VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab
Key Takeaways
- A VLAN design is incomplete until trunks, access ports, gateways, DHCP scopes, and security rules agree.
- 802.1Q trunks carry multiple VLANs between switches, routers, firewalls, and access points.
- Router-on-a-stick uses subinterfaces with VLAN tags to route between VLANs.
- Firewall policy should be written as source, destination, service, action, and logging requirements.
- PBQ troubleshooting should compare symptoms against VLAN membership, trunk allowed lists, native VLANs, gateways, and rules.
VLAN and Firewall Design Lab
This lab combines Layer 2 segmentation, Layer 3 gateways, and security policy. In a performance-based question, you may have to place switchports into VLANs, mark a trunk, choose subinterfaces, and build firewall rules that allow only required traffic.
Scenario
A small office has one router or firewall connected to a switch. The switch also connects to access points, phones, users, and servers.
| VLAN | Name | Subnet | Default gateway | Purpose |
|---|---|---|---|---|
| 10 | Users | 172.20.10.0/24 | 172.20.10.1 | Employee workstations |
| 20 | Voice | 172.20.20.0/24 | 172.20.20.1 | IP phones |
| 30 | Servers | 172.20.30.0/24 | 172.20.30.1 | File, print, and application servers |
| 40 | Guest | 172.20.40.0/24 | 172.20.40.1 | Internet-only wireless guests |
| 99 | Management | 172.20.99.0/24 | 172.20.99.1 | Switches, APs, and firewall management |
Switch Port Plan
| Port type | Example ports | Required setting |
|---|---|---|
| User access | 1-20 | Access VLAN 10 |
| Phone plus PC | 21-28 | Data VLAN 10 and voice VLAN 20 |
| Server access | 29-34 | Access VLAN 30 |
| AP uplink | 35-38 | Trunk allowing VLANs 10, 40, and 99 if AP management is tagged |
| Router or firewall uplink | 48 | 802.1Q trunk allowing VLANs 10, 20, 30, 40, and 99 |
Access ports carry one data VLAN. Trunks carry multiple VLANs with tags. A trunk allowed list that omits VLAN 40 would explain why the guest SSID broadcasts but clients cannot reach the guest gateway.
Router-on-a-Stick Map
| Subinterface | Encapsulation | IP address |
|---|---|---|
| g0/0.10 | 802.1Q VLAN 10 | 172.20.10.1/24 |
| g0/0.20 | 802.1Q VLAN 20 | 172.20.20.1/24 |
| g0/0.30 | 802.1Q VLAN 30 | 172.20.30.1/24 |
| g0/0.40 | 802.1Q VLAN 40 | 172.20.40.1/24 |
| g0/0.99 | 802.1Q VLAN 99 | 172.20.99.1/24 |
If the physical interface is up but a specific VLAN cannot route, focus on that VLAN tag, the trunk allowed list, the subinterface IP address, and the host default gateway.
Firewall Rule Table
| Order | Source | Destination | Service | Action | Log |
|---|---|---|---|---|---|
| 1 | Users | Servers | SMB, HTTPS, DNS as required | Allow | Yes |
| 2 | Voice | Call manager or voice gateway | SIP, RTP, DHCP, DNS, NTP as required | Allow | Yes |
| 3 | Guest | Internet | HTTP, HTTPS, DNS | Allow | Yes |
| 4 | Guest | Internal RFC1918 networks | Any | Deny | Yes |
| 5 | Management | Network devices | SSH, HTTPS, SNMP, syslog as required | Allow | Yes |
| 6 | Any | Any | Any | Deny | Yes |
Rules are evaluated in order on many firewalls and ACL systems. A broad deny above an allow can break a service. A broad allow above a deny can defeat segmentation.
Troubleshooting Prompts
| Symptom | Likely check |
|---|---|
| User gets an APIPA address | DHCP scope, DHCP relay, access VLAN, trunk path to DHCP server |
| Guest can browse Internet but can also reach file server | Guest-to-internal deny rule missing or ordered too low |
| Voice phones boot but cannot register | Voice VLAN, DHCP options, call manager reachability, firewall ports |
| AP management is unreachable | AP management VLAN tag, trunk allowed list, management gateway |
| Only one VLAN works across trunk | Native VLAN or allowed VLAN mismatch, missing subinterface |
Common PBQ Traps
- Marking the router uplink as an access port instead of a trunk.
- Allowing the guest VLAN to reach internal networks.
- Forgetting DHCP relay when the DHCP server is in a different VLAN.
- Configuring the host gateway as an address from the wrong subnet.
- Allowing a VLAN on the switch trunk but not creating the matching routed interface.
- Creating firewall rules without a final deny or without logging where the scenario asks for auditing.
A router-on-a-stick design needs to route VLAN 30. Which interface component is required?
Guest wireless clients can reach internal file servers. Which firewall rule is most directly missing or misordered?
Which items must align for a VLAN to work across a trunk to a router or firewall? Select three.
Select all that apply