Skip to content

P01-T03 - VLANs and Gateways

Objective

Create the reusable VLAN foundation on HQ-CHR01, assign the gateway addresses, and validate bidirectional connectivity with the hypervisor on VLAN 100 before any Windows workload is introduced.

Validated lab status

Validated against the live lab on Friday, July 17, 2026:

  • the 802.1Q trunk is carried on ether2
  • VLAN interfaces 10,20,30,40,50,60,70,80,90,100,110 exist on ether2
  • each VLAN gateway was validated in the deployed router config as 172.20.X.1/24
  • 172.20.100.1 was used successfully for hypervisor-side administration
  • 172.20.20.1 was reachable from HQ-DC01

Inputs

Key Value
Router HQ-CHR01
Trunk interface ether2
Hypervisor IP 172.20.100.11/24
Hypervisor gateway 172.20.100.1

Target State

Property Value
VLAN interfaces 10,20,30,40,50,60,70,80,90,100,110
Gateway pattern 172.20.X.1/24
Hypervisor reachability CHR <-> H1 over VLAN 100
Build network VLAN 110 -> 172.20.110.1/24

Prechecks

  • Complete P01-T02.
  • Confirm GEILLAN.100 exists on H1 with 172.20.100.11/24.
  • Create a RouterOS backup before editing interfaces:
/system backup save name=pre-vlan-baseline
/export hide-sensitive file=pre-vlan-baseline

Execution

  1. Create VLAN interfaces on ether2 with the exact idempotent RouterOS block used in the source deployment:
:if ([:len [/interface vlan find where name="vlan10-mgmt"]] = 0) do={
    /interface vlan add name=vlan10-mgmt interface=ether2 vlan-id=10 comment="Management"
} else={
    /interface vlan set [find where name="vlan10-mgmt"] interface=ether2 vlan-id=10 comment="Management"
}

:if ([:len [/interface vlan find where name="vlan20-servers"]] = 0) do={
    /interface vlan add name=vlan20-servers interface=ether2 vlan-id=20 comment="Servers"
} else={
    /interface vlan set [find where name="vlan20-servers"] interface=ether2 vlan-id=20 comment="Servers"
}

:if ([:len [/interface vlan find where name="vlan30-workstations"]] = 0) do={
    /interface vlan add name=vlan30-workstations interface=ether2 vlan-id=30 comment="Workstations"
} else={
    /interface vlan set [find where name="vlan30-workstations"] interface=ether2 vlan-id=30 comment="Workstations"
}

:if ([:len [/interface vlan find where name="vlan40-printers"]] = 0) do={
    /interface vlan add name=vlan40-printers interface=ether2 vlan-id=40 comment="Printers"
} else={
    /interface vlan set [find where name="vlan40-printers"] interface=ether2 vlan-id=40 comment="Printers"
}

:if ([:len [/interface vlan find where name="vlan50-voice"]] = 0) do={
    /interface vlan add name=vlan50-voice interface=ether2 vlan-id=50 comment="Voice"
} else={
    /interface vlan set [find where name="vlan50-voice"] interface=ether2 vlan-id=50 comment="Voice"
}

:if ([:len [/interface vlan find where name="vlan60-corpwifi"]] = 0) do={
    /interface vlan add name=vlan60-corpwifi interface=ether2 vlan-id=60 comment="Corporate WiFi"
} else={
    /interface vlan set [find where name="vlan60-corpwifi"] interface=ether2 vlan-id=60 comment="Corporate WiFi"
}

:if ([:len [/interface vlan find where name="vlan70-guestwifi"]] = 0) do={
    /interface vlan add name=vlan70-guestwifi interface=ether2 vlan-id=70 comment="Guest WiFi"
} else={
    /interface vlan set [find where name="vlan70-guestwifi"] interface=ether2 vlan-id=70 comment="Guest WiFi"
}

:if ([:len [/interface vlan find where name="vlan80-dmz"]] = 0) do={
    /interface vlan add name=vlan80-dmz interface=ether2 vlan-id=80 comment="DMZ"
} else={
    /interface vlan set [find where name="vlan80-dmz"] interface=ether2 vlan-id=80 comment="DMZ"
}

:if ([:len [/interface vlan find where name="vlan90-backup"]] = 0) do={
    /interface vlan add name=vlan90-backup interface=ether2 vlan-id=90 comment="Backup"
} else={
    /interface vlan set [find where name="vlan90-backup"] interface=ether2 vlan-id=90 comment="Backup"
}

:if ([:len [/interface vlan find where name="vlan100-hypervisor"]] = 0) do={
    /interface vlan add name=vlan100-hypervisor interface=ether2 vlan-id=100 comment="Hypervisors"
} else={
    /interface vlan set [find where name="vlan100-hypervisor"] interface=ether2 vlan-id=100 comment="Hypervisors"
}
  1. Assign gateways for VLANs 10,20,30,40,50,60,70,80,90,100 with the exact block used in the source deployment:
:if ([:len [/ip address find where interface="vlan10-mgmt"]] = 0) do={
    /ip address add address=172.20.10.1/24 interface=vlan10-mgmt comment="VLAN10 gateway"
} else={
    /ip address set [find where interface="vlan10-mgmt"] address=172.20.10.1/24 comment="VLAN10 gateway"
}

:if ([:len [/ip address find where interface="vlan20-servers"]] = 0) do={
    /ip address add address=172.20.20.1/24 interface=vlan20-servers comment="VLAN20 gateway"
} else={
    /ip address set [find where interface="vlan20-servers"] address=172.20.20.1/24 comment="VLAN20 gateway"
}

:if ([:len [/ip address find where interface="vlan30-workstations"]] = 0) do={
    /ip address add address=172.20.30.1/24 interface=vlan30-workstations comment="VLAN30 gateway"
} else={
    /ip address set [find where interface="vlan30-workstations"] address=172.20.30.1/24 comment="VLAN30 gateway"
}

:if ([:len [/ip address find where interface="vlan40-printers"]] = 0) do={
    /ip address add address=172.20.40.1/24 interface=vlan40-printers comment="VLAN40 gateway"
} else={
    /ip address set [find where interface="vlan40-printers"] address=172.20.40.1/24 comment="VLAN40 gateway"
}

:if ([:len [/ip address find where interface="vlan50-voice"]] = 0) do={
    /ip address add address=172.20.50.1/24 interface=vlan50-voice comment="VLAN50 gateway"
} else={
    /ip address set [find where interface="vlan50-voice"] address=172.20.50.1/24 comment="VLAN50 gateway"
}

:if ([:len [/ip address find where interface="vlan60-corpwifi"]] = 0) do={
    /ip address add address=172.20.60.1/24 interface=vlan60-corpwifi comment="VLAN60 gateway"
} else={
    /ip address set [find where interface="vlan60-corpwifi"] address=172.20.60.1/24 comment="VLAN60 gateway"
}

:if ([:len [/ip address find where interface="vlan70-guestwifi"]] = 0) do={
    /ip address add address=172.20.70.1/24 interface=vlan70-guestwifi comment="VLAN70 gateway"
} else={
    /ip address set [find where interface="vlan70-guestwifi"] address=172.20.70.1/24 comment="VLAN70 gateway"
}

:if ([:len [/ip address find where interface="vlan80-dmz"]] = 0) do={
    /ip address add address=172.20.80.1/24 interface=vlan80-dmz comment="VLAN80 gateway"
} else={
    /ip address set [find where interface="vlan80-dmz"] address=172.20.80.1/24 comment="VLAN80 gateway"
}

:if ([:len [/ip address find where interface="vlan90-backup"]] = 0) do={
    /ip address add address=172.20.90.1/24 interface=vlan90-backup comment="VLAN90 gateway"
} else={
    /ip address set [find where interface="vlan90-backup"] address=172.20.90.1/24 comment="VLAN90 gateway"
}

:if ([:len [/ip address find where interface="vlan100-hypervisor"]] = 0) do={
    /ip address add address=172.20.100.1/24 interface=vlan100-hypervisor comment="VLAN100 gateway"
} else={
    /ip address set [find where interface="vlan100-hypervisor"] address=172.20.100.1/24 comment="VLAN100 gateway"
}
  1. Validate the interface inventory and addressing in RouterOS:
/interface vlan print detail
/ip address print

Expected VLAN interfaces at this point:

  • vlan10-mgmt
  • vlan20-servers
  • vlan30-workstations
  • vlan40-printers
  • vlan50-voice
  • vlan60-corpwifi
  • vlan70-guestwifi
  • vlan80-dmz
  • vlan90-backup

  • vlan100-hypervisor

  • Test reachability from CHR to 172.20.100.11:

/ping 172.20.100.11 interface=vlan100-hypervisor count=5
  1. Test reachability from H1 to 172.20.100.1:
ping -c 5 172.20.100.1
ip route get 172.20.100.1
  1. Add VLAN 110 for image build and staging before creating VMID 4000.

Add the build network exactly as deployed:

:if ([:len [/interface vlan find where name="vlan110-build"]] = 0) do={
    /interface vlan add \
        name=vlan110-build \
        interface=ether2 \
        vlan-id=110 \
        comment="Image build and staging"
} else={
    /interface vlan set \
        [find where name="vlan110-build"] \
        interface=ether2 \
        vlan-id=110 \
        comment="Image build and staging"
}

:if ([:len [/ip address find where interface="vlan110-build"]] = 0) do={
    /ip address add \
        address=172.20.110.1/24 \
        interface=vlan110-build \
        comment="VLAN110 build gateway"
} else={
    /ip address set \
        [find where interface="vlan110-build"] \
        address=172.20.110.1/24 \
        comment="VLAN110 build gateway"
}

:if ([:len [/interface list find where name="BUILD"]] = 0) do={
    /interface list add name=BUILD comment="Image build and staging network"
}

:if ([:len [/interface list member find where list="LAN" and interface="vlan110-build"]] = 0) do={
    /interface list member add list=LAN interface=vlan110-build
}

:if ([:len [/interface list member find where list="BUILD" and interface="vlan110-build"]] = 0) do={
    /interface list member add list=BUILD interface=vlan110-build
}

Validation

  • Exactly ten VLAN interfaces exist after the base block is applied.
  • Exactly eleven VLAN interfaces exist after the build network is added.
  • Every interface has the correct VLAN ID and 172.20.X.1/24 gateway.
  • CHR can ping 172.20.100.11.
  • H1 can ping 172.20.100.1.
  • ip route get 172.20.100.1 on H1 resolves through GEILLAN.100.
  • /interface vlan print where name="vlan110-build" returns the build VLAN.
  • /ip address print where interface="vlan110-build" returns 172.20.110.1/24.
  • HQ-DC01 can ping 172.20.20.1.

Evidence

  • Output of /interface vlan print detail.
  • Output of /ip address print.
  • Output of ping -c 5 172.20.100.1 on H1.
  • Output of ip route get 172.20.100.1 on H1.

Rollback

  • Remove only the newly created VLAN interfaces and gateway addresses if validation fails.
  • Restore pre-vlan-baseline if multiple values are uncertain.