Secure and Expand a Small Office Network

Build a 3-VLAN office network, troubleshoot failures, and harden it with ACLs.

Introduction

30 Second Summary

Every office has departments that need their own private space on the network, but still need to communicate with each other. A single flat network where everyone shares the same space creates security risks and unnecessary traffic.

In this project, you will build a multi-department office network from scratch, troubleshoot a real connectivity failure, and harden the network with security controls. You will work entirely inside Cisco Packet Tracer, the same simulation tool used in CCNA preparation.

What You'll Build

A secured three-department office network where Sales, Engineering, and Management each live on their own VLAN, communicate through a central router, and follow traffic policies you defined and tested.

By the end of this project, you'll have:

A live 3-VLAN network you can ping across, with Sales, Engineering, and Management departments communicating through a single router using inter-VLAN routing.
Hands-on proof you can diagnose and fix a connectivity failure using Cisco IOS show commands. This is the same troubleshooting methodology used on the job.
A hardened network where unused ports are shut down and port security locks each active port to a single device, blocking unauthorized connections automatically.
Secret Mission: Write a protocol-level ACL that blocks Engineering from pinging Management while permitting web traffic through.

Are there any prerequisites?

You need Cisco Packet Tracer 8.2.2 installed on your computer. You also need a basic understanding of IP addresses. The project explains subnetting as needed.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Set Up the Network Topology

You need a working baseline network before you can expand or secure it. Every change you make in later steps (adding departments, troubleshooting failures, locking down ports) depends on having a correctly wired, correctly addressed topology to start from.

In this step, you will build a small office network with two departments (Sales and Engineering), assign IP addresses to each PC, and create the VLANs that separate department traffic on the switch.

In this step, get ready to:

Place a router, a switch, and four PCs in Cisco Packet Tracer and cable them together.
Assign IP addresses and default gateways to each PC.
Create VLANs on the switch and configure port assignments plus a trunk link.

Build the physical topology

A topology is the physical layout of your network: which devices exist and how they connect. You will place six devices and cable them so every link light turns green, confirming a healthy Layer 1 connection.

In Packet Tracer, open the bottom-left device panel.
Click Network Devices then Routers.
Drag a 1941 router into the workspace.
Click Network Devices then Switches.
Drag a 2960 switch into the workspace.
Click End Devices and drag four PC icons into the workspace.

You should now see six devices: one router, one switch, and four PCs arranged in your workspace.

Next, cable everything together using straight-through copper cables.

Click the Connections category (lightning bolt icon) at the bottom of the device panel.
Select Copper Straight-Through (the solid black line).
Click the Router, choose GigabitEthernet0/0, then click the Switch and choose GigabitEthernet0/1.
Connect PC1 to Switch port FastEthernet0/1.
Connect PC2 to Switch port FastEthernet0/2.
Connect PC3 to Switch port FastEthernet0/3.
Connect PC4 to Switch port FastEthernet0/4.

Wait a few seconds for Packet Tracer to negotiate the links. All link lights between the switch and PCs should turn green. The link between the router and switch may show green on the switch side and red on the router side. That is expected because the router interface is administratively down by default.

Seeing orange or red link lights on the PC connections?

Orange lights mean the link is still negotiating. Wait about 30 seconds for them to turn green.

If a light stays red, click the cable to verify both ends are connected to the correct ports. Delete the cable and re-draw it if needed.

Why are my link lights not turning green?

Configure IP addresses on PCs

Each PC needs an IP address so devices can find each other on the network. Sales PCs will use the 192.168.10.0/24 subnet, and Engineering PCs will use 192.168.20.0/24.

Double-click PC1 to open its configuration window.
Click the Desktop tab, then click IP Configuration.
Enter 192.168.10.10 in the IPv4 Address field.
Enter 255.255.255.0 in the Subnet Mask field.
Enter 192.168.10.1 in the Default Gateway field.
Close the PC1 window.

Repeat the same process for PC2 (also Sales department).

Double-click PC2 and navigate to Desktop then IP Configuration.
Enter IP 192.168.10.11, Subnet 255.255.255.0, Gateway 192.168.10.1.
Close the PC2 window.

Now configure the Engineering PCs on a different subnet.

Double-click PC3 and navigate to Desktop then IP Configuration.
Enter IP 192.168.20.10, Subnet 255.255.255.0, Gateway 192.168.20.1.
Close the PC3 window.
Double-click PC4 and navigate to Desktop then IP Configuration.
Enter IP 192.168.20.11, Subnet 255.255.255.0, Gateway 192.168.20.1.
Close the PC4 window.

Verify one of your configurations by double-clicking PC1, going to Desktop then IP Configuration. You should see 192.168.10.10 still saved in the IPv4 Address field.

IP address disappeared after closing the window?

Make sure you are entering the address under the Static radio button, not DHCP. If DHCP is selected, Packet Tracer discards your manual entries.

Why did my PC IP address reset?

Configure VLANs on the switch and the trunk to the router

A VLAN is a virtual boundary inside a switch that separates traffic into isolated groups. By putting Sales PCs on VLAN 10 and Engineering PCs on VLAN 20, you ensure each department's traffic stays separate at Layer 2.

Click the Switch to open its window, then click the CLI tab.
Press Enter to get a command prompt.
Create the two VLANs by entering these commands:

enable
configure terminal
vlan 10
name SALES
exit
vlan 20
name ENGINEERING
exit

What do these commands do?

`enable` enters privileged EXEC mode so you can make configuration changes.
`configure terminal` enters global configuration mode.
`vlan 10` creates VLAN 10 (or enters its config if it already exists).
`name SALES` gives VLAN 10 a human-readable label.
`exit` returns to global config mode so you can create the next VLAN.

You can confirm the VLANs were created by running:

do show vlan brief

You should see VLAN 10 (SALES) and VLAN 20 (ENGINEERING) listed in the output, both in active status. No ports are assigned yet.

Now assign switch ports to each VLAN by entering these commands (still in global config mode):

interface range FastEthernet0/1 - 2
switchport mode access
switchport access vlan 10
exit
interface range FastEthernet0/3 - 4
switchport mode access
switchport access vlan 20
exit

What do these commands do?

`interface range FastEthernet0/1 - 2` selects both Sales ports at once so you can configure them together.
`switchport mode access` tells the port it connects to a single end device (not another switch).
`switchport access vlan 10` places those ports into VLAN 10, so any traffic from PC1 or PC2 is tagged as Sales traffic.

Finally, configure the link between the switch and router as a trunk. A trunk port carries traffic from multiple VLANs over a single cable using 802.1Q tags.

Configure the trunk port by entering these commands:

interface GigabitEthernet0/1
switchport mode trunk
exit
end

Why does the router link need to be a trunk?

The router needs to receive traffic from all VLANs so it can route between them. A trunk port tags each frame with its VLAN number, so the router knows which department the traffic belongs to.

Verify your port assignments by running this command:

show vlan brief

You should see VLAN 10 (SALES) with ports Fa0/1 and Fa0/2 listed, and VLAN 20 (ENGINEERING) with ports Fa0/3 and Fa0/4 listed. GigabitEthernet0/1 will NOT appear here because trunk ports are excluded from this view.

Ports not showing under the correct VLAN?

Make sure you typed switchport mode access before switchport access vlan 10. The order matters. Without access mode set first, the VLAN assignment may not stick.

If you see ports under VLAN 1 instead of VLAN 10 or 20, re-enter the interface and re-apply the VLAN assignment.

Why are my switch ports still in VLAN 1?

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file (Ctrl+S or File then Save).

ⓧ I'd like to double check the full configuration

Here is a summary of everything you should have at this point:

PC1: IP 192.168.10.10, Subnet 255.255.255.0, Gateway 192.168.10.1. Connected to Switch Fa0/1.
PC2: IP 192.168.10.11, Subnet 255.255.255.0, Gateway 192.168.10.1. Connected to Switch Fa0/2.
PC3: IP 192.168.20.10, Subnet 255.255.255.0, Gateway 192.168.20.1. Connected to Switch Fa0/3.
PC4: IP 192.168.20.11, Subnet 255.255.255.0, Gateway 192.168.20.1. Connected to Switch Fa0/4.
Router 1941: GigabitEthernet0/0 connected to Switch GigabitEthernet0/1. No IP configuration on the router yet.
Switch 2960: VLAN 10 (SALES) with Fa0/1 and Fa0/2. VLAN 20 (ENGINEERING) with Fa0/3 and Fa0/4. GigabitEthernet0/1 set to trunk mode.

Before you move on, take a look at your full topology. What do you expect to see?

Your workspace should show 1 router (1941), 1 switch (2960), and 4 PCs, all connected with green link lights on the switch-to-PC cables. The router-to-switch link may still show red on the router side since you have not enabled that interface yet.

Save your topology by pressing Ctrl+S.
Name the file something memorable like office-network.pkt.

Your baseline topology is wired, addressed, and segmented into two departments. Next up, you will configure the router to bridge these VLANs so departments can actually talk to each other.

Configure Inter-VLAN Routing and Test Connectivity

Your topology is wired and your VLANs are configured. PCs in the same department can already talk to each other.

But cross-department communication is completely blocked. VLANs isolate traffic by design. To bridge them, you need a router configured with sub-interfaces. This pattern is called router-on-a-stick.

In this step, get ready to:

Experience VLAN isolation firsthand by attempting a cross-VLAN ping.
Configure router sub-interfaces to enable inter-VLAN routing.
Verify full connectivity between all PCs across all VLANs.

Experience the isolation

Before you fix anything, you need to see the problem. Right now the router has no IP configuration, so traffic between VLANs has nowhere to go.

Click on PC1 in your topology.
Go to the Desktop tab, then click Command Prompt.
Ping PC2 (same VLAN) by running this command:

ping 192.168.10.11

You should see replies coming back. PC1 and PC2 share VLAN 10, so the switch forwards traffic between them directly.

Now for the real test. What do you think will happen if you ping PC3, which lives on a completely different VLAN?

Ping PC3 (different VLAN) by running this command:

ping 192.168.20.10

Request timed out. The ping fails completely. This is VLAN isolation in action.

Why does the cross-VLAN ping fail?

VLANs create separate broadcast domains on the switch. Without a Layer 3 device (a router) to forward packets between them, traffic from VLAN 10 can never reach VLAN 20.

The switch knows PC3 is on VLAN 20, but PC1's frame arrives tagged for VLAN 10. The switch will not cross that boundary on its own.

This gap is exactly what you will fix in the next substep.

Configure router sub-interfaces (router-on-a-stick)

Router-on-a-stick uses a single physical link to the switch, split into virtual sub-interfaces. Each sub-interface handles traffic for one VLAN.

Why router-on-a-stick instead of Layer 3 switching?

The 2960 switch in Packet Tracer is a Layer 2 switch. It cannot route traffic between VLANs on its own. A separate router with sub-interfaces is the standard approach for inter-VLAN routing with a Layer 2 switch.

This is also the pattern tested on the CCNA exam.

Click on the Router in your topology.
Go to the CLI tab.
Enter the following commands to enable the physical interface and create both sub-interfaces:

enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end

What does this configuration do?

`no shutdown` activates the physical GigabitEthernet0/0 interface. No IP address goes on the physical interface itself.

`interface GigabitEthernet0/0.10` creates a virtual sub-interface. `encapsulation dot1Q 10` tells the router that traffic tagged with VLAN 10 belongs here. The IP address becomes the default gateway for all PCs in VLAN 10.

The same pattern repeats for VLAN 20. Each sub-interface acts as the gateway for its department.

Confirm the sub-interfaces are up by running this command on the router:

show ip interface brief

You should see GigabitEthernet0/0.10 with IP 192.168.10.1 showing status up and protocol up. The same for GigabitEthernet0/0.20 with IP 192.168.20.1.

Sub-interfaces showing down/down?

Make sure you ran no shutdown on the physical GigabitEthernet0/0 interface. Sub-interfaces inherit the physical interface state. If the physical interface is shutdown, all sub-interfaces stay down.

Also check that the cable between the router and switch shows green link lights in the topology.

help me fix my router sub-interfaces showing down

Verify full connectivity

The router sub-interfaces are up. Now it is time to prove that cross-VLAN traffic actually flows through them.

Before you run the next ping, predict: will PC1 be able to reach PC3 now that the router has sub-interfaces configured?

Click on PC1 and open Desktop > Command Prompt.
Ping PC2 (same VLAN) to confirm intra-VLAN still works:

ping 192.168.10.11

Replies come back. Same-VLAN connectivity is still working.

Now ping PC3 (Engineering, VLAN 20) to test inter-VLAN routing:

ping 192.168.20.10

Replies come back. Traffic is flowing from VLAN 10 through the router and into VLAN 20.

Ping PC4 (Engineering, VLAN 20) to confirm the entire Engineering subnet is reachable:

ping 192.168.20.11

Replies come back. All four PCs can now communicate across VLANs through the router.

What is happening behind the scenes?

When PC1 pings PC3, the packet goes to PC1's default gateway (192.168.10.1) on sub-interface GigabitEthernet0/0.10. The router strips the VLAN 10 tag, routes the packet, and sends it out GigabitEthernet0/0.20 with a VLAN 20 tag. The switch delivers it to PC3.

Return to the Router CLI and run this command to see the final interface state:

show ip interface brief

Both sub-interfaces show up / up with their assigned IP addresses. This confirms your router-on-a-stick configuration is complete.

Cross-VLAN pings still failing?

Check that PC1's default gateway is set to 192.168.10.1 and PC3's default gateway is set to 192.168.20.1. Without the correct gateway, PCs do not know to send cross-subnet traffic to the router.

Also verify that the switch trunk port (GigabitEthernet0/1) is still configured as switchport mode trunk. Run show interfaces trunk on the switch to check.

help me troubleshoot my inter-VLAN routing

✔️ Awesome, I've got everything!

Great. Make sure you have verified that PC1 can ping all three other PCs successfully.

ⓧ I'd like to double check the full configuration

Here is the complete router configuration you should have at this point:

enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end

After running these commands, show ip interface brief on the router should show GigabitEthernet0/0 up with no IP, GigabitEthernet0/0.10 with 192.168.10.1 (up/up), and GigabitEthernet0/0.20 with 192.168.20.1 (up/up).

Your network now routes traffic between departments. Next up, you will expand the network by onboarding a brand-new Management department. And something will break.

Expand the Network with a New Department

Your network is alive. Sales and Engineering can talk to each other across VLANs thanks to the router-on-a-stick configuration you just completed.

Now comes your first real ticket as a junior network engineer: onboard a brand-new Management department. You will add a new VLAN, connect the devices, and discover that the new department cannot communicate with the rest of the network. This is the troubleshooting moment that separates theory from real job skills.

In this step, get ready to:

Add two new Management PCs to the topology and configure their IP addresses.
Create VLAN 30 on the switch and assign ports.
Diagnose and fix a connectivity failure using show commands.

Add Management devices and configure their IPs

The Management department needs two PCs connected to the switch. You will place them in the topology and give them IP addresses on a new subnet.

In Cisco Packet Tracer, add two new PCs from End Devices. Label them PC5 and PC6.
Connect PC5 to the switch port FastEthernet0/5 using a straight-through cable.
Connect PC6 to the switch port FastEthernet0/6 using a straight-through cable.

Both connections should show green link lights after a few seconds.

Click on PC5, go to Desktop > IP Configuration, and enter:

IP Address: 192.168.30.10
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.30.1

Click on PC6, go to Desktop > IP Configuration, and enter:

IP Address: 192.168.30.11
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.30.1

Your topology now shows 6 PCs, 1 switch, and 1 router. PC5 and PC6 both have green link lights to the switch.

Link lights not turning green?

Make sure you used a straight-through copper cable (the solid black line in Packet Tracer's cable menu). Also confirm you connected to FastEthernet0/5 and FastEthernet0/6 on the switch side.

help me fix my cable connections in Packet Tracer

Create VLAN 30 and assign ports

With the physical connections in place, you need to tell the switch that these ports belong to a new VLAN for the Management department.

Click on the switch, go to the CLI tab, and enter privileged EXEC mode by typing:

enable
configure terminal

Create VLAN 30 and name it MANAGEMENT by running:

vlan 30
name MANAGEMENT
exit

Assign FastEthernet0/5 and FastEthernet0/6 as access ports in VLAN 30 by running:

interface FastEthernet0/5
switchport mode access
switchport access vlan 30
exit
interface FastEthernet0/6
switchport mode access
switchport access vlan 30
exit

What do these commands do?

vlan 30 creates a new VLAN with ID 30 in the switch's VLAN database.
name MANAGEMENT gives the VLAN a human-readable label so you know which department it belongs to.
switchport mode access sets the port to carry traffic for a single VLAN only.
switchport access vlan 30 assigns that port to VLAN 30.

Now test whether the new VLAN works internally.

Click on PC5, go to Desktop > Command Prompt.
Ping PC6 to confirm same-VLAN connectivity by running:

ping 192.168.30.11

You should see replies from 192.168.30.11. PC5 and PC6 are in the same VLAN, so the switch forwards traffic between them directly.

Before you run the next ping, think about what you expect to happen. PC5 is on the 192.168.30.0 subnet and PC1 is on the 192.168.10.0 subnet. Do you think this ping will succeed or fail?

From PC5's Command Prompt, ping PC1 by running:

ping 192.168.10.10

Request timed out. The ping failed.

The Management VLAN exists on the switch, but cross-VLAN traffic cannot reach PC1. Something is missing on the router side. This is exactly the kind of failure you will troubleshoot on the job.

Troubleshoot and fix the connectivity failure

A real network engineer does not guess. You use show commands to systematically compare the switch state and the router state until you find the gap.

On the switch CLI, verify that VLAN 30 exists with the correct ports by running:

show vlan brief

What should I see?

You should see VLAN 30 named MANAGEMENT with Fa0/5 and Fa0/6 listed under the Ports column. This confirms the switch knows about the VLAN and its ports are assigned correctly.

On the switch CLI, confirm the trunk is carrying your VLANs by running:

show interfaces trunk

What does this tell you?

The output shows GigabitEthernet0/1 is trunking with 802.1Q encapsulation. Under "Vlans allowed and active in management domain" you should see VLANs 1, 10, 20, and 30. The trunk is fine. It can carry VLAN 30 traffic to the router.

Now check the router. Click on the router, go to the CLI tab, and run:

show ip interface brief

Look at the sub-interfaces listed. You see GigabitEthernet0/0.10 with 192.168.10.1 and GigabitEthernet0/0.20 with 192.168.20.1. There is no sub-interface for the 192.168.30.0 network.

That is the root cause. The switch tags VLAN 30 traffic and sends it to the router, but the router has no sub-interface to receive it. Traffic has nowhere to go.

Why did this happen?

Adding a VLAN on the switch is only half the job. For inter-VLAN routing to work, the router also needs a matching sub-interface with the correct encapsulation and IP address. This is the most common real-world VLAN expansion failure: the switch has the VLAN but the router lacks the sub-interface.

Fix the issue by creating the missing sub-interface on the router. In the router CLI, run:

enable
configure terminal
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What does this code do?

interface GigabitEthernet0/0.30 creates a logical sub-interface numbered 30 on the physical GigabitEthernet0/0 port.
encapsulation dot1Q 30 tells the router to tag and accept frames for VLAN 30 using the 802.1Q standard.
ip address 192.168.30.1 255.255.255.0 assigns the gateway IP that PC5 and PC6 are already configured to use.

Now predict the outcome. You are about to ping PC1 from PC5 again. The switch has VLAN 30, the trunk carries it, and the router now has a sub-interface. Do you think it will work this time?

Return to PC5's Command Prompt and test connectivity to PC1 by running:

ping 192.168.10.10

You should see replies from 192.168.10.10. The Management department can now communicate across VLANs through the router.

Still seeing request timed out?

Run show ip interface brief on the router again. Confirm GigabitEthernet0/0.30 shows status "up" and protocol "up" with IP 192.168.30.1. If the status is "down", make sure the physical interface GigabitEthernet0/0 has no shutdown applied.

Also verify PC5's default gateway is set to 192.168.30.1 in its IP Configuration tab. A mismatched gateway is the second most common cause of cross-VLAN ping failure.

help me troubleshoot why my Management VLAN cannot ping across to Sales

Confirm the router sub-interface is up by running on the router CLI:

show ip interface brief

You should see three sub-interfaces all showing "up" and "up": GigabitEthernet0/0.10 with 192.168.10.1, GigabitEthernet0/0.20 with 192.168.20.1, and GigabitEthernet0/0.30 with 192.168.30.1.

You just completed your first real troubleshooting ticket. You expanded a live network, hit a connectivity wall, diagnosed it systematically with show commands, and fixed it. Next up, you will lock this network down so unauthorized devices cannot plug in.

Secure the Network

Your network is working. All three departments can communicate through the router. But a working network is not the same as a secure network.

Right now, 18 switch ports sit unused and active. Anyone could walk up, plug in a device, and gain access to your VLANs. In this step, you'll apply the hardening practices that hiring managers expect: shutting down unused ports and enabling port security to lock each port to its assigned device.

In this step, get ready to:

Shut down all unused switch ports to close off physical access points.
Enable port security on active access ports to lock each port to one device.
Verify that port security is active and protecting the network.

Shut down unused switch ports

The switch has 24 FastEthernet ports, but only 6 are connected to PCs. The remaining 18 ports (FastEthernet0/7 through FastEthernet0/24) are active and accepting connections. Each one is an open door into your network.

Click on the switch in your topology to open it.
Go to the CLI tab.
Enter these commands to select all unused ports and disable them:

enable
configure terminal
interface range FastEthernet0/7-24
shutdown
exit

What do these commands do?

interface range FastEthernet0/7-24 selects all 18 unused ports at once so you can configure them in a single step.
shutdown disables the selected ports. No device can communicate through a shut-down port, even if physically connected.

Confirm the ports are disabled by running this command:

do show ip interface brief

You should see FastEthernet0/7 through FastEthernet0/24 listed with a status of administratively down. This means they were intentionally disabled by your configuration.

Ports still showing up?

Make sure you typed interface range (not just interface). Without range, the switch tries to find a single interface with that name and throws an error.

Also confirm you pressed Enter after shutdown and waited for the console messages to finish before running the show command.

Help me troubleshoot why my switch ports are not shutting down.

Enable port security on active access ports

Shutting down unused ports blocks physical access. Port security goes further by locking each active port to a specific MAC address.

If someone disconnects a legitimate PC and plugs in a different device, the port detects the new MAC address and shuts itself down automatically.

Still in the switch CLI, enter these commands to configure port security on all six active access ports:

configure terminal
interface range FastEthernet0/1-6
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky
end

What does each command do?

switchport port-security enables port security on the selected interfaces.
switchport port-security maximum 1 allows only one MAC address per port.
switchport port-security violation shutdown disables the port if a second MAC address is detected.
switchport port-security mac-address sticky makes the switch remember the first MAC address it learns and save it to the running configuration. You do not need to manually type each device's MAC address.

Why sticky instead of static?

Static MAC configuration requires you to look up and type every device's MAC address by hand. Sticky learning automates this by recording whichever MAC address appears first on each port. In a real office, this saves significant time when onboarding dozens of devices.

Verify port security is active

Before you run the verification commands, predict what you expect to see. How many MAC addresses should each port allow? What should happen if a violation occurs?

Run this command to see a summary of all secured ports:

show port-security

You should see all six ports (FastEthernet0/1 through FastEthernet0/6) listed with a status of SecureUp, MaxSecureAddr of 1, and SecurityViolation count of 0.

Now drill into the detail for a single port by running:

show port-security interface FastEthernet0/1

The output confirms Port Security is Enabled, Maximum MAC Addresses is 1, and Violation Mode is Shutdown. This proves your configuration is active and protecting each port.

Port security status showing not enabled?

Port security requires the interface to be in access mode. If you see an error, confirm the ports are set to switchport mode access. Your ports were configured as access ports when you assigned VLANs in Step 1, so this should already be set.

Also check that you selected the correct range (FastEthernet0/1-6) and not the trunk port (GigabitEthernet0/1). Port security cannot be applied to trunk ports.

Help me figure out why port security is not enabling on my switch.

✔️ Awesome, I've got everything!

Great. Your switch is now hardened with disabled unused ports and port security on every active connection.

ⓧ I'd like to double check the full configuration

Here are all the commands you entered on the switch in this step. Scroll up and confirm each section is present in your CLI history.

Shutdown block: interface range FastEthernet0/7-24 followed by shutdown.
Port security block: interface range FastEthernet0/1-6 followed by switchport port-security, switchport port-security maximum 1, switchport port-security violation shutdown, and switchport port-security mac-address sticky.

Run show port-security one more time and confirm all six ports show SecureUp with max 1 MAC address.

Your network is locked down. Unused ports are disabled and every active port is secured to its assigned device. Next up, you'll control which departments can talk to each other using an Access Control List.

Control Traffic with an Access Control List

In the previous step, you locked down the physical layer by shutting down unused ports and enabling port security. Your network is now protected against unauthorized devices plugging in.

Port security controls who can physically connect, but it does not control which departments can talk to each other once connected. An Access Control List (ACL) lets you define a traffic policy that filters packets based on source and destination. This is how real networks enforce least-privilege access between departments.

In this step, get ready to:

Create an extended ACL that blocks Engineering from reaching Management.
Apply the ACL to the correct router sub-interface.
Test the policy from multiple departments to confirm it works.

Design the access policy

Your traffic policy: Engineering (192.168.20.0/24) should NOT be able to reach Management (192.168.30.0/24). All other traffic between departments should continue to flow normally.

Why an extended ACL?

Standard ACLs (numbered 1-99) can only filter based on the source address. Extended ACLs (numbered 100-199) can filter on both source and destination, which is what you need to block traffic from one specific department to another.

Click on the Router in your topology.
Go to the CLI tab.
Enter global configuration mode and create the extended ACL by entering these commands:

enable
configure terminal
access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip any any

What do these commands do?

access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 blocks all IP traffic from the Engineering subnet to the Management subnet. The 0.0.0.255 is a wildcard mask that matches all hosts in a /24 network.
access-list 100 permit ip any any allows everything else through. Without this line, the ACL's implicit deny at the end would block ALL traffic, not just Engineering-to-Management.

Verify the ACL was created by running this command:

do show access-lists

You should see your two-line ACL 100 listed with the deny and permit entries.

Not seeing ACL 100?

Make sure you typed the commands in global configuration mode (the prompt shows Router(config)#). If you see an error, check that you used 0.0.0.255 for the wildcard mask, not 255.255.255.0 (the subnet mask). ACLs use wildcard masks, which are the inverse of subnet masks.

Help me troubleshoot my ACL configuration

Apply the ACL to the correct interface

An ACL does nothing until you apply it to an interface. Cisco best practice is to apply ACLs as close to the source of the filtered traffic as possible.

Why inbound on the Engineering sub-interface?

Engineering traffic enters the router through GigabitEthernet0/0.20. Applying the ACL inbound here catches the traffic at the earliest point, before the router wastes resources routing packets that will be dropped.

While still in global configuration mode on the router, apply ACL 100 inbound on the Engineering sub-interface by entering these commands:

interface GigabitEthernet0/0.20
ip access-group 100 in
exit

What does this do?

interface GigabitEthernet0/0.20 enters the sub-interface that handles all Engineering VLAN 20 traffic.
ip access-group 100 in attaches ACL 100 to this interface and applies it to inbound traffic. Every packet arriving from Engineering is now checked against ACL 100 before being routed.

The ACL is now active. Time to prove it works.

Test the policy

A good network engineer tests from multiple perspectives to confirm the policy works exactly as designed. You will ping from three different PCs to prove the ACL blocks only what it should.

Before you run the first test, predict: if PC3 (Engineering) pings PC5 (Management at 192.168.30.10), do you think it will succeed or fail?

Click on PC3 in your topology.
Go to the Desktop tab, then open Command Prompt.
Ping PC5 (Management) by entering:

ping 192.168.30.10

You see "Request timed out" for each attempt. The ACL blocked Engineering from reaching Management.

Now test that the ACL only blocks traffic to Management. From the same PC3 Command Prompt, ping PC1 (Sales):

ping 192.168.10.10

You get replies. The permit ip any any rule allows Engineering to reach Sales because that traffic does not match the deny entry.

Now verify that Sales is unaffected by the ACL. Click on PC1, go to Desktop > Command Prompt, and ping PC5 (Management):

ping 192.168.30.10

You get replies. Sales can reach Management because the ACL is only applied on the Engineering sub-interface.

Why can Sales still reach Management?

ACL 100 is applied inbound on GigabitEthernet0/0.20, which only processes traffic entering from Engineering. Sales traffic enters through GigabitEthernet0/0.10, where no ACL is applied. The ACL never sees Sales packets.

Finally, confirm the ACL is counting blocked packets. Return to the Router CLI and run:

show access-lists

You should see your deny entry with a match count (shown in parentheses, for example (4 matches)) confirming that packets hit the deny rule. The permit entry also shows matches from the successful pings.

Ping from PC3 to PC5 succeeds when it should fail?

Make sure you applied the ACL to the correct direction. It must be ip access-group 100 in on GigabitEthernet0/0.20. If you applied it outbound or on a different sub-interface, remove it and reapply.
Verify the ACL entries are correct by running show access-lists on the router. The deny entry must list 192.168.20.0 0.0.0.255 as the source and 192.168.30.0 0.0.0.255 as the destination.
Check that PC3's default gateway is 192.168.20.1. If the gateway is wrong, traffic may not reach the router at all.

Help me troubleshoot why my ACL is not blocking traffic

Secret mission

Write a Granular ACL that Permits Specific Services

Your ACL 100 blocks ALL traffic from Engineering to Management. In the real world, that is too aggressive. What if Engineering needs to access a web server hosted in Management? In this secret mission, you will replace your blanket deny with a protocol-level ACL that blocks pings (ICMP) while permitting web traffic (TCP port 80).

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer, so there are no cloud resources or ongoing costs. Decide whether to keep your topology file for future reference, or delete it entirely.

Resources you used:

Cisco Packet Tracer topology file (.pkt file) containing your 3-VLAN network with router, switch, and 6 PCs.

Keep everything running

No action needed. Choose this if you plan to extend the topology with OSPF, DHCP, or additional security features.

Save your topology by pressing Ctrl+S in Packet Tracer. Name the file something memorable like office-network-vlans.pkt.
Your saved file makes a great portfolio piece. You can reopen it anytime to demonstrate VLANs, inter-VLAN routing, port security, and ACLs.

Pause - I'll come back to this later

Save your work and close Packet Tracer to free up system memory. Your topology will be exactly as you left it when you reopen the file.

Save your topology by pressing Ctrl+S in Packet Tracer.
Close Cisco Packet Tracer.
When you are ready to return, double-click the .pkt file to reopen it in Packet Tracer.

Delete - I don't want to use this again

Remove all project files and start fresh. This cannot be undone.

Close Cisco Packet Tracer without saving. If prompted to save, click No.
If you previously saved a .pkt file, locate it on your computer and delete it. On macOS, move it to the Trash. On Windows, right-click the file and select Delete.

Nice Work!

You just built, broke, fixed, and secured a multi-department office network from scratch. That is the exact progression a junior network engineer faces in their first week on the job.

Here's what you accomplished:

Built a 3-VLAN office network with inter-VLAN routing via router-on-a-stick, enabling Sales, Engineering, and Management departments to communicate through a central router.
Diagnosed and fixed a real connectivity failure using Cisco IOS show commands, cross-referencing switch VLAN state against router sub-interface configuration to find the missing piece.
Hardened the network with port security, unused port shutdown, and an extended ACL that enforces a traffic policy between departments.
Secret Mission: Wrote a granular protocol-level ACL that blocks ICMP while permitting TCP port 80 between specific subnets.

Ready to quiz yourself?