9 Integrated Network Infrastructure Labs

A staged guide to installing, configuring, securing, troubleshooting, and documenting a small wired and wireless network using VLANs.

Plan the network and its success criteria

A small integrated network combines physical links, switching and routing, wireless access, and verification. A typical lab uses a router or Layer 3 switch, a managed access switch, an access point, and wired and wireless clients. Work in a simulator or isolated lab, since device commands vary by vendor and software version.

The example plan uses three networks:

10 is for Staff, with subnet 192.168.10.0/24 and gateway 192.168.10.1.
20 is for Guest, with subnet 192.168.20.0/24 and gateway 192.168.20.1.
99 is for Network management, with subnet 192.168.99.0/24 and gateway 192.168.99.1.

The target behavior is for staff and guest clients to receive the correct addressing, reach their gateways, and access only destinations permitted by network policy. The switch and AP should be manageable from the management network. A separates Layer 2 broadcast domains; communication between VLANs requires a Layer 3 device and may be controlled with access rules.

Install and verify the physical network

Begin by drawing the topology and labeling each device, port, cable, and intended . Record which switch port connects to the router or Layer 3 switch, which connects to the AP, and which ports serve endpoints. Maintain a port-and-cable schedule so links can be traced without guessing.

Choose cable and connectors rated for the environment and intended Ethernet speed. Route and secure cable using approved pathways, avoid damage and sharp bends, and maintain separation from electrical wiring as required by applicable codes and site rules. Terminate and label both ends consistently.

Before connecting equipment, use a cable tester to check wire map and continuity. For a standards-compliant installation, use an appropriate certification tester and preserve its results. A basic wire-map pass does not certify a cable category or its performance.

Inspect the work area and use safe practices around ladders and overhead hazards. Do not work on electrical wiring; use qualified personnel where electrical or building-code work is required. Use nonconductive ladders near electrical hazards and maintain clearance from power lines.

Verify the physical links: Connected ports should show link indicators. Record cable-test results, port numbers, labels, and failed links. If a port has no link, check power, seating, the patch cable, termination, and port status before changing network settings.

Configure switching and VLANs

Create VLANs 10, 20, and 99 on the managed switch. Configure endpoint ports as access ports in their intended . Configure the router-facing link as a carrying the required VLANs. Configure the AP-facing link as an access port or to match the AP design: an AP mapping multiple SSIDs to VLANs generally needs a , while a single-network AP may use an access port.

The following Cisco IOS-style example creates VLANs, configures a , and places an endpoint port in 10. Interface names and supported syntax vary.

Apply the intended and settings at both ends of each link. Limit trunks to the VLANs they need, and manage devices through a designated management rather than an endpoint network.

Verify switching: Inspect the table, port modes, and list. Connect a test client to an access port and confirm it belongs to the expected . A mismatch between the 's allowed VLANs and the router or AP configuration is a common cause of partial connectivity.

Enable routing and address assignment

On the router or Layer 3 switch, create a gateway for each and provide scopes with addresses, subnet masks, gateways, and DNS settings appropriate to each network. can run on the routing device or an authorized server. If the server is outside a client , configure and verify on that 's gateway.

In a design, the router link must carry tagged traffic, and each router subinterface must match its tag. This Cisco IOS-style example shows subinterfaces for the three example networks:

Apply the intended access controls. For example, guest clients may be allowed Internet access but denied access to staff and management networks. Creating VLANs alone does not provide security.

Verify routing and addressing: For a client in each , check its assigned address, mask, gateway, and DNS server. Ping its gateway, then test permitted destinations. If a client receives no address, check its access-port , scope, relay configuration, tagging, and whether the address pool is exhausted.

Add wireless access

Configure two distinct SSIDs, such as Staff and Guest, and map each to its corresponding . Use current, supported Wi-Fi security settings and strong credentials. Do not use an open guest network unless the design explicitly calls for it and compensating controls are in place. Set an appropriate management address for the AP and verify that its switch port supplies the required VLANs and power.

Test with a wireless client on each . Confirm association, authentication, assigned and IP settings, gateway reachability, and access only to destinations allowed by policy. Wireless faults may arise at the radio link, client authentication, AP-to-switch connection, mapping, or stage. Troubleshoot each layer rather than changing several settings at once.

Troubleshoot from the physical layer upward

Use a repeatable sequence: physical link → switching and → IP configuration → routing and policy → wireless association and radio conditions → application. Change one variable at a time and retest. helps isolate the problem before a setting is changed.

Check these areas according to the symptom:

No link light: Check power, cable path, terminations, patch cord, port state, and speed/duplex negotiation. Test the cable.
No address: Check the access , allowance, scope, relay, and server reachability.
Can ping the gateway but not another subnet: Check routing, subnet mask, return route, and access-control rules.
Staff works but guest fails: Check guest -to- mapping, AP , guest gateway, , and guest-specific policy.
Wi-Fi associates but has no network access: Check AP uplink and tagging, , gateway, client isolation, and authentication settings.
Slow or intermittent Wi-Fi: Check client signal and location, interference, channel use, AP placement, and wired uplink health.

For each failure, record the symptom, the test that isolated the layer, the change made, and the result. This record helps distinguish a corrected fault from an accidental workaround.

Test acceptance and document the network

Test at least one wired and one wireless client in each user . Verify addressing, gateway reachability, permitted inter- traffic, blocked traffic, DNS resolution, and any required Internet access. Confirm that the management interface is reachable only from authorized locations.

Save the device configurations, topology, port-and-cable schedule, address plan, test results, and known limitations. A completed network is not merely one that links up: its intended behavior must be tested and documented. The staged approach reduces guesswork: plan and label the installation, verify cabling, configure VLANs and trunks, add routing and , map wireless networks to the correct VLANs, and test expected access and restrictions.