zNetLaB › Guided labs › Security
VLAN hopping — a port that negotiates a trunk
Security Advanced 4 devices 5 checked tasks 100 points Plan lab
A switch port left on its defaults will happily negotiate a trunk with anything that asks, and a trunk carries every VLAN. Take the user ports out of negotiation, make them access ports in the right VLAN, change the native VLAN on the real trunk to something unused, and park the unused ports where they cannot do harm. You build it in a browser, type real commands at each device, and every task below is
checked against the running configuration — so you find out it is wrong before anybody else does.
Open this lab in the simulator
The simulator runs in your browser with nothing to install. This lab is part of the full simulator: open it free for 7 days with a new account, then with a plan. It needs an account, which keeps your progress.
The scenario
A switch port left on its defaults will happily negotiate a trunk with anything that asks, and a trunk carries every VLAN. Take the user ports out of negotiation, make them access ports in the right VLAN, change the native VLAN on the real trunk to something unused, and park the unused ports where they cannot do harm.
Your role: a security engineer. Level: Advanced Done when: all 5 goals show as passed (100 points).
Network status
Devices: 2 switchs, 2 PCs, cabled as drawn. No Layer 1 or Layer 2 faults: every link is connected and up. SW-Access starts with and VLAN 10, VLAN 999 already configured. SW-Dist starts with and VLAN 10, VLAN 999 already configured. Staff-PC is a host with 10.30.10.11/24. Attacker is a host with 10.30.10.99/24. Known problems
The network worked and now does not: the scenario above says what users report. The cause is a configuration fault, not a cable. Find it with show commands (interfaces, routes, neighbours, running-config) before you change anything; fix only what is wrong. Goals
Both user ports are fixed access ports in VLAN 10 (25 pts) Negotiation is off on the user ports (no DTP) (20 pts) The uplink is a trunk, with native VLAN 999 (an unused VLAN) (30 pts) The other end of the trunk agrees on the native VLAN (15 pts) The staff PC can still reach the attacker’s LAN (same VLAN 10) (10 pts) The activity, in order
Both user ports are fixed access ports in VLAN 10 Why: A VLAN is a separate broadcast domain; the port’s VLAN decides which devices can talk without a router. Verify with: show vlan brief Negotiation is off on the user ports (no DTP) Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config The uplink is a trunk, with native VLAN 999 (an unused VLAN) Why: A trunk carries many VLANs over one cable, tagged with 802.1Q. Both ends must agree. Verify with: show interfaces trunk The other end of the trunk agrees on the native VLAN Why: This is the task that checks your configuration directly: the line must really be there, not just look right. Verify with: show running-config The staff PC can still reach the attacker’s LAN (same VLAN 10) Why: A ping needs a route in BOTH directions. This is the end-to-end proof that everything before it worked. Verify with: ping 10.30.10.99 Tips
Work in the order given: later goals depend on the earlier ones. After every change, run the verify command before moving on; do not guess. Stuck? Read the verify output first. It names the interface, neighbour or route that is wrong. Common mistake: Mismatched native VLANs between the two trunk ends Common mistake: “switchport mode access” without “nonegotiate” on a switch that still sends DTP frames Common mistake: Using VLAN 1 as the native VLAN or for user traffic Why this matters
A port left at its defaults can negotiate a trunk, and a trunk carries every VLAN — or, with a native-VLAN trick, lets an attacker’s double-tagged frame reach a VLAN it was never in. Take user ports out of negotiation and give the real trunk an unused native VLAN.
What you will be able to do
Hard-code access ports and turn negotiation off
Set the trunk native VLAN to an unused VLAN on both ends
Park unused ports in a dead VLAN and shut them
The network
Catalyst 2960-24TT, Catalyst 3560-24PS, PC — 4 devices in all, already cabled.
Fa0/1 Fa0 Fa0/2 Fa0 Gi0/1 Gi0/1 SW-Access SW-Dist Staff-PC 10.30.10.11/24 Attacker 10.30.10.99/24 Drawn from this lab: devices, cables, ports and the addresses already set. Device Model Address already set
SW-Access Catalyst 2960-24TT configure it SW-Dist Catalyst 3560-24PS configure it Staff-PC PC 10.30.10.11 / 255.255.255.0 Attacker PC 10.30.10.99 / 255.255.255.0
Cabling
SW-Access Fa0/1 ↔ Staff-PC Fa0 SW-Access Fa0/2 ↔ Attacker Fa0 SW-Access Gi0/1 ↔ SW-Dist Gi0/1
What is configured at the start
These are already configured when the lab opens — including, where this is a troubleshooting lab, the fault itself:
SW-Access vlan 10
name STAFF
vlan 999
name PARKING
exit SW-Dist vlan 10
name STAFF
vlan 999
name PARKING
exit
interface g0/1
switchport trunk encapsulation dot1q
switchport mode trunk
exit Tasks, and how each one is checked
Every task is decided by reading the live network — a neighbour in FULL, a ping that succeeds, a line in the running configuration — not by looking for a keyword you typed. The same command shows you what the lab sees.
# Task Pts How to verify it yourself
1 Both user ports are fixed access ports in VLAN 10 25 On SW-Access: show vlan brief — Fa0/1 is an access port in VLAN 10. and On SW-Access: show vlan brief — Fa0/2 is an access port in VLAN 10. 2 Negotiation is off on the user ports (no DTP) 20 On SW-Access: show running-config contains the line(s) matching interface FastEthernet0/2 … switchport nonegotiate|interface FastEthernet0/2 … switchport mode access. 3 The uplink is a trunk, with native VLAN 999 (an unused VLAN) 30 On SW-Access: show interfaces trunk lists Gi0/1. and On SW-Access: show running-config contains the line(s) matching interface GigabitEthernet0/1 … switchport trunk native vlan 999. 4 The other end of the trunk agrees on the native VLAN 15 On SW-Dist: show running-config contains the line(s) matching interface GigabitEthernet0/1 … switchport trunk native vlan 999. 5 The staff PC can still reach the attacker’s LAN (same VLAN 10) 10 On Staff-PC: ping 10.30.10.99 must succeed.
Stuck? Ask the coach
Tell the coach what you see or what you tried. It gives you a hint, not the answer, the way a senior engineer would. Included with a free trial or any plan.
Ask the coach
Common mistakes
Mismatched native VLANs between the two trunk ends
“switchport mode access” without “nonegotiate” on a switch that still sends DTP frames
Using VLAN 1 as the native VLAN or for user traffic
Reference solution
Try it yourself first — the lab checks your work either way. This is one configuration that makes every task pass, device by device:
SW-Access interface range Fa0/1 - 2
switchport mode access
switchport access vlan 10
switchport nonegotiate
exit
interface g0/1
switchport mode trunk
switchport trunk native vlan 999
exit SW-Dist interface g0/1
switchport trunk native vlan 999
exit Where this is examined
CCNA security fundamentals, CCNP ENCOR/SCOR (Layer 2 attacks), Security+ (VLAN hopping), CEH (network attacks).
This lab practises these topics in the zNetLaB certification courses:
Port security, DHCP snooping, DAI — CCNA · Security Fundamentals ACLs, ZBFW, 802.1X, MACsec, wireless security — CCNP Enterprise · ENCOR · Security Attacks and their defences (spoofing, flooding, rogue devices) — CompTIA Network+ · Network Security Network attacks: spoofing, flooding, rogue devices, VLAN hopping — CompTIA Security+ · Threats, Vulnerabilities and Mitigations Common threats, vulnerabilities and attack techniques — CCNP Security Core · Security Concepts Layer-2 attacks: MAC flooding, VLAN hopping, STP takeover — Ethical Hacking (network level) · Network Attacks and Defences
Related labs
Where to start
The lessons all guided labs plans
CCNA®, CCNP® and Cisco® are trademarks of Cisco Systems, Inc. zNetLaB is not affiliated with or endorsed by Cisco.