DEV Community

Cover image for 🛠️ Step-by-Step Lab Guide: Web Server with VLAN Segmentation
ekko1500
ekko1500

Posted on

🛠️ Step-by-Step Lab Guide: Web Server with VLAN Segmentation

#infrastructure #networking #tutorial

This lab creates an isolated network environment where a Windows Server with IIS sits behind VLAN segmentation, accessible only from authorized VLANs.

📋 Lab Overview 

Internet (Simulated)
       ↓
   [Router] ← Layer 3 routing + ACLs
       ↓
   [Switch] ← VLAN 10, 20, 30 + VTP Server
    ↙   ↘
VLAN 10    VLAN 20
(Web Server) (Client PCs)
Enter fullscreen mode Exit fullscreen mode

Your rules mapped:

  • Rule 1 – Allow 30 devices (office + internet) → Configure ACL permitting /27 subnet
  • Rule 2 – Access server from VLAN 10 → Assign web server to VLAN 10
  • Rule 3 – Access local VM from VLAN 20 → Client PCs in VLAN 20 can reach VLAN 10

Phase 1: VMware ESXi Setup

Step 1.1: Install ESXi

  1. Download VMware ESXi from Broadcom (free license available)
  2. Install on bare metal or in VMware Workstation for testing
  3. Set management IP: 192.168.1.50/24

Step 1.2: Create Virtual Switch for VLANs

Reference: VLAN deployment requires port groups with specific VLAN IDs

  1. Log into ESXi web interface (https://[your-ESXi-IP]/ui)
  2. Navigate to Networking → Virtual switches
  3. Click Add standard virtual switch
  4. Name: vSwitch-VLAN
  5. No uplink adapters (isolated internal network)
  6. Click Add

Step 1.3: Create VLAN Port Groups

Port Group Name VLAN ID Purpose
VLAN 10 - Servers 10 Web Server VM
VLAN 20 - Clients 20 Client PCs
VLAN 30 - Management 30 Management access

Steps for each:

  1. Networking → Port groups → Add port group
  2. Name: VLAN 10 - Servers
  3. VLAN ID: 10
  4. Virtual switch: vSwitch-VLAN
  5. Click Add

Note: VLAN ID must be between 2 and 4000

Phase 2: Create Virtual Machines

Step 2.1: Web Server VM (VLAN 10)

  1. Virtual Machines → Create/Register VM
  2. Name: WEB-SERVER-01
  3. Guest OS: Microsoft Windows Server 2019/2022
  4. CPU: 2 vCPU, RAM: 4GB, HDD: 40GB
  5. Network Adapter 1: VLAN 10 - Servers
  6. Complete creation, then power on

Step 2.2: Client VM (VLAN 20)

  1. Create/Register VM
  2. Name: CLIENT-01
  3. Guest OS: Windows 10/11 or Ubuntu Linux
  4. CPU: 1 vCPU, RAM: 2GB, HDD: 32GB
  5. Network Adapter 1: VLAN 20 - Clients
  6. Power on after creation

Step 2.3: Verify Isolation (Before Router Config)

Both VMs cannot ping each other yet—they're on different VLANs with no router between them.

Phase 3: Windows Server IIS Configuration

Step 3.1: Set Static IP on Web Server

Inside WEB-SERVER-01 VM:

  1. Open Control Panel → Network and Sharing Center → Change adapter settings
  2. Right-click network adapter → Properties
  3. Select Internet Protocol Version 4 (TCP/IPv4) → Properties
  4. Configure:
    • IP address: 10.10.10.10
    • Subnet mask: 255.255.255.0
    • Default gateway: 10.10.10.1 (router interface for VLAN 10)

Step 3.2: Install IIS

PowerShell as Administrator:

Install-WindowsFeature -name Web-Server -IncludeManagementTools
Enter fullscreen mode Exit fullscreen mode

Step 3.3: Create Test Website

  1. Open IIS Manager
  2. Right-click Sites → Add Website
  3. Site name: TestSite
  4. Physical path: C:\inetpub\testsite
  5. Create folder and add index.html: 
<html><body><h1>VLAN 10 Web Server</h1></body></html>
Enter fullscreen mode Exit fullscreen mode

Step 3.4: Configure Windows Firewall 

New-NetFirewallRule -DisplayName "Allow HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow
Enter fullscreen mode Exit fullscreen mode

Phase 4: Router/Switch Configuration

Step 4.1: VTP Server Setup (Central Switch)

VTP propagates VLAN configuration across switches

Switch# configure terminal
Switch(config)# vtp domain MYLAB
Switch(config)# vtp mode server
Switch(config)# vtp password cisco123
Switch(config)# vtp pruning
Enter fullscreen mode Exit fullscreen mode

Step 4.2: Create VLANs 

Switch(config)# vlan 10
Switch(config-vlan)# name SERVERS
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name CLIENTS
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name MANAGEMENT
Switch(config-vlan)# exit
Enter fullscreen mode Exit fullscreen mode

Step 4.3: Configure Trunk Ports

For VTP to work, trunk ports must be configured between switches

Switch(config)# interface gi1/0/1
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk encapsulation dot1q
Switch(config-if)# switchport trunk allowed vlan 1,10,20,30
Enter fullscreen mode Exit fullscreen mode

Step 4.4: Assign Access Ports

Web server port:

Switch(config)# interface gi1/0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Enter fullscreen mode Exit fullscreen mode

Client ports:

Switch(config)# interface gi1/0/3
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Enter fullscreen mode Exit fullscreen mode

Step 4.5: Router-on-a-Stick (Inter-VLAN Routing)

Router configuration:

Router(config)# interface gi0/1.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 10.10.10.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gi0/1.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 10.10.20.1 255.255.255.0
Router(config-subif)# exit

Router(config)# interface gi0/1.30
Router(config-subif)# encapsulation dot1Q 30
Router(config-subif)# ip address 10.10.30.1 255.255.255.0
Enter fullscreen mode Exit fullscreen mode

Step 4.6: Set Client Static IPs

On CLIENT-01 VM:

  • IP: 10.10.20.50
  • Mask: 255.255.255.0
  • Gateway: 10.10.20.1

Test connectivity:

ping 10.10.10.10
Enter fullscreen mode Exit fullscreen mode

Should succeed now—router forwards between VLANs.

Phase 5: Access Control Rules

Step 5.1: Rule 1 – Allow 30 Office Devices

Define ACL for subnet 192.168.1.0/27 (30 hosts)

Router(config)# access-list 100 permit ip 192.168.1.0 0.0.0.31 any
Router(config)# interface gi0/0
Router(config-if)# ip access-group 100 in
Enter fullscreen mode Exit fullscreen mode

Step 5.2: Rule 2 – Restrict Web Server Access

Only VLAN 10 can reach web server; visitors (VLAN 20) cannot

! Deny visitors from reaching server VLAN
Router(config)# access-list 101 deny ip 10.10.20.0 0.0.0.255 10.10.10.0 0.0.0.255
Router(config)# access-list 101 permit ip any any
Router(config)# interface gi0/1.20
Router(config-subif)# ip access-group 101 in
Enter fullscreen mode Exit fullscreen mode

Step 5.3: Rule 3 – Local VM Access from VLAN 20

No action needed—inter-VLAN routing already allows this.

Phase 6: Testing & Verification

Test 1: Within VLAN 10

From WEB-SERVER-01: Can other VLAN 10 devices ping? Yes.

Test 2: Across VLANs

From CLIENT-01 (VLAN 20):

ping 10.10.10.10     → Success
Enter fullscreen mode Exit fullscreen mode

Test 3: Web Access

From CLIENT-01 browser: http://10.10.10.10 → IIS page loads

Test 4: Verify ACLs 

Router# show access-lists
Router# show ip interface gi0/1.20
Enter fullscreen mode Exit fullscreen mode

📊 Final Architecture 

┌─────────────────────────────────────────────────────────┐
│                      INTERNET                            │
│                        ↓                                 │
│              [Router] ACL 100 (permits /27)             │
│                        ↓                                 │
│   ┌────────────────────┴────────────────────┐          │
│   ↓ (gi0/1.10)                              ↓ (gi0/1.20)│
│ ┌──────────────────┐              ┌──────────────────┐  │
│ │ VLAN 10 - /24    │              │ VLAN 20 - /24    │  │
│ │ 10.10.10.0/24    │              │ 10.10.20.0/24    │  │
│ │                  │              │                  │  │
│ │ [WEB-SERVER-01]  │◄───ping───►  │ [CLIENT-01]      │  │
│ │ 10.10.10.10      │              │ 10.10.20.50      │  │
│ │ IIS: Port 80     │              │                  │  │
│ └──────────────────┘              └──────────────────┘  │
│                                                          │
│              [VTP Server Switch] - VLANs 10,20,30       │
└─────────────────────────────────────────────────────────┘
Enter fullscreen mode Exit fullscreen mode

⚠️ Troubleshooting Tips

Problem Solution
VMs can't ping Check VLAN assignment, trunk config, subnet masks
VTP not syncing Verify domain name, password, trunk ports
IIS not reachable Check Windows Firewall, port 80
ACL blocking everything Verify rule order and subnet masks

Want me to clarify any step or help with Cisco vs. Huawei/other vendor syntax?

Top comments (0)