← Back to Lab Index
Lab 01 §1.1 Intermediate ⏱ 45 min

Switched Campus — STP, EtherChannel & VLANs

Master Layer 2 switching: MST, EtherChannel LACP, VTP v3, STP security features, and VLAN design.

Network Topology
MPLS CORE + PE EDGE DMVPN WEST DMVPN EAST CUSTOMER EDGE + BORDER CORE-1 10.255.1.1 CORE-2 10.255.1.2 CORE-3 10.255.1.3 CORE-4 10.255.1.4 EDGE-1 10.255.2.1 EDGE-2 10.255.2.2 EDGE-3 10.255.2.3 EDGE-4 10.255.2.4 HUB-WC-1 172.16.10.254 HUB-WC-2 172.16.10.253 HUB-EC-1 172.16.20.254 HUB-EC-2 172.16.20.253 SPK-WC-1 .10.1 SPK-WC-2 .10.2 SPK-WC-3 .10.3 SPK-EC-1 .20.1 SPK-EC-2 .20.2 SPK-EC-3 .20.3 BORDER-1 10.255.3.1 BORDER-2 10.255.3.2 CE-CORP-1 10.255.6.1 CE-CORP-2 10.255.6.2 P Router (CORE) PE Router (EDGE) DMVPN Hub DMVPN Spoke Border (ASBR) Customer Edge (CE) AS 65000 — OSPF Area 0 — LDP

Prerequisites

Task Sheet — CCIE Exam Format

Task 1Medium
Configure VTP v3 domain 'ENTERPRISE' with SW-CORE-1 as primary server. All other switches in client mode.
✓ Verify: show vtp status | include Version
Task 2Medium
Create VLANs: 100 (Management), 200 (Data), 300 (Voice), 400 (Native). Assign names matching VLAN numbers.
✓ Verify: show vlan brief
Task 3Hard
Configure EtherChannel between SW-CORE-1 and SW-CORE-2 using LACP active mode. Use port-channel 1. Configure as L3 with IP 10.0.100.0/31.
✓ Verify: show etherchannel 1 summary
Task 4Hard
Enable MST with region name 'ENTERPRISE', revision 1. Map VLAN 100-200 to instance 1, VLAN 300-400 to instance 2. SW-CORE-1 primary root for instance 1.
✓ Verify: show spanning-tree mst
Task 5Hard
Enable PortFast and BPDUGuard on all access ports. Enable Root Guard on all uplink ports toward distribution.
✓ Verify: show spanning-tree detail | include Bpdu
Task 6Expert
Configure private VLAN: primary VLAN 500, isolated secondary VLAN 501, community secondary VLAN 502.
✓ Verify: show vlan private-vlan

Key Concepts

MST (Multiple Spanning Tree) maps multiple VLANs to a single STP instance, reducing CPU overhead compared to PVST+ which runs one instance per VLAN. MST instances share a common internal spanning tree (IST) for BPDU communication, with each region appearing as a single bridge to outside regions.

EtherChannel bundles physical links into one logical channel, providing bandwidth aggregation and link redundancy. LACP (802.3ad) is the standards-based protocol; active/active is preferred for fast negotiation. The load-balancing algorithm (src-dst-mac, src-dst-ip) determines per-flow link selection — change with 'port-channel load-balance'.

BPDUGuard disables a PortFast-enabled port if it receives any BPDU, protecting against accidental switch connections. Root Guard prevents a port from becoming root port, protecting the STP root election. Loop Guard prevents alternate/root ports from becoming designated if BPDUs stop (unidirectional link failure).

Verification Commands

show spanning-tree mst 1
Expect SW-CORE-1 as root: 'This bridge is the root'
show etherchannel 1 summary
Expect Po1(SU) with member ports in (P) state
show vtp status
Expect VTP Version 3, Primary Server on SW-CORE-1
show interfaces trunk
Expect VLANs 100,200,300,400 active in allowed list

Common Mistakes & Troubleshooting

EtherChannel not forming

Verify both ends use same mode (LACP active/active or active/passive). Check 'show etherchannel summary' for (I) flag = incompatible config. Speed, duplex, and trunk config must match.

MST instances not converging

Verify region name, revision number, and VLAN-to-instance mapping match exactly on all switches. Any mismatch puts switches in different MST regions. Use 'show spanning-tree mst configuration digest' to compare.

BPDUGuard not triggering

Confirm PortFast is enabled first ('spanning-tree portfast'). BPDUGuard only works on PortFast-enabled ports. Check 'show spanning-tree interface Gix/x detail'.

Solution Configs

Attempt the tasks yourself before viewing solutions.
Type SOLUTION to unlock.

SW-CORE-1

! See solution-configs/SW-CORE-1.cfg
! Key configs included in task walkthrough above
Study Timer
45:00
CCIE EI v1.0 Blueprint: §1.1  ·  ← All Labs  ·  Independent study resource. Not affiliated with Cisco Systems, Inc.
⬇ Initial Configs — Load These to Start the Lab
⬇ EDGE-1-initial.cfg ⬇ EDGE-2-initial.cfg
Solution Configs — Reveal After Completing Tasks
Complete the tasks above, then check the solution configs folder after git clone.

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.