Exam Objective 2.1: Configure network infrastructure connectivity (switch-to-switch and switch-to-router).
2.1.a Layer 2/Layer 3 physical interfaces
2.1.b Layer 2 802.1Q trunk interfaces
2.1.c Layer 2/Layer 3 LACP port-channel/EtherChannel
2.1.d Switch virtual interface (SVI)
This objective is the foundation of Domain 2.0 — before you can troubleshoot VLANs, spanning tree, or edge-host connectivity, you need to know how to actually build the links between switches and between switches and routers in the first place. It covers four distinct but related building blocks: basic physical interfaces (both Layer 2 and Layer 3 modes), 802.1Q trunking to carry multiple VLANs over one link, EtherChannel/LACP to bundle multiple physical links into one logical link, and SVIs to give a switch a routable Layer 3 presence on a VLAN.
Layer 2 interface (switchport): By default, every physical interface on a Cisco Catalyst switch operates as a Layer 2 switchport — it forwards frames based on MAC address and belongs to a VLAN, but does not have an IP address of its own and cannot route traffic.
Configuration:
interface GigabitEthernet0/1
switchport
switchport mode access
switchport access vlan 10
Layer 3 interface (routed port): On a Layer 3 switch, any physical interface can instead be converted into a routed port — behaving exactly like a router interface, with its own IP address, capable of participating in routing, and no longer tied to a VLAN or switchport behavior at all.
Configuration:
interface GigabitEthernet0/1
no switchport
ip address 10.1.1.1 255.255.255.252
The no switchport command is the key toggle — it removes the interface from Layer 2 switching entirely and converts it into a Layer 3 routed interface. Running switchport (without "no") reverses this, returning the interface to Layer 2 mode.
When each is used:
Layer 2 switchports — connecting end hosts, APs, phones, or any device that should simply belong to a VLAN
Layer 3 routed ports — connecting to a router, or connecting two Layer 3 switches directly point-to-point without needing VLAN/trunking behavior on that specific link (commonly used instead of an SVI-over-trunk design for simple point-to-point links between distribution/core switches)
Exam Alert: Know that switchport-related commands (switchport mode, switchport access vlan) only apply while an interface is in Layer 2 mode. Attempting to configure an IP address directly on an interface still in switchport mode will fail — no switchport must be applied first.
A trunk is a link, typically between two switches (or a switch and a router), designed to carry traffic for multiple VLANs over a single physical connection. Without trunking, each VLAN would require its own dedicated physical cable between switches — clearly not scalable.
How 802.1Q tagging works: As a frame belonging to a specific VLAN crosses a trunk link, the sending switch inserts a 4-byte 802.1Q tag into the Ethernet frame header, containing (among other fields) a 12-bit VLAN ID field identifying which VLAN the frame belongs to. The receiving switch reads this tag to determine which VLAN to forward the frame into, then strips the tag before delivering the frame to an access-port end host (which has no awareness of VLAN tagging at all).
Native VLAN: 802.1Q defines one VLAN per trunk as the native VLAN — traffic in the native VLAN is sent across the trunk untagged, rather than with an 802.1Q tag. This exists primarily for backward compatibility with older equipment that doesn't understand 802.1Q tagging. The default native VLAN is VLAN 1 unless explicitly changed.
Configuration:
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,30
Key trunk configuration elements:
switchport trunk encapsulation dot1q — required on switch platforms that support multiple trunking encapsulations (legacy ISL and 802.1Q); many modern Catalyst switches only support 802.1Q and this command is not needed/available
switchport mode trunk — sets the port to unconditionally trunk
switchport trunk native vlan — changes the native (untagged) VLAN away from the default of VLAN 1, a common security best practice
switchport trunk allowed vlan — restricts which VLANs are actually permitted to cross this specific trunk, rather than allowing all VLANs by default
Native VLAN mismatch: If the two ends of a trunk are configured with different native VLANs, untagged traffic on one side is interpreted as belonging to a different VLAN on the other side, which can cause traffic to leak between VLANs and generates a CDP native VLAN mismatch warning message in the switch log. This is a distinct and commonly tested trunk misconfiguration.
DTP (Dynamic Trunking Protocol): A Cisco-proprietary protocol that allows two connected switches to automatically negotiate whether a link should become a trunk or remain an access port, based on each side's switchport mode setting (access, trunk, dynamic auto, dynamic desirable). Best practice in production networks is to disable DTP negotiation entirely and hard-code switchport mode trunk (or switchport mode access) on both ends, since DTP negotiation is a known vector for VLAN hopping attacks if left in its default dynamic state.
Exam Alert: Know that a native VLAN mismatch is a silent misconfiguration — the trunk still comes up, but traffic handling becomes inconsistent between the two switches. This mirrors the "duplex mismatch stays up/up" pattern from objective 1.1 — a link being up does not guarantee it's correctly configured.
EtherChannel bundles multiple physical links between the same two devices into a single logical link, providing both increased aggregate bandwidth and redundancy — if one physical link in the bundle fails, traffic continues flowing over the remaining links without requiring spanning tree to recalculate a new topology.
LACP (Link Aggregation Control Protocol): The IEEE standard (802.3ad) protocol used to negotiate and maintain an EtherChannel bundle dynamically, allowing two switches to automatically detect and agree on which physical links can be combined into a bundle, and to add/remove links from the bundle as their status changes.
LACP modes:
active — the interface actively sends LACP negotiation packets, attempting to form a channel with the other side
passive — the interface will only participate in LACP negotiation if the other side initiates it (won't send negotiation packets on its own)
At least one side of the link must be set to active for LACP negotiation to actually begin; two sides both set to passive will never form a channel, since neither side ever initiates.
Configuration (Layer 2 EtherChannel):
interface range GigabitEthernet0/1 - 2
channel-group 1 mode active
interface Port-channel1
switchport mode trunk
Configuration (Layer 3 EtherChannel):
interface range GigabitEthernet0/1 - 2
no switchport
channel-group 2 mode active
interface Port-channel2
no switchport
ip address 10.1.1.1 255.255.255.252
Critical requirement — matching interface configuration: All physical interfaces being bundled into the same EtherChannel must be configured identically before joining the channel — same speed, same duplex, same switchport mode (access or trunk), same allowed VLANs (if trunking), and same Layer 2/Layer 3 mode. Mismatched member interfaces will fail to bundle correctly, or the channel will simply not form, and IOS will typically flag the inconsistency.
Verification commands:
show etherchannel summary — the primary command, showing each port-channel, its member interfaces, and their individual status flags (a lowercase "P" indicates a port is bundled into the channel; other flags indicate a port that failed to join)
show interfaces port-channel [number] — shows the logical port-channel interface's own status, similar to show interfaces on a physical port
show lacp neighbor — displays LACP-specific information learned from the neighboring switch on each bundled link
Exam Alert: Know that at least one side must run LACP mode active (active-active or active-passive both work; passive-passive never forms a channel). Also know that mismatched member-interface settings (speed, duplex, trunk mode, allowed VLANs) are the most common reason a port fails to join a channel bundle.
An SVI is a logical, software-based Layer 3 interface associated with a specific VLAN on a Layer 3 switch (or multilayer switch), giving that VLAN a routable IP presence directly on the switch without needing a separate physical router interface or a router-on-a-stick design.
Configuration:
interface Vlan10
ip address 192.168.10.1 255.255.255.0
no shutdown
How an SVI works: The SVI acts as the default gateway for hosts in that VLAN. When a host in VLAN 10 sends traffic destined for a different subnet, it sends the traffic to the SVI's IP address (192.168.10.1 in the example above); the switch then routes that traffic in hardware (via its Layer 3 routing engine) to the appropriate destination, whether that's another local SVI/VLAN or an uplink toward the rest of the network.
Important prerequisite — ip routing: On a Layer 3 (multilayer) Catalyst switch, the global command ip routing must be enabled before SVIs will actually route traffic between VLANs; without it, SVIs can still exist and hold an IP address but the switch will not forward traffic between different SVI subnets.
SVI must-have conditions to come up (up/up):
The VLAN itself must exist in the VLAN database (created with vlan [number] in global config, or learned via VTP)
At least one access or trunk port actively carrying that VLAN must be in an up/up (forwarding) state somewhere on the switch — an SVI for a VLAN with no active ports will not come up, since IOS treats the SVI's link status as dependent on the VLAN having live traffic-carrying member ports
Common SVI problems:
SVI configured for a VLAN number that doesn't actually exist in the VLAN database yet
SVI shows up/down because no port on the switch is currently an active member of that VLAN
ip routing not enabled globally, so traffic between VLANs silently fails to route even though each SVI itself looks correctly configured and up
Exam Alert: The dependency between an SVI's link status and having at least one active port in that VLAN is a frequently tested "gotcha" — students often assume an SVI failing to come up must be an IP addressing problem, when the actual cause is that no physical port is currently forwarding traffic for that VLAN.
Confirm whether the interface is meant to be Layer 2 (switchport) or Layer 3 (routed) and verify the switchport / no switchport configuration matches the intent.
For trunk links, confirm switchport mode trunk is set on both ends, and that native VLAN and allowed VLAN lists match/are intentional on both sides.
For EtherChannel, confirm LACP mode (active/passive) is configured correctly on both ends, and that all member interfaces have identical speed, duplex, and switchport settings before checking show etherchannel summary for bundling status.
For SVIs, confirm the underlying VLAN actually exists in the VLAN database, confirm at least one port is an active member of that VLAN, and confirm ip routing is enabled globally if inter-VLAN routing is expected.
Use show interfaces status for a quick multi-port overview, show etherchannel summary for channel-specific detail, and show vlan brief to confirm VLAN existence and current port membership.
Q1. Which command converts a Layer 2 switchport into a Layer 3 routed interface capable of holding its own IP address?
A. switchport mode trunk
B. no switchport
C. ip routing
D. channel-group mode active
Answer: B. The no switchport command removes an interface from Layer 2 switching entirely, converting it into a Layer 3 routed port that can then be assigned an IP address directly, just like a traditional router interface.
Q2. Two switches are connected by a trunk link. Switch A has its native VLAN set to VLAN 1, while Switch B has its native VLAN set to VLAN 99. What is the most likely result?
A. The trunk will fail to come up entirely
B. Untagged traffic will be misinterpreted between the two switches, and a native VLAN mismatch warning will typically be logged
C. Both switches will automatically negotiate a matching native VLAN
D. The mismatch has no effect since 802.1Q always tags every frame
Answer: B. A native VLAN mismatch does not bring the trunk link down — the trunk still comes up — but untagged traffic sent across the link gets interpreted as belonging to a different VLAN on each side, which can allow traffic to leak between VLANs and typically triggers a CDP native VLAN mismatch log message.
Q3. Two switches need to form an LACP EtherChannel. Switch A's member interfaces are configured with channel-group 1 mode passive, and Switch B's member interfaces are also configured with channel-group 1 mode passive. What happens?
A. The channel forms successfully since both sides agree
B. The channel fails to form, because at least one side must be set to active for LACP negotiation to begin
C. The channel forms, but only carries untagged traffic
D. The channel automatically converts to PAgP instead
Answer: B. LACP passive mode means the interface will only respond to negotiation if the other side initiates it. If both sides are set to passive, neither side ever sends the initiating negotiation packets, so the channel never forms. At least one side must be set to active.
Q4. An administrator configures interface Vlan20 with a valid IP address on a Layer 3 switch, but show ip interface brief shows the SVI as up/down. What is the most likely cause?
A. ip routing has not been enabled globally
B. VLAN 20 does not exist in the VLAN database, or no port is currently an active member of VLAN 20
C. The SVI requires a channel-group configuration
D. The native VLAN is mismatched
Answer: B. An SVI's link status depends on the associated VLAN actually existing and having at least one active (up/up) port as a member of that VLAN somewhere on the switch. If VLAN 20 doesn't exist yet, or no port is currently forwarding traffic in that VLAN, the SVI itself will show up/down even with a correctly configured IP address.
Q5. Which global configuration command must be enabled on a Layer 3 switch before SVIs will route traffic between different VLANs?
A. switchport mode trunk
B. ip routing
C. channel-group mode active
D. spanning-tree portfast
Answer: B. The ip routing global command enables Layer 3 routing functionality on a multilayer switch. Without it, SVIs can exist and hold valid IP addresses, but the switch will not actually route traffic between the different VLAN subnets represented by those SVIs.
Q6. Before bundling two physical interfaces into an EtherChannel, which of the following must match between the member interfaces?
A. Only the interface description
B. Speed, duplex, and switchport mode (access or trunk) settings, among other Layer 2 parameters
C. Only the VLAN ID assigned to each port
D. Nothing needs to match; EtherChannel automatically reconciles differences
Answer: B. All physical interfaces joining the same EtherChannel bundle must be configured identically beforehand — matching speed, duplex, switchport mode, and allowed VLANs if trunking. Mismatched settings between member interfaces will prevent the interface from successfully joining the channel bundle.