physical topology is built. Now you need to logically segment the network so that each department's traffic stays separate.

In a real office, you would not want Sales, HR, and IT devices sharing the same broadcast domain. VLANs solve this by creating isolated Layer 2 segments on the same physical switch. In this step, you will create three department VLANs plus a dedicated native VLAN on both switches, then assign each PC's port to the correct VLAN.

In this step, get ready to:
  • Create VLANs 10 (Sales), 20 (HR), 30 (IT), and 99 (NativeVLAN) on both switches.
  • Assign access ports to the correct VLANs on each switch.
  • Verify VLAN configuration with show commands.
Create VLANs and a dedicated native VLAN on SW1

Each VLAN gets a number and a descriptive name. You will also create VLAN 99 as a dedicated native VLAN for trunk security later.

  • Click SW1 in your Packet Tracer workspace.
  • Select the CLI tab at the top of the device window.
  • Press Enter to get a prompt, then enter the following commands to set the hostname and create all four VLANs:
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name HR
SW1(config-vlan)# exit
SW1(config)# vlan 30
SW1(config-vlan)# name IT
SW1(config-vlan)# exit
SW1(config)# vlan 99
SW1(config-vlan)# name NativeVLAN
SW1(config-vlan)# exit

What does this configuration do?

enable enters privileged EXEC mode, and configure terminal enters global configuration mode where you can make changes to the switch.

Each vlan <number> command creates a new VLAN and drops you into VLAN configuration mode. The name command gives the VLAN a human-readable label (Sales, HR, IT). VLAN 99 will be used later as a dedicated native VLAN to harden your trunks.

Why a dedicated native VLAN?

By default, all Cisco switches use VLAN 1 as the native VLAN on trunks. Native VLAN traffic crosses trunks untagged, which creates a security risk. Using VLAN 99 (a VLAN with no user devices) ensures untagged frames cannot accidentally reach end-user ports.

  • Verify your VLANs were created by running this command from privileged EXEC mode:
SW1(config)# end
SW1# show vlan brief

You should see VLANs 10 (Sales), 20 (HR), 30 (IT), and 99 (NativeVLAN) listed alongside the default VLAN 1. No ports are assigned to the new VLANs yet.

Don't see your VLANs listed?

Make sure you typed exit after each VLAN name command to leave VLAN config mode. If you stayed in VLAN config mode, subsequent vlan commands may not have been applied.

Re-enter the commands from configure terminal and make sure each block ends with exit.

Help me troubleshoot my VLAN creation on SW1 in Packet Tracer

Assign access ports on SW1

Creating VLANs is only half the job. Each switch port that connects to a PC must be explicitly placed into the correct VLAN. Ports in access mode carry traffic for only one VLAN.

  • Return to global configuration mode and assign PC1 (Fa0/1) to VLAN 10, PC2 (Fa0/2) to VLAN 20, and PC3 (Fa0/3) to VLAN 30 by entering these commands:
SW1# configure terminal
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 30
SW1(config-if)# exit

What does this configuration do?

switchport mode access tells the port it will only carry traffic for a single VLAN (as opposed to a trunk port, which carries multiple VLANs).

switchport access vlan 10 assigns that port to VLAN 10. Any device plugged into this port is now a member of the Sales VLAN. The same pattern applies to Fa0/2 (HR) and Fa0/3 (IT).

  • Verify the port assignments by running:
SW1(config)# end
SW1# show vlan brief

You should now see Fa0/1 listed under VLAN 10, Fa0/2 under VLAN 20, and Fa0/3 under VLAN 30. These ports no longer appear under VLAN 1.

Ports still showing under VLAN 1?

Check that you typed the VLAN number correctly in each switchport access vlan command. If you assigned a port to a VLAN that does not exist, Cisco IOS may reject it silently or show an error.

Also verify you ran switchport mode access before the VLAN assignment on each interface. Without this, the port may default to dynamic mode.

Help me fix my access port VLAN assignment on SW1

Repeat the configuration on SW2

For VLANs to span multiple switches, both switches must have the same VLAN database. You will now mirror the exact same VLAN and port configuration on SW2.

  • Click SW2 in your workspace.
  • Select the CLI tab.
  • Enter the following commands to set the hostname and create the same four VLANs:
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW2
SW2(config)# vlan 10
SW2(config-vlan)# name Sales
SW2(config-vlan)# exit
SW2(config)# vlan 20
SW2(config-vlan)# name HR
SW2(config-vlan)# exit
SW2(config)# vlan 30
SW2(config-vlan)# name IT
SW2(config-vlan)# exit
SW2(config)# vlan 99
SW2(config-vlan)# name NativeVLAN
SW2(config-vlan)# exit

Why identical VLANs on both switches?

CCNA exam topic 2.1 covers VLANs spanning multiple switches. For a VLAN to work across an inter-switch trunk, the VLAN must exist in the VLAN database of both switches. If SW2 does not know about VLAN 10, it will drop any VLAN 10 tagged frames that arrive over the trunk.

  • Now assign the access ports on SW2. PC4 (Fa0/1) goes to VLAN 10, PC5 (Fa0/2) to VLAN 20, and PC6 (Fa0/3) to VLAN 30:
SW2(config)# interface FastEthernet0/1
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 10
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/2
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 20
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/3
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 30
SW2(config-if)# exit

What should I see?

The commands are identical to SW1 (same VLAN numbers, same interface-to-VLAN mapping). The only difference is the hostname prompt showing SW2 instead of SW1. This symmetry makes troubleshooting easier because you know both switches should be configured the same way.

  • Verify the configuration by running:
SW2(config)# end
SW2# show vlan brief

You should see VLANs 10, 20, 30, and 99 listed, with Fa0/1 under VLAN 10, Fa0/2 under VLAN 20, and Fa0/3 under VLAN 30.

  • Save your Packet Tracer file (File > Save).

SW2 VLANs or ports not matching SW1?

Double check you did not accidentally reopen SW1's CLI. Look at the hostname in the prompt to confirm you are on SW2.

If a VLAN name has a typo, re-enter the vlan <number> command followed by the correct name command. The new name overwrites the old one.

Help me verify my SW2 VLAN configuration matches SW1

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file with both switches configured.

ⓧ I'd like to double check the full configuration

Here is the complete set of commands for both switches in this step.

SW1 full configuration:

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW1
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name HR
SW1(config-vlan)# exit
SW1(config)# vlan 30
SW1(config-vlan)# name IT
SW1(config-vlan)# exit
SW1(config)# vlan 99
SW1(config-vlan)# name NativeVLAN
SW1(config-vlan)# exit
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/3
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 30
SW1(config-if)# exit
SW1(config)# end
SW1# show vlan brief

SW2 full configuration:

Switch> enable
Switch# configure terminal
Switch(config)# hostname SW2
SW2(config)# vlan 10
SW2(config-vlan)# name Sales
SW2(config-vlan)# exit
SW2(config)# vlan 20
SW2(config-vlan)# name HR
SW2(config-vlan)# exit
SW2(config)# vlan 30
SW2(config-vlan)# name IT
SW2(config-vlan)# exit
SW2(config)# vlan 99
SW2(config-vlan)# name NativeVLAN
SW2(config-vlan)# exit
SW2(config)# interface FastEthernet0/1
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 10
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/2
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 20
SW2(config-if)# exit
SW2(config)# interface FastEthernet0/3
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 30
SW2(config-if)# exit
SW2(config)# end
SW2# show vlan brief

Both switches now have identical VLAN databases and matching port assignments. Next up, you will bundle the two inter-switch links into a single high-bandwidth LACP EtherChannel trunk so your VLANs can actually communicate across switches.

Configure LACP EtherChannel Trunk Between Switches

Your VLANs exist on both switches, but right now the two switches have no idea those VLANs need to talk to each other. The inter-switch links on Fa0/23 and Fa0/24 are just regular ports sitting idle.

In this step, you will bundle those two links into a single EtherChannel using LACP (Link Aggregation Control Protocol), then configure the bundle as an 802.1Q trunk with a hardened native VLAN. This gives you both bandwidth aggregation and redundancy in a single logical link.

In this step, get ready to:
  • Bundle Fa0/23 and Fa0/24 into a Port-Channel using LACP active mode on both switches.
  • Configure the Port-Channel as a trunk with native VLAN 99 and an explicit allowed VLAN list.
  • Verify the EtherChannel is up and trunking correctly.
Configure EtherChannel on SW1

EtherChannel bundles multiple physical links into one logical interface called a Port-Channel. LACP active mode means the switch actively tries to negotiate the bundle with its partner.

  • Click SW1 in the workspace, then select the CLI tab.
  • Enter global configuration mode and configure the EtherChannel with trunk settings by entering these commands:
SW1(config)# interface range FastEthernet0/23-24
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-Channel1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99
SW1(config-if)# exit

What do these commands do?

  • interface range FastEthernet0/23-24 selects both inter-switch ports at once so you can configure them together.
  • channel-group 1 mode active assigns both ports to EtherChannel group 1 and tells them to actively negotiate using LACP.
  • interface Port-Channel1 enters the logical bundled interface. Trunk settings go here, not on the individual member ports.
  • switchport trunk native vlan 99 moves untagged traffic off the default VLAN 1 to your dedicated native VLAN for security.
  • switchport trunk allowed vlan 10,20,30,99 restricts the trunk to carry only the VLANs you need. This prevents unwanted VLAN traffic from crossing the link.

Why configure trunk settings on the Port-Channel?

When you use EtherChannel, the Port-Channel interface is the logical entity that handles switching decisions. Any trunk configuration (mode, native VLAN, allowed VLANs) must be applied to the Port-Channel interface. The settings automatically propagate down to the physical member ports.

Seeing an error after channel-group?

Make sure you are in interface range mode (your prompt should show config-if-range). If you accidentally exited to global config mode, re-enter the interface range command first.

help me troubleshoot my EtherChannel configuration on SW1 in Packet Tracer

Configure EtherChannel on SW2

SW2 needs the identical EtherChannel configuration. Both sides must use LACP active mode for the bundle to form successfully.

  • Click SW2 in the workspace, then select the CLI tab.
  • Enter global configuration mode and configure the EtherChannel with trunk settings by entering these commands:
SW2(config)# interface range FastEthernet0/23-24
SW2(config-if-range)# channel-group 1 mode active
SW2(config-if-range)# exit
SW2(config)# interface Port-Channel1
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk native vlan 99
SW2(config-if)# switchport trunk allowed vlan 10,20,30,99
SW2(config-if)# exit

What is happening between the two switches?

With both sides set to LACP active, the switches exchange LACP packets (called LACPDUs) over Fa0/23 and Fa0/24. Once they agree on parameters, the two physical links are bundled into a single logical Port-Channel1 interface.

If one side were set to mode on (static) instead of mode active, the bundle would fail because LACP negotiation cannot pair with a static configuration. You will explore this exact failure in the Secret Mission.

Port-Channel not forming?

Confirm that both SW1 and SW2 use channel-group 1 mode active on Fa0/23 and Fa0/24. The channel-group number (1) must match on each switch's own interfaces, and both sides need LACP active or one active and one passive.

help me figure out why my EtherChannel is not forming between SW1 and SW2

Verify the EtherChannel and trunk status

Configuration is only half the job. On the CCNA exam and in production networks, you must verify that the EtherChannel actually formed and that trunk parameters are correct.

  • On SW1's CLI, run this command to check the EtherChannel status:
SW1# show etherchannel summary
  • Look for Po1(SU) in the output. The S means Layer 2 and U means in use.
  • Confirm both member ports show Fa0/23(P) and Fa0/24(P). The (P) means bundled in port-channel.
  • Now verify the trunk configuration by running:
SW1# show interfaces trunk
  • Confirm that Port-Channel1 appears as a trunk with native VLAN 99 and allowed VLANs 10,20,30,99.
  • Repeat both commands on SW2 to confirm its side matches.

What does each flag mean?

  • Po1(SU) = Port-Channel 1 is a Layer 2 (S) port-channel that is in use (U).
  • (P) next to a port = that port is bundled and active in the channel.
  • (I) would mean a port is individual/standalone and NOT bundled. If you see this, something is misconfigured.

Seeing (I) instead of (P) on a port?

This means the port failed to join the bundle. Check that both Fa0/23 and Fa0/24 on that switch have channel-group 1 mode active configured. Also verify the physical cables are connected between the correct ports on each switch.

help me fix my EtherChannel port showing as individual instead of bundled

  • Save your Packet Tracer file by pressing Ctrl+S (Windows) or Cmd+S (macOS).

✔️ I see Po1(SU) with both ports showing (P)

Your LACP EtherChannel is up and running. Both physical links are bundled into a single trunk carrying your VLANs across switches.

ⓧ I don't see Port-Channel1 in the trunk output

The Port-Channel interface might not be configured as a trunk. Go back into the Port-Channel1 interface on the affected switch and re-apply the trunk commands:

SW1(config)# interface Port-Channel1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 99
SW1(config-if)# switchport trunk allowed vlan 10,20,30,99
SW1(config-if)# exit

Then run show interfaces trunk again to verify.

Your two switches are now connected by a redundant, high-bandwidth LACP trunk. Next up, you will assign IP addresses to the PCs and test whether VLAN traffic actually crosses this trunk successfully.

Configure PC IP Addresses and Test VLAN Connectivity

Your LACP EtherChannel trunk is live and carrying tagged VLAN traffic between both switches.

Now it's time to prove the network actually works. You'll assign IP addresses to each PC and run ping tests to verify that same-VLAN devices communicate across switches while different-VLAN devices stay isolated.

In this step, get ready to:
  • Assign IP addresses to all six PCs across three VLANs.
  • Test intra-VLAN connectivity across the EtherChannel trunk.
  • Confirm that inter-VLAN traffic is blocked without a router.
Assign IP addresses to PCs

Each VLAN uses its own subnet so that devices in the same VLAN share a network and devices in different VLANs are on separate networks. Without a router, traffic cannot cross between subnets.

  • Click on PC1 in the Packet Tracer workspace.
  • Select the Desktop tab in the window that opens.
  • Click IP Configuration.
  • Enter 192.168.10.1 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Leave the Default Gateway field blank.
  • Close the PC1 window.

Why leave the gateway blank?

This lab is a pure Layer 2 network with no router. A default gateway is only needed when traffic must leave the local subnet. By leaving it blank, you keep the focus on VLAN switching and confirm that inter-VLAN traffic is truly blocked at Layer 2.

Repeat the same process for the remaining five PCs using the addresses below.

  • Click PC2, open Desktop > IP Configuration, and set the IPv4 address to 192.168.20.1 with subnet mask 255.255.255.0.
  • Click PC3, open Desktop > IP Configuration, and set the IPv4 address to 192.168.30.1 with subnet mask 255.255.255.0.
  • Click PC4, open Desktop > IP Configuration, and set the IPv4 address to 192.168.10.2 with subnet mask 255.255.255.0.
  • Click PC5, open Desktop > IP Configuration, and set the IPv4 address to 192.168.20.2 with subnet mask 255.255.255.0.
  • Click PC6, open Desktop > IP Configuration, and set the IPv4 address to 192.168.30.2 with subnet mask 255.255.255.0.

What's the addressing scheme?

Each VLAN maps to its own /24 subnet. VLAN 10 (Sales) uses 192.168.10.0/24, VLAN 20 (HR) uses 192.168.20.0/24, and VLAN 30 (IT) uses 192.168.30.0/24.

Matching the third octet to the VLAN ID is a common convention in enterprise networks. It makes troubleshooting easier because you can immediately tell which VLAN a device belongs to just from its IP address.

IP Configuration window not showing fields?

Make sure the Static radio button is selected at the top of the IP Configuration window. If DHCP is selected, the fields will be greyed out because the PC is waiting for an address from a DHCP server that doesn't exist in this lab.

help me configure static IP addresses on PCs in Packet Tracer

Test intra-VLAN connectivity across switches

The real test of your network is whether VLAN 10 traffic on SW1 can reach VLAN 10 on SW2 through the EtherChannel trunk. If the trunk, VLANs, and IP addresses are all configured correctly, pings between same-VLAN PCs on different switches will succeed.

  • Click on PC1 in the workspace.
  • Select the Desktop tab, then click Command Prompt.
  • Ping PC4 across the trunk by typing this command:
ping 192.168.10.2

You should see replies from 192.168.10.2 confirming that VLAN 10 traffic is crossing the EtherChannel trunk between SW1 and SW2.

First ping may time out

The first ping packet often times out because the switch needs to perform an ARP lookup to learn the destination MAC address. If you see one "Request timed out" followed by successful replies, that is normal behaviour. Run the ping again and all four packets should succeed.

  • Now test VLAN 20. Click on PC2, open Desktop > Command Prompt, and run:
ping 192.168.20.2
  • Test VLAN 30. Click on PC3, open Desktop > Command Prompt, and run:
ping 192.168.30.2

All three pings should show successful replies. This proves your VLANs span across both switches through the trunk.

Ping is failing with Request timed out?

Check that both PCs are in the same VLAN. Click the switch each PC is connected to, open the CLI, and run show vlan brief to confirm the access port is in the correct VLAN.

Verify the trunk is still operational by running show etherchannel summary on either switch. You should see Po1(SU) with both member ports showing (P).

Also double-check that the subnet masks on both PCs are 255.255.255.0 and the IP addresses match the correct VLAN subnet.

help me troubleshoot why my cross-switch ping is failing

Confirm inter-VLAN isolation

A successful ping proves connectivity. A failed ping is equally important here because it proves your VLANs are properly segmenting traffic. Without a router, devices in different VLANs cannot communicate.

  • Go back to PC1's Command Prompt (still open from the previous test).
  • Try to ping PC2's IP address (which is in VLAN 20, a different subnet) by running:
ping 192.168.20.1

This ping should fail with "Request timed out" or "Destination host unreachable." This is the expected result.

Why does the inter-VLAN ping fail?

PC1 is in VLAN 10 (subnet 192.168.10.0/24) and PC2 is in VLAN 20 (subnet 192.168.20.0/24). These are different Layer 2 broadcast domains.

For traffic to move between VLANs, a Layer 3 device (router or Layer 3 switch) is required to route packets between subnets. That topic falls under the CCNA IP Connectivity domain, not Network Access. This failure confirms your VLANs are doing their job.

  • Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.

Your VLANs are working exactly as designed. Same-VLAN devices communicate freely across the trunk, and different-VLAN devices are completely isolated. Next, you'll enable Layer 2 discovery and harden your access ports with PortFast and BPDU Guard.

Enable CDP, PortFast, and BPDU Guard

Your VLANs are spanning both switches and your PCs can ping each other across the EtherChannel trunk.

Now it is time to layer on the features that make this network production-ready. In this step you will verify that your switches can automatically discover each other using CDP, then protect your access ports with PortFast and BPDU Guard.

In this step, get ready to:
  • Verify CDP neighbour discovery between SW1 and SW2.
  • Enable PortFast and BPDU Guard on all access ports.
  • Observe Spanning Tree root bridge election and port roles.
Verify CDP neighbours

Cisco Discovery Protocol (CDP) is a Layer 2 protocol that lets Cisco devices automatically discover their directly connected neighbours. It runs by default on Cisco switches, so your topology should already have neighbour information ready to view.

  • Click on SW1 in your Packet Tracer workspace and select the CLI tab.
  • View your CDP neighbours by running this command:
SW1# show cdp neighbors

What should I see?

You should see SW2 listed as a neighbour on the Port-Channel1 interface. The output table has columns for Device ID, Local Interface, Holdtime, Capability, Platform, and Port ID.

This confirms Layer 2 discovery is working between your switches. Note the Device ID (SW2), the platform (2960), and the port information for your portfolio documentation later.

Not seeing SW2 in the output?

Make sure the EtherChannel trunk is still operational. Run show etherchannel summary and confirm you see Po1(SU) with both ports as (P).

If the Port-Channel is down, CDP has no active link to discover neighbours on. Go back and verify your LACP configuration from the previous step.

Help me troubleshoot why CDP is not showing my neighbour switch

Enable PortFast on access ports

When a port first comes up, Spanning Tree Protocol (STP) makes it wait through listening and learning states before forwarding traffic. This protects against loops but adds a 30-second delay on ports connected to PCs.

PortFast skips those states and moves access ports straight to forwarding. It is safe on ports that connect to end devices because a PC will never create a switching loop.

  • On SW1, enable PortFast on all three access ports by running these commands:
SW1(config)# interface range FastEthernet0/1-3
SW1(config-if-range)# spanning-tree portfast
SW1(config-if-range)# exit

What does this command do?

interface range FastEthernet0/1-3 selects all three access ports at once so you can configure them together.

spanning-tree portfast tells STP to skip the 30-second listening/learning delay on these ports. PCs connected to these ports will get network access immediately when the link comes up.

  • Now repeat the same configuration on SW2. Click on SW2, open the CLI tab, and enter global configuration mode.
  • Enable PortFast on SW2's access ports by running these commands:
SW2(config)# interface range FastEthernet0/1-3
SW2(config-if-range)# spanning-tree portfast
SW2(config-if-range)# exit

Seeing a PortFast warning message?

When you enter the spanning-tree portfast command, the switch may display a warning that PortFast should only be enabled on ports connected to a single host. This is expected and informational only. Your ports connect to PCs, so PortFast is appropriate here.

Enable BPDU Guard and verify STP

BPDU Guard adds a safety layer on top of PortFast. If someone plugs an unauthorized switch into an access port, that port would receive Bridge Protocol Data Units (BPDUs). BPDU Guard immediately shuts the port down to prevent a potential switching loop.

  • On SW1, enable BPDU Guard on the access ports by running these commands:
SW1(config)# interface range FastEthernet0/1-3
SW1(config-if-range)# spanning-tree bpduguard enable
SW1(config-if-range)# exit

What does this command do?

spanning-tree bpduguard enable monitors incoming frames on these ports for BPDUs. If a BPDU arrives (meaning a switch was plugged in instead of a PC), the port goes into err-disabled state automatically.

This is a critical security feature for access ports in enterprise networks. It prevents rogue switches from disrupting your STP topology.

  • Repeat on SW2. Click on SW2, open the CLI tab, and enter global configuration mode.
  • Enable BPDU Guard on SW2's access ports by running these commands:
SW2(config)# interface range FastEthernet0/1-3
SW2(config-if-range)# spanning-tree bpduguard enable
SW2(config-if-range)# exit
  • Now verify the Spanning Tree state for VLAN 10 by running this command on SW1:
SW1# show spanning-tree vlan 10

What should I see?

The output shows the root bridge information (Bridge ID priority and MAC address) and the port roles for VLAN 10. One of your switches has been elected the root bridge for this VLAN based on having the lowest Bridge ID.

Look for which ports are in a Forwarding state and which (if any) are in a Blocking state. Note which switch is the root bridge. You will document this in your portfolio in the next step.

Why does STP matter here?

Your EtherChannel bundles two physical links into one logical link, so STP treats Port-Channel1 as a single path. Without EtherChannel, STP would block one of the two links to prevent a loop.

This is why EtherChannel and STP work together in real enterprise networks. You get both redundancy and full bandwidth utilization.

  • Save the running configuration on both switches to preserve your PortFast and BPDU Guard settings:
SW1# copy running-config startup-config
  • Repeat on SW2:
SW2# copy running-config startup-config
  • Save your Packet Tracer file by pressing Ctrl+S (Windows) or Cmd+S (macOS).

Not sure which switch is the root bridge?

Look at the top of the show spanning-tree vlan 10 output for the Root ID section. If the root bridge address matches the Bridge ID of the switch you are on, that switch is the root.

The switch with the lowest priority number (or lowest MAC address if priorities are equal) wins the root bridge election.

Help me understand the spanning-tree output and root bridge election

Your access ports are now hardened with PortFast and BPDU Guard, and you have verified both CDP discovery and STP operation. Next up, you will capture all of your verification outputs and push everything to GitHub as a professional portfolio artifact.

Document for Your Portfolio

Your network is fully built, verified, and hardened. The switches are talking, VLANs are segmented, and your EtherChannel trunk is carrying traffic across both switches.

Now you need to capture evidence of everything you built. A professional portfolio artifact shows employers the exact commands you ran and the outputs that prove your configuration works. In this step, you will save your topology, capture verification outputs, and push everything to GitHub.

In this step, get ready to:
  • Save your Packet Tracer file and capture a topology screenshot.
  • Run show commands on both switches and save the outputs.
  • Update your README and push all files to GitHub.
Save and take a topology screenshot

Your .pkt file contains the full topology, but a screenshot makes your work instantly visible in a README without requiring Packet Tracer to open it.

  • In Packet Tracer, click File in the top menu bar.
  • Click Save to save your ccna-network-access-lab.pkt file.
  • Make sure your full topology is visible in the workspace. You should see SW1, SW2, and all six PCs with their cable connections.
  • Take a screenshot of the full Packet Tracer workspace using the Snipping Tool (Windows) or Cmd+Shift+4 (macOS).
  • Save the screenshot as topology.png in the same local folder where your .pkt file lives.

Zoom out for the full picture

Before taking the screenshot, use the scroll wheel or the zoom controls in Packet Tracer to fit the entire topology in one view. A clear, readable screenshot makes a much stronger portfolio impression.

Capture show command outputs

Employers and certification study groups want to see real CLI output proving your configuration works. You will run six key verification commands on both switches and save everything into a single text file.

  • Click SW1 in Packet Tracer and open the CLI tab.
  • Run each of the following commands one at a time, and copy the output of each:
show vlan brief
show interfaces trunk
show etherchannel summary
show cdp neighbors
show spanning-tree vlan 10
show running-config
  • Repeat the same six commands on SW2.
  • Open a plain text editor (Notepad on Windows, TextEdit on macOS set to plain text).
  • Paste all the outputs into the file. Add a heading before each section so you can tell which switch and command produced the output (for example, --- SW1: show vlan brief ---).
  • Save the file as verification-outputs.txt in the same local folder as your other project files.

Why these six commands?

Each command maps to a specific CCNA Network Access exam objective. show vlan brief proves VLAN configuration (topic 2.1). show interfaces trunk proves trunking and native VLAN (topic 2.2). show cdp neighbors proves Layer 2 discovery (topic 2.3).

show etherchannel summary proves LACP bundling (topic 2.4). show spanning-tree vlan 10 proves STP awareness (topic 2.5). show running-config captures everything together as a reference.

Can't copy text from the Packet Tracer CLI?

In the CLI tab, click and drag to select text, then use Ctrl+C (Windows) or Cmd+C (macOS) to copy. If selection does not work, try right-clicking inside the CLI window and choosing Select All or Copy.

help me copy CLI output from Cisco Packet Tracer into a text file

Update your README and push to GitHub

A well-structured README turns a raw lab file into a professional portfolio piece. It tells viewers what you built, which exam objectives you covered, and what the verification results prove.

  • Open the README.md file in your local project folder (or edit it directly on GitHub by clicking the pencil icon on the repository page).
  • Replace the default content with the following template, filling in your own details:
# CCNA Network Access Lab

## Objective

This lab covers the entire CCNA 200-301 Network Access domain (Section 2.0, topics 2.1-2.5):
- 2.1: VLANs spanning multiple switches
- 2.2: Interswitch connectivity (802.1Q trunking, native VLAN)
- 2.3: Layer 2 discovery (CDP)
- 2.4: EtherChannel (LACP)
- 2.5: Rapid PVST+ Spanning Tree (PortFast, BPDU Guard)

## Topology Diagram

![Network Topology](topology.png)

## Configuration Summary

Key commands used:
- Created VLANs 10 (Sales), 20 (HR), 30 (IT), 99 (NativeVLAN) on both switches
- Assigned access ports with `switchport mode access` and `switchport access vlan`
- Bundled Fa0/23-24 into Port-Channel1 using `channel-group 1 mode active` (LACP)
- Hardened trunk with `switchport trunk native vlan 99` and explicit allowed VLAN list
- Enabled `spanning-tree portfast` and `spanning-tree bpduguard enable` on access ports

## Verification Results

See [verification-outputs.txt](verification-outputs.txt) for full CLI output from both switches.

Key results:
- `show etherchannel summary`: Po1(SU) with Fa0/23(P) and Fa0/24(P)
- `show interfaces trunk`: Port-Channel1 trunking with native VLAN 99
- `show cdp neighbors`: SW2 visible from SW1 on Port-Channel1
- Cross-switch pings successful within each VLAN
- Inter-VLAN pings fail (no router, confirming proper segmentation)

## What I Learned

Add your own reflections here about what you found most interesting or challenging.

What does this template do?

The Objective section maps your work directly to CCNA exam topics so anyone reviewing your profile instantly sees relevance. The Topology Diagram section embeds your screenshot using Markdown image syntax.

The Verification Results section links to your full outputs file and highlights the most important results. This structure makes it easy for hiring managers or study partners to understand your lab at a glance.

  • Fill in the What I Learned section with your own reflections about the lab.
  • Save README.md.
  • Make sure your local project folder contains all four files: ccna-network-access-lab.pkt, topology.png, verification-outputs.txt, and README.md.

Now push your files to the ccna-network-access-lab repository on GitHub. You can do this by dragging and dropping files into the repository page on GitHub, or by using Git from the command line.

Upload via GitHub.com

  • Go to your ccna-network-access-lab repository on GitHub.com.
  • Click Add file, then Upload files.
  • Drag and drop ccna-network-access-lab.pkt, topology.png, and verification-outputs.txt into the upload area.
  • Click Commit changes.
  • Now click the README.md file in the repository, then click the pencil icon to edit it.
  • Replace the content with your completed README template and click Commit changes.

Push via Git CLI

  • Open your terminal and navigate to your local project folder.
  • Initialize the repository and push by running these commands:
git init
git add .
git commit -m "Add CCNA Network Access lab files"
git branch -M main
git remote add origin https://github.com/YOUR-USERNAME/ccna-network-access-lab.git
git push -u origin main
  • Replace YOUR-USERNAME with your actual GitHub username.
  • Refresh your repository page on GitHub. You should see all four files listed, and the README should render with your topology screenshot visible.

Don't see your topology screenshot in the README?

Make sure your image filename matches exactly. The Markdown line ![Network Topology](topology.png) is case-sensitive. If you saved your file as Topology.PNG or topology.PNG, update the Markdown to match.

help me embed an image in my GitHub README

Your portfolio artifact is live. Next up, you will intentionally break your EtherChannel and document a professional troubleshooting workflow.

Secret mission

Break and Fix the EtherChannel

In the real world, misconfigurations happen constantly. The best network engineers are the ones who can diagnose and fix problems fast. In this secret mission, you will intentionally break your EtherChannel with a mode mismatch, use show commands to identify the failure, and document the entire troubleshooting process for your portfolio.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer with a free GitHub repository, so there are no ongoing costs.

Decide whether to keep your resources as they are, make them private, or delete them entirely.

Resources you used:

  • GitHub repository (ccna-network-access-lab).
  • Local project files (ccna-network-access-lab.pkt, topology.png, verification-outputs.txt, README.md).

Keep everything running

No action needed. Choose this if you plan to keep building on this lab or want to reference it later.

  • Your GitHub repository stays public and accessible to employers and connections.
  • Your local .pkt file remains on your machine ready to reopen in Packet Tracer.

Pause - I'll come back to this later

Hide your work from public view while keeping everything intact for later.

  • On GitHub, go to your ccna-network-access-lab repository.
  • Click Settings in the repository navigation bar.
  • Scroll to the Danger Zone section at the bottom.
  • Click Change visibility and set the repository to Private.
  • Your local files stay on your machine. No changes needed there.

Delete - I don't want to use this again

Remove all project resources completely. Only choose this if you are sure you will not need this lab again.

  • Delete the GitHub repository:
  • Go to your ccna-network-access-lab repository on GitHub.
  • Click Settings in the repository navigation bar.
  • Scroll to the Danger Zone section.
  • Click Delete this repository and follow the confirmation prompts.
  • Delete your local project files:

On macOS or Linux, run:

rm -rf ~/Desktop/ccna-network-access-lab

On Windows, run:

rmdir /s /q %USERPROFILE%\Desktop\ccna-network-access-lab

Nice Work!

Nice Work!

You just built, verified, and troubleshot an enterprise-grade Layer 2 network covering the entire CCNA Network Access domain. This single lab touched every exam objective from 2.1 through 2.5, and you now have a documented portfolio artifact to prove it.

You've learned how to:

  • Configure VLANs spanning two switches connected by a hardened LACP EtherChannel trunk with a dedicated native VLAN for security.
  • Verify Layer 2 neighbour discovery with CDP, observe Spanning Tree root bridge election and port roles, and secure access ports with PortFast and BPDU Guard.
  • Document your full switch configurations, topology screenshots, and verification outputs in a GitHub portfolio repository that employers and connections can review.
  • Secret Mission: Intentionally broke and repaired an EtherChannel by diagnosing a mode mismatch, then documented the troubleshooting process for your portfolio.

Ready to quiz yourself?