VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab

CompTIA Network+ N10-009

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and Applied Networking Judgment Official Domain Weights and an 8-12 Week Study Plan How to Use Labs, Practice, and PBQ Workflow Missed-Question Notebook and Final Readiness Metrics

2 Domain 1: Networking Concepts (23%)

OSI and TCP/IP Models with Device and Protocol Mapping Networking Appliances and Where They Operate Ports and Protocol Decision Table Traffic Types and Encapsulation Flow

3 Domain 1: Media, Connectors, Transceivers, and Network Architectures

Copper, Fiber, Coax, and DAC Media Connector and Transceiver Selection Network Topologies and Design Patterns Cloud and Virtual Networking Concepts

4 Domain 1: IP Addressing and Subnetting Mastery

IPv4 Classes, Private/Public, APIPA, and Loopback CIDR, VLSM, and Subnet Math IPv6 Address Types and Notation Routing Basics and Longest Prefix Match

5 Domain 2: Network Implementation - Routing

Static vs Dynamic Routing and Route Selection OSPF, EIGRP, and BGP Basics at Network+ Depth NAT/PAT, VIP/FHRP, and Subinterfaces Routing PBQs and Troubleshooting Route Table Clues

6 Domain 2: Network Implementation - Switching

VLANs, Access Ports, Trunks, and Native VLAN STP/RSTP Loop Prevention and Bridge Roles Port Aggregation/LACP, MTU, Jumbo Frames, and Interface Settings Switch Implementation PBQs and Common Misconfigurations

7 Domain 2: Network Implementation - Wireless and Physical Implementation

Wi-Fi Standards, Bands, and Channels SSID Security, Guest Networks, and Authentication Antennas, Coverage, Roaming, Interference, and Site Surveys Physical Installation Implications

8 Domain 2: Network Implementation - Services Implementation

DNS Record Types and Troubleshooting Cues DHCP, DHCPv6, SLAAC, Scopes, Leases, and Relay NTP, PTP, NTS, and Time-Sensitive Networking Service Implementation PBQs: DNS, DHCP, VLANs, and Firewall Direction

9 Domain 3 Part A: Network Operations Documentation and Governance

Physical, Logical, Rack, Cable, Wireless Diagrams, and IPAM Asset Inventory, Baselines, SLAs, SOPs, and Runbooks Change Management and Request Tracking Lifecycle, EOL, EOS, Decommissioning, and Configuration Management

10 Domain 3 Part B: Monitoring, Remote Access, and Resilience

SNMP, Flow, Syslog, Packet Capture, Log Aggregation, APIs, and Port Mirroring Baselines and Performance Metrics Remote Access, Management Paths, and Secure Admin Habits DR and HA Concepts: RPO, RTO, MTTR, MTBF, Sites, Failover, and Testing

11 Domain 4: Logical Security and Secure Access (14%)

Encryption in Transit, Encryption at Rest, PKI, and Certificates IAM, MFA, SSO, Directory Services, and AAA Authorization, Least Privilege, RBAC, Geofencing, and Time-Based Access VPNs and Secure Management Design

12 Domain 4: Segmentation, Risk, and Network Attacks (14%)

Segmentation for Guest, BYOD, IoT, IIoT, SCADA, ICS, and OT Risk, Compliance, Audit, Data Locality, PCI, and GDPR Network Attacks and Scenario Cues Attack-to-Mitigation PBQ Tables

13 Domain 4: Security Controls and Hardening (14%)

Firewalls, IDS, IPS, Security Zones, and Screened Subnets ACLs, Filtering, NAC, Hardening, and Key Management Deception Technologies and Physical Security Zero Trust, SASE, and Trusted or Untrusted Zone Decisions

14 Domain 5: Troubleshooting Methodology and Tools (24%)

Official Troubleshooting Methodology and Evidence Handling Command-Line Tools: ping, traceroute, nslookup, dig, ipconfig, ifconfig, ip, arp, netstat, ss, and route Packet, Protocol, and Wi-Fi Analyzers Choosing the Right Tool by Symptom PBQs

15 Domain 5: Physical, Interface, and Wireless Troubleshooting (24%)

Cable Issues: Type, Attenuation, Crosstalk, Termination, and TX/RX Interface Issues: Errors, Discards, Duplex, Speed, Port Status, and PoE Transceiver, Fiber, and Signal Strength Troubleshooting Wireless Troubleshooting: Interference, Channels, Roaming, RSSI/SNR, Security, and Captive Portals

16 Domain 5: Network Services, Switching, Routing, and Performance Troubleshooting (24%)

DHCP, DNS, NTP, and IP Addressing Issues VLAN, STP, Trunk, Native VLAN, and ACL Issues Routing, Default Gateway, Route Table, and NAT Issues Congestion, Latency, Jitter, Packet Loss, and Application Performance Clues

17 Performance-Based Question Labs

Subnetting and VLSM Design Lab VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab Wireless Deployment and Troubleshooting Lab Monitoring, Log Triage, and Route or Service Troubleshooting Lab

18 High-Yield Reference and Final Study Plan

High-Yield Ports and Protocols Table Wi-Fi, Cabling, Connectors, and Transceivers Quick Table Acronyms and Command-Line Tool Quick Table Final 7-Day Review Plan and Readiness Checklist

19 Final Synthesis: Strategy, Remediation, and Readiness

Mixed-Set Decision Strategy for Qualifiers and Close Answers Missed-Question Remediation Notebook by Error Type Exam-Day Time Management and PBQ Order 100-Question Readiness Simulation Blueprint Mapped to N10-009 Weights

VLAN, Trunk, Router-on-a-Stick, and Firewall Rule Lab

Key Takeaways Explain This Topic AI

A VLAN design is incomplete until trunks, access ports, gateways, DHCP scopes, and security rules all agree.

IEEE 802.1Q trunks carry multiple tagged VLANs between switches, routers, firewalls, and access points.

Router-on-a-stick uses subinterfaces with matching 802.1Q tags to route between VLANs over one physical link.

Firewall policy should be written as source, destination, service, action, and logging, evaluated top-down.

PBQ troubleshooting compares symptoms against VLAN membership, trunk allowed lists, native VLAN, gateways, and rule order.

Last updated: June 2026

VLAN and Firewall Design Lab

This lab combines Layer 2 segmentation, Layer 3 gateways, and security policy. In a PBQ you may place switchports into VLANs, mark a trunk, choose subinterfaces, and build firewall rules that allow only required traffic. CompTIA exam objective 2.3 (VLANs and trunking) and 4.x (security) both surface here, so a single scenario can test multiple objectives at once.

A VLAN (Virtual Local Area Network) is a Layer 2 broadcast domain defined in switch software. Devices in different VLANs cannot talk without a Layer 3 device (router or firewall) routing between them.

Scenario

A small office has one router or firewall connected to a switch. The switch also connects to access points, phones, users, and servers.

VLAN Name Subnet Gateway Purpose
10 Users 172.20.10.0/24 172.20.10.1 Employee workstations
20 Voice 172.20.20.0/24 172.20.20.1 IP phones
30 Servers 172.20.30.0/24 172.20.30.1 File, print, application servers
40 Guest 172.20.40.0/24 172.20.40.1 Internet-only wireless guests
99 Management 172.20.99.0/24 172.20.99.1 Switches, APs, firewall management
Switch Port Plan

Port type Example ports Required setting
User access 1-20 Access VLAN 10
Phone plus PC 21-28 Data VLAN 10, voice VLAN 20
Server access 29-34 Access VLAN 30
AP uplink 35-38 Trunk allowing VLANs 10, 40, 99
Router/firewall uplink 48 802.1Q trunk allowing 10, 20, 30, 40, 99

An access port carries one untagged data VLAN (a phone-plus-PC port adds a tagged voice VLAN). A trunk port carries multiple tagged VLANs. The frame format adds a 4-byte 802.1Q tag containing a 12-bit VLAN ID (1-4094). A trunk allowed list that omits VLAN 40 explains why the guest SSID broadcasts but clients cannot reach the guest gateway.

Router-on-a-Stick Map

Subinterface Encapsulation IP address
g0/0.10 802.1Q VLAN 10 172.20.10.1/24
g0/0.20 802.1Q VLAN 20 172.20.20.1/24
g0/0.30 802.1Q VLAN 30 172.20.30.1/24
g0/0.40 802.1Q VLAN 40 172.20.40.1/24
g0/0.99 802.1Q VLAN 99 172.20.99.1/24

If the physical interface is up but one VLAN cannot route, focus on that VLAN's tag, the trunk allowed list, the subinterface IP, and the host default gateway. The native VLAN (untagged on the trunk) must match on both ends or you see a mismatch and inter-switch leakage.

Firewall Rule Table

Most firewalls and access control lists evaluate rules top-down and stop at the first match. Order is therefore part of the answer.

Order Source Destination Service Action Log
1 Users Servers SMB, HTTPS, DNS as required Allow Yes
2 Voice Call manager / voice gateway SIP, RTP, DHCP, DNS, NTP Allow Yes
3 Guest Internet HTTP, HTTPS, DNS Allow Yes
4 Guest Internal RFC1918 Any Deny Yes
5 Management Network devices SSH, HTTPS, SNMP, syslog Allow Yes
6 Any Any Any Deny (implicit) Yes

A broad deny above an allow breaks a service; a broad allow above a deny defeats segmentation. The final implicit deny should log so you can audit what was dropped.

Troubleshooting Matrix

Symptom Likely check
User gets an APIPA (169.254.x.x) address DHCP scope, DHCP relay, access VLAN, trunk path
Guest can browse but also reaches a file server Guest-to-internal deny missing or ordered too low
Voice phones boot but cannot register Voice VLAN, DHCP option 150, call manager reachability
AP management unreachable AP mgmt VLAN tag, trunk allowed list, mgmt gateway
Only one VLAN works across a trunk Native VLAN or allowed-VLAN mismatch, missing subinterface

An APIPA address (169.254.0.0/16) means the client found no DHCP server - a strong signal that the DHCP relay (IP helper) or trunk path is wrong, not that DHCP itself crashed.

DHCP Relay Detail

DHCP discovery is a broadcast that does not cross a router by default. When the DHCP server sits in VLAN 30 but clients are in VLAN 10, configure an IP helper-address on the VLAN 10 gateway pointing to the server. Without it, VLAN 10 clients self-assign APIPA while VLAN 30 clients (same broadcast domain as the server) lease normally.

Common PBQ Traps

Marking the router uplink as an access port instead of a trunk.

Allowing the guest VLAN to reach internal RFC1918 networks.

Forgetting DHCP relay when the server is in a different VLAN.

Setting a host gateway to an address from the wrong subnet.

Allowing a VLAN on the trunk but never creating the matching routed subinterface.

Writing firewall rules without a final deny, or without logging where auditing is required.