6 Integrated Switching and Wireless Practice
A practical guide to building and verifying a small campus network that combines VLANs, switch trunks, spanning tree, LACP EtherChannel, and wireless access.
Topology and plan
The lab uses three switches in a triangle. S1 and S2 connect through two physical links bundled as one logical , and each has a separate trunk to S3. An access point (AP) connects to S3. This creates redundant Layer 2 paths, while prevents a forwarding loop. The port channel is treated as one logical spanning-tree link, not as two independent links.
The examples use Cisco IOS/IOS XE-style commands. Interface names and some syntax vary by switch model and software release, so treat the configurations as a lab template and check platform documentation before applying them to production equipment.
The plan is:
10: staff wireless and wired clients; example subnet192.0.2.0/24.20: guest wireless clients; example subnet198.51.100.0/24.30: network management and AP management; example subnet203.0.113.0/24.999: unused on switch-to-switch trunks; no example subnet.
The example subnets are reserved for documentation and lab use. End-to-end IP connectivity requires a DHCP scope and a default gateway for each client . separation by itself does not provide inter- routing or guest access control.
Create VLANs and access ports
Create the VLANs on all three switches. For a small static lab, configure them locally; in a managed network, use the organization’s approved -distribution method.
On S3, place wired staff and guest test devices on access ports. Substitute the ports actually used in the lab. and are intended for end-device ports, not switch-to-switch links.
If a port receiving BPDUs is configured with , it can enter an error-disabled state. Investigate the cause before restoring it.
Configure trunks and
Make S1 the root bridge for the lab VLANs. The example uses Rapid PVST+; other platforms may use a different spanning-tree mode or terminology.
Configure S1–S3 and S2–S3 as matching switch-to-switch trunks. The must match at both ends of each link. Explicitly restrict the allowed VLANs to those needed across that link. A mismatch in native VLANs can contribute to spanning-tree loops.
Example for S1’s link to S3; configure the corresponding S3 interface the same way, and repeat for the S2–S3 link:
Check spanning-tree state separately for each . With S1 as root, its participating ports should be designated and forwarding. In the triangle, should place a redundant path into a non-forwarding role for each relevant . Which S3 uplink blocks can depend on bridge IDs, path costs, and port priorities, so verify the actual result rather than assuming which interface will block.
Build the
Use two physical links between S1 and S2. Configure both sides for and ensure that member ports are compatible. The example uses channel group 1 and the logical interface Port-channel1.
On both S1 and S2:
Using active at both ends is valid because each end actively sends negotiation messages. Match , , and trunk settings at both ends of the port channel, and keep the member settings compatible. Mismatched member settings or negotiation modes can prevent the bundle from forming. treats the bundle as one logical path; it does not independently block one member while forwarding another.
Add wireless access
Connect the AP to an S3 port configured to carry management and client VLANs. In this design, management traffic is untagged on 30, while wireless client traffic is tagged for VLANs 10 and 20. The AP, wireless controller, and switch must agree on this design.
For controller-managed APs, map the staff and guest WLANs to VLANs 10 and 20 on the controller. AP configuration and tagging details vary by product and deployment mode. Confirm that the AP actually tags client traffic for the VLANs assigned to its WLANs.
The AP’s management setting must match the switch port’s native- behavior. The on the AP link does not have to match the on the separate switch-to-switch trunks, but it must match the AP’s expected handling of management traffic. An SSID name alone does not establish mapping, DHCP service, routing, or guest isolation.
Verify the network
Run these checks on the switches; exact output varies by platform.
Confirm that:
VLANs 10, 20, 30, and 999 exist and are active where required.
Trunks are operational, use the intended , and allow the required VLANs.
Both physical S1–S2 links are bundled in Port-channel1; the channel is up and uses .
identifies S1 as root for VLANs 10, 20, and 30, and the redundant triangle path is not forwarding in a way that creates a loop.
A wired test device receives an address from the correct ’s DHCP scope.
A staff wireless client maps to 10 and a guest client to 20, each receives the correct address, and each receives only the access permitted by the network’s routing and security policies.
Verify each layer independently, then test both wired and wireless clients end to end.
Isolate common faults
Use a layered fault-isolation approach: check physical and link state first, then membership, trunk carriage, channel state, spanning-tree state, wireless mapping, and finally DHCP, routing, and security.
One works across a trunk but another does not: The may be missing, inactive, or absent from the allowed list. Check
show briefandshow interfaces trunk; create the and allow it on every required trunk.A trunk is up, but untagged traffic lands in the wrong : Check for a native- mismatch or an incorrect AP management setting. Compare the at both ends of that specific link and align AP management tagging with the switch port.
is down or only one member is bundled: mode or member settings may differ, or and trunk settings may be inconsistent. Check
show summaryandshow neighbor; use compatible modes and align speed, duplex, trunk mode, , and allowed VLANs.Clients experience intermittent loss or a broadcast storm: A Layer 2 loop, spanning-tree issue, or incorrect port-channel configuration may be responsible. Check spanning-tree roles and logs, verify that parallel links are bundled at both ends, and keep enabled. Do not disable it to hide the symptom.
The AP is reachable but wireless clients get no address: Check -to- mapping, AP uplink tagging, existence along the path, and DHCP scope or relay service.
AP management becomes unreachable after trunk changes: Check for a native/tagging mismatch or a management omitted from the allowed list. Verify the AP management , switch-port , and 30 on every relevant path.
An access port enters an error-disabled state: may have received a BPDU, or another protection feature may have triggered. Check interface status and logs, determine why the BPDU or fault occurred before recovery, and keep edge protections on genuine endpoint ports.
Design principles
A reliable integrated design depends on consistent definitions and trunk policies, matching native- behavior at each link’s endpoints, compatible member configuration, and spanning-tree protection for redundant paths. Wireless service adds a mapping step: each must map to the intended , and the AP’s management and client traffic must be carried correctly by its uplink. Verify each layer independently and test wired and wireless clients end to end.