Configuring Routers and Switches

This aiMOOC prepares you to configure, verify, secure, document, and troubleshoot routers and managed switches in a vocational networking lab. It is designed for apprentices, trainees, and vocational students who need practical skills that transfer from a simulator to real equipment. The examples use common Cisco IOS-style commands because they are widely used in training environments, but the underlying concepts also apply to equipment from other vendors. Always check the command reference for the exact hardware and software release you are using.

Introduction

A small business network may look simple, but reliable operation depends on several layers working together. Ethernet cables and ports must be connected correctly, switch ports must be assigned to the intended VLANs, router interfaces must have correct IP addresses, hosts must use suitable default gateways, and administrators must verify that the configuration is both functional and secure.

A switch mainly forwards Ethernet frames inside a local network. A router forwards IP packets between different networks. In many workplaces, routers and Layer 3 switches also enforce network boundaries, connect sites, and provide paths toward firewalls or Internet gateways. Your task as a trainee is not only to enter commands, but also to understand why each command is needed, predict the result, verify the result, and document the final state.

Learning Outcomes

After completing this aiMOOC, you should be able to explain the roles of routers and switches, plan a small routed and switched network, access a device through the console or SSH, apply a basic device configuration, create and verify VLANs, configure access and trunk ports, assign Layer 3 addresses, configure inter-VLAN routing, create a simple static route, save and back up configuration information, and troubleshoot common Layer 1, Layer 2, and Layer 3 faults.

You should also be able to work safely in a training rack, follow change-control principles, protect management access, and produce technical documentation that another technician can understand.

How Routers and Switches Work Together

Switching Inside a LAN

A managed Ethernet switch learns source MAC addresses from frames that arrive on its ports. It builds a MAC address table and uses that table to decide where known unicast frames should be forwarded. If the destination MAC address is unknown, or if the frame is a broadcast, the switch may flood the frame within the relevant VLAN.

A VLAN creates a logical Layer 2 broadcast domain. Devices in different VLANs do not communicate directly through a Layer 2 switch. To exchange IP packets between VLANs, they need a Layer 3 device such as a router or multilayer switch.

Routing Between Networks

A router examines the destination IP address of a packet and compares it with its routing table. It chooses a suitable next hop or outgoing interface. Routes may be directly connected, configured statically, or learned through a dynamic routing protocol.

A host sends traffic for a remote subnet to its default gateway. The gateway address must normally be an IP address on the same local subnet as the host. If the gateway is missing or incorrect, the host may still reach devices in its own subnet but fail to reach remote networks.

Layer 2 and Layer 3 in One Device

Some enterprise switches can perform both switching and routing. A Layer 3 switch can use switched virtual interfaces, often called SVIs, to provide default-gateway addresses for VLANs. In a smaller training topology, a Layer 2 switch and an external router can provide the same learning goals through a design called router-on-a-stick.

Physical Installation and Safe Working

Before You Configure

Before touching a production device, obtain authorization and confirm the change plan. In a training lab, identify the device model, power requirements, port labels, console connection, and cabling. Keep liquids away from equipment, follow local electrical and electrostatic-discharge procedures, and do not insert or remove modules unless the hardware documentation says that hot swapping is supported.

Use clear cable labels and avoid pulling cables by the connector. Record which patch-panel outlet, switch port, router interface, or uplink each cable uses. Good physical documentation reduces troubleshooting time later.

Ethernet Ports and Patch Leads

Modern access switches often use 8P8C modular Ethernet connectors commonly called RJ-45 connectors. A copper Ethernet link depends on the cable category, termination quality, negotiated speed and duplex, and the capabilities of both endpoints.

Do not assume that a dark link light means a configuration problem. First check power, cable seating, the correct port, interface shutdown state, and the physical medium. Troubleshooting should begin at the physical layer before you investigate VLANs or routes.

Patch Panels and Structured Cabling

A patch panel provides a fixed termination point for horizontal cabling. Short patch leads then connect panel ports to switch ports. This makes a cabinet easier to maintain and allows changes without disturbing permanent cable runs.

Planning a Training Network

A good technician writes the addressing and VLAN plan before entering configuration commands. The following example is suitable for a small workshop, office, or Packet Tracer lab.

Purpose	VLAN	IPv4 subnet	Default gateway	Example switch ports
Workshop devices	10	192.168.10.0/24	192.168.10.1	Access ports 1 to 8
Office devices	20	192.168.20.0/24	192.168.20.1	Access ports 9 to 16
Guest devices	30	192.168.30.0/24	192.168.30.1	Access ports 17 to 20
Network management	99	192.168.99.0/24	192.168.99.1	Switch SVI
Unused-port parking VLAN	999	No routed subnet	None	Disabled unused ports

The private addresses above are examples for a closed training environment. In a real workplace, use the organization’s approved address plan. Keep an up-to-date record of subnet masks, gateways, DHCP scopes, reserved addresses, VLAN IDs, trunks, and management addresses.

Suggested Lab Topology

A simple topology can use one managed switch, one router, and at least two PCs. Connect the router to a trunk port on the switch. Put the PCs in different access VLANs so that you can test same-VLAN communication and inter-VLAN routing. A second switch can be added later to practice trunks between switches.

PC-A ---- access VLAN 10 ----\
                              SW1 ---- 802.1Q trunk ---- R1
PC-B ---- access VLAN 20 ----/

Accessing the Command-Line Interface

Console Access

Console access is useful when the device has no management IP address or when remote access is unavailable. In a lab, connect a supported console cable, open a terminal emulator, and use the serial settings recommended by the device vendor. Many Cisco devices traditionally use 9600 bits per second, 8 data bits, no parity, 1 stop bit, and no flow control, but you should verify the documentation for the actual model.

A new or erased device may offer an initial setup dialog. In a guided vocational exercise, you will often decline that dialog so you can practice the commands manually.

Command Modes

Cisco IOS-style interfaces use several command modes. The prompt helps you identify the current mode.

Mode	Example prompt	Typical purpose
User EXEC	`Switch>`	Basic checks
Privileged EXEC	`Switch#`	Detailed show commands and access to configuration
Global configuration	`Switch(config)#`	Device-wide settings
Interface configuration	`Switch(config-if)#`	Port or interface settings
Line configuration	`Switch(config-line)#`	Console and remote terminal settings

Basic Device Configuration

The exact syntax varies by platform and release. The following examples are intended for a controlled training environment. Do not paste unfamiliar commands into a live network. Read each command, predict its effect, and verify it.

Set Identity and Protect Privileged Access

A meaningful hostname helps technicians identify the device in the CLI, logs, diagrams, and monitoring systems.

enable
configure terminal
hostname SW1
no ip domain-lookup
enable secret Use-A-Training-Secret
end

Use a unique strong secret in a real environment. Do not reuse the example text. Enterprise environments should follow organizational authentication, AAA, and credential-management policies.

Configure Secure Remote Management with SSH

SSH protects management sessions with encryption. A common IOS-style setup requires a hostname, domain name, local user or AAA method, cryptographic keys, and VTY lines that accept SSH.

configure terminal
hostname SW1
ip domain-name training.example
username netadmin privilege 15 secret Use-A-Unique-Secret
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
login local
transport input ssh
end

The supported key sizes and SSH algorithms depend on the platform and software release. Follow current vendor security guidance for production equipment. Avoid Telnet because it does not protect the session with encryption.

Save the Configuration

The running configuration is active in memory. To retain intended changes across a reboot, save the configuration using the method supported by the platform.

copy running-config startup-config

Before and after a significant change, capture a backup according to workplace procedures. A backup is useful only if you know which device and software version it belongs to and can restore it safely.

Configuring VLANs and Access Ports

A VLAN groups switch ports into a logical Layer 2 network. Access ports normally carry traffic for one VLAN. The following example creates three user VLANs and one management VLAN.

configure terminal
vlan 10
 name WORKSHOP
vlan 20
 name OFFICE
vlan 30
 name GUEST
vlan 99
 name MANAGEMENT
end

Assign access ports only after checking the cabling plan. Interface names vary by switch model.

configure terminal
interface range gigabitEthernet 1/0/1-8
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
exit
interface range gigabitEthernet 1/0/9-16
 switchport mode access
 switchport access vlan 20
 spanning-tree portfast
 spanning-tree bpduguard enable
end

PortFast and BPDU Guard are commonly used on suitable edge ports connected to end devices, but they must not be applied blindly to switch-to-switch links. Follow the network design and vendor guidance.

Verify the result:

show vlan brief
show interfaces status
show mac address-table

Configuring Trunks

A trunk carries traffic for multiple VLANs over one physical link. IEEE 802.1Q identifies VLAN membership by adding a VLAN tag to frames, except for traffic that uses the native VLAN on a conventional 802.1Q trunk.

For a switch uplink, explicitly configure the intended trunk and limit the VLANs to those that must cross it.

configure terminal
interface gigabitEthernet 1/0/24
 description TRUNK_TO_R1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
end

Some platforms support or require additional trunk-encapsulation or negotiation commands; others do not. A native-VLAN mismatch between the two ends of a trunk can cause traffic and control-protocol problems. Verify both ends instead of assuming they match.

show interfaces trunk
show interfaces gigabitEthernet 1/0/24 switchport

Configuring Inter-VLAN Routing

Router-on-a-Stick

Router-on-a-stick uses one physical router interface with multiple logical subinterfaces. Each subinterface processes traffic for one 802.1Q VLAN and normally provides that VLAN’s default-gateway address.

On the switch, the link toward the router must carry the required VLANs as a trunk. On the router, create one subinterface for each routed VLAN.

configure terminal
interface gigabitEthernet 0/0
 no shutdown
exit
interface gigabitEthernet 0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
exit
interface gigabitEthernet 0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
exit
interface gigabitEthernet 0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
exit
interface gigabitEthernet 0/0.99
 encapsulation dot1Q 99
 ip address 192.168.99.1 255.255.255.0
end

The parent physical interface is enabled with no shutdown, while the IP addresses are placed on subinterfaces. Configure each host with an address and mask from its own subnet and use the corresponding router subinterface as the default gateway.

Management Address on a Layer 2 Switch

A Layer 2 switch can use an SVI for management. In this example, VLAN 99 is the management VLAN.

configure terminal
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.99.1
end

For the management SVI to become operational, the VLAN must exist and the switching platform must have an appropriate active Layer 2 path for that VLAN. Verify the design and device behavior with show ip interface brief and VLAN/trunk checks.

Static Routing Between Routers

A router automatically knows its directly connected networks. To reach a remote network without a dynamic routing protocol, you can add a static route. The next example uses documentation address space on a point-to-point training link.

Suppose R1 and R2 share 198.51.100.0/30, with R1 at 198.51.100.1 and R2 at 198.51.100.2. A remote LAN 192.168.40.0/24 is behind R2. R1 can use:

configure terminal
ip route 192.168.40.0 255.255.255.0 198.51.100.2
end

R2 also needs a return path toward networks behind R1. Routing is bidirectional: a successful outbound path is not enough if the return traffic has no route.

Verify routes with:

show ip route
show ip interface brief
ping 198.51.100.2

Securing a Small Switched Network

Security should be part of normal configuration, not an afterthought. Apply only controls that are supported by the device and approved by your organization.

Unused access ports should be disabled. Many organizations also move them into a dedicated unused VLAN.

configure terminal
vlan 999
 name UNUSED
interface range gigabitEthernet 1/0/17-23
 switchport mode access
 switchport access vlan 999
 shutdown
end

Use SSH rather than Telnet for remote CLI access. Restrict management reachability through network design and access controls. Use unique credentials, prefer centralized AAA when required, keep device software supported, synchronize time, collect logs, and maintain backups. On trunks, allow only the VLANs that must cross the link. Do not use VLAN 1 as the normal management VLAN in a design where a separate management VLAN is available.

Physical security also matters. Network cabinets should be protected from unauthorized access, and console ports should not be treated as harmless simply because they require a cable.

Verification and Troubleshooting

A professional configuration is not finished when the commands are entered. It is finished when the intended behavior has been verified and documented.

A Layered Troubleshooting Method

Start with the simplest observable facts and move upward:

Physical layer: Check power, correct cable, correct port, link indicators, interface status, and transceiver or medium.
Data link layer: Check VLAN membership, access or trunk mode, allowed VLANs, MAC learning, and spanning-tree state.
Network layer: Check IP address, subnet mask, interface state, default gateway, ARP or neighbor information, and routing table.
Application layer: Check the service only after lower-layer connectivity is working.

This method reduces random configuration changes and makes your troubleshooting notes easier to follow.

High-Value Verification Commands

Command	What it helps you verify
`show ip interface brief`	Layer 3 addresses and interface state
`show interfaces status`	Switch-port state, VLAN, speed, and duplex summary where supported
`show vlan brief`	VLAN existence and access-port membership
`show interfaces trunk`	Trunk state, native VLAN, and allowed VLANs
`show mac address-table`	Learned MAC addresses and ports
`show ip route`	Connected, static, and learned routes
`show running-config`	Active configuration
`show spanning-tree`	Spanning-tree state and topology information
`show lldp neighbors`	Neighbor discovery on platforms using LLDP

Use ping to test IP reachability and traceroute to inspect the routed path. A failed ping does not automatically prove that routing is wrong because firewalls and endpoint policies may block ICMP. Combine test results with interface, VLAN, ARP, and route information.

Common Faults to Diagnose

Symptom	Likely areas to inspect	Example evidence
No link	Cable, disabled port, wrong medium, power	Interface is down or no carrier is detected
Same-VLAN hosts cannot communicate	Access VLAN, port state, host addressing, endpoint firewall	VLAN table or MAC table does not match the plan
Same subnet works but remote subnet fails	Default gateway and routing	Host has no gateway or router has no route
One VLAN does not cross an uplink	Trunk allowed list and VLAN existence	VLAN is missing from trunk output
Switch management address is unreachable	SVI state, management VLAN, gateway, trunk	SVI is down or management VLAN is not carried
SSH fails but local console works	Management IP path, RSA keys, VTY login, SSH version	Device has no reachable management interface or VTY policy rejects SSH

Documentation and Handover

Technical documentation is part of the job. After a change, update the network diagram, port map, VLAN table, address plan, device inventory, and change record. Record what was changed, why it was changed, who authorized it, how it was tested, and whether rollback was needed.

A useful handover package contains enough information for another technician to reproduce your tests. Do not place live passwords or private keys in ordinary documentation. Store secrets only in approved credential-management systems.

Practical Lab: Build, Configure, Verify

Work in a simulator or authorized training rack. The goal is to configure a small segmented network and prove that it behaves as designed.

Network plan: Create VLANs 10 and 20, choose one subnet for each, and identify the default gateway for each subnet.
Physical build: Connect two end devices to access ports and connect the switch to a router using an uplink intended for trunking.
Switch setup: Configure the hostname, VLANs, access ports, trunk, management SVI, and SSH in accordance with the lab design.
Router setup: Configure router-on-a-stick subinterfaces and enable the parent interface.
Host setup: Assign IP addresses, masks, and default gateways from your plan.
Verification: Prove same-VLAN and inter-VLAN connectivity and record output from appropriate show commands.
Fault exercise: Ask a partner or instructor to introduce one safe configuration fault, then troubleshoot it systematically without resetting the entire topology.
Handover: Save the configuration and produce a one-page technical record containing the topology, VLANs, addresses, tests, and final result.

Professional Reference Sources

The command examples in this aiMOOC should be checked against the actual platform. These sources provide reliable background and current vendor guidance:

Interactive Tasks

Quiz: Test Your Knowledge

What is the main Layer 2 forwarding identifier used by an Ethernet switch? (MAC address) (!IP address) (!TCP port) (!DNS name)

What is the main purpose of a default gateway on an IPv4 host? (To reach destinations outside the local subnet) (!To assign a MAC address to the host) (!To create a VLAN on the switch) (!To save the switch configuration)

Which type of switch port normally carries traffic for one assigned VLAN? (Access port) (!Trunk port) (!Console port) (!Routed loopback)

Which standard is commonly used to identify VLAN traffic on an Ethernet trunk? (IEEE 802.1Q) (!IEEE 802.11) (!HTTP) (!DNS)

Which command is used in the example to verify configured VLANs and access-port membership? (show vlan brief) (!show ip route) (!copy startup-config running-config) (!ping localhost)

What must separate VLANs use when they need to exchange IP traffic through a Layer 2 switch design? (A Layer 3 routing function) (!A second keyboard) (!A longer patch cable) (!A duplicate MAC address)

Why is SSH preferred to Telnet for remote device management? (SSH encrypts the management session) (!SSH creates VLANs automatically) (!SSH increases Ethernet cable speed) (!SSH replaces IP addressing)

What does router-on-a-stick use to route several VLANs over one physical router link? (Router subinterfaces) (!Separate power supplies) (!Multiple DNS zones) (!USB storage partitions)

What should you check first when an Ethernet interface has no physical link? (Physical connection and interface state) (!Dynamic routing metric) (!Application password) (!DNS cache)

Why should a technician verify a configuration after entering commands? (To prove that the network behaves as intended) (!To avoid writing documentation) (!To make every port a trunk) (!To remove all VLANs)

Memory Game

MAC address	Layer 2 hardware identifier learned by an Ethernet switch
Default gateway	Local Layer 3 next hop used for remote destinations
Access port	Switch interface normally assigned to one VLAN
Trunk port	Link that can carry traffic for multiple VLANs
Static route	Manually configured path to a destination network
SVI	Logical VLAN interface that can hold a management or gateway address
SSH	Encrypted protocol used for remote command-line management

Drag and Drop

Match the correct terms.	Topic
Access port	Carries endpoint traffic for one assigned VLAN
Trunk port	Carries traffic for several VLANs
Router subinterface	Provides a logical Layer 3 interface for one VLAN in router-on-a-stick
Management SVI	Provides an IP interface used to manage a Layer 2 switch
Static route	Defines a manually configured path to a remote network

Match each configuration concept with the role it performs in the network.

Crossword Puzzle

Switching	What process forwards Ethernet frames inside a LAN?
Routing	What process forwards IP packets between networks?
Ethernet	What wired LAN technology commonly uses managed switches?
Trunking	What technique carries several VLANs across one link?
Gateway	What local router address does a host use for remote networks?
Subnetting	What process divides an IP address space into smaller networks?

LearningApps

Cloze Text

A managed switch learns source

from Ethernet frames. An access port is normally assigned to one

. A trunk can carry traffic for

over one physical link. IEEE

is widely used for VLAN tagging on Ethernet trunks. A host uses its

when the destination is outside the local subnet. Router-on-a-stick uses logical

on one physical router interface. A Layer 2 switch can use an

for a management IP address. Secure remote CLI access should normally use

instead of Telnet. A technician checks the

when diagnosing paths to remote networks. The configuration should be

before the work is handed over.

Open-Ended Tasks

Easy

Port Identification: Photograph or sketch a training switch and label the console port, two access ports, one uplink, and the power connection.
Cable Map: Trace five authorized patch leads in a training rack and create a table showing both ends of each connection.
CLI Modes: Use a simulator to enter user EXEC, privileged EXEC, global configuration, and interface configuration modes, then explain what each mode is for.
VLAN Poster: Create a one-page visual explanation showing how two VLANs can share one physical switch while remaining separate Layer 2 broadcast domains.

Standard

Switch Configuration Project: Build a simulated switch with two user VLANs, assign access ports, configure a management SVI, verify the result, and submit screenshots or command output.
Router-on-a-Stick Lab: Configure two VLAN gateways on router subinterfaces, test inter-VLAN communication, and explain every command in your own words.
Troubleshooting Interview: Interview a network technician or instructor about a real switching or routing fault, then summarize the symptoms, evidence, root cause, and fix without disclosing confidential information.
Configuration Demonstration Video: Record a short screen video in a simulator that shows how you verify VLANs, trunks, interface status, and routing without revealing passwords.

Advanced

Fault Injection Challenge: Create a working lab, introduce three controlled faults such as a wrong access VLAN, missing trunk VLAN, and wrong default gateway, then produce a structured troubleshooting report.
Secure Management Design: Design an SSH-based management plan for a small organization, including a management VLAN, restricted administrative reachability, credential handling, logging, and backup procedures.
Network Handover Package: Produce a professional topology diagram, VLAN and IP plan, port map, verification record, rollback note, and change summary for a multi-switch training network.
Comparative Platform Study: Compare how two vendors configure VLANs, trunks, management IP addresses, and static routes, then identify concepts that stay the same even when command syntax changes.

Learning Assessment

Configuration Reasoning: Given a topology with two VLANs and one router link, explain which interfaces should be access ports, which should be a trunk, where the gateway addresses belong, and why.
Evidence-Based Troubleshooting: Diagnose a scenario in which same-VLAN traffic works but inter-VLAN traffic fails, using a sequence of show commands and test results to justify each conclusion.
Change Planning: Prepare a safe change plan for adding a new office VLAN to an existing switch and router, including pre-checks, implementation, verification, rollback, and documentation.
Security Transfer: Evaluate a basic lab configuration and propose improvements for production management access, unused ports, allowed VLANs, authentication, logging, and software maintenance.
Design Comparison: Compare router-on-a-stick with Layer 3 switching for a growing organization and explain trade-offs involving scale, performance, simplicity, and fault domains.
Technical Handover: Create a concise handover document that another trainee can use to reproduce your tests and confirm the final network state without access to your personal notes.

Evidence of Learning

Evidence area	What successful work should show
Knowledge	You can explain MAC-based switching, VLAN separation, IP routing, default gateways, trunks, SVIs, router subinterfaces, static routes, and secure management.
Practical skills	You can connect authorized equipment, enter configuration safely, create VLANs, configure interfaces, assign addresses, save changes, and use verification commands.
Troubleshooting	You can move from physical checks to Layer 2 and Layer 3 evidence, form a testable hypothesis, correct the fault, and confirm the result.
Products	You can produce a topology diagram, port map, VLAN and IP plan, configuration record, test results, and change summary.
Professional practice	You protect credentials, respect authorization boundaries, follow safety procedures, document changes, and avoid uncontrolled experimentation on live networks.
Transfer	You can apply the same networking concepts to unfamiliar switch or router platforms even when the exact command syntax differs.

OERs on the Topic

The following Wikipedia article provides open background material on switching. Use it to review concepts, then return to the practical configuration tasks in this aiMOOC.

You can also compare the related router concept with network switching, Ethernet, VLANs, IP routing, Subnetting, Secure Shell, and Network troubleshooting.