4.4.9 Lab - Troubleshoot Inter-VLAN Routing (Answers)

Last Updated: Jul 21, 2026 CCNA v7 Course #2 4 Comments

Lab - Troubleshoot Inter-VLAN Routing (Instructor Version)

Topology

Addressing Table

Device Interface IP Address Subnet Mask Default Gateway
R1 G0/0/1.3 10.3.0.1 255.255.255.0 N/A
G0/0/1.4 10.4.0.1 255.255.255.0
G0/0/1.13 10.13.0.1 255.255.255.0
S1 VLAN 3 10.3.0.11 255.255.255.0 10.3.0.1
S2 VLAN 3 10.3.0.12 255.255.255.0 10.3.0.1
PC-A NIC 10.4.0.50 255.255.255.0 10.4.0.1
PC-B NIC 10.13.0.50 255.255.255.0 10.13.0.1

VLAN Table

VLAN Name Interface Assigned
3 Management S1: VLAN 3

S2: VLAN 3
4 Operations S1: F0/6
7 ParkingLot S1: F0/2-4, F0/7-24, G0/1-2

S2: F0/2-17, F0/19-24, G0/1-2
8 Native N/A
13 Maintenance S2: F0/18

Objectives

  • Part 1: Evaluate Network Operation
  • Part 2: Gather information, create an action plan, and implement corrections

Background / Scenario

Instructor Note: Preconfiguration scripts for all the devices are documented below. Cut and paste or otherwise use these to pre-configure the equipment for the student.

Router R1

enable
configure terminal
hostname R1
no ip domain lookup
enable secret class
line con 0
 password cisco
 login
 logging synch
line vty 0 4
 password cisco
 login
service password-encryption
banner motd $ Authorized Users Only! $
interface g0/0/1
 no shut
interface g0/0/1.3
 encap dot1q 3
 ip add 10.3.0.1 255.255.255.0
interface g0/0/1.4
 encap dot1q 4 native
 ip address 10.4.0.1 255.255.255.0
interface g0/0/1.8
! encap dot1q 8 native
 encap dot1q 8
interface g0/0/1.13
 encap dot1q 13
 ip address 10.13.0.1 255.255.255.0
end

Switch S1

enable
config terminal
hostname S1
no ip domain-lookup
enable secret class
line con 0
 password cisco
 login
 logging synch
line vty 0 15
 password cisco
 login
service password-encryption
banner motd $ Authorized Users Only! $
vlan 3
 name Management
vlan 4
 name Operations
vlan 7
 name ParkingLot
vlan 8
 name Native
!vlan 13
! name Maintenance
interface vlan 3
 ip address 10.3.0.11 255.255.255.0
 no shut
exit
ip default-gateway 10.3.0.1
interface range f0/2-4, f0/7-24, G0/1-2
 switchport mode access
 switchport access vlan 7
 shutdown
interface f0/1
 switchport mode trunk
! switchport trunk native vlan 8
! switchport trunk allowed vlan add 3
 switchport trunk allowed vlan 4,8,13
 no shutdown
interface f0/6
 switchport mode access
 switchport access vlan 4
 no shutdown
interface f0/5
 switchport mode access
! default interface fa0/5
! switchport mode trunk
 switchport trunk native vlan 8
! switchport trunk allowed vlan 3,4,8,13
 switchport access vlan 3
 no shut
end

Switch S2

enable
config terminal
hostname S2
no ip domain-lookup
enable secret class
line con 0
 password cisco
 login
 logging synch
line vty 0 15
 password cisco
 login
service password-encryption
banner motd $ Authorized Users Only! $
vlan 3
 name Management
vlan 4
 name Operations
vlan 7
 name ParkingLot
vlan 8
 name Native
vlan 13
 name Maintenance
interface vlan 3
 ip address 10.3.0.12 255.255.255.0
 no shut
interface range f0/2-17, f0/19-24, G0/1-2
 switchport mode access
 switchport access vlan 7
 shutdown
interface f0/18
 switchport mode access
 switchport access vlan 13
interface f0/1
 switchport mode trunk
 switchport trunk native vlan 8
 switchport trunk allowed vlan 4,8
! switchport trunk allowed vlan add 3,13
ip default-gateway 10.3.0.1
end

Your instructor has preconfigured all the network equipment and has included intentional errors that are keeping the inter-VLAN routing from working. Your task is to evaluate the network and identify and correct the configuration errors to restore full connectivity. You may find errors with the configurations which are not directly related to inter-VLAN routing that impact the ability of the network devices to perform this function.

Note: The design approach used in this lab is to assess your ability to configure and troubleshoot inter-VLAN routing only. This design may not reflect networking best practices.

Note: The router used with CCNA hands-on labs it the Cisco 4221 with Cisco IOS XE Release 16.9.4 (universalk9 image). The switches used in the labs are Cisco Catalyst 2960s with Cisco IOS Release 15.2(2) (lanbasek9 image). Other routers, switches, and Cisco IOS versions can be used. Depending on the model and Cisco IOS version, the commands available and the output produced might vary from what is shown in the labs. Refer to the Router Interface Summary Table at the end of the lab for the correct interface identifiers.

Note: Ensure that the routers and switches have been erased and have no startup configurations. If you are unsure contact your instructor.

Instructor Note: Refer to the Instructor Lab Manual for the procedures to initialize and reload devices

Required Resources

  • 1 Router (Cisco 4221 with Cisco IOS XE Release 16.9.4 universal image or comparable)
  • 2 Switches (Cisco 2960 with Cisco IOS Release 15.2(2) lanbasek9 image or comparable)
  • 2 PCs (Windows with a terminal emulation program, such as Tera Term)
  • Console cables to configure the Cisco IOS devices via the console ports
  • Ethernet cables as shown in the topology

Instructions

Part 1: Evaluate Network Operation.

Note: You may need to disable the Windows Firewall on PC–A and PC–B.

Requirement:

  • No VLAN 7 trunk traffic because there is no devices in VLAN 7.
  • VLAN 8 is the native VLAN.
  • All trunks are static.
  • End to end connectivity

Use Ping to test the following criteria and record the results in the table below.

From To Ping Results
R1 S1 VLAN 3 (10.3.0.11) Unsuccessful
S2 VLAN 3 (10.3.0.12) Unsuccessful
PC-A (10.4.0.50) Unsuccessful
PC-B (10.13.0.50) Unsuccessful
S1 S2 VLAN 3 (10.3.0.12) Unsuccessful
PC-A (10.4.0.50) Unsuccessful
PC-B (10.13.0.50) Unsuccessful
S2 PC-A (10.4.0.50) Unsuccessful
PC-B (10.13.0.50) Unsuccessful

Part 2: Gather information, create an action plan, and implement corrections.

a. For each criterion that is not met, gather information by examining the running configuration and routing tables and develop a hypothesis for what is causing the malfunction.

b. Create an action plan that you think will fix the issue. Develop a list of all the commands you intend to issue to fix the issue, and a list of all the commands you need to revert the configuration, should your action plan fail to correct the issue.

Hint: If you need to reset a switchport to default configuration, use the command default interface interface name.

As an example for F0/10:

S1(config)# default interface f0/10

c. Execute your action plans one at a time for each criterion that fails and record the fix actions.

Router R1:

configure terminal
interface g0/0/1.8
 encapsulation dot1q 8 native
 exit

Switch S1:

configure terminal
default interface f0/5
interface f0/5
 switchport mode trunk
 switchport trunk native vlan 8
 switchport trunk allowed vlan 3,4,8,13
interface f0/1
 switchport trunk allowed vlan add 3,13
 switchport trunk native vlan 8
vlan 13
 name Maintenance
 exit

Switch S2:

configure terminal
interface f0/1
 switchport trunk allowed vlan add 3,13
exit

Documentation Table: Confirmed Configuration Errors

# Device Problem Direct Evidence from the Preconfiguration Script
1 R1 Native VLAN assigned to the wrong subinterface - .4 instead of .8 encapsulation dot1q 4 native is active on G0/0/1.4; the correct line, encapsulation dot1q 8 native, sits commented out on G0/0/1.8
2 S1 F0/5 (the link to R1) stuck in access mode switchport mode access is active; the correct switchport mode trunk line is commented out
3 S1 F0/1 (the link to S2) missing its native VLAN and missing VLAN 3 from the allowed list Both switchport trunk native vlan 8 and switchport trunk allowed vlan add 3 are commented out
4 S1 VLAN 13 never created vlan 13 and name Maintenance are both commented out entirely
5 S2 F0/1 (the link to S1) missing VLAN 3 and VLAN 13 from the allowed list Active list is only 4,8; the correct switchport trunk allowed vlan add 3,13 line is commented out

Device Configuration - Final

! ==============================================================
!--- Lab - Troubleshoot Inter-VLAN Routing
!--- FIX SCRIPT FOR ROUTER R1
!--- Usage: from the console on R1, enter privileged EXEC mode with "enable" (secret "class"), then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Confirmed directly from this lab's own preconfiguration script (Background/Scenario) and its "Device Configuration - Final" section: the native VLAN flag sits on G0/0/1.4 instead of G0/0/1.8.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Fix: move the native VLAN flag to subinterface .8, where it belongs
! --------------------------------------------------------------

!--- IOS allows only one native subinterface per physical port - setting it here automatically clears the flag from .4 (which keeps its IP address and plain "encapsulation dot1Q 4" untouched).
interface GigabitEthernet0/0/1.8
 encapsulation dot1q 8 native

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification (Part 1's Ping Test Results table):
!---   R1# show interfaces g0/0/1.4  -> no longer shows "native" in the encapsulation line
!---   R1# show interfaces g0/0/1.8  -> now shows "802.1Q Virtual LAN, Native VLAN 8"
!---   R1# ping 10.4.0.50 (PC-A)     -> success (this is exactly the ping the native-flag bug broke)
!---   R1# ping 10.13.0.50 (PC-B)    -> success once S1's F0/5 trunk fix (its own script) is also applied
! ==============================================================


! ==============================================================
!--- Lab - Troubleshoot Inter-VLAN Routing
!--- FIX SCRIPT FOR SWITCH S1
!--- Usage: from the console on S1, enter privileged EXEC mode with "enable" (secret "class"), then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Confirmed directly from this lab's own preconfiguration script and "Device Configuration - Final" section: F0/5 is stuck in access mode, F0/1's native VLAN was never set and its allowed list was missing VLAN 3, and VLAN 13 was never created here at all.
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Fix 1: reset F0/5 (the link to R1) to a clean slate, then trunk it
! --------------------------------------------------------------

!--- "default interface" wipes the leftover "switchport access vlan 3" / access mode completely (this is the lab's own documented hint for resetting a port), so the trunk below starts from a clean state.
default interface FastEthernet0/5
interface FastEthernet0/5
 switchport mode trunk
 switchport trunk native vlan 8
 switchport trunk allowed vlan 3,4,8,13

! --------------------------------------------------------------
!--- Fix 2: correct F0/1 (the link to S2) - add the missing native VLAN and VLAN 3
! --------------------------------------------------------------

!--- Adding native vlan 8 clears the CDP mismatch against S2 (which already had it set correctly). "allowed vlan add" appends to whatever's already configured (4,8,13) instead of replacing it - the confirmed final state is 3,4,8,13, keeping VLAN 4 in the list even though S2 has no VLAN 4 device (harmless - it just carries no traffic there).
interface FastEthernet0/1
 switchport trunk allowed vlan add 3,13
 switchport trunk native vlan 8

! --------------------------------------------------------------
!--- Fix 3: create the missing VLAN 13
! --------------------------------------------------------------

!--- Confirmed missing: the lab's own preconfiguration script has this VLAN creation commented out entirely on S1 (present and active on S2).
vlan 13
 name Maintenance

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification:
!---   S1# show interfaces trunk           -> F0/1 AND F0/5 both trunking, native VLAN 8, VLANs 3,4,8,13 allowed
!---   S1# show vlan brief                 -> VLAN 13 now present
!---   S1# ping 10.3.0.1 (R1)              -> success
!---   S1# ping 10.3.0.12 (S2)             -> success (needs S2's own F0/1 fix too)
!---   S1# ping 10.4.0.50 (PC-A)           -> success
!---   S1# ping 10.13.0.50 (PC-B)          -> success
! ==============================================================


! ==============================================================
!--- Lab - Troubleshoot Inter-VLAN Routing
!--- FIX SCRIPT FOR SWITCH S2
!--- Usage: from the console on S2, enter privileged EXEC mode with "enable" (secret "class"), then paste this whole file. Every line beginning with "!" is a comment; IOS ignores it, so pasting a comment by accident is harmless.
!--- Confirmed directly from this lab's own preconfiguration script and "Device Configuration - Final" section: F0/1's allowed-VLAN list was missing both VLAN 3 and VLAN 13 (native VLAN 8 was already correctly set here - S1 was the side missing it).
! ==============================================================

enable
configure terminal

! --------------------------------------------------------------
!--- Fix: add the missing VLANs to F0/1's allowed list
! --------------------------------------------------------------

!--- "allowed vlan add" appends to the existing list (4,8) instead of replacing it - the confirmed final state is 3,4,8,13 on both switches' F0/1, matching S1's side exactly.
interface FastEthernet0/1
 switchport trunk allowed vlan add 3,13

end

! --------------------------------------------------------------
!--- Operational habit (not explicitly required by this lab): save to NVRAM. (Press Enter when prompted for the destination filename.)
! --------------------------------------------------------------
copy running-config startup-config

! ==============================================================
!--- Verification:
!---   S2# show interfaces trunk -> F0/1 trunking, native VLAN 8, VLANs 3,4,8,13 allowed
!---   S2# ping 10.3.0.1 (R1)    -> success (needs S1's F0/5 fix too)
!---   S2# ping 10.3.0.11 (S1)   -> success
!---   S2# ping 10.4.0.50 (PC-A) -> success (needs S1's F0/5 fix too)
!---   S2# ping 10.13.0.50 (PC-B) -> success (local, S2's own F0/18)
! ==============================================================

Download Packet Tracer (.pka) file:

Icon

4.4.9 Lab - Troubleshoot Inter-VLAN Routing - Physical Mode

1 file(s) 318.70 KB
Download
Tags:, ,

About The Author

ITExamAnswers Editorial Team

The ITExamAnswers Editorial Team is a dedicated group of certified IT professionals and network engineers. We rigorously review, verify, and update all exam materials to ensure you receive the most accurate and reliable resources for your certification journey.

Related Posts

Subscribe
Notify of
guest

4 Corrections & Clarifications