Build a Coffee Shop Network Core

Build a segmented coffee shop network with VLANs, routing, and DHCP.

Introduction

30 Second Summary

A busy coffee shop depends on its network whenever a payment is taken or a customer gets online. One shared connection leaves business devices tangled with guest traffic.

In this project, you will build a segmented coffee shop network core with automatic client addressing in Cisco Packet Tracer. Router-on-a-Stick will route traffic between four VLANs over one IEEE 802.1Q trunk.

What You'll Build

Your finished coffee-shop-core.pkt will let you demonstrate a manager reaching POS resources while the four business roles stay in their planned networks.

By the end of this project, you'll have:

  • A labeled topology you can open to trace the router uplink, five wired switch connections, guest devices, and the ISP placeholder.
  • Working Staff and POS services where Manager-PC reaches its printer while POS-PC receives the correct settings and reaches POS-Printer.
  • Evidence the core works through same-VLAN pings, inter-VLAN pings, a reachable switch management address, connected routes, and DHCP leases.
  • Secret Mission: Diagnose a POS terminal that receives a valid lease from the wrong VLAN, then restore its printer connection using switch evidence.

Are there any prerequisites?

You need Cisco Packet Tracer installed and opening successfully on your Mac. You also need a Cisco Networking Academy account plus prior experience configuring VLANs.

Before We Start

This checkpoint locks in the network you are about to build. It also captures why the coffee shop's traffic needs clear boundaries.

Set Up the Coffee Shop Workspace

The coffee shop core begins as a blank canvas in Cisco Packet Tracer. A misplaced interface or gateway can send every later check in the wrong direction.

This step gives each device a clear role. You will also pin every subnet to a written plan before any configuration starts.

In this step, get ready to:
  • Confirm the required Packet Tracer device models.
  • Build the labeled coffee shop topology.
  • Save a cabled workspace with its four-subnet addressing plan.
Confirm the models and save the file

The project depends on a specific router model plus a specific switch model. Checking both models now prevents interface differences from breaking the port map later.

  • Locate 2911 in the Packet Tracer device lists.
  • Locate 3560 in the Packet Tracer device lists.

✔️ Both models are available

Both model names are available in the device lists. Your installation supports the topology used throughout this project.

  • Start a blank Logical workspace.
  • Save the workspace as coffee-shop-core.pkt.

ⓧ A model is missing

A missing model means your Packet Tracer installation needs an update before this topology can use the planned interfaces.

  • Visit the Cisco Networking Academy Resource Hub.
  • Sign in with your Cisco Networking Academy account.
  • Download the current Packet Tracer installer.
  • Complete the Packet Tracer update.
  • Press Cmd+Space on macOS or the Windows key on Windows.
  • Type Cisco Packet Tracer into the search bar.
  • Press Enter.

Packet Tracer reopens with the updated device library.

  • Repeat the model check for 2911 plus 3560.
  • Start a blank Logical workspace.
  • Save the workspace as coffee-shop-core.pkt.

That check clears the first hurdle. Your saved file now uses the device models that every later instruction expects.

Still Missing a Device Model?

  • Confirm the Packet Tracer update finished before you reopened the application.
  • Return to the Resource Hub if the installer did not complete.

Still stuck? Help me find the missing Packet Tracer device models.

Place and label the topology

The topology becomes your visual source of truth. Each label ties a coffee shop role to one device before ports or addresses enter the picture.

  • Place one 2911 router from the device selection area.
  • Set the router display name to COFFEE-R1.
  • Place one 3560 switch from the device selection area.
  • Set the switch display name to COFFEE-SW1.
  • Place one cloud from the device selection area.
  • Set the cloud display name to ISP Cloud - Follow-on Project.

Why Include the ISP Cloud?

The cloud marks the Internet edge reserved for a follow-on project. Internal verification in this project stops at COFFEE-R1.

  • Place one PC for the manager station from the device selection area.
  • Set the PC display name to Manager-PC.
  • Place one printer for the manager station from the device selection area.
  • Set the printer display name to Manager-Printer.
  • Place one PC for the point-of-sale station from the device selection area.
  • Set the PC display name to POS-PC.
  • Place one printer for the point-of-sale station from the device selection area.
  • Set the printer display name to POS-Printer.

The Staff and POS sides now have a client plus a dedicated printer. Their labels make the two business roles easy to distinguish.

  • Place one access point from the device selection area.
  • Set the access point display name to Guest-AP.
  • Place one laptop for the first guest station.
  • Set the first laptop display name to Guest-Laptop1.
  • Place one laptop for the second guest station.
  • Set the second laptop display name to Guest-Laptop2.
  • Place one laptop for the third guest station.
  • Set the third laptop display name to Guest-Laptop3.

The full device set is in place. Every label now maps a business role to a specific object in the workspace.

Cable the internal workspace

Interface labels are easy to mix up in a dense workspace. Work down the port map one link at a time.

Each Copper Straight-Through link connects an endpoint or router interface to the planned switch port. This fixed map becomes the foundation for the access-port configuration in the next step.

  • Create a Copper Straight-Through link from COFFEE-R1 GigabitEthernet0/0 to COFFEE-SW1 GigabitEthernet0/1.
  • Create a Copper Straight-Through link from Manager-PC FastEthernet0 to COFFEE-SW1 FastEthernet0/1.
  • Create a Copper Straight-Through link from Manager-Printer FastEthernet0 to COFFEE-SW1 FastEthernet0/2.
  • Create a Copper Straight-Through link from POS-PC FastEthernet0 to COFFEE-SW1 FastEthernet0/3.
  • Create a Copper Straight-Through link from POS-Printer FastEthernet0 to COFFEE-SW1 FastEthernet0/4.
  • Create a Copper Straight-Through link from Guest-AP Port 0 to COFFEE-SW1 FastEthernet0/5.

The switch now has five wired endpoint connections. The sixth link connects the switch to the router.

  • Leave Guest-Laptop1 unassociated.
  • Leave Guest-Laptop2 unassociated.
  • Leave Guest-Laptop3 unassociated.

The addressing plan anchors each VLAN to one IPv4 subnet. Static reservations keep gateways plus infrastructure addresses predictable.

  • Add an annotation to the Logical workspace by copying the text below:
VLAN 10 STAFF: 192.168.10.0/24, gateway 192.168.10.1. VLAN 20 POS: 192.168.20.0/24, gateway 192.168.20.1. VLAN 30 GUEST: 192.168.30.0/24, gateway 192.168.30.1. VLAN 99 INFRA: 192.168.99.0/24, gateway 192.168.99.1. Gateway addresses reserve .1, COFFEE-SW1 management reserves 192.168.99.2, printers reserve .10, and dynamic leases begin after .20.

How Does This Plan Stay Consistent?

  • The .1 address anchors each subnet gateway.
  • The 192.168.99.2 address belongs to switch management.
  • The .10 address gives each printer a predictable location.
  • Dynamic DHCP leases begin after .20.
  • Save coffee-shop-core.pkt.

Before the final scan, ask yourself whether every required device or wired link is visible without opening a configuration window.

  • Count the 11 labeled objects in the Logical workspace.
  • Trace the five endpoint links connected to switch ports FastEthernet0/1 through FastEthernet0/5.
  • Trace the router uplink from GigabitEthernet0/0 to GigabitEthernet0/1.
  • Check each wired link for green triangles at both ends.
  • Confirm all three guest laptops remain unassociated.
  • Compare the workspace annotation with the four-subnet plan above.

You should see all 11 labeled objects. Six wired links should show green triangles at both ends.

The three guest laptops should remain unassociated. The workspace annotation should cover the Staff, POS, Guest, and Infrastructure subnets.

That foundation is locked in. Every later configuration now points back to this saved map.

Missing a Green Link?

  • Check that each connection uses Copper Straight-Through.
  • Check each endpoint against the exact interface listed in the port map.
  • Replace any link that ends on the wrong switch port.

Still stuck? Help me diagnose a missing Packet Tracer link light.

Your coffee shop workspace is mapped and saved. Next, you will separate its business roles into dedicated VLANs.

Segment the Network with VLANs

Your coffee shop topology now contains every planned device. However, every connected endpoint still begins in the default broadcast domain.

In this step, you will use VLANs to separate Staff, POS, Guest, and Infrastructure traffic at Layer 2. Temporary static addressing will let you prove that the Staff segment works before routing exists.

In this step, get ready to:
  • Create the four function-based VLANs on COFFEE-SW1.
  • Assign each wired endpoint port to its planned access VLAN.
  • Prove Staff connectivity with temporary static addressing.
Segment the switch ports

A VLAN creates a separate broadcast domain inside the switch. The VLAN database defines the segments that access ports can join.

  • Select COFFEE-SW1 in the Logical workspace.
  • Click the CLI tab.
  • Press Enter to reach the switch prompt.
  • Create the VLAN database by entering these Cisco IOS commands:
enable
configure terminal
hostname COFFEE-SW1
vlan 10
 name STAFF
vlan 20
 name POS
vlan 30
 name GUEST
vlan 99
 name INFRA
end
show vlan brief

What does this configuration do?

  • The hostname COFFEE-SW1 command gives the switch a recognizable prompt.
  • The four vlan commands create the planned broadcast domains.
  • Each name command labels a VLAN by its coffee shop role.
  • The show vlan brief command displays each VLAN with its current access ports.
  • Save coffee-shop-core.pkt by pressing Cmd+S (macOS) or Ctrl+S (Windows).
  • Confirm the VLAN table lists 10 STAFF, 20 POS, 30 GUEST, and 99 INFRA.

The new VLANs should appear as active. Their endpoint ports are assigned in the next two command groups.

Missing a VLAN from the table?

  • Check that you entered each VLAN number before its matching name.
  • Confirm that the prompt showed COFFEE-SW1(config-vlan)# when you entered each name.

Still stuck? Help me find why a VLAN is missing from show vlan brief.

Staff devices share VLAN 10. Their switch ports need access mode so every untagged endpoint frame enters that VLAN.

  • Assign the two Staff ports by entering these commands:
enable
configure terminal
interface fastethernet0/1
 switchport mode access
 switchport access vlan 10
 no shutdown
interface fastethernet0/2
 switchport mode access
 switchport access vlan 10
 no shutdown
end
show vlan brief

How do the Staff ports work?

  • The interface commands select the ports connected to Manager-PC and Manager-Printer.
  • The switchport mode access command makes each port carry traffic for one endpoint VLAN.
  • The switchport access vlan 10 command places both ports in the Staff broadcast domain.
  • The no shutdown command enables each interface.
  • Save coffee-shop-core.pkt.
  • Confirm Fa0/1 and Fa0/2 appear under VLAN 10.

The Staff devices now share one isolated Layer 2 segment.

Staff ports listed under the wrong VLAN?

  • Check that both Staff interfaces use VLAN 10.
  • Confirm that you configured fastethernet0/1 and fastethernet0/2.

Need another pair of eyes? Help me diagnose my Staff access-port assignments.

The POS devices need their own access VLAN. The Guest-AP port belongs to a third segment reserved for later wireless configuration.

  • Assign the POS and Guest ports by entering these commands:
enable
configure terminal
interface fastethernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
interface fastethernet0/4
 switchport mode access
 switchport access vlan 20
 no shutdown
interface fastethernet0/5
 switchport mode access
 switchport access vlan 30
 no shutdown
end
show vlan brief

How are the remaining ports separated?

  • Ports fastethernet0/3 and fastethernet0/4 join VLAN 20 for POS traffic.
  • Port fastethernet0/5 joins VLAN 30 for the Guest-AP.
  • VLAN 99 remains available for the switch management interface configured later.
  • Save coffee-shop-core.pkt.
  • Confirm Fa0/3 and Fa0/4 appear under VLAN 20.
  • Confirm Fa0/5 appears under VLAN 30.

Your five wired endpoint ports are now separated by business role.

POS or Guest ports missing?

  • Check that the POS interfaces use VLAN 20.
  • Check that the Guest-AP interface uses VLAN 30.
  • Confirm that each interface includes switchport mode access.

Still not matching the plan? Help me correct my POS and Guest access ports.

✔️ Awesome, I've got everything!

Your VLAN database now contains all four planned segments. The five endpoint ports also match the addressing plan.

ⓧ I'd like to double check the full code

The complete COFFEE-SW1 configuration for this step appears below.

enable
configure terminal
hostname COFFEE-SW1
vlan 10
 name STAFF
vlan 20
 name POS
vlan 30
 name GUEST
vlan 99
 name INFRA
interface fastethernet0/1
 switchport mode access
 switchport access vlan 10
 no shutdown
interface fastethernet0/2
 switchport mode access
 switchport access vlan 10
 no shutdown
interface fastethernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
interface fastethernet0/4
 switchport mode access
 switchport access vlan 20
 no shutdown
interface fastethernet0/5
 switchport mode access
 switchport access vlan 30
 no shutdown
end
show vlan brief
Set temporary static addresses

Devices inside the same VLAN need compatible IPv4 settings before they can exchange traffic. Temporary addresses let you test the Staff and POS segments without waiting for DHCP.

  • Return to the Logical workspace.
  • Select Manager-PC.
  • Click the Desktop tab.
  • Open IP Configuration.
  • Enter 192.168.10.21 in the address field.
  • Enter 255.255.255.0 in the subnet mask field.
  • Enter 192.168.10.1 in the default gateway field.

Manager-PC should now show a Staff address ending in .21.

  • Close the Manager-PC window.
  • Select Manager-Printer.
  • Click the Desktop tab.
  • Open IP Configuration.
  • Enter 192.168.10.10 in the address field.
  • Enter 255.255.255.0 in the subnet mask field.
  • Enter 192.168.10.1 in the default gateway field.

Manager-Printer should now show the reserved Staff printer address ending in .10.

  • Close the Manager-Printer window.
  • Select POS-PC.
  • Click the Desktop tab.
  • Open IP Configuration.
  • Enter 192.168.20.21 in the address field.
  • Enter 255.255.255.0 in the subnet mask field.
  • Enter 192.168.20.1 in the default gateway field.

POS-PC should now show a POS address ending in .21.

  • Close the POS-PC window.
  • Select POS-Printer.
  • Click the Desktop tab.
  • Open IP Configuration.
  • Enter 192.168.20.10 in the address field.
  • Enter 255.255.255.0 in the subnet mask field.
  • Enter 192.168.20.1 in the default gateway field.

POS-Printer should now show the reserved POS printer address ending in .10.

Why keep the printers static?

A predictable printer address gives each client a stable destination. The later DHCP exclusions protect these reserved addresses from dynamic leases.

🙋‍♀️ Unable to enter an address?

  • Confirm that you opened IP Configuration from the device's Desktop tab.
  • Check that each Staff device uses the 192.168.10.0/24 subnet.
  • Check that each POS device uses the 192.168.20.0/24 subnet.

Need help comparing the fields? Help me check the four temporary static configurations.

Prove same-VLAN connectivity

Manager-PC and Manager-Printer share VLAN 10. Their traffic can cross COFFEE-SW1 without a router because both devices are in the same subnet.

  • Close the POS-Printer window.
  • Select Manager-PC.
  • Click the Desktop tab.
  • Open Command Prompt.

Before you run this, ask yourself whether two devices in the same VLAN need an active router gateway to communicate.

  • Test the Staff printer from Manager-PC by running this command:
ping 192.168.10.10

What does this ping prove?

The ping sends test traffic from Manager-PC to the static address on Manager-Printer. Successful replies prove that both Staff ports share VLAN 10.

You should see replies from 192.168.10.10. The first request can time out while the devices complete address resolution.

  • Run the same ping again if only the first request times out.

That is the first working slice of your coffee shop network. Manager-PC can now reach its printer inside the isolated Staff VLAN.

Printer ping still timing out?

  • Confirm Manager-PC uses 192.168.10.21 with subnet mask 255.255.255.0.
  • Confirm Manager-Printer uses 192.168.10.10 with subnet mask 255.255.255.0.
  • Check that Fa0/1 and Fa0/2 both appear under VLAN 10.

Still seeing timeouts? Help me diagnose the failed Staff same-VLAN ping.

  • Save coffee-shop-core.pkt.
  • Close the Manager-PC window.
  • Select COFFEE-SW1.
  • Click the CLI tab.

Before the final check, ask yourself which access ports should appear under VLANs 10, 20, and 30.

  • Display the completed VLAN table by running this command:
show vlan brief

What should the VLAN table confirm?

  • VLAN 10 should list Fa0/1 and Fa0/2.
  • VLAN 20 should list Fa0/3 and Fa0/4.
  • VLAN 30 should list Fa0/5.
  • VLAN 99 should appear as INFRA.

You now have a verified VLAN database with the correct access-port membership. The successful Staff ping proves that the first isolated segment carries traffic.

Your wired endpoints are segmented by role. Next, you will build the 802.1Q trunk and expose the missing-routing barrier before adding VLAN gateways.

Configure the 802.1Q Trunk

Your Cisco Packet Tracer coffee shop already keeps Staff and POS traffic in separate VLANs. The remaining uplink still carries no tagged traffic for those networks.

An 802.1Q trunk lets one physical link carry several VLANs by tagging each frame. You will configure that shared path before testing whether it can move traffic between subnets.

In this step, get ready to:
  • Turn the switch uplink into a restricted 802.1Q trunk.
  • Bring the router uplink online without a Layer 3 address.
  • Test cross-VLAN communication with the current configuration.
Configure the switch trunk

The allowed VLAN list limits the trunk to the four networks in your addressing plan. This keeps unrelated VLAN traffic off the coffee shop uplink.

  • Switch back to the COFFEE-SW1 CLI from earlier.
  • Configure the uplink as a restricted trunk by running these commands:
enable
configure terminal
interface gigabitethernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 no shutdown
end
show interfaces trunk

What Does This Configuration Do?

  • The interface gigabitethernet0/1 command selects the switch port connected to the router.
  • The switchport trunk encapsulation dot1q command selects 802.1Q frame tagging.
  • The switchport mode trunk command makes the uplink carry tagged VLAN traffic.
  • The allowed VLAN command restricts that traffic to VLANs 10, 20, 30, and 99.
  • The show interfaces trunk command displays the trunk state and allowed VLAN list.
  • Review the trunk status shown in the CLI.

You should see the uplink operating as a trunk. You should also see VLANs 10, 20, 30, and 99 in its allowed list.

Uplink Missing From the Trunk Output?

  • Confirm that you configured gigabitethernet0/1. This is the switch port cabled to COFFEE-R1.
  • Confirm that the allowed VLAN list is written as 10,20,30,99 with no spaces.
  • Run show interfaces trunk again after entering no shutdown.

Still stuck? Help me diagnose why GigabitEthernet0/1 is missing from the trunk output.

Activate the router uplink

The router needs its physical uplink enabled before it can receive tagged frames. The interface stays without an IP address because later VLAN gateways belong on separate subinterfaces.

  • Return to the Logical workspace.
  • Select COFFEE-R1.
  • Click the CLI tab.
  • Name the router and activate its physical uplink by running these commands:
enable
configure terminal
hostname COFFEE-R1
interface gigabitethernet0/0
 no ip address
 no shutdown
end
show ip interface brief

What Does This Router Configuration Do?

  • The hostname COFFEE-R1 command gives the router the name used in your topology.
  • The interface gigabitethernet0/0 command selects the physical link connected to COFFEE-SW1.
  • The no ip address command keeps the shared physical link free of a Layer 3 address.
  • The no shutdown command enables the interface.
  • The show ip interface brief command summarizes interface addresses and status.
  • Review the row for GigabitEthernet0/0.

You should see that the physical interface is enabled without an IP address. The live link is now ready to receive tagged traffic from the switch.

Router Uplink Still Down?

  • Confirm that COFFEE-R1 GigabitEthernet0/0 is cabled to COFFEE-SW1 GigabitEthernet0/1.
  • Confirm that both physical interfaces include no shutdown.
  • Run show ip interface brief again after checking the cable.

Need another pair of eyes? Help me find why the router uplink is not active.

✔️ Awesome, I've got everything!

  • Confirm that the switch trunk lists VLANs 10, 20, 30, and 99.
  • Confirm that the router uplink is enabled without an IP address.

ⓧ I'd like to double check the full code

Compare the switch sequence from this step with this complete reference.

enable
configure terminal
interface gigabitethernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,99
 no shutdown
end
show interfaces trunk

Switch Reference

This sequence configures the full switch-side trunk from this step. Its final command displays the trunk state and allowed VLANs.

Compare the router sequence from this step with this complete reference.

enable
configure terminal
hostname COFFEE-R1
interface gigabitethernet0/0
 no ip address
 no shutdown
end
show ip interface brief

Router Reference

This sequence configures the full router-side physical uplink from this step. Its final command displays the interface address and status summary.

Test cross-VLAN reachability

The cable now provides a tagged Layer 2 path between the switch and router. A host-to-host test reveals whether the current configuration can also move traffic between separate subnets.

  • Return to the Logical workspace.
  • Select Manager-PC.
  • Click the Desktop tab.
  • Click Command Prompt.

Before you run the test, do you think tagged traffic alone can reach the POS subnet?

  • Test communication from Manager-PC to POS-PC by running this command:
ping 192.168.20.21

The Timeout Is Intentional

The ping times out. This is the designed result for the current network.

The trunk transports tagged frames between the devices. No VLAN gateway exists yet to route packets from the Staff subnet into the POS subnet.

  • Leave the timed-out ping visible for your checkpoint.

You have built the shared tagged path and proved its current boundary. Next up, you will add the VLAN gateways that turn this timed-out test into successful inter-VLAN communication.

Enable Inter-VLAN Routing

The 802.1Q trunk now carries all four VLANs between the switch and router. The failed Manager-PC ping proved that the isolated networks still have no path between them.

Each subnet now needs a Layer 3 gateway. You will use Router-on-a-Stick to enable inter-VLAN routing across the existing trunk.

In this step, get ready to:
  • Create four router subinterfaces that provide the VLAN gateways.
  • Configure a management switch virtual interface (SVI) on COFFEE-SW1.
  • Verify routed connectivity between Staff, POS, and Infrastructure devices.
Create the router subinterfaces

Router-on-a-Stick gives one physical router interface several logical subinterfaces. Each subinterface maps one VLAN tag to that VLAN's default gateway.

Why Router-on-a-Stick?

A multilayer switch can route VLANs locally. This lab keeps COFFEE-SW1 focused on Layer 2 switching.

COFFEE-R1 handles every gateway through the shared trunk. This approach makes the tagged path for each VLAN visible.

The four similar configuration blocks are a little fiddly, so VLAN order keeps the mappings clear.

  • Return to the COFFEE-R1 device window from earlier.
  • Select the CLI tab.
  • Add the four gateway subinterfaces by entering these commands:
enable
configure terminal
interface gigabitethernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitethernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
interface gigabitethernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
interface gigabitethernet0/0.99
 encapsulation dot1Q 99
 ip address 192.168.99.1 255.255.255.0
end

What do these subinterfaces do?

  • The decimal suffixes identify four logical interfaces on the existing physical link.
  • Each encapsulation dot1Q command associates a subinterface with one VLAN tag.
  • Each ip address command creates the default gateway for one subnet.
  • Traffic keeps its VLAN identity while sharing the same physical router connection.

Before you check the routing table, predict how many connected VLAN networks the router now lists.

  • Display the router's routing table by running this command:
show ip route

What should the routing table show?

You should see four directly connected networks for 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24, and 192.168.99.0/24.

These routes prove that COFFEE-R1 now has an active Layer 3 interface inside every planned VLAN.

✔️ Awesome, I've got everything!

Great. COFFEE-R1 now lists all four VLAN networks as directly connected.

ⓧ I'd like to double check the full code

  • Compare the commands on COFFEE-R1 with this complete configuration sequence:
enable
configure terminal
interface gigabitethernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
interface gigabitethernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
interface gigabitethernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
interface gigabitethernet0/0.99
 encapsulation dot1Q 99
 ip address 192.168.99.1 255.255.255.0
end
show ip route

Missing a connected VLAN route?

  • Check that every subinterface number matches its VLAN tag.
  • Check that each gateway address belongs to the subnet for the same-numbered VLAN.
  • Confirm that the physical GigabitEthernet0/0 interface remains enabled.

Still stuck? Help me diagnose a missing connected VLAN route on COFFEE-R1.

Add the switch management SVI

COFFEE-SW1 needs an address inside the Infrastructure VLAN before you can reach it from another subnet. The management SVI supplies that address without turning the switch into the network's router.

  • Return to the COFFEE-SW1 device window from earlier.
  • Select the CLI tab.
  • Configure the VLAN 99 management address by entering these commands:
enable
configure terminal
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.99.1
end

What does this switch configuration do?

  • The interface vlan 99 command creates the switch's logical management interface inside the Infrastructure VLAN.
  • The address 192.168.99.2 gives COFFEE-SW1 a predictable management destination.
  • The ip default-gateway 192.168.99.1 command sends management traffic for other subnets to COFFEE-R1.
  • COFFEE-R1 remains responsible for routing between the VLANs.
  • Display the switch interface summary by running this command:
show ip interface brief

What should the interface summary show?

You should see Vlan99 with the address 192.168.99.2.

That address gives your Infrastructure VLAN a reachable switch management endpoint.

✔️ Awesome, I've got everything!

COFFEE-SW1 now has its planned management address in VLAN 99.

ⓧ I'd like to double check the full code

  • Compare the commands on COFFEE-SW1 with this complete configuration sequence:
enable
configure terminal
interface vlan 99
 ip address 192.168.99.2 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.99.1
end
show ip interface brief

VLAN 99 missing its management address?

  • Confirm that VLAN 99 still exists in the switch VLAN database.
  • Confirm that VLAN 99 remains allowed across the switch trunk.
  • Check that the SVI address is 192.168.99.2 with mask 255.255.255.0.

Still stuck? Help me diagnose the VLAN 99 management SVI on COFFEE-SW1.

Verify routed connectivity

The router now has a gateway in every subnet. These tests prove that packets can cross VLAN boundaries through COFFEE-R1.

Before you run the pings, predict which paths should succeed now that every VLAN has a gateway.

  • Return to the Manager-PC device window.
  • Select the Desktop tab.
  • Select Command Prompt.
  • Test the Staff gateway by entering these commands:
ping 192.168.10.1
ping 192.168.20.21
ping 192.168.99.2

What should Manager-PC reach?

  • The first ping proves that Manager-PC can reach its Staff gateway.
  • The second ping proves that traffic can cross from the Staff VLAN to the POS VLAN.
  • The third ping proves that Manager-PC can reach the switch management SVI in the Infrastructure VLAN.

You should see successful replies from all three destinations.

  • Repeat an affected ping once if only its first request is lost.
  • Record the successful Manager-PC results in your verification notes.
  • Return to the POS-PC device window.
  • Select the Desktop tab.
  • Select Command Prompt.
  • Test the POS gateway by entering these commands:
ping 192.168.20.1
ping 192.168.10.10

What should POS-PC reach?

You should see successful replies from the POS gateway at 192.168.20.1.

You should also see successful replies from the Staff printer at 192.168.10.10. This result confirms routing in the opposite direction.

  • Repeat an affected ping once if only its first request is lost.
  • Record the successful POS-PC results in your verification notes.
  • Save coffee-shop-core.pkt again in Cisco Packet Tracer.

Still seeing a cross-VLAN timeout?

  • Confirm that the source device still has the gateway from its own subnet.
  • Confirm that the destination device still has its planned temporary static address.
  • Check that the router subinterface for each tested VLAN uses the matching VLAN tag.

Still stuck? Help me trace a failed cross-VLAN ping through the coffee shop topology.

You have cleared the routing barrier because Manager-PC now reaches POS-PC across the trunk. COFFEE-SW1 also answers on its Infrastructure management address.

POS-PC now reaches the Staff printer. That confirms traffic is routing successfully in both directions.

Your four VLANs now have working gateways through one trunk. Next up, you will use DHCP to replace temporary client settings with consistent leases.

Configure DHCP and Verify the Core

Your Router-on-a-Stick gateways now move traffic between the coffee shop VLANs. Cisco Packet Tracer already proves that the routed core works.

The PCs still depend on manually entered settings that are easy to mistype. In this step, DHCP gives each client a consistent address while the printers keep predictable static addresses.

In this step, get ready to:
  • Configure DHCP for the Staff, POS, Guest VLANs.
  • Replace the temporary PC addresses with DHCP leases.
  • Prove the core with IOS output plus a host ping matrix.
Configure the DHCP pools

Each DHCP pool represents one client subnet. The excluded ranges protect every gateway plus the static printer addresses from accidental allocation.

  • Return to the COFFEE-R1 command line from earlier.
  • Apply the reserved address boundaries plus the three client scopes by running these commands:
enable
configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp excluded-address 192.168.20.1 192.168.20.20
ip dhcp excluded-address 192.168.30.1 192.168.30.20
ip dhcp pool STAFF
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
ip dhcp pool POS
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
ip dhcp pool GUEST
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
end
show ip dhcp pool

What Does This Configuration Do?

  • Each ip dhcp excluded-address command keeps addresses from .1 through .20 outside the dynamic range.
  • The STAFF pool serves clients in 192.168.10.0/24.
  • The POS pool serves clients in 192.168.20.0/24.
  • The GUEST pool prepares addressing for 192.168.30.0/24.
  • The show ip dhcp pool command summarizes each configured pool.
  • Review the pool output for entries named STAFF, POS, GUEST.

Strong progress. COFFEE-R1 can now offer each client VLAN its own address range while the reserved addresses stay predictable.

✔️ Awesome, I've got everything!

Your router now shows all three DHCP pools. Each pool uses the matching VLAN gateway.

ⓧ I'd like to double check the full code

  • Compare the complete DHCP block on COFFEE-R1 with this reference:
enable
configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp excluded-address 192.168.20.1 192.168.20.20
ip dhcp excluded-address 192.168.30.1 192.168.30.20
ip dhcp pool STAFF
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
ip dhcp pool POS
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
ip dhcp pool GUEST
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
end
show ip dhcp pool

Missing a DHCP Pool?

  • Check that each ip dhcp pool command uses the uppercase name from the addressing plan.
  • Check that each network command uses the subnet for its matching VLAN.
  • Check that each default-router value ends in .1.

Still stuck? Help me compare my COFFEE-R1 DHCP pools with the Staff, POS, and Guest addressing plan.

Switch the PCs to DHCP

A DHCP client requests its settings from the router instead of relying on a manual entry. The VLAN of its switch port determines which pool answers that request.

  • Select Manager-PC in the Logical workspace.
  • Select the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.

You should see DHCP request successful. The Staff client now receives its settings from COFFEE-R1.

  • Return to the Desktop area on Manager-PC.
  • Select Command Prompt.
  • Inspect the Staff lease by running this command:
ipconfig /all

What Does This Check Show?

  • The IPv4 address identifies the lease supplied to Manager-PC.
  • The subnet mask confirms that the client belongs to its planned /24 network.
  • The default gateway identifies the router subinterface used for traffic outside VLAN 10.

You should see a 192.168.10.x address. The default gateway should be 192.168.10.1.

Manager-PC Received the Wrong Settings?

  • Confirm that Manager-PC is still connected to Fa0/1 on COFFEE-SW1.
  • Confirm that the Staff access port still belongs to VLAN 10.
  • Confirm that the STAFF pool uses gateway 192.168.10.1.

Need help? Help me diagnose why Manager-PC did not receive a 192.168.10.x DHCP lease in Packet Tracer.

  • Select POS-PC in the Logical workspace.
  • Select the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.

You should see DHCP request successful. The POS client now requests its settings through VLAN 20.

  • Return to the Desktop area on POS-PC.
  • Select Command Prompt.
  • Inspect the POS lease by running this command:
ipconfig /all

Why Check POS Separately?

POS-PC should receive its lease from the pool associated with VLAN 20. Its address plus gateway prove that the switch port reaches the correct DHCP scope.

You should see a 192.168.20.x address. The default gateway should be 192.168.20.1.

  • Record the IPv4 address shown for POS-PC here: your POS-PC IPv4 lease.

POS-PC Received the Wrong Settings?

  • Confirm that POS-PC is still connected to Fa0/3 on COFFEE-SW1.
  • Confirm that the POS access port still belongs to VLAN 20.
  • Confirm that the POS pool uses gateway 192.168.20.1.

Need another pair of eyes? Help me diagnose why POS-PC did not receive a 192.168.20.x DHCP lease in Packet Tracer.

Both PCs now receive settings from their matching VLAN pools. The two printers keep their static .10 addresses.

Save and verify the network core

The running configuration holds the live network state. Copying it to the startup configuration preserves the device settings inside the saved lab.

The save command pauses for a destination confirmation. The shown destination is the one you need.

  • Return to the COFFEE-R1 command line from earlier.
  • Save the router configuration by running this command:
copy running-config startup-config

What Does This Command Save?

The command copies the active router configuration into its startup configuration. The DHCP pools plus Router-on-a-Stick gateways remain available when the simulated device starts again.

  • Accept the displayed destination by pressing Enter.

You should return to the router prompt after the copy completes.

  • Switch back to the COFFEE-SW1 command line from earlier.
  • Save the switch configuration by running the same command:
copy running-config startup-config

Why Save the Switch Too?

The switch startup configuration preserves the VLAN database references plus port assignments. It also preserves the trunk plus management SVI settings.

  • Accept the displayed destination by pressing Enter.

You should return to the switch prompt after the copy completes.

Configuration Copy Did Not Finish?

  • Press Enter when the device waits for destination confirmation.
  • Confirm that you entered the command from privileged mode.
  • Repeat the command on the device whose prompt did not return.

Still blocked? Help me save the running configurations on COFFEE-R1 and COFFEE-SW1 in Packet Tracer.

  • Switch back to the COFFEE-R1 command line.
  • Inspect the DHCP bindings plus routed interfaces by running these commands:
show ip dhcp binding
show ip route
show ip interface brief

What Do the Router Checks Prove?

  • The DHCP binding table shows the addresses issued to the Staff client plus POS client.
  • The routing table confirms that all four VLAN networks remain directly connected.
  • The interface summary confirms the gateway addresses on the router subinterfaces.

You should see bindings for the two PCs. You should also see the four connected VLAN networks from the previous step.

Missing a DHCP Binding?

  • Return to the missing PC's IP Configuration window.
  • Select DHCP again.
  • Repeat show ip dhcp binding on COFFEE-R1.

Need help reading the table? Help me understand why a PC is missing from the COFFEE-R1 DHCP binding output.

  • Switch back to the COFFEE-SW1 command line.
  • Inspect the VLANs plus trunk plus management interface by running these commands:
show vlan brief
show interfaces trunk
show ip interface brief

What Do the Switch Checks Prove?

  • The VLAN summary confirms the planned access-port memberships.
  • The trunk summary confirms that VLANs 10,20,30,99 remain allowed.
  • The interface summary confirms the management SVI address 192.168.99.2.

You should see Fa0/1 through Fa0/5 in their planned VLANs. The trunk should still carry all four VLANs.

Switch Output Does Not Match the Plan?

  • Compare each access port with the device connected to it.
  • Confirm that Gi0/1 still operates as the router trunk.
  • Confirm that VLAN 99 still owns the management SVI.

Want help correlating the output? Help me compare my COFFEE-SW1 verification output with the planned VLAN, trunk, and management settings.

Before you run the ping matrix, predict whether every destination should reply.

  • Return to the Manager-PC Command Prompt.
  • Test the Staff gateway plus both printers plus the POS client plus switch management by running:
ping 192.168.10.1
ping 192.168.10.10
ping 192.168.20.10
ping [[POS_PC_IP="your POS-PC IPv4 lease"]]
ping 192.168.99.2

What Does the Staff Matrix Prove?

  • The gateway test proves that Manager-PC reaches its local router subinterface.
  • The printer tests prove same-VLAN plus inter-VLAN reachability.
  • The POS client test proves communication between the leased PCs.
  • The management test proves that VLAN 99 remains reachable through the router.

Each destination should return replies. This proves that the Staff lease works across the routed core.

One Staff Ping Failed?

  • Compare the failed destination with the matching VLAN in the addressing plan.
  • Check the source PC's gateway with ipconfig /all.
  • Check the destination device's current address.

Need help isolating the failed path? Help me diagnose one failed ping from Manager-PC in the final coffee shop verification matrix.

  • Return to the POS-PC Command Prompt.
  • Test the POS gateway plus both static printers by running:
ping 192.168.20.1
ping 192.168.10.10
ping 192.168.20.10

What Does the POS Matrix Prove?

  • The gateway test proves that POS-PC reaches its VLAN 20 router subinterface.
  • The manager printer test proves inter-VLAN routing from POS to Staff.
  • The POS printer test proves local VLAN 20 connectivity.

All three destinations should return replies. The internal coffee shop core now passes its final connectivity matrix.

One POS Ping Failed?

  • Confirm that POS-PC still has a 192.168.20.x lease.
  • Confirm that its gateway is 192.168.20.1.
  • Confirm that POS-Printer still uses 192.168.20.10.

Need help tracing the failure? Help me diagnose one failed ping from POS-PC in the final coffee shop verification matrix.

  • Save coffee-shop-core.pkt again by pressing Cmd+S on macOS or Ctrl+S on Windows.

That is the complete network core working: COFFEE-R1 supplies the leases while the VLANs, trunk, gateways, static printers, management SVI, saved configurations remain intact.

Secret mission

Find and Fix a Misassigned POS Port

A valid IP address can still reveal a broken network. Deliberately move the POS terminal into the Staff VLAN. Use its lease and switch evidence to diagnose the fault before restoring service.

Clean Up Your Resources

Clean Up Your Resources

Choose whether to preserve your network lab, pause the local simulation, or delete the project file. This project runs entirely in Cisco Packet Tracer, so there are no ongoing costs.

No paid cloud resources or persistent external resources were created.

Resources you used:

  • The saved coffee-shop-core.pkt file containing the complete topology, device configurations, addressing plan, and corrected POS access port.

Keep everything running

No action is needed. Choose this option if you want to keep working on the coffee shop network.

  • Keep coffee-shop-core.pkt saved on your Mac.
  • Preserve the file as your starting point for future guest wireless, security, or ISP work.
  • Leave Cisco Packet Tracer open if you plan to continue immediately.

Your corrected VLAN assignments, Router-on-a-Stick gateways, management address, DHCP pools, and startup configurations remain available.

Pause - I'll come back to this later

Pausing ends the local simulation session while preserving every saved network setting. You can reopen the project whenever you are ready to continue.

  • Confirm the saved project is named coffee-shop-core.pkt.
  • Exit Cisco Packet Tracer.
  • Keep coffee-shop-core.pkt on your Mac.

The file retains the topology plus the saved startup configurations for COFFEE-R1 and COFFEE-SW1.

Delete - I don't want to use this again

Deleting the project file removes the complete coffee shop lab from your Mac. Cisco Packet Tracer remains installed for future projects.

  • Exit Cisco Packet Tracer.
  • Use your Mac's file search to locate coffee-shop-core.pkt.
  • Delete coffee-shop-core.pkt from the search results.
  • Search for coffee-shop-core.pkt again to confirm the file is gone.

Removing this file also removes the saved VLAN, trunk, Router-on-a-Stick, management SVI, DHCP, printer, and startup configuration state. No cloud teardown or billing cleanup is required.

Nice Work!

Nice Work!

You made it! Your saved coffee-shop-core.pkt topology in Cisco Packet Tracer now provides segmented connectivity with automatic client addressing.

You also proved that you can diagnose a valid but incorrect lease using host output and switch evidence.

You've learned how to:

  • Plan a segmented IPv4 design with dedicated Staff, POS, Guest, and Infrastructure VLANs.
  • Carry tagged traffic over a restricted 802.1Q trunk. Route between the four networks with Router-on-a-Stick gateways.
  • Automate client addressing with DHCP pools while preserving static printer addresses. Verify the finished core with host tests and device state.
  • Complete the optional Secret Mission by using lease data and switch port membership to diagnose and repair the misassigned POS port.

Ready to quiz yourself?