🛠️ Step-by-Step Lab Guide: Web Server with VLAN Segmentation

This lab creates an isolated network environment where a Windows Server with IIS sits behind VLAN segmentation, accessible only from authorized VLANs.

📋 Lab Overview

Internet (Simulated)
↓
[Router] ← Layer 3 routing + ACLs
↓
[Switch] ← VLAN 10, 20, 30 + VTP Server
↙ ↘
VLAN 10 VLAN 20
(Web Server) (Client PCs)

Enter fullscreen mode

Exit fullscreen mode

Your rules mapped:

• Rule 1 – Allow 30 devices (office + internet) → Configure ACL permitting /27 subnet
• Rule 2 – Access server from VLAN 10 → Assign web server to VLAN 10
• Rule 3 – Access local VM from VLAN 20 → Client PCs in VLAN 20 can reach VLAN 10

Phase 1: VMware ESXi Setup

Step 1.1: Install ESXi

1. Download VMware ESXi from Broadcom (free license available)
2. Install on bare metal or in VMware Workstation for testing
3. Set management IP: 192.168.1.50/24

Step 1.2: Create Virtual Switch for VLANs

Reference: VLAN deployment requires port groups with specific VLAN IDs

1. Log into ESXi web interface (https://[your-ESXi-IP]/ui)
2. Navigate to Networking → Virtual switches
3. Click Add standard virtual switch
4. Name: vSwitch-VLAN
5. No uplink adapters (isolated internal network)
6. Click Add

Step 1.3: Create VLAN Port Groups

Port Group Name
VLAN ID
Purpose

VLAN 10 – Servers
10
Web Server VM

VLAN 20 – Clients
20
Client PCs

VLAN 30 – Management
30
Management access

Steps for each:

1. Networking → Port groups → Add port group
2. Name: VLAN 10 – Servers
3. VLAN ID: 10
4. Virtual switch: vSwitch-VLAN
5. Click Add

Note: VLAN ID must be between 2 and 4000

Phase 2: Create Virtual Machines

Step 2.1: Web Server VM (VLAN 10)

1. Virtual Machines → Create/Register VM
2. Name: WEB-SERVER-01
3. Guest OS: Microsoft Windows Server 2019/2022
4. CPU: 2 vCPU, RAM: 4GB, HDD: 40GB
5. Network Adapter 1: VLAN 10 – Servers
6. Complete creation, then power on

Step 2.2: Client VM (VLAN 20)

1. Create/Register VM
2. Name: CLIENT-01
3. Guest OS: Windows 10/11 or Ubuntu Linux
4. CPU: 1 vCPU, RAM: 2GB, HDD: 32GB
5. Network Adapter 1: VLAN 20 – Clients
6. Power on after creation

Step 2.3: Verify Isolation (Before Router Config)

Both VMs cannot ping each other yet—they’re on different VLANs with no router between them.

Phase 3: Windows Server IIS Configuration

Step 3.1: Set Static IP on Web Server

Inside WEB-SERVER-01 VM:

1. Open Control Panel → Network and Sharing Center → Change adapter settings
2. Right-click network adapter → Properties
3. Select Internet Protocol Version 4 (TCP/IPv4) → Properties
4. Configure:
   • IP address: 10.10.10.10
   • Subnet mask: 255.255.255.0
   • Default gateway: 10.10.10.1 (router interface for VLAN 10)

Step 3.2: Install IIS

PowerShell as Administrator:

Install-WindowsFeature -name Web-Server -IncludeManagementTools

Enter fullscreen mode

Exit fullscreen mode

Step 3.3: Create Test Website

1. Open IIS Manager
2. Right-click Sites → Add Website
3. Site name: TestSite
4. Physical path: C:\inetpub\testsite
5. Create folder and add index.html:

VLAN 10 Web Server

Enter fullscreen mode

Exit fullscreen mode

Step 3.4: Configure Windows Firewall

New-NetFirewallRule -DisplayName “Allow HTTP” -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

Enter fullscreen mode

Exit fullscreen mode

Phase 4: Router/Switch Configuration

Step 4.1: VTP Server Setup (Central Switch)

VTP propagates VLAN configuration across switches

Switch# configure terminal
Switch(config)# vtp domain MYLAB
Switch(config)# vtp mode server
Switch(config)# vtp password cisco123
Switch(config)# vtp pruning

Enter fullscreen mode

Exit fullscreen mode

Step 4.2: Create VLANs

Switch(config)# vlan 10
Switch(config-vlan)# name SERVERS
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name CLIENTS
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name MANAGEMENT
Switch(config-vlan)# exit

Enter fullscreen mode

Exit fullscreen mode

Step 4.3: Configure Trunk Ports

For VTP to work, trunk ports must be configured between switches

Switch(config)# interface gi1/0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport trunk allowed vlan 1,10,20,30

Enter fullscreen mode

Exit fullscreen mode

Step 4.4: Assign Access Ports

Web server port:

Switch(config)# interface gi1/0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10

Enter fullscreen mode

Exit fullscreen mode

Client ports:

Switch(config)# interface gi1/0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20

Enter fullscreen mode

Exit fullscreen mode

Step 4.5: Router-on-a-Stick (Inter-VLAN Routing)

Router configuration:

Router(config)# interface gi0/1.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 10.10.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gi0/1.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 10.10.20.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gi0/1.30
Router(config-subif)# encapsulation dot1Q 30
Router(config-subif)# ip address 10.10.30.1 255.255.255.0

Enter fullscreen mode

Exit fullscreen mode

Step 4.6: Set Client Static IPs

On CLIENT-01 VM:

• IP: 10.10.20.50
• Mask: 255.255.255.0
• Gateway: 10.10.20.1

Test connectivity:

ping 10.10.10.10

Enter fullscreen mode

Exit fullscreen mode

Should succeed now—router forwards between VLANs.

Phase 5: Access Control Rules

Step 5.1: Rule 1 – Allow 30 Office Devices

Define ACL for subnet 192.168.1.0/27 (30 hosts)

Router(config)# access-list 100 permit ip 192.168.1.0 0.0.0.31 any
Router(config)# interface gi0/0
Router(config-if)# ip access-group 100 in

Enter fullscreen mode

Exit fullscreen mode

Step 5.2: Rule 2 – Restrict Web Server Access

Only VLAN 10 can reach web server; visitors (VLAN 20) cannot

! Deny visitors from reaching server VLAN
Router(config)# access-list 101 deny ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
Router(config)# access-list 101 permit ip any any
Router(config)# interface gi0/1.20
Router(config-subif)# ip access-group 101 in

Enter fullscreen mode

Exit fullscreen mode

Step 5.3: Rule 3 – Local VM Access from VLAN 20

No action needed—inter-VLAN routing already allows this.

Phase 6: Testing & Verification

Test 1: Within VLAN 10

From WEB-SERVER-01: Can other VLAN 10 devices ping? Yes.

Test 2: Across VLANs

From CLIENT-01 (VLAN 20):

ping 10.10.10.10 → Success

Enter fullscreen mode

Exit fullscreen mode

Test 3: Web Access

From CLIENT-01 browser: http://10.10.10.10 → IIS page loads

Test 4: Verify ACLs

Router# show access-lists
Router# show ip interface gi0/1.20

Enter fullscreen mode

Exit fullscreen mode

📊 Final Architecture

┌─────────────────────────────────────────────────────────┐
│ INTERNET │
│ ↓ │
│ [Router] ACL 100 (permits /27) │
│ ↓ │
│ ┌────────────────────┴────────────────────┐ │
│ ↓ (gi0/1.10) ↓ (gi0/1.20)│
│ ┌──────────────────┐ ┌──────────────────┐ │
│ │ VLAN 10 – /24 │ │ VLAN 20 – /24 │ │
│ │ 10.10.10.0/24 │ │ 10.10.20.0/24 │ │
│ │ │ │ │ │
│ │ [WEB-SERVER-01] │◄───ping───► │ [CLIENT-01] │ │
│ │ 10.10.10.10 │ │ 10.10.20.50 │ │
│ │ IIS: Port 80 │ │ │ │
│ └──────────────────┘ └──────────────────┘ │
│ │
│ [VTP Server Switch] – VLANs 10,20,30 │
└─────────────────────────────────────────────────────────┘

Enter fullscreen mode

Exit fullscreen mode

⚠️ Troubleshooting Tips

Problem
Solution

VMs can’t ping
Check VLAN assignment, trunk config, subnet masks

VTP not syncing
Verify domain name, password, trunk ports

IIS not reachable
Check Windows Firewall, port 80

ACL blocking everything
Verify rule order and subnet masks

Want me to clarify any step or help with Cisco vs. Huawei/other vendor syntax?

Source link