Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Configuring Network Segmentation with VLANs · mukul975 | DecimalAI

Configuring Network Segmentation With Vlans

NewSkillScoreMaintained

configuring-network-segmentation-with-vlans

Designs and implements VLAN-based network segmentation on managed switches to isolate network zones, enforce access control between segments, and reduce the attack surface by limiting lateral movement paths in enterprise network environments.

DevOpsby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/configuring-network-segmentation-with-vlans/SKILL.md

decimalai skills pull configuring-network-segmentation-with-vlans --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/configuring-network-segmentation-with-vlans/SKILL.md https://app.decimal.ai/s/configuring-network-segmentation-with-vlans/SKILL.md

Raw file: /s/configuring-network-segmentation-with-vlans/SKILL.md ↗ · machine-readable summary at /s/configuring-network-segmentation-with-vlans.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

No measurable change+209% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-07	✓→✓	＝ Same ✓	—	—
case-13	✗→✗	＝ Same ✗	—	—
case-06	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/configuring-network-segmentation-with-vlans/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Configuring Network Segmentation with VLANs

When to Use

Segmenting an enterprise network into isolated security zones (corporate, servers, DMZ, guest, IoT)
Meeting compliance requirements (PCI-DSS, HIPAA, SOC 2) that mandate network isolation for sensitive data
Reducing blast radius of security incidents by preventing lateral movement between network segments
Isolating high-risk devices (IoT, BYOD, legacy systems) from critical infrastructure
Implementing defense-in-depth by combining VLANs with firewall rules and access control lists

Do not use VLANs as the sole security control without Layer 3 filtering, for isolating networks that require air-gapping, or without proper switch hardening against VLAN hopping attacks.

Prerequisites

Managed switches supporting 802.1Q VLAN trunking (Cisco Catalyst, HP Aruba, Juniper EX, etc.)
Layer 3 switch or firewall for inter-VLAN routing and access control
Network design document specifying VLAN assignments, IP subnets, and traffic flow requirements
Console or SSH access to switches with privileged configuration mode
Understanding of 802.1Q trunking, STP, and inter-VLAN routing concepts

Workflow

Step 1: Design the VLAN Architecture

# Define VLANs based on security zones and function

VLAN Plan:
  VLAN 10  - CORPORATE    (10.10.10.0/24)  - Employee workstations
  VLAN 20  - SERVERS      (10.10.20.0/24)  - Internal servers
  VLAN 30  - DMZ          (10.10.30.0/24)  - Internet-facing servers
  VLAN 40  - GUEST        (10.10.40.0/24)  - Guest WiFi
  VLAN 50  - IOT          (10.10.50.0/24)  - IoT/OT devices
  VLAN 60  - VOIP         (10.10.60.0/24)  - VoIP phones
  VLAN 100 - MANAGEMENT   (10.10.100.0/24) - Switch/AP management
  VLAN 999 - QUARANTINE   (10.10.99.0/24)  - Isolated/compromised hosts
  VLAN 998 - NATIVE_UNUSED                  - Native VLAN (no traffic)

# Traffic flow matrix:
# CORPORATE -> SERVERS: Allowed (specific ports)
# CORPORATE -> DMZ: Allowed (HTTP/HTTPS only)
# CORPORATE -> GUEST: Denied
# CORPORATE -> IOT: Denied
# GUEST -> Any Internal: Denied
# IOT -> SERVERS: Allowed (specific ports to specific hosts only)
# DMZ -> SERVERS: Allowed (database ports only)
# MANAGEMENT -> All: Allowed (from management stations only)

Step 2: Configure VLANs on Cisco Catalyst Switch

! Enter configuration mode
enable
configure terminal

! Create VLANs
vlan 10
  name CORPORATE
  exit
vlan 20
  name SERVERS
  exit
vlan 30
  name DMZ
  exit
vlan 40
  name GUEST
  exit
vlan 50
  name IOT
  exit
vlan 60
  name VOIP
  exit
vlan 100
  name MANAGEMENT
  exit
vlan 998
  name NATIVE_UNUSED
  exit
vlan 999
  name QUARANTINE
  exit

! Configure access ports for workstations (VLAN 10)
interface range GigabitEthernet1/0/1-24
  switchport mode access
  switchport access vlan 10
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure access ports for servers (VLAN 20)
interface range GigabitEthernet1/0/25-36
  switchport mode access
  switchport access vlan 20
  switchport nonegotiate
  spanning-tree portfast
  spanning-tree bpduguard enable
  no shutdown
  exit

! Configure trunk ports to other switches
interface GigabitEthernet1/0/48
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Configure trunk to firewall/router
interface GigabitEthernet1/0/47
  switchport mode trunk
  switchport trunk encapsulation dot1q
  switchport trunk native vlan 998
  switchport trunk allowed vlan 10,20,30,40,50,60,100
  switchport nonegotiate
  no shutdown
  exit

! Shutdown unused ports
interface range GigabitEthernet1/0/37-46
  shutdown
  switchport mode access
  switchport access vlan 999
  exit

Step 3: Harden Switch Against VLAN Hopping

! Disable DTP on all ports (prevents switch spoofing)
interface range GigabitEthernet1/0/1-46
  switchport nonegotiate
  exit

! Set native VLAN to unused VLAN on all trunks
interface range GigabitEthernet1/0/47-48
  switchport trunk native vlan 998
  exit

! Enable DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip dhcp snooping trust
  exit

! Enable Dynamic ARP Inspection
ip arp inspection vlan 10,20,30,40,50,60
interface GigabitEthernet1/0/47
  ip arp inspection trust
  exit

! Enable IP Source Guard (prevents IP spoofing)
interface range GigabitEthernet1/0/1-36
  ip verify source
  exit

! Enable Port Security
interface range GigabitEthernet1/0/1-24
  switchport port-security
  switchport port-security maximum 2
  switchport port-security violation restrict
  switchport port-security aging time 60
  exit

! Set VTP to transparent mode (prevents VTP attacks)
vtp mode transparent

! Enable BPDU Guard globally
spanning-tree portfast bpduguard default

! Enable Storm Control
interface range GigabitEthernet1/0/1-36
  storm-control broadcast level 10
  storm-control multicast level 10
  storm-control action shutdown
  exit

Step 4: Configure Inter-VLAN Routing with ACLs

! On the Layer 3 switch or firewall, configure SVIs
interface Vlan10
  ip address 10.10.10.1 255.255.255.0
  no shutdown
  exit
interface Vlan20
  ip address 10.10.20.1 255.255.255.0
  no shutdown
  exit
interface Vlan30
  ip address 10.10.30.1 255.255.255.0
  no shutdown
  exit
interface Vlan40
  ip address 10.10.40.1 255.255.255.0
  no shutdown
  exit
interface Vlan50
  ip address 10.10.50.1 255.255.255.0
  no shutdown
  exit

! ACL: Corporate to Servers (allow specific services)
ip access-list extended CORP-TO-SERVERS
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 80
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 443
  permit tcp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 445
  permit udp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 eq 53
  permit icmp 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 echo
  deny ip any any log
  exit

! ACL: Guest to Internet only (deny all internal)
ip access-list extended GUEST-OUTBOUND
  deny ip 10.10.40.0 0.0.0.255 10.0.0.0 0.255.255.255
  deny ip 10.10.40.0 0.0.0.255 172.16.0.0 0.15.255.255
  deny ip 10.10.40.0 0.0.0.255 192.168.0.0 0.0.255.255
  permit tcp 10.10.40.0 0.0.0.255 any eq 80
  permit tcp 10.10.40.0 0.0.0.255 any eq 443
  permit udp 10.10.40.0 0.0.0.255 any eq 53
  deny ip any any log
  exit

! ACL: IoT limited access
ip access-list extended IOT-OUTBOUND
  permit tcp 10.10.50.0 0.0.0.255 host 10.10.20.10 eq 443
  permit tcp 10.10.50.0 0.0.0.255 any eq 443
  permit udp 10.10.50.0 0.0.0.255 host 10.10.20.1 eq 53
  deny ip 10.10.50.0 0.0.0.255 10.10.50.0 0.0.0.255 log
  deny ip any any log
  exit

! Apply ACLs to VLAN interfaces
interface Vlan10
  ip access-group CORP-TO-SERVERS out
  exit
interface Vlan40
  ip access-group GUEST-OUTBOUND in
  exit
interface Vlan50
  ip access-group IOT-OUTBOUND in
  exit

Step 5: Configure DHCP and DNS per VLAN

! DHCP pools for each VLAN
ip dhcp pool CORPORATE
  network 10.10.10.0 255.255.255.0
  default-router 10.10.10.1
  dns-server 10.10.20.10
  domain-name corp.example.com
  lease 1
  exit

ip dhcp pool GUEST
  network 10.10.40.0 255.255.255.0
  default-router 10.10.40.1
  dns-server 1.1.1.1 8.8.8.8
  lease 0 4
  exit

ip dhcp pool IOT
  network 10.10.50.0 255.255.255.0
  default-router 10.10.50.1
  dns-server 10.10.20.10
  lease 7
  exit

! Exclude gateway and server IPs from DHCP pools
ip dhcp excluded-address 10.10.10.1 10.10.10.10
ip dhcp excluded-address 10.10.40.1 10.10.40.10
ip dhcp excluded-address 10.10.50.1 10.10.50.10

Step 6: Verify and Test Segmentation

bash
# From a workstation on VLAN 10 (Corporate):
# Should succeed:
ping 10.10.20.10          # Server access
curl https://10.10.20.10  # HTTPS to server

# Should fail:
ping 10.10.40.100         # Guest VLAN - should be blocked
ping 10.10.50.100         # IoT VLAN - should be blocked

# From a device on VLAN 40 (Guest):
# Should succeed:
ping 8.8.8.8              # Internet access
curl https://www.google.com

# Should fail:
ping 10.10.10.1           # Corporate gateway - blocked
ping 10.10.20.10          # Server - blocked

# Verify switch configuration
show vlan brief
show interfaces trunk
show ip arp inspection statistics
show ip dhcp snooping binding
show port-security
show ip access-lists

# Run VLAN hopping tests (from authorized pentest)
# These should all fail if hardening is correct:
# 1. DTP negotiation - should fail (nonegotiate)
# 2. Double tagging - should fail (native VLAN 998)
# 3. ARP spoofing - should fail (DAI enabled)

Key Concepts

| Term | Definition | |------|------------| | VLAN (Virtual LAN) | Logical network partition at Layer 2 that groups switch ports into isolated broadcast domains, regardless of physical location | | 802.1Q Trunking | IEEE standard for VLAN tagging that adds a 4-byte header to Ethernet frames, identifying which VLAN a frame belongs to across trunk links | | Inter-VLAN Routing | Layer 3 forwarding of traffic between VLANs using a router, Layer 3 switch, or firewall with access control lists | | Native VLAN | VLAN assigned to untagged frames on trunk ports; should be set to an unused VLAN to prevent VLAN hopping attacks | | DHCP Snooping | Switch feature that validates DHCP messages and builds a binding table of IP-MAC-port mappings, preventing rogue DHCP servers | | Port Security | Switch feature that limits the number of MAC addresses per port and takes action (shutdown, restrict) when violated |

Tools & Systems

Cisco Catalyst/Nexus: Enterprise managed switches with comprehensive VLAN, trunking, and security feature support
HP Aruba CX: Enterprise switches with REST API management and VLAN segmentation capabilities
pfSense/OPNsense: Open-source firewalls for inter-VLAN routing with stateful access control
NetBox: Open-source IPAM and DCIM tool for documenting VLAN assignments, IP addressing, and network topology
Nmap: Network scanner for verifying segmentation effectiveness by testing reachability across VLAN boundaries

Common Scenarios

Scenario: Implementing PCI-DSS Compliant Network Segmentation for Retail

Context: A retail chain must isolate their payment card processing systems from the general corporate network to meet PCI-DSS requirements. The current flat network has point-of-sale terminals, employee workstations, inventory servers, and guest WiFi on a single VLAN. The environment uses Cisco Catalyst 9300 switches.

Approach:

Design VLAN architecture: POS terminals on VLAN 50 (CDE), corporate on VLAN 10, servers on VLAN 20, guest on VLAN 40
Create VLANs on all access-layer switches and configure access ports by function
Configure trunk links between switches with explicit VLAN allowed lists (no "all" trunks)
Set native VLAN to 998 (unused) on all trunks and disable DTP on every port
Configure ACLs on the Layer 3 switch: CDE VLAN can only reach the payment processor's IP on port 443; no other inter-VLAN traffic to/from CDE
Enable DHCP snooping, DAI, and port security on all access ports
Verify segmentation with penetration testing from each VLAN, confirming CDE is fully isolated

Pitfalls:

Leaving DTP enabled on access ports, allowing VLAN hopping to reach the CDE
Using VLAN 1 as the native VLAN, enabling double-tagging attacks
Not restricting trunk allowed VLANs, carrying all VLANs including CDE to non-essential switches
Creating ACLs that allow "any" source to reach CDE servers instead of specific POS terminal IPs

Output Format

## Network Segmentation Implementation Report

**Network**: Retail Store #42
**Switch Platform**: Cisco Catalyst 9300
**VLANs Configured**: 8

### VLAN Summary

| VLAN ID | Name | Subnet | Ports | Purpose |
|---------|------|--------|-------|---------|
| 10 | CORPORATE | 10.10.10.0/24 | Gi1/0/1-24 | Employee workstations |
| 20 | SERVERS | 10.10.20.0/24 | Gi1/0/25-36 | Internal servers |
| 30 | DMZ | 10.10.30.0/24 | Gi2/0/1-4 | Internet-facing |
| 40 | GUEST | 10.10.40.0/24 | WiFi AP trunk | Guest WiFi |
| 50 | CDE | 10.10.50.0/24 | Gi2/0/5-12 | POS terminals |
| 100 | MGMT | 10.10.100.0/24 | Gi1/0/48 | Switch management |
| 998 | NATIVE | N/A | Trunks only | Unused native |
| 999 | QUARANTINE | 10.10.99.0/24 | Unused ports | Isolation |

### Security Hardening Status

| Control | Status |
|---------|--------|
| DTP Disabled (nonegotiate) | All ports |
| Native VLAN (998) | All trunks |
| DHCP Snooping | VLANs 10,20,40,50 |
| Dynamic ARP Inspection | VLANs 10,20,40,50 |
| Port Security | Access ports |
| BPDU Guard | Access ports |
| Unused Ports Shutdown | 10 ports in VLAN 999 |
| VTP Transparent Mode | Enabled |

Illustrative Want to see what configuring-network-segmentation-with-vlans would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 08:11 UTC · 22 cases

Lift

50% vs 50%

Agent turns

1.0 vs 1.0

Tokens

+209%

6,355.45 vs 2,060.09

fail → pass · 2pass → pass · 1fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-13 We need to enforce port security on corporate access ports GigabitEthernet1/0/1-24 on a Cisco Catalyst switch. We want to allow a maximum of 2 MAC addresses per port, but if a third MAC address connects, we want to drop non-compliant traffic and generate SNMP/syslog alerts without shutting down the entire interface. Which violation mode and limit should be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 Our team wants to segment guest Wi-Fi and corporate devices by defining VLAN 10 and VLAN 40 on a Cisco Catalyst switch, but we intend to leave Dynamic Trunking Protocol (DTP) on auto, keep native VLAN as VLAN 1, and leave unused ports enabled without port security to save configuration effort. Is setting up VLAN IDs alone sufficient for network segmentation without switch hardening?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 We are isolating smart HVAC sensors on IoT VLAN 50 (10.10.50.0/24) using extended ACL IOT-OUTBOUND on a Layer 3 switch. The sensors only need to report telemetry via HTTPS to a specific internal server at host 10.10.20.10, send DNS queries to 10.10.20.1, and reach external HTTPS servers, while blocking all inter-IoT lateral communication. What rule structure ensures lateral traffic within VLAN 50 is blocked?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 On our Cisco Catalyst 48-port access switch, ports GigabitEthernet1/0/37-46 are currently unused. A junior admin suggested leaving them in VLAN 1 in an active state for quick future patching. What is the standard security workflow for configuring unused switch ports?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 To mitigate broadcast storms caused by network loops or misbehaving NICs on workstation access ports GigabitEthernet1/0/1-36, we want to set a traffic threshold of 10% for broadcast and multicast traffic on a Cisco Catalyst switch. If traffic exceeds this level, the interface should shut down. How should storm control be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 After applying VLAN configuration, trunking, and layer 2 security hardening on a Cisco Catalyst switch, we need to inspect the active VLAN assignments, trunking native VLAN statuses, and Dynamic ARP Inspection counter metrics. Which Cisco IOS operational show commands verify these three specific components?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 We are configuring the DHCP pool for GUEST on a Cisco switch serving subnet 10.10.40.0/24. Because guest devices churn rapidly, we want to configure a short lease time of 4 hours to avoid address pool exhaustion, while standard corporate leases run for 1 day. What is the DHCP pool configuration for lease time on guest subnets?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our enterprise headquarters is separating high-risk IoT devices, guest access, corporate devices, and server infrastructure across our switch infrastructure. I need you to create a complete network isolation plan and deliver a Network Segmentation Implementation Report in Markdown. Please make sure the output clearly lists the network name, platform, and total VLAN count at the top, followed by a formatted VLAN Summary table and a Security Hardening Status table outlining switchport protection mechanisms.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 We are configuring Dynamic ARP Inspection (DAI) on VLANs 10, 20, 40 on a Cisco Catalyst switch to block ARP poisoning and spoofing. DAI relies on DHCP snooping binding tables. Which interface configuration is necessary on the trunk port GigabitEthernet1/0/47 facing our core router to allow legitimate ARP responses from gateway interfaces?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 We are enabling DHCP Snooping across user VLANs 10, 20, 40 on a Cisco Catalyst switch to prevent rogue DHCP server attacks. We need to specify which switch interface receives valid DHCP server offers from our central firewall on GigabitEthernet1/0/47. By default, all interfaces are untrusted. How should GigabitEthernet1/0/47 be configured?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are deploying a new network setup for Retail Store #88 using Cisco Catalyst switches. We need to isolate our point-of-sale systems, employee workstations, guest Wi-Fi, and internal servers to meet PCI-DSS compliance requirements and prevent unauthorized lateral movement. Please process our topology details and generate a Network Segmentation Implementation Report. The response should specify the network name and switch platform, include a VLAN Summary table with columns for VLAN ID, Name, Subnet, Ports, and Purpose, and provide a Security Hardening Status table listing key Layer 2 security controls.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We are migrating a flat regional clinic network into segmented security zones on Cisco Catalyst hardware. The setup must isolate medical equipment, corporate endpoints, and public Wi-Fi while configuring appropriate inter-VLAN controls and anti-hopping protections. Please provide a Network Segmentation Implementation Report summarizing this deployment, formatted with a VLAN Summary section mapping VLAN IDs to subnets and port assignments, alongside a Security Hardening Status section showing implemented switch protections.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are configuring trunk port GigabitEthernet1/0/47 between our access switch and core firewall on a Cisco Catalyst switch. A team member suggested leaving the native VLAN at default VLAN 1 since untagged frames are rare. How should native VLAN be configured on trunk links to secure against double-tagging attacks?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-15 We are setting up VLAN management on a Cisco Catalyst switch array. By default, Cisco switches run in VTP Server or Client mode. To prevent accidental VLAN database overwrites from unauthorized or misconfigured switches introduced to the network, what VTP operational mode should be enforced?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 We are configuring an extended Access Control List named GUEST-OUTBOUND on a Cisco Layer 3 switch for Guest VLAN 40 (subnet 10.10.40.0/24). Guest users need outbound access to the internet (HTTP/HTTPS/DNS) but must be strictly blocked from reaching any internal RFC 1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). How should the ACL rules be ordered to enforce this?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We have a high-security classified industrial control system that requires physical air-gapping and zero electronic connection to any enterprise network or router. We want to implement this air-gap requirement solely by creating a software VLAN tag on our existing internet-connected Cisco Catalyst core switch. Can we fulfill the physical air-gap mandate by assigning a dedicated VLAN ID and applying Layer 3 access control lists on the switch?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 We want to separate our accounting department from marketing on our Layer 2 switch using VLAN 10 and VLAN 20. However, we plan to allow traffic between them by placing all hosts in the same 10.0.0.0/16 IP subnet without any Layer 3 gateway, firewall, or ACLs, relying strictly on VLAN tagging for full access control. Is assigning distinct Layer 2 VLAN IDs without Layer 3 filtering sufficient to prevent unauthorized lateral communication?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 To prevent malicious users on workstation access ports GigabitEthernet1/0/1-36 from spoofing IP addresses outside their assigned DHCP leases, we are enabling Layer 2 IP traffic filtering. Which Cisco IOS interface command should be applied to these access ports in conjunction with DHCP snooping?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 On a Cisco Catalyst switch, trunk port GigabitEthernet1/0/48 connects to an upstream distribution switch. By default, Cisco trunk ports carry all VLANs (1-4094). We have active VLANs 10, 20, 30, 40, 50, 60, 100, plus native VLAN 998. Should we allow all VLANs across the trunk, or restrict the allowed VLAN list?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 We need to create extended ACL CORP-TO-SERVERS on our Layer 3 switch to govern traffic from Corporate VLAN 10 (10.10.10.0/24) to Server VLAN 20 (10.10.20.0/24). Workstations must be allowed HTTP (80), HTTPS (443), SMB (445), DNS (53), and ICMP echo to server IPs, with all other traffic logged and denied. How should this ACL be constructed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 On our Cisco Catalyst access switch, ports GigabitEthernet1/0/1-24 are connected to end-user workstations in VLAN 10. To optimize Spanning Tree Protocol (STP) convergence speed, we enabled STP PortFast. Is PortFast alone sufficient, or what additional STP security feature must be paired on access ports to prevent unauthorized switches or rogue bridging?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 We are configuring access ports GigabitEthernet1/0/1-24 on a Cisco Catalyst switch for corporate workstations in VLAN 10. The system default allows Dynamic Trunking Protocol (DTP) negotiation so connected devices can auto-negotiate trunk links if needed. Should we leave DTP in dynamic auto mode on these workstation access ports?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of 0 percentage points is the difference between those two pass rates over the 22 comparable cases. 2 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 50%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 2
Skill version measured: v1
Run completed: 7/28/2026, 08:11 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+240% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 54 days ago

Other measured skills in the registry, with their headline benchmark lift.