Cisco 350-401: Campus Layer 2 Switching and Segmentation — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Campus Layer 2 switching and segmentation provide the broadcast-domain isolation, deterministic forwarding, and operational safeguards required for a scalable, resilient enterprise LAN. This section explains how Ethernet switches learn and forward, how VLANs and trunks segment traffic, how inter-VLAN routing is enabled on multilayer switches, how Spanning Tree variants control looped topologies, how to aggregate links safely, how to manage VLAN propagation, and how to harden Layer 2 against common attacks and failures. It closes with validation guidance and a practical scenario.

Ethernet Switching and VLAN Segmentation Fundamentals

Ethernet switches forward frames based on destination MAC addresses and segment traffic with VLANs.

• MAC learning and forwarding

  • When a switch receives a frame, it learns the source MAC and ingress interface into the CAM (MAC address) table. Entries age out (typically 300 seconds) if not refreshed.
  • Destination lookup determines action:
    • Known unicast: forward to the single egress interface in the CAM table.
    • Unknown unicast, broadcast, and many multicast frames: flood to all ports in the VLAN except the ingress.
  • Filtering occurs when the destination maps to the same port as the source (no forwarding), or by policies such as storm control, port security, or private VLANs (if used).

• Failure modes and trade-offs

  • CAM exhaustion (e.g., MAC flooding attacks) forces excessive unknown-unicast flooding; protect with port security and control-plane policing.
  • MAC flapping (same MAC learned on multiple ports) often indicates physical loops, miswired HA pairs, or vPC/VSS split-brain conditions.

• VLANs and access

  • A VLAN defines a Layer 2 broadcast domain; access ports carry a single, untagged VLAN for the attached endpoint.
  • Voice VLANs: an access port can carry a tagged 802.1Q voice VLAN for an IP phone and untagged data VLAN for a PC behind the phone. CDP/LLDP advertise the voice VLAN to the phone. Trust CoS on the port only if QoS is deployed end-to-end.

  Example (access plus voice): interface Gi1/0/10 switchport mode access switchport access vlan 20 switchport voice vlan 200 mls qos trust cos spanning-tree portfast spanning-tree bpduguard enable switchport port-security maximum 3 switchport port-security mac-address sticky switchport port-security violation restrict

• Trunks and native VLANs

  • 802.1Q trunks carry multiple VLANs between switches. Each trunk has an allowed VLAN list; restrict it to the minimum set.
  • The native VLAN is sent untagged on 802.1Q by default. Use an unused, dedicated native VLAN and tag the native VLAN if supported to prevent VLAN hopping and mismatches from creating control-plane anomalies.
  • Failure modes: native VLAN mismatches trigger spanning-tree PVID errors and can blackhole control traffic; overly permissive trunks propagate unintended VLANs across the campus.

• Layer 2 multicast

  • Without control, multicast floods within the VLAN. IGMP snooping constrains forwarding by learning receiver ports from IGMP joins and leaves. If no multicast router is present in the VLAN, enable an IGMP snooping querier to sustain group state.

  Example: ip igmp snooping ip igmp snooping vlan 20 querier 10.20.0.1

Inter-VLAN Routing and Multilayer Switch Design

Inter-VLAN routing is performed on multilayer switches using SVIs (one per routed VLAN). Hardware forwarding (CEF) uses the FIB and adjacency table for line-rate performance, avoiding CPU-intensive process switching.

• SVI deployment

  • Create an SVI for each user VLAN and place the first-hop gateway there. Summarize at distribution where possible. Use object tracking for redundant gateways (HSRP/VRRP) and consistent ACL/QoS at the SVI.
  • Align Layer 2 and Layer 3 boundaries: routed access designs use Layer 3 links from access to distribution, shrinking Layer 2 failure domains and simplifying convergence, while preserving segmentation with SVIs at distribution.

• Gateway redundancy and convergence

  • Co-design first-hop redundancy with spanning-tree root placement so the active gateway is topologically closest to hosts. HSRP/VRRP are common; GLBP or chassis virtualization (VSS/StackWise Virtual) allow active-active gateway utilization.
  • Failure modes: misaligned STP root and active gateway cause suboptimal traffic paths and convergence delays; asymmetric ACLs on SVIs result in one-way reachability.

• Operational guidance

  • Use consistent SVI numbering and IP addressing, and track DHCP relay (ip helper-address) per VLAN. Monitor ARP/ND tables and control-plane CPU for anomalies during events.

Spanning Tree and Loop Protection

Spanning Tree Protocol prevents Layer 2 loops while permitting physical redundancy.

• Protocol choices

  • 802.1D PVST+: per-VLAN instances, slower convergence.
  • 802.1w Rapid PVST+: per-VLAN instances with fast convergence via proposal/agreement and sync.
  • 802.1s MST: maps many VLANs to a few spanning-tree instances, scaling better in large environments. All switches in a region must match name, revision, and VLAN-to-instance mapping; mismatches create boundaries and run PVST+ on edge VLANs.

• Root election and port roles

  • The root bridge is chosen by the lowest bridge ID (priority + MAC). Intentionally set priorities to place the primary and secondary roots at distribution.
  • RSTP roles: root, designated, alternate, and backup. States: discarding, learning, forwarding. Operate edge links as point-to-point for faster sync.

  Example (rapid PVST+ with deterministic roots): spanning-tree mode rapid-pvst spanning-tree vlan 10,20,200 priority 4096 spanning-tree vlan 10,20,200 root secondary

• Edge and topology protection

  • PortFast: immediately transitions edge ports to forwarding; never enable on switch interconnects.
  • BPDU Guard: errdisables a PortFast port on receipt of any BPDU; pair with PortFast to stop accidental loops via unmanaged switches.
  • Root Guard: prevents a designated port from becoming root by blocking superior BPDUs; use on access-layer uplinks facing downstream switches to protect root placement.
  • Loop Guard: keeps non-designated ports from moving to forwarding if BPDUs stop arriving (typical on unidirectional links); complement with UDLD aggressive for optical links.
  • Bridge Assurance (on supported platforms): ensures BPDUs are bidirectionally present on core/distribution point-to-point links, preventing silent failures.

• Failure modes

  • Unidirectional links can push alternate ports to forwarding and create loops; Loop Guard and UDLD mitigate this.
  • BPDU Filter on non-edge ports suppresses BPDUs and can cause catastrophic loops; avoid except for specific, validated use cases.

Link Aggregation, VTP, and Trunk Operations

• EtherChannel fundamentals

  • Bundles parallel links into a Port-Channel seen as a single logical interface by STP (blocking decisions apply to the bundle). Benefits include higher aggregate bandwidth and faster recovery.
  • Negotiation: LACP (active/passive, IEEE 802.1AX) or PAgP (desirable/auto, Cisco proprietary). Mode on forces bundling without negotiation and risks loops if mispaired—avoid between switches.
  • Member consistency: speed/duplex, allowed VLANs, native VLAN, STP settings, and channel-group mode must match. Use LACP min-links to keep the bundle down until a minimum member count is present.
  • Load balancing: per-flow hashing by source/destination MAC/IP/port; choose a method that matches dominant traffic patterns. Remember hashing is per switch and per direction; symmetry is not guaranteed.

  Example (LACP trunk): interface range Gi1/1-2 channel-group 1 mode active switchport mode trunk switchport trunk allowed vlan 10,20,200 switchport trunk native vlan 999 interface Port-channel1 switchport mode trunk spanning-tree link-type point-to-point

• VTP concepts and pruning

  • VTP distributes VLAN definitions. Modes: server, client, transparent, and off (platform-dependent). Version 3 adds better authentication and primary server roles.
  • Risks: a device with a higher configuration revision number can overwrite the domain and cause VLAN loss. Best practice is transparent or off, with explicit trunk allowed VLAN lists.
  • VTP pruning conserves trunk bandwidth by preventing unused VLANs from flooding; however, it relies on accurate VTP state and is inferior to explicit “allowed VLAN” pruning.
  • Trunk mismatch troubleshooting: verify encapsulation (802.1Q), allowed VLAN list, and native VLAN; DTP auto/desired negotiations can create surprises—use switchport mode trunk and switchport nonegotiate for stability.

  Example (secure trunk with explicit pruning): interface Gi1/0/48 switchport mode trunk switchport trunk allowed vlan 10,20,200 switchport trunk native vlan 999 switchport nonegotiate

Layer 2 Security, Multicast, and Operational Validation

• Port security

  • Limits MAC addresses per access port; sticky learning preserves learned MACs in the running config. Violation actions: protect, restrict, or shutdown. Increase maximum for voice+data ports. Age sticky MACs during moves to reduce operations tickets.

• DHCP snooping and ARP inspection

  • DHCP snooping builds a binding table (IP/MAC/VLAN/interface) and blocks untrusted DHCP offers. Trust uplinks to legitimate servers and rate-limit clients. Persist bindings across reloads if supported.
  • Dynamic ARP Inspection uses snooping bindings to verify ARP packets, preventing spoofing. Trust uplinks; add ARP ACLs for static-address devices. Validate source MAC/IP where available to stop man-in-the-middle attempts.

  Example: ip dhcp snooping ip dhcp snooping vlan 10,20 ip arp inspection vlan 10,20 interface Port-channel1 ip dhcp snooping trust ip arp inspection trust interface Gi1/0/10 ip dhcp snooping limit rate 25

• IGMP snooping operations

  • With a multicast router present, mrouter ports are learned automatically from PIM hellos or can be statically configured. Without one, enable a snooping querier per VLAN to avoid flooding.
  • Watch for group-state blackholes if snooping is enabled but reports are filtered by ACLs or storm control.

• Validation and loop troubleshooting

  • Baseline:
    • show mac address-table dynamic to locate hosts and detect flapping.
    • show spanning-tree vlan X to confirm root, roles, and timers; check for inconsistent states.
    • show etherchannel summary for member health; verify hashing and min-links behavior during failures.
    • show interfaces trunk for allowed/native VLAN correctness; check logs for PVID/native mismatches.
    • show vtp status to ensure safe mode and expected version.
    • show ip dhcp snooping binding and show ip arp inspection statistics to validate security pipelines.
  • Loop indicators: sudden CPU spikes, broadcast/multicast storms, MAC flaps across ports, errdisable due to BPDU Guard. Use SPAN for packet sampling, and enable storm-control to cap impact while you remediate.
  • Common root causes: unmanaged switches connected to two access ports, PortFast enabled uplinks, native VLAN mismatches, unidirectional fiber, EtherChannel misconfiguration (“on” vs negotiated).

Practical Problem Scenario

Northwind Manufacturing experiences intermittent broadcast storms and voice quality drops after adding two new access closets. The environment uses distribution-layer SVIs, Rapid PVST+, and IP telephony with phones daisy-chained to PCs.

1. Define and prune VLAN scope

   • Configure explicit trunk allowed VLANs and move the native VLAN to an unused ID (999), tagging native if supported.
   • Rationale: constrains broadcast domains to intended links and eliminates native mismatches that amplify loops and control-plane anomalies.

2. Align spanning-tree roots with gateways

   • Set distribution switches as primary/secondary STP roots for user and voice VLANs; verify point-to-point link types.
   • Rationale: ensures shortest Layer 2 path to active default gateways, reduces convergence time, and stabilizes traffic flows.

3. Harden edge ports

   • Enable PortFast and BPDU Guard on all access-facing ports; set port security with sticky MACs and a maximum of three on voice/data ports.
   • Rationale: accelerates endpoint bring-up, prevents accidental loops via unmanaged devices, and mitigates CAM exhaustion or MAC-spoofing.

4. Remediate EtherChannel consistency

   • Convert all inter-switch bundles to LACP (active on both sides), set min-links 2 for distribution uplinks, and ensure VLAN/natives match on members and Port-Channel.
   • Rationale: negotiated aggregation prevents accidental parallel links from forwarding independently; min-links preserves symmetric capacity and predictable hashing during failures.

5. Enable DHCP snooping and DAI

   • Trust only uplinks toward legitimate DHCP servers; enable DHCP rate limits on access ports; enable ARP inspection using the snooping table; add ARP ACLs for static servers.
   • Rationale: blocks rogue DHCP servers that redirect traffic and prevents ARP-based man-in-the-middle that would degrade voice and data.

6. Optimize voice access ports

   • Configure switchport voice vlan for all phone ports; enable CoS trust with Auto-QoS if available; increase port-security maximum to cover phone, PC, and softphone MACs.
   • Rationale: guarantees correct VLAN separation and QoS marking preservation, directly improving MOS and jitter performance.

7. Constrain multicast with IGMP snooping

   • Verify PIM-enabled SVI exists for each VLAN with multicast receivers; where no router is present, enable an IGMP snooping querier; mark distribution uplinks as mrouter ports if needed.
   • Rationale: prevents unnecessary multicast flooding that can trigger broadcast storm symptoms and consume phone CPU resources.

8. Validate and test failover

   • Run show spanning-tree vlan all, show interfaces trunk, show etherchannel summary, and examine syslog for PVID/native mismatch or BPDU Guard events. Pull a member link of each Port-Channel and confirm no topology change causes voice packet loss.
   • Rationale: proactive validation proves deterministic convergence and uncovers hidden asymmetries before impacting users.

9. Detect and prevent unidirectional failures

   • Enable UDLD aggressive on fiber uplinks and Loop Guard on non-designated ports; enable Bridge Assurance on distribution interconnects.
   • Rationale: catches one-way link conditions that otherwise trigger alternate-port forwarding and loops.

10. Operationalize monitoring

    • Add alerts for MAC flapping, STP topology changes exceeding thresholds, DHCP snooping violations, and IGMP group count anomalies.
    • Rationale: early-warning telemetry shortens mean time to detect and prevents minor wiring mistakes from cascading into campus-wide outages.

← Enterprise Network Architecture and Design · All domains · Unicast Routing and Route Control →

Practice these questions → · Timed practice on ExamRoll.io →