CCNP Lab Module

Complete Hands-On Lab Guide — Switching, Routing & Security

Module Topic Devices Labs

1 VLANs, Trunking & STP DSW1, DSW2, ASW1–4 6 labs

2 OSPF R1-Core, R2-Core, R3-Edge 5 labs

3 BGP R1-Core, R2-Core, R3-Edge, R-ISP 5 labs

4 MPLS R1-Core, R2-Core, R3-Edge 3 labs

5 QoS R1-Core, R2-Core, DSW1 3 labs

6 First-Hop Redundancy R1-Core, R2-Core, DSW1/2 3 labs

7 WAN & VPN R1-Core, R3-Edge, R-ISP 3 labs

8 NAT, ACLs & Capstone All devices 3 labs

Tool: GNS3 or EVE-NG | Images: IOSv (routers) + IOL L2 (switches) | Recommended RAM: 16 GB | Lab sequence: M1
→ M2 → M3 → M6 → M7 → M4 → M5 → M8
Module 1 — VLANs, Trunking & STP

Lab 1.1 — VLAN Creation, Trunking & VTP

Objective: Create VLANs on the VTP server, propagate to the client, configure 802.1Q trunks on all inter-switch
links, and assign access ports to the correct VLANs.

Topology used: DSW1 (VTP Server) — DSW2 (VTP Client) — ASW1/2/3/4 (VTP Transparent)

Part A — VTP Configuration

Task A1: Configure DSW1 as VTP Server
DSW1(config)# vtp mode server
DSW1(config)# vtp domain CCNP-LAB
DSW1(config)# vtp password cisco123
DSW1(config)# vtp version 2

Task A2: Configure DSW2 as VTP Client

DSW2(config)# vtp mode client
DSW2(config)# vtp domain CCNP-LAB
DSW2(config)# vtp password cisco123

Task A3: Configure ASW1–4 as VTP Transparent (run on each)

ASWx(config)# vtp mode transparent
ASWx(config)# vtp domain CCNP-LAB

Task A4: Verify VTP

DSW1# show vtp status
DSW2# show vtp status

Check: VTP Domain Name matches on all switches. DSW2 Configuration Revision must be lower than DSW1.

Part B — VLAN Creation

Task B1: Create VLANs on DSW1 (propagates to DSW2 via VTP)
DSW1(config)# vlan 10
DSW1(config-vlan)# name SALES
DSW1(config)# vlan 20
DSW1(config-vlan)# name HR
DSW1(config)# vlan 30
DSW1(config-vlan)# name IT
DSW1(config)# vlan 40
DSW1(config-vlan)# name MGMT
DSW1(config)# vlan 999
DSW1(config-vlan)# name NATIVE

Task B2: Create VLANs manually on ASW1–4 (transparent mode — VTP won't push to them)
ASW1(config)# vlan 10
ASW1(config-vlan)# name SALES
ASW1(config)# vlan 999
ASW1(config-vlan)# name NATIVE

ASW2(config)# vlan 20
ASW2(config-vlan)# name HR
ASW2(config)# vlan 999

ASW3(config)# vlan 30
ASW3(config-vlan)# name IT
 ASW3(config)# vlan 999

ASW4(config)# vlan 40
ASW4(config-vlan)# name MGMT
ASW4(config)# vlan 999

Task B3: Verify VLAN propagation on DSW2

DSW2# show vlan brief

VLANs 10, 20, 30, 40, 999 should appear automatically on DSW2. If missing, check: (1) trunk between DSW1-DSW2 is
up, (2) domain names match, (3) passwords match, (4) DSW2 revision is lower than DSW1.

Part C — Trunk Configuration

Task C1: Configure trunk between DSW1 and DSW2 (Gi0/1 on both sides)
DSW1(config)# interface GigabitEthernet0/1
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 999
DSW1(config-if)# switchport trunk allowed vlan 10,20,30,40,999
DSW1(config-if)# no shutdown

DSW2(config)# interface GigabitEthernet0/1

DSW2(config-if)# switchport trunk encapsulation dot1q
DSW2(config-if)# switchport mode trunk
DSW2(config-if)# switchport trunk native vlan 999
DSW2(config-if)# switchport trunk allowed vlan 10,20,30,40,999
DSW2(config-if)# no shutdown

Task C2: Configure downlink trunks on DSW1 (Gi0/2 → ASW1, Gi0/3 → ASW2)
DSW1(config)# interface GigabitEthernet0/2
DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 999
DSW1(config-if)# switchport trunk allowed vlan 10,999
DSW1(config-if)# no shutdown

DSW1(config)# interface GigabitEthernet0/3

DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk native vlan 999
DSW1(config-if)# switchport trunk allowed vlan 20,999
DSW1(config-if)# no shutdown

Task C3: Configure downlink trunks on DSW2 (Gi0/2 → ASW3, Gi0/3 → ASW4)
DSW2(config)# interface GigabitEthernet0/2
DSW2(config-if)# switchport trunk encapsulation dot1q
DSW2(config-if)# switchport mode trunk
DSW2(config-if)# switchport trunk native vlan 999
DSW2(config-if)# switchport trunk allowed vlan 30,999
DSW2(config-if)# no shutdown

DSW2(config)# interface GigabitEthernet0/3

DSW2(config-if)# switchport trunk encapsulation dot1q
DSW2(config-if)# switchport mode trunk
DSW2(config-if)# switchport trunk native vlan 999
DSW2(config-if)# switchport trunk allowed vlan 40,999
 DSW2(config-if)# no shutdown

Task C4: Configure uplink trunks on all ASW switches (Gi0/0 on each)
ASWx(config)# interface GigabitEthernet0/0
ASWx(config-if)# switchport mode trunk
ASWx(config-if)# switchport trunk native vlan 999
ASWx(config-if)# switchport trunk allowed vlan ,999
ASWx(config-if)# no shutdown

Task C5: Configure access ports on ASW switches (Gi0/1 toward VPCs)
ASW1(config)# interface GigabitEthernet0/1
ASW1(config-if)# switchport mode access
ASW1(config-if)# switchport access vlan 10
ASW1(config-if)# spanning-tree portfast
ASW1(config-if)# no shutdown

(Repeat on ASW2 vlan 20, ASW3 vlan 30, ASW4 vlan 40)

Part D — Verification
Command What to check

show vtp status Mode, domain, version, revision number

show vtp password Passwords match on all switches

show interfaces trunk All trunk links listed, VLANs allowed/active

show vlan brief All VLANs active on correct switches

show interfaces Gi0/1 trunk Per-interface trunk detail

Common Mistakes
Mistake Symptom Fix

Trunk not configured on DSW2 side VTP not propagating Configure trunk on both ends

VTP domain name mismatch Silent no-sync Match domain name exactly (case-sensitive)

VTP password mismatch Silent no-sync Match password on all switches

DSW2 revision >= DSW1 VTP ignores updates Toggle DSW2: transparent then client

Used "allowed vlan X" not "add" Other VLANs dropped Use: switchport trunk allowed vlan add X

VLAN 999 not created CDP native VLAN warning Create vlan 999 on all switches

Forgot encapsulation dot1q Trunk not forming on L3 switch Add: switchport trunk encapsulation dot1q
 Lab 1.2 — 802.1Q Trunking & Native VLAN
Objective: Deep understanding of 802.1Q tagging, native VLAN security, controlling allowed VLANs per trunk, and
troubleshooting trunk mismatches.

Why native VLAN 999?

Default native VLAN is VLAN 1 which is also the management VLAN. Frames on the native VLAN are sent
untagged across trunks. An attacker can exploit this with double-tagging (VLAN hopping) — crafting a frame with
outer tag VLAN 1 and inner tag of a target VLAN. Using an unused VLAN (999) as native VLAN with no users
assigned prevents this attack.

Part A — Native VLAN Best Practice

DSW1(config)# interface GigabitEthernet0/1
DSW1(config-if)# switchport trunk native vlan 999

DSW2(config)# interface GigabitEthernet0/1

DSW2(config-if)# switchport trunk native vlan 999

! Optional: Tag native VLAN too (strongest security)

DSW1(config)# vlan dot1q tag native

Part B — Controlling Allowed VLANs

! WRONG — replaces entire allowed list with only VLAN 50
DSW1(config-if)# switchport trunk allowed vlan 50

! CORRECT — adds VLAN 50 without removing others

DSW1(config-if)# switchport trunk allowed vlan add 50

! Remove one VLAN without affecting others

DSW1(config-if)# switchport trunk allowed vlan remove 50

! Verify
DSW1# show interfaces trunk

Part C — Break & Fix Exercises

Exercise Break command Symptom Fix

Native VLAN mismatch Set native vlan 1 on DSW1 only CDP warning message Match native vlan 999 both ends

VLAN removed from trunk allowed vlan remove 20 PC2 traffic silently fails allowed vlan add 20

One side in access mode switchport mode access on DSW2 Trunk disappears from show trunk switchport mode trunk on DSW2
Lab 1.3 — STP, RSTP, Root Bridge Election & Port States
Objective: Understand STP loop prevention, manually control root bridge election per VLAN, upgrade to RSTP,
configure PortFast and BPDU Guard, and test failover.

Part A — Observe Default STP

! Check STP mode
DSW1# show spanning-tree summary

! Check STP for VLAN 10 on all switches

DSW1# show spanning-tree vlan 10
DSW2# show spanning-tree vlan 10
ASW1# show spanning-tree vlan 10

! Find current root bridge

DSW1# show spanning-tree vlan 10 | include Root

Part B — Root Bridge Election

Make DSW1 root for VLANs 10/20 and DSW2 root for VLANs 30/40 (load balancing):
! Method 1: Manual priority (must be multiples of 4096)
DSW1(config)# spanning-tree vlan 10 priority 4096
DSW1(config)# spanning-tree vlan 20 priority 4096
DSW2(config)# spanning-tree vlan 30 priority 4096
DSW2(config)# spanning-tree vlan 40 priority 4096

! Method 2: Macro (easier)

DSW1(config)# spanning-tree vlan 10,20 root primary
DSW2(config)# spanning-tree vlan 30,40 root primary

! Set secondary root (failover)

DSW2(config)# spanning-tree vlan 10,20 root secondary
DSW1(config)# spanning-tree vlan 30,40 root secondary

! Verify
DSW1# show spanning-tree vlan 10
DSW2# show spanning-tree vlan 30

Part C — Enable RSTP on all switches

DSW1(config)# spanning-tree mode rapid-pvst
DSW2(config)# spanning-tree mode rapid-pvst
ASW1(config)# spanning-tree mode rapid-pvst
ASW2(config)# spanning-tree mode rapid-pvst
ASW3(config)# spanning-tree mode rapid-pvst
ASW4(config)# spanning-tree mode rapid-pvst

! Verify
DSW1# show spanning-tree summary

Part D — PortFast and BPDU Guard

! Per-interface PortFast + BPDU Guard on access ports
ASW1(config)# interface GigabitEthernet0/1
ASW1(config-if)# spanning-tree portfast
ASW1(config-if)# spanning-tree bpduguard enable

! Or globally on all access ports (recommended)

ASW1(config)# spanning-tree portfast default
 ASW1(config)# spanning-tree portfast bpduguard default

! Auto-recovery from err-disabled after BPDU Guard triggers

ASW1(config)# errdisable recovery cause bpduguard
ASW1(config)# errdisable recovery interval 30

! Verify
ASW1# show spanning-tree interface GigabitEthernet0/1 portfast
ASW1# show spanning-tree interface GigabitEthernet0/1 detail

STP Port Roles & States Reference

Port Role Meaning

Root port Best path toward the root bridge — one per non-root switch

Designated port Forwarding port elected per segment — one per segment

Alternate port (RSTP) Blocked backup path toward root

Backup port (RSTP) Blocked backup on same segment

Port State STP RSTP Description

Blocking / Discarding Yes Yes (Discarding) Receives BPDUs only, no data forwarding

Listening Yes No STP transitioning, not forwarding

Learning Yes Yes Building MAC table, not forwarding data

Forwarding Yes Yes Normal operation, forwarding data

Disabled Yes Yes Port is shut down

Key STP Facts for CCNP Exam

Parameter Value

Default STP priority 32768

Priority increment Multiples of 4096 only

STP convergence time 30–50 seconds

RSTP convergence time 1–2 seconds

Hello timer 2 seconds

Forward delay 15 seconds

Max age 20 seconds

Root bridge election Lowest priority wins; tie = lowest MAC address

PortFast skips Listening + Learning states (goes straight to Forwarding)

BPDU Guard action err-disables the port immediately

Lab 1.4 — EtherChannel (LACP & PAgP)
Objective: Bundle two physical links into one logical port-channel for both redundancy and increased bandwidth.

When to use EtherChannel:

Use EtherChannel when two or more physical links connect the SAME two switches. Without EtherChannel, STP
will block one link. With EtherChannel, STP sees one logical link and both physical ports carry traffic.
! LACP configuration (IEEE standard — use this in production)
DSW1(config)# interface range GigabitEthernet0/2 - 3
DSW1(config-if-range)# switchport trunk encapsulation dot1q
DSW1(config-if-range)# switchport mode trunk
DSW1(config-if-range)# channel-group 1 mode active
DSW1(config-if-range)# no shutdown

DSW1(config)# interface port-channel 1

DSW1(config-if)# switchport trunk encapsulation dot1q
DSW1(config-if)# switchport mode trunk
DSW1(config-if)# switchport trunk allowed vlan 10,20,30,40,999

! Same config on the other switch with mode active

! Verify
DSW1# show etherchannel summary
DSW1# show interfaces port-channel 1 trunk

PAgP is Cisco proprietary — use mode desirable/auto. LACP is IEEE standard — use mode active/passive. Always use
LACP in real networks and exams unless Cisco-only environment.

EtherChannel Modes Reference

Protocol Mode Behaviour

LACP active Actively sends LACP negotiation packets

LACP passive Responds to LACP only, does not initiate

PAgP desirable Actively sends PAgP negotiation packets

PAgP auto Responds to PAgP only, does not initiate

None on Forces channel with no negotiation (both sides must be on)

Lab 1.5 — Inter-VLAN Routing (SVIs)
Objective: Enable Layer 3 routing between VLANs using Switched Virtual Interfaces (SVIs) on DSW1 and DSW2.
This allows PC1 to ping PC2, PC3, and PC4.
! Enable IP routing on DSW1
DSW1(config)# ip routing

! Create SVI for each VLAN

DSW1(config)# interface vlan 10
DSW1(config-if)# ip address [Link] [Link]
DSW1(config-if)# no shutdown

DSW1(config)# interface vlan 20

DSW1(config-if)# ip address [Link] [Link]
DSW1(config-if)# no shutdown

! Repeat on DSW2 for VLANs 30 and 40

DSW2(config)# ip routing

DSW2(config)# interface vlan 30

DSW2(config-if)# ip address [Link] [Link]
DSW2(config-if)# no shutdown

DSW2(config)# interface vlan 40

DSW2(config-if)# ip address [Link] [Link]
DSW2(config-if)# no shutdown

! Set default gateways on VPCs

VPC1> ip [Link]/24 [Link]
VPC2> ip [Link]/24 [Link]
VPC3> ip [Link]/24 [Link]
VPC4> ip [Link]/24 [Link]

! Verify
DSW1# show ip route
DSW1# show ip interface brief
VPC1> ping [Link]

For PC1 (VLAN 10) to reach PC3 (VLAN 30 on DSW2), you also need a routed link or routing protocol between DSW1
and DSW2. Add a static route or configure OSPF between the distribution switches — this is covered in Module 2.
Lab 1.6 — Switch Security
Objective: Protect the access layer from common attacks using DHCP Snooping, Dynamic ARP Inspection, and
Port Security.
! DHCP Snooping — prevents rogue DHCP servers
ASW1(config)# ip dhcp snooping
ASW1(config)# ip dhcp snooping vlan 10
ASW1(config)# no ip dhcp snooping information option
! Mark uplink (trusted) port
ASW1(config)# interface GigabitEthernet0/0
ASW1(config-if)# ip dhcp snooping trust

! Dynamic ARP Inspection — prevents ARP spoofing

ASW1(config)# ip arp inspection vlan 10
ASW1(config)# interface GigabitEthernet0/0
ASW1(config-if)# ip arp inspection trust

! Port Security — limits MACs per port

ASW1(config)# interface GigabitEthernet0/1
ASW1(config-if)# switchport port-security
ASW1(config-if)# switchport port-security maximum 1
ASW1(config-if)# switchport port-security mac-address sticky
ASW1(config-if)# switchport port-security violation restrict

! Verify
ASW1# show ip dhcp snooping binding
ASW1# show ip arp inspection vlan 10
ASW1# show port-security interface GigabitEthernet0/1

Port Security Violation Modes

Mode Action when violation occurs

protect Drops violating frames silently, no alert

restrict Drops frames AND increments violation counter, sends syslog

shutdown (default) err-disables the port immediately

Module 2 — OSPF

Lab Topic Key Commands Devices

2.1 Single-area OSPF router ospf 1, network, area 0 R1, R2, R3

2.2 Multi-area OSPF area X stub, area X nssa, ABR config R1, R2, R3

2.3 OSPF tuning ip ospf cost, ip ospf priority, area X range R1, R2, R3

2.4 Redistribution redistribute connected/static, default-metric R1, R2, R3

2.5 DR/BDR election ip ospf priority, show ospf neighbor R1, R2, R3

Core OSPF Commands Reference

! Basic OSPF setup
R1(config)# router ospf 1
R1(config-router)# router-id [Link]
R1(config-router)# network [Link] [Link] area 0
R1(config-router)# network [Link] [Link] area 0

! Verification commands
R1# show ip ospf neighbor
R1# show ip ospf database
R1# show ip route ospf
R1# show ip ospf interface brief

! Tuning
R1(config-if)# ip ospf cost 10
R1(config-if)# ip ospf hello-interval 5
R1(config-if)# ip ospf dead-interval 20
R1(config-if)# ip ospf priority 255

! Authentication
R1(config-if)# ip ospf authentication message-digest
R1(config-if)# ip ospf message-digest-key 1 md5 ospfpass

OSPF Neighbor State Machine

State Meaning

Down No hellos received from neighbor

Init Hello received but own router-ID not in it yet

2-Way Bidirectional communication, DR/BDR election happens here

ExStart Master/slave election for DBD exchange

Exchange DBD (database description) packets being exchanged

Loading LSR/LSU packets exchanging missing LSAs

Full Databases synchronized — adjacency formed

Module 3 — BGP

Lab Topic Key Commands Devices

3.1 eBGP peering router bgp, neighbor remote-as, network R1, R3, R-ISP

3.2 iBGP + Route Reflector neighbor update-source, route-reflector-client R1, R2, R3

3.3 Path attributes local-preference, med, as-path prepend R1, R2, R3, ISP

3.4 Route filtering ip prefix-list, route-map, neighbor filter R1, R3

3.5 BGP + OSPF redistribute bgp into ospf, next-hop-self All routers

Core BGP Commands Reference

! eBGP peering (R1 AS 65001 peers with ISP AS 100)
R1(config)# router bgp 65001
R1(config-router)# bgp router-id [Link]
R1(config-router)# neighbor [Link] remote-as 100
R1(config-router)# network [Link] mask [Link]

! iBGP (within same AS)

R1(config-router)# neighbor [Link] remote-as 65001
R1(config-router)# neighbor [Link] update-source Loopback0
R1(config-router)# neighbor [Link] next-hop-self

! Path attributes
R1(config-router)# neighbor [Link] route-map SET-LOCAL-PREF in
R1(config)# route-map SET-LOCAL-PREF permit 10
R1(config-route-map)# set local-preference 200

! Verification
R1# show bgp summary
R1# show bgp neighbors
R1# show ip bgp
R1# show ip bgp [Link]
Modules 4–8 Quick Reference

Module 4 — MPLS
! Enable MPLS LDP on all interfaces
R1(config)# mpls ip
R1(config)# interface GigabitEthernet0/1
R1(config-if)# mpls ip

! VRF for L3VPN

R1(config)# ip vrf CUSTOMER-A
R1(config-vrf)# rd 65001:1
R1(config-vrf)# route-target export 65001:1
R1(config-vrf)# route-target import 65001:1

! Verify
R1# show mpls interfaces
R1# show mpls ldp neighbor
R1# show mpls forwarding-table
R1# traceroute mpls ipv4 [Link]/32

Module 5 — QoS
! MQC — Classify, Mark, Queue
R1(config)# class-map match-any VOICE
R1(config-cmap)# match dscp ef

R1(config)# policy-map WAN-POLICY

R1(config-pmap)# class VOICE
R1(config-pmap-c)# priority 512
R1(config-pmap)# class class-default
R1(config-pmap-c)# fair-queue

R1(config)# interface GigabitEthernet0/1

R1(config-if)# service-policy output WAN-POLICY

! Verify
R1# show policy-map interface GigabitEthernet0/1

Module 6 — First-Hop Redundancy (HSRP / VRRP / GLBP)

! HSRP
DSW1(config)# interface vlan 10
DSW1(config-if)# standby 10 ip [Link]
DSW1(config-if)# standby 10 priority 110
DSW1(config-if)# standby 10 preempt
DSW1(config-if)# standby 10 track GigabitEthernet0/0 20

! VRRP
DSW1(config-if)# vrrp 10 ip [Link]
DSW1(config-if)# vrrp 10 priority 110
DSW1(config-if)# vrrp 10 preempt

! Verify
DSW1# show standby brief
 DSW1# show vrrp brief
DSW1# show glbp brief

Module 7 — WAN & VPN

! GRE tunnel
R1(config)# interface tunnel 0
R1(config-if)# ip address [Link] [Link]
R1(config-if)# tunnel source GigabitEthernet0/1
R1(config-if)# tunnel destination [Link]

! IPsec site-to-site (IKEv2)

R1(config)# crypto ikev2 proposal IKE-PROP
R1(config-ikev2-prop)# encryption aes-cbc-256
R1(config-ikev2-prop)# integrity sha256
R1(config-ikev2-prop)# group 14

! Verify
R1# show crypto ikev2 sa
R1# show crypto ipsec sa
R1# show interface tunnel 0

Module 8 — NAT, ACLs & Capstone

! PAT (overload)
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# access-list 1 permit [Link] [Link]
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside

! Extended ACL
R1(config)# ip access-list extended BLOCK-TELNET
R1(config-ext-nacl)# deny tcp any any eq 23
R1(config-ext-nacl)# permit ip any any
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip access-group BLOCK-TELNET in

! Verify
R1# show ip nat translations
R1# show ip access-lists
Master IP Addressing Table

Device Interface IP Address Subnet Purpose

R-ISP Gi0/1 [Link] /30 Link to R1-Core

R-ISP Gi0/2 [Link] /30 Link to R3-Edge

R1-Core Gi0/0 [Link] /30 Link to R-ISP

R1-Core Gi0/1 [Link] /30 Link to R2-Core

R1-Core Lo0 [Link] /32 Router-ID / BGP

R2-Core Gi0/0 [Link] /30 Link to R1-Core

R2-Core Gi0/1 [Link] /30 Link to R3-Edge

R2-Core Lo0 [Link] /32 Router-ID / BGP

R3-Edge Gi0/0 [Link] /30 Link to R-ISP

R3-Edge Gi0/1 [Link] /30 Link to R2-Core

R3-Edge Lo0 [Link] /32 Router-ID / BGP

DSW1 Gi0/0 10.1.2.x /30 Uplink to R1-Core

DSW1 VLAN 10 SVI [Link] /24 Gateway for PC1

DSW1 VLAN 20 SVI [Link] /24 Gateway for PC2

DSW2 Gi0/0 10.1.3.x /30 Uplink to R3-Edge

DSW2 VLAN 30 SVI [Link] /24 Gateway for PC3

DSW2 VLAN 40 SVI [Link] /24 Gateway for PC4

VPC1 eth0 [Link] /24 VLAN 10 host

VPC2 eth0 [Link] /24 VLAN 20 host

VPC3 eth0 [Link] /24 VLAN 30 host

VPC4 eth0 [Link] /24 VLAN 40 host

VLAN Reference Table

VLAN ID Name Subnet Gateway (SVI) Hosts Switch

10 SALES [Link]/24 [Link] PC1 ([Link]) DSW1 / ASW1

20 HR [Link]/24 [Link] PC2 ([Link]) DSW1 / ASW2

30 IT [Link]/24 [Link] PC3 ([Link]) DSW2 / ASW3

40 MGMT [Link]/24 [Link] PC4 ([Link]) DSW2 / ASW4

999 NATIVE N/A N/A None — security only All switches

Trunk Links Summary

Link From Interface To Interface Allowed VLANs Native VLAN

DSW1 — DSW2 Gi0/1 Gi0/1 10,20,30,40,999 999

DSW1 — ASW1 Gi0/2 Gi0/0 10,999 999

DSW1 — ASW2 Gi0/3 Gi0/0 20,999 999

DSW2 — ASW3 Gi0/2 Gi0/0 30,999 999

DSW2 — ASW4 Gi0/3 Gi0/0 40,999 999

Lab Sequence & Recommended Order

Order Module Topic Why this order

1 Module 1 VLANs, Trunking, STP Build L2 foundation first

2 Module 2 OSPF Add L3 routing within the network

3 Module 3 BGP Add external routing to ISP

4 Module 6 HSRP / VRRP / GLBP Add gateway redundancy

5 Module 7 WAN & VPN (GRE, IPsec) Connect sites securely

6 Module 4 MPLS Add service provider features

7 Module 5 QoS Tune traffic prioritization

8 Module 8 NAT, ACLs, Capstone Integrate everything

After completing Module 8, insert your Palo Alto or FortiGate VM between R3-Edge and the Internet cloud in your
topology. This creates a full end-to-end lab combining CCNP routing/switching with your existing firewall security labs —
the most valuable practice setup possible.