Six Cisco devices. R1 connects the lab to the school network and serves SW1. R2 and R3 share one set of gateway addresses for the switches below them, so either router can fail without the PCs noticing.
Behind R2 and R3
Behind R1
Pick a VLAN to trace it. Bright lines are up, dim ones have nothing connected, pale lines are routed links.
What needs attention
Device clocks are off
R1 is 55 minutes fast, R2 is 14 minutes slow, R3 is 39 minutes slow, SW1 is 54 minutes fast, SW2 is 52 minutes fast and SW3 is 50 minutes fast, compared with the time each device was read. Log timestamps and DHCP lease times are only as good as the clock, and no device syncs from an NTP server.
Blackhole VLAN 666 waiting for a capture to confirm it
SW2 and SW3 are reported finished and will be checked at the next capture. Parking spare ports in a VLAN that leads nowhere, and shutting them down, means anything plugged into a spare port can't reach a real network.
Fixed since the first capture on 14 September
RIP now sends updates on the links in use: R1 learns VLANs 10, 20, 30 and 99, and R2 and R3 learn the default route from R1.
SW2 and SW3 now use the shared gateway 172.16.99.1 for management.
SW3 Gi1/0/24 is locked to access mode.
SW2 is now the spanning-tree root for VLANs 10, 20, 30 and 99, with SW3 as backup root.
No empty subinterfaces, DHCP pools or VLAN interfaces are left, and every DHCP pool hands out DNS servers.
R1
Edge router. Connects the lab to the school network, lets every user VLAN share one outside address, hands out DHCP leases and routes the VLANs on SW1.
Cisco 1941/K9 with HWIC-2T serial card and HWIC-4ESW switch card IOS 15.2(4)M3, up 4 days, 10 hours Serial number FCZ1928919A
Bright ports are up, dim ports have no link, dashed ports are shut down.
Outside
Gi0/1 10.233.192.79/24 on the school network, NAT outside
Default route
Via 10.233.192.1
SW1 trunk
Gi0/0 to SW1 Gi1/0/1, VLANs 110, 120, 130 and 199
Link to R2
Fa0/1/3 in VLAN 12, address 172.16.12.1/30
Link to R3
Fa0/1/0 in VLAN 13, address 172.16.13.1/30
DHCP
Pools for VLANs 10, 20, 30, 110, 120 and 130, 1 lease in use
NAT
Overload on Gi0/1 for the same six VLANs, 58 translations at capture
Routing
Static default route and RIPv2, 4 routes learned
Remote access
SSH with a local user
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi0/1
10.233.192.79/24
Routed, NAT outside
School network switch, port Gi0/13
up
Gi0/0
Trunk with subinterfaces
SW1 Gi1/0/1
up
Gi0/0.110
172.16.110.1/24
VLAN 110
Gateway for VLAN 110
up
Gi0/0.120
172.16.120.1/24
VLAN 120
Gateway for VLAN 120
up
Gi0/0.130
172.16.130.1/24
VLAN 130
Gateway for VLAN 130
up
Gi0/0.199
172.16.199.1/24
VLAN 199
Gateway for SW1 management
up
Fa0/1/3
Switch port, VLAN 12
R2 Gi0/1
up
Fa0/1/0
Switch port, VLAN 13
R3 Gi0/1
up
Fa0/1/1
Switch port, VLAN 1
Nothing connected
down
Fa0/1/2
Switch port, VLAN 1
Nothing connected
down
Vlan12
172.16.12.1/30
VLAN interface
R2, through Fa0/1/3
up
Vlan13
172.16.13.1/30
VLAN interface
R3, through Fa0/1/0
up
Se0/0/0
Serial
Not in use
shut down
Se0/0/1
Serial
Not in use
shut down
How it works
NAT overload. Every PC behind R1 reaches the internet from one address, 10.233.192.79. R1 remembers which inside address and port each conversation came from, so replies find their way back. The access list called NAT decides which networks may use it.
DHCP and relay. R1 hands out addresses from .51 upward; .1 to .50 stay free for gateways and switches. PCs behind R2 and R3 can't reach R1 directly, so their router forwards the request (ip helper-address) and R1 answers that router.
Sharing the default route. R1 announces its default route in RIP (default-information originate), so R2 and R3 learn to send internet traffic to R1. RIP only sends updates on interfaces that aren't passive.
A switch card in a router. Fa0/1/0 to Fa0/1/3 are switch ports, not router ports. Each link to R2 and R3 therefore gets its own VLAN, 12 and 13, and R1's address sits on the VLAN interface.
Config
interface GigabitEthernet0/0.110
encapsulation dot1Q 110
ip address 172.16.110.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan12
ip address 172.16.12.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
!
router rip
version 2
passive-interface default
no passive-interface Serial0/0/0
no passive-interface Serial0/0/1
no passive-interface Vlan12
no passive-interface Vlan13
network 172.16.0.0
default-information originate
no auto-summary
!
ip nat inside source list NAT interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 10.233.192.1
Show full running config
!
! Last configuration change at 11:26:31 UTC Sat Aug 15 2026
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
ip cef
!
!
!
!
!
ip dhcp excluded-address 172.16.10.1 172.16.10.50
ip dhcp excluded-address 172.16.20.1 172.16.20.50
ip dhcp excluded-address 172.16.30.1 172.16.30.50
ip dhcp excluded-address 172.16.110.1 172.16.110.50
ip dhcp excluded-address 172.16.120.1 172.16.120.50
ip dhcp excluded-address 172.16.130.1 172.16.130.50
!
ip dhcp pool 110gandalf
network 172.16.110.0 255.255.255.0
default-router 172.16.110.1
dns-server 1.1.1.1 8.8.8.8
!
ip dhcp pool 120frodo
network 172.16.120.0 255.255.255.0
default-router 172.16.120.1
dns-server 1.1.1.1 8.8.8.8
!
ip dhcp pool 130sam
network 172.16.130.0 255.255.255.0
default-router 172.16.130.1
dns-server 1.1.1.1 8.8.8.8
!
ip dhcp pool 10salg
network 172.16.10.0 255.255.255.0
default-router 172.16.10.1
dns-server 1.1.1.1 8.8.8.8
!
ip dhcp pool 20indkob
network 172.16.20.0 255.255.255.0
default-router 172.16.20.1
dns-server 1.1.1.1 8.8.8.8
!
ip dhcp pool 30hr
network 172.16.30.0 255.255.255.0
default-router 172.16.30.1
dns-server 1.1.1.1 8.8.8.8
!
!
!
no ip domain lookup
ip domain name lefekarli.local
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
license udi pid CISCO1941/K9 sn FCZ1928919A
license accept end user agreement
license boot module c1900 technology-package securityk9
license boot module c1900 technology-package datak9
!
!
username admin privilege 15 secret 4 <removed>
!
redundancy
!
!
!
!
!
ip ssh version 2
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0.110
encapsulation dot1Q 110
ip address 172.16.110.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/0.120
encapsulation dot1Q 120
ip address 172.16.120.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/0.130
encapsulation dot1Q 130
ip address 172.16.130.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface GigabitEthernet0/0.199
encapsulation dot1Q 199
ip address 172.16.199.1 255.255.255.0
!
interface GigabitEthernet0/1
ip address 10.233.192.79 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
ip nat inside
ip virtual-reassembly in
shutdown
!
interface Serial0/0/1
no ip address
ip nat inside
ip virtual-reassembly in
shutdown
clock rate 2000000
!
interface FastEthernet0/1/0
switchport access vlan 13
no ip address
!
interface FastEthernet0/1/1
no ip address
!
interface FastEthernet0/1/2
no ip address
!
interface FastEthernet0/1/3
switchport access vlan 12
no ip address
!
interface Vlan1
no ip address
!
interface Vlan12
ip address 172.16.12.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
!
interface Vlan13
ip address 172.16.13.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
!
router rip
version 2
passive-interface default
no passive-interface Serial0/0/0
no passive-interface Serial0/0/1
no passive-interface Vlan12
no passive-interface Vlan13
network 172.16.0.0
default-information originate
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip nat inside source list NAT interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 10.233.192.1
!
ip access-list standard NAT
remark permit Local LAN to use NAT
permit 172.16.10.0 0.0.0.255
permit 172.16.20.0 0.0.0.255
permit 172.16.30.0 0.0.0.255
permit 172.16.110.0 0.0.0.255
permit 172.16.120.0 0.0.0.255
permit 172.16.130.0 0.0.0.255
!
!
!
!
control-plane
!
!
!
line con 0
logging synchronous
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end
clock set <hh:mm:ss, current UTC> <day> <month> <year>
SW1
Access switch for the three user VLANs behind R1.
Cisco Catalyst 2960-X, WS-C2960X-24TS-L IOS 15.2(7)E14, up 4 days, 10 hours Serial number FOC1751S4H6
Filled ports are access ports in their VLAN colour, outlined ports are trunks, and bright ports have something plugged in. Crossed-out ports are parked in blackhole VLAN 666.
Management
172.16.199.11 in VLAN 199, gateway 172.16.199.1
Uplink
Gi1/0/1 trunk to R1 Gi0/0, VLANs 110, 120, 130 and 199
Rapid PVST+, root bridge for VLANs 110, 120, 130 and 199
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi1/0/1
Trunk: 110, 120, 130, 199
R1 Gi0/0
up
Gi1/0/13
Access VLAN 110
Nothing connected
down
Gi1/0/15
Access VLAN 110
Nothing connected
down
Vlan199
172.16.199.11/24
VLAN interface
Switch management
up
How it works
Access ports and the trunk. An access port belongs to one VLAN, and the PC on it never sees a VLAN tag. Port 1 is a trunk: it carries all four VLANs to R1 and marks every frame with an 802.1Q tag, so R1 knows which VLAN the frame belongs to.
Managing the switch. A switch needs an address of its own to be managed over the network. SW1 has one on its VLAN 199 interface and sends everything for other networks to R1.
Gateway router for VLANs 10, 20, 30 and 99, and the active HSRP router.
Cisco 1941/K9 with HWIC-2T serial card IOS 15.4(3)M3, up 4 days, 1 hour Serial number FCZ2041B0PQ
Bright ports are up, dim ports have no link, dashed ports are shut down.
Management
172.16.99.2 in VLAN 99
Uplink
Gi0/1 172.16.12.2/30 to R1 Fa0/1/3
VLAN trunk
Gi0/0 to SW2 Gi1/0/5
Shared gateways
Active for 172.16.10.1, 172.16.20.1, 172.16.30.1 and 172.16.99.1, priority 110 with preempt
DHCP relay
Forwards requests to R1 at 172.16.12.1
Routing
RIPv2, 6 routes learned, including the default route
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi0/1
172.16.12.2/30
Routed
R1 Fa0/1/3
up
Gi0/0
Trunk with subinterfaces
SW2 Gi1/0/5
up
Gi0/0.10
172.16.10.2/24
VLAN 10
Shares gateway 172.16.10.1
up
Gi0/0.20
172.16.20.2/24
VLAN 20
Shares gateway 172.16.20.1
up
Gi0/0.30
172.16.30.2/24
VLAN 30
Shares gateway 172.16.30.1
up
Gi0/0.99
172.16.99.2/24
VLAN 99
Shares gateway 172.16.99.1
up
Se0/0/0
Serial
Not in use
shut down
Se0/0/1
Serial
Not in use
shut down
How it works
Router-on-a-stick. SW2 sends every VLAN to R2 over one cable, and each frame carries a tag with its VLAN number. R2 splits that cable into subinterfaces, one per VLAN, and each subinterface is the router for its VLAN.
HSRP. R2 and R3 both answer for the .1 address in each VLAN. R2 has the higher priority, 110 against 90, so it forwards the traffic. If R2 stops, R3 takes over the same address within seconds and the PCs never notice.
Config
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 172.16.10.2 255.255.255.0
ip helper-address 172.16.12.1
standby 10 ip 172.16.10.1
standby 10 priority 110
standby 10 preempt
!
interface GigabitEthernet0/1
ip address 172.16.12.2 255.255.255.252
duplex auto
speed auto
!
router rip
version 2
passive-interface default
no passive-interface GigabitEthernet0/1
no passive-interface Serial0/0/0
network 172.16.0.0
no auto-summary
Show full running config
!
! Last configuration change at 09:02:50 UTC Mon Sep 14 2026
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name lefekarli.local
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
cts logging verbose
!
!
license udi pid CISCO1941/K9 sn FCZ2041B0PQ
!
!
username admin privilege 15 secret 5 <removed>
!
redundancy
!
!
ip ssh version 2
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 172.16.10.2 255.255.255.0
ip helper-address 172.16.12.1
standby 10 ip 172.16.10.1
standby 10 priority 110
standby 10 preempt
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 172.16.20.2 255.255.255.0
ip helper-address 172.16.12.1
standby 20 ip 172.16.20.1
standby 20 priority 110
standby 20 preempt
!
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 172.16.30.2 255.255.255.0
ip helper-address 172.16.12.1
standby 30 ip 172.16.30.1
standby 30 priority 110
standby 30 preempt
!
interface GigabitEthernet0/0.99
encapsulation dot1Q 99
ip address 172.16.99.2 255.255.255.0
standby 99 ip 172.16.99.1
standby 99 priority 110
standby 99 preempt
!
interface GigabitEthernet0/1
ip address 172.16.12.2 255.255.255.252
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
no ip address
shutdown
clock rate 2000000
!
router rip
version 2
passive-interface default
no passive-interface GigabitEthernet0/1
no passive-interface Serial0/0/0
network 172.16.0.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
!
line con 0
logging synchronous
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end
clock set <hh:mm:ss, current UTC> <day> <month> <year>
R3
Backup gateway router for VLANs 10, 20, 30 and 99. Takes over the shared addresses if R2 stops.
Cisco 1941/K9 with HWIC-2T serial card IOS 15.4(3)M4, up 4 days, 10 hours Serial number FCZ2028B0AY
Bright ports are up, dim ports have no link, dashed ports are shut down.
Management
172.16.99.3 in VLAN 99
Uplink
Gi0/1 172.16.13.2/30 to R1 Fa0/1/0
VLAN trunk
Gi0/0 to SW3 Gi1/0/5
Shared gateways
Standby for 172.16.10.1, 172.16.20.1, 172.16.30.1 and 172.16.99.1, priority 90 with preempt
DHCP relay
Forwards requests to R1 at 172.16.13.1
Routing
RIPv2, 6 routes learned, including the default route
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi0/1
172.16.13.2/30
Routed
R1 Fa0/1/0
up
Gi0/0
Trunk with subinterfaces
SW3 Gi1/0/5
up
Gi0/0.10
172.16.10.3/24
VLAN 10
Shares gateway 172.16.10.1
up
Gi0/0.20
172.16.20.3/24
VLAN 20
Shares gateway 172.16.20.1
up
Gi0/0.30
172.16.30.3/24
VLAN 30
Shares gateway 172.16.30.1
up
Gi0/0.99
172.16.99.3/24
VLAN 99
Shares gateway 172.16.99.1
up
Se0/0/0
Serial
Not in use
shut down
Se0/0/1
Serial
Not in use
shut down
How it works
Standby and preempt. R3 listens for R2's HSRP hello messages. If they stop for 10 seconds, R3 becomes active for the .1 addresses. R2 is set to preempt, so it takes the role back as soon as it returns.
Two addresses, one gateway. R3 has its own .3 address in each VLAN next to R2's .2. PCs use neither: their gateway is .1, which belongs to whichever router is active.
Config
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 172.16.10.3 255.255.255.0
ip helper-address 172.16.13.1
standby 10 ip 172.16.10.1
standby 10 priority 90
standby 10 preempt
!
interface GigabitEthernet0/1
ip address 172.16.13.2 255.255.255.252
duplex auto
speed auto
!
router rip
version 2
passive-interface default
no passive-interface GigabitEthernet0/1
no passive-interface Serial0/0/1
network 172.16.0.0
no auto-summary
Show full running config
!
! Last configuration change at 08:38:23 UTC Mon Sep 14 2026
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name lefekarli.local
ip cef
no ipv6 cef
multilink bundle-name authenticated
!
!
cts logging verbose
!
!
license udi pid CISCO1941/K9 sn FCZ2028B0AY
license boot module c1900 technology-package datak9
!
!
username admin privilege 15 secret 5 <removed>
!
redundancy
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 172.16.10.3 255.255.255.0
ip helper-address 172.16.13.1
standby 10 ip 172.16.10.1
standby 10 priority 90
standby 10 preempt
!
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 172.16.20.3 255.255.255.0
ip helper-address 172.16.13.1
standby 20 ip 172.16.20.1
standby 20 priority 90
standby 20 preempt
!
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 172.16.30.3 255.255.255.0
ip helper-address 172.16.13.1
standby 30 ip 172.16.30.1
standby 30 priority 90
standby 30 preempt
!
interface GigabitEthernet0/0.99
encapsulation dot1Q 99
ip address 172.16.99.3 255.255.255.0
standby 99 ip 172.16.99.1
standby 99 priority 90
standby 99 preempt
!
interface GigabitEthernet0/1
ip address 172.16.13.2 255.255.255.252
duplex auto
speed auto
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
no ip address
shutdown
!
router rip
version 2
passive-interface default
no passive-interface GigabitEthernet0/1
no passive-interface Serial0/0/1
network 172.16.0.0
no auto-summary
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip ssh version 2
!
!
!
!
control-plane
!
!
!
line con 0
logging synchronous
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
login local
transport input ssh
line vty 5 15
login local
transport input ssh
!
scheduler allocate 20000 1000
!
end
Rapid PVST+, root bridge for VLANs 10, 20, 30 and 99
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi1/0/5
Trunk: 10, 20, 30, 99
R2 Gi0/0
up
Po1
Trunk: 10, 20, 30, 99
SW3 Po1
up
Gi1/0/1
Member of Po1
SW3 Gi1/0/1
up
Gi1/0/2
Member of Po1
SW3 Gi1/0/2
up
Gi1/0/3
Member of Po1
SW3 Gi1/0/3
up
Gi1/0/4
Member of Po1
SW3 Gi1/0/4
up
Gi1/0/13
Access VLAN 10
PC at 172.16.10.56
up
Gi1/0/15
Access VLAN 20
Nothing connected
down
Gi1/0/17
Access VLAN 30
Nothing connected
down
Gi1/0/24
Access VLAN 99
Nothing connected
down
Vlan99
172.16.99.22/24
VLAN interface
Switch management
up
Vlan666
VLAN interface, no address
Not in use
down
How it works
EtherChannel. The four cables to SW3 work as one 4 Gbit link called Po1. PAgP, set to desirable on both ends, checks that the cables match before bundling them. Spanning tree sees a single link, so none of the four gets blocked and traffic spreads across all of them.
Spanning tree. With more than one path between switches, frames could loop forever. Spanning tree elects one root bridge per VLAN, here SW2, and keeps a single loop-free path to it. The lowest bridge priority wins; on a tie, the lowest MAC address decides.
40 Server and 222 Blackhole exist but have no ports
Spanning tree
Rapid PVST+, reaches the root bridge (SW2) through Po1
Interfaces
Interface
Address
VLAN or mode
Connects to
State
Gi1/0/5
Trunk: 10, 20, 30, 99
R3 Gi0/0
up
Po1
Trunk: 10, 20, 30, 99
SW2 Po1
up
Gi1/0/1
Member of Po1
SW2 Gi1/0/1
up
Gi1/0/2
Member of Po1
SW2 Gi1/0/2
up
Gi1/0/3
Member of Po1
SW2 Gi1/0/3
up
Gi1/0/4
Member of Po1
SW2 Gi1/0/4
up
Gi1/0/13
Access VLAN 10
Nothing connected
down
Gi1/0/15
Access VLAN 20
Nothing connected
down
Gi1/0/17
Access VLAN 30
PC at 172.16.30.51
up
Gi1/0/24
Access VLAN 99
Nothing connected
down
Vlan99
172.16.99.33/24
VLAN interface
Switch management
up
How it works
Root and backup root. The root bridge for VLANs 10, 20, 30 and 99 is SW2. SW2 carries priority 24576 (root primary) and SW3 carries 28672 (root secondary), so SW3 takes over the root role only if SW2 disappears.
Everything on this page was read from the devices' console ports with show commands on 14 September 2026 between 09:14 and 09:27 UTC. Nothing was changed on the devices. Password hashes are removed, and the NAT table is left out because it lists the sites people visit.