Build Your First Office Network

Configure a two-department VLAN network using Cisco IOS CLI in Packet Tracer.

Introduction

30 Second Summary

Every time you connect to Wi-Fi at an office, your device joins a network that someone had to design, address, and configure. That network keeps departments separated and makes sure every device can communicate.

In this project, you will build a two-department office network from scratch using Cisco Packet Tracer. You will configure VLANs, assign IP addresses, and set up inter-VLAN routing using the same CLI commands used on real Cisco enterprise equipment.

What You'll Build

A fully functional inter-VLAN routed network with two departments (Sales and Engineering), a switch, a router, and four PCs that can all communicate with each other.

By the end of this project, you'll have:

  • A Packet Tracer topology file with a configured switch and router connecting two departments (Sales and Engineering).
  • Two VLANs separating department traffic, configured entirely through the Cisco IOS command-line interface.
  • Four PCs with static IP addresses and verified end-to-end connectivity using ping.
  • Secret Mission: Configure a DHCP server on the router so devices get their IP addresses automatically, just like in a real office.

Are there any prerequisites?

None. This project includes full setup instructions for Cisco Packet Tracer, which is completely free. You just need a Windows PC and a free Cisco Networking Academy account (created in Step 1).

Before We Start

Before We Start...

Install Cisco Packet Tracer

Every network you build in this project lives inside Cisco Packet Tracer. It is a free network simulation tool that runs the same Cisco IOS command-line interface used on real enterprise equipment.

In this step, you will create a free account, download Packet Tracer, and confirm it is ready to go. The whole process takes about five minutes.

In this step, get ready to:
  • Create a free Cisco Networking Academy account.
  • Install Cisco Packet Tracer 9.0 on your Windows PC.
  • Verify the workspace canvas is ready for building networks.
Create a free Cisco Networking Academy account

Cisco Packet Tracer requires a free Networking Academy account to download and sign in. You will create one at netacad.com and enroll in a short introductory course that unlocks the download link.

  • Open your browser and go to netacad.com.
  • Click Sign Up (or Join) in the top-right corner of the page.
  • Enter your first name, last name, and email address.
  • Check your email inbox for an activation message from Cisco Networking Academy.
  • Click the activation link in the email to confirm your account.
  • Complete your profile by entering your country, date of birth, and a password.
  • Accept the Terms and Conditions.

Why do I need an account to download Packet Tracer?

Cisco requires authentication every time Packet Tracer launches. The account is completely free and also gives you access to free Cisco courses and certifications.

  • Once signed in to netacad.com, navigate to the Getting Started with Cisco Packet Tracer course page.
  • Click Enroll (or Get Started) to add the course to your account.

What is this course?

You do not need to complete the course. Enrolling unlocks the Packet Tracer download link on your account. The course itself is a short optional walkthrough of the Packet Tracer interface.

Not receiving the activation email?

Check your spam or junk folder. The email comes from noreply@netacad.com and may take a minute to arrive.

help me troubleshoot my NetAcad account activation

Download and install Packet Tracer

With your account ready, check whether Cisco Packet Tracer is already on your computer. This avoids downloading it again if you already have the right version.

  • Press the Windows key and type Packet Tracer to search your computer.

✔️ I have Packet Tracer 9.0 or higher

You already have the version you need. Open it and sign in with your NetAcad credentials when prompted.

  • Click the Cisco Networking Academy icon on the login screen.
  • Enter the email and password you used when creating your NetAcad account.
  • Skip ahead to the verify substep below.

ⓧ I have an older version of Packet Tracer

You need version 9.0 for this project. Follow the download steps below to get the latest version.

  • Log in to netacad.com with your NetAcad credentials.
  • Click Resources in the navigation menu, then select Download Packet Tracer.
  • Download the Windows 64-bit installer (the file is approximately 1.4 GB).
  • Run the installer and follow the on-screen prompts to complete the installation.
  • Launch Packet Tracer after installation finishes.
  • Packet Tracer will ask Would you like to run multi-user when the application starts? Click No.
  • On the login screen, click the Cisco Networking Academy icon.
  • Enter the email and password you used when creating your NetAcad account.

ⓧ Packet Tracer isn't installed

No problem. Follow these steps to download and install Packet Tracer for the first time.

  • Log in to netacad.com with your NetAcad credentials.
  • Click Resources in the navigation menu, then select Download Packet Tracer.
  • Download the Windows 64-bit installer (the file is approximately 1.4 GB).
  • Run the downloaded installer file.
  • Accept the license agreement and click Next through the setup wizard.
  • Click Install and wait for the installation to finish.
  • Leave the Launch Cisco Packet Tracer checkbox checked and click Finish.
  • Packet Tracer will ask Would you like to run multi-user when the application starts? Click No.
  • On the login screen, click the Cisco Networking Academy icon.
  • Enter the email and password you used when creating your NetAcad account.

Seeing an error when you sign in?

If you see an error that says your account cannot be found, make sure you enrolled in the Getting Started with Cisco Packet Tracer course. Enrolling in at least one course is required before the login works.

help me fix my Packet Tracer login error

Verify Packet Tracer opens successfully

Once you sign in, Packet Tracer opens its main workspace. Confirm you see the right screen before moving on.

  • Look for the large white workspace canvas in the centre of the screen. This is where you will build your network topology.
  • Look at the bottom of the screen for the device toolbar. You should see categories like Network Devices, End Devices, and Connections.
  • Confirm the version by clicking Help in the menu bar, then About Cisco Packet Tracer. The window should show version 9.0 or higher.

What should I see?

You should see a clean white canvas with a menu bar at the top and a device selection toolbar at the bottom. The toolbar is split into categories with icons for routers, switches, PCs, and cables. This is the workspace where you will drag, drop, and connect network devices.

Workspace not loading?

If the canvas appears grey or the toolbar is missing, try closing and reopening Packet Tracer. Make sure you clicked No to the multi-user prompt on launch.

help me fix my Packet Tracer workspace display issue

Your simulation environment is ready. Next up, you will drag devices onto the canvas and cable them together to build your two-department office network.

Build the Network Topology

Packet Tracer is installed and ready to go. Now it is time to build the physical foundation of your office network.

Every network starts with hardware. In a real office, a network engineer racks switches and routers, runs cables between them, and connects end-user devices. You will do the same thing virtually by placing devices on the Packet Tracer canvas and wiring them together.

In this step, get ready to:
  • Place a switch, a router, and four PCs on the canvas.
  • Connect all devices using the correct cable type.
  • Verify every physical link is active (green lights).
Place the network devices on the canvas

Your network needs two types of infrastructure devices. A switch connects devices within the same local network. A router connects different networks together so traffic can flow between them.

  • Look at the bottom-left corner of the Packet Tracer window. You will see the Network Component Box with a row of category icons.
  • Click the Network Devices category (the icon showing a router and switch).
  • Click the Switches subcategory in the row below.
  • Find 2960 in the device list that appears to the right. Click it, then click on the workspace canvas to place it.
  • Click the Routers subcategory.
  • Find 1941 in the device list. Click it, then click on the canvas to the right of your switch to place it.

Now add the end-user devices that represent your office workers' computers.

  • Click the End Devices category in the bottom-left toolbar.
  • Click the PC device in the device list.
  • Click on the canvas four times to place four PCs. They will automatically be named PC0, PC1, PC2, and PC3.
  • Arrange the PCs so that PC0 and PC1 are grouped together on the left (these are your Sales department). Place PC2 and PC3 grouped together on the right (these are your Engineering department).

Why two departments?

Separating Sales and Engineering into different groups mirrors how real offices isolate department traffic for security and performance. In the next step, you will assign each group to its own VLAN to enforce that separation at the network level.

Use labels to stay organized

You can click on any device's default label (like "PC0") to rename it. Consider adding labels like "Sales-PC0" to keep your topology easy to read as it grows.

Connect devices with straight-through cables

Devices sitting on the canvas cannot communicate until you cable them together. You will use straight-through copper cables for every connection in this topology. Straight-through cables connect unlike devices (PC to switch, switch to router).

  • Click the Connections category in the bottom-left toolbar (the lightning bolt icon).
  • Click Copper Straight-Through (the solid black line) in the cable list.

Connect the Sales PCs to the switch first.

  • Click PC0. A list of interfaces appears. Select FastEthernet0.
  • Click the switch (Switch0). Select FastEthernet0/1 from the interface list.
  • Click PC1, select FastEthernet0.
  • Click the switch, select FastEthernet0/2.

Now connect the Engineering PCs.

  • Click PC2, select FastEthernet0.
  • Click the switch, select FastEthernet0/3.
  • Click PC3, select FastEthernet0.
  • Click the switch, select FastEthernet0/4.

Finally, connect the switch to the router.

  • Click the switch, select GigabitEthernet0/1.
  • Click the router, select GigabitEthernet0/0.

Why GigabitEthernet for the uplink?

The connection between the switch and router carries traffic for all four PCs across both departments. A GigabitEthernet link provides more bandwidth than FastEthernet, preventing this shared link from becoming a bottleneck.

Don't see the interface you need?

Make sure you selected Copper Straight-Through from the Connections category before clicking a device. If you accidentally chose the wrong cable type, press the Esc key to cancel and try again.

If a port is greyed out, it is already in use. Double-check you connected to the correct port numbers listed above.

Help me troubleshoot my cable connections in Packet Tracer.

Verify all link lights are green

Each cable connection shows small coloured circles (link lights) at both ends. These indicate whether the physical layer connection is working.

  • Look at each cable connection on your canvas. Both ends should show green circles.
  • If any link light is amber (orange), wait 15 to 30 seconds. The switch runs Spanning Tree Protocol on startup, which temporarily blocks ports before allowing traffic through.
  • Confirm you have exactly five cables total: four from PCs to the switch, and one from the switch to the router.

What do the link light colours mean?

Green means the physical connection is active and ready to pass traffic. Amber means the port is blocked or still initializing. Red means the connection has a problem (wrong cable type or incompatible interfaces).

If you see red, delete the cable by clicking the Delete tool (the X icon on the right toolbar), clicking the cable, then re-creating it with the correct cable type and ports.

Link lights staying amber after 30 seconds?

Try clicking the Fast Forward Time button in the bottom-right Realtime bar. This advances the simulation clock and forces Spanning Tree to finish converging.

If a light is red instead of amber, the cable type is wrong. Delete it and reconnect using Copper Straight-Through.

Why are my link lights not turning green in Packet Tracer?

Your physical network is built. Every device is placed and every cable is connected. Next up, you will configure VLANs on the switch to separate Sales and Engineering traffic at the data link layer.

Configure VLANs on the Switch

Your network topology is physically connected and all link lights are green. Right now, every device on the switch shares the same broadcast domain, which means all four PCs can hear each other's network traffic regardless of department.

VLANs solve this by creating separate virtual networks on a single physical switch. In this step, you'll create two VLANs (Sales and Engineering), assign switch ports to each one, and configure a trunk port so both VLANs can reach the router.

In this step, get ready to:
  • Create VLAN 10 (Sales) and VLAN 20 (Engineering) on the switch.
  • Assign switch ports to the correct VLANs.
  • Configure a trunk port to carry both VLANs to the router.
Enter the switch CLI and create VLANs

The switch CLI in Packet Tracer works exactly like a real Cisco IOS command-line interface. You access it by clicking the switch device and selecting the CLI tab.

  • Click the switch on your canvas to open its device window.
  • Click the CLI tab at the top of the device window.
  • Press Enter if you see a blank screen to get the Switch> prompt.
  • Enter privileged EXEC mode and create both VLANs by entering these commands:
enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit

What do these commands do?

  • enable enters privileged EXEC mode (the # prompt), giving you full administrative access to the switch.
  • configure terminal enters global configuration mode where you can make changes to the switch.
  • vlan 10 and vlan 20 create the two VLANs. The name command gives each VLAN a human-readable label.
  • Each exit returns you one level up in the CLI hierarchy.

After the last exit, your prompt should show Switch(config)#, confirming you are back in global configuration mode with both VLANs created.

Not seeing the Switch> prompt?

  • Make sure you clicked the CLI tab, not the Config tab.
  • Press Enter once or twice if the screen appears blank.
  • If you see a message asking about the initial configuration dialog, type no and press Enter.

Help me get to the Switch> prompt in Packet Tracer

Assign ports to VLANs

Each PC port needs to be told which VLAN it belongs to. Access mode means the port carries traffic for only one VLAN.

  • From the Switch(config)# prompt, assign the Sales ports (Fa0/1 and Fa0/2) to VLAN 10 by entering these commands:
interface range fastethernet 0/1-2
switchport mode access
switchport access vlan 10
exit

What does this configure?

  • interface range fastethernet 0/1-2 selects both Sales PC ports at once so you can configure them together.
  • switchport mode access sets the ports to carry traffic for a single VLAN only.
  • switchport access vlan 10 assigns these ports to the Sales VLAN.

Your prompt returns to Switch(config)# after the exit, confirming the port assignments were accepted.

  • Now assign the Engineering ports (Fa0/3 and Fa0/4) to VLAN 20 by entering these commands:
interface range fastethernet 0/3-4
switchport mode access
switchport access vlan 20
exit

What does this configure?

This follows the same pattern as the Sales ports. It selects Fa0/3 and Fa0/4 (the Engineering PC ports), sets them to access mode, and assigns them to VLAN 20.

Your prompt should again show Switch(config)# after the exit.

Seeing an Invalid input error?

  • Check spelling: fastethernet is one word with no spaces.
  • Make sure you are in global configuration mode (Switch(config)#), not privileged EXEC mode (Switch#). If you see Switch#, type configure terminal to get back into config mode.
  • The range format must be 0/1-2 with no spaces around the dash.

Help me fix my VLAN port assignment commands

Configure the trunk port and verify

A trunk port carries traffic from multiple VLANs simultaneously. The uplink from the switch to the router needs to be a trunk so both VLAN 10 and VLAN 20 traffic can reach the router for inter-VLAN routing.

  • Configure the uplink port to the router as a trunk by entering these commands:
interface gigabitethernet 0/1
switchport mode trunk
exit
end

What does this configure?

  • interface gigabitethernet 0/1 selects the port connected to the router.
  • switchport mode trunk allows this port to carry traffic for all VLANs.
  • end exits all the way back to privileged EXEC mode (Switch#).
  • Verify your VLAN configuration by entering this command:
show vlan brief

You should see VLAN 10 (Sales) with ports Fa0/1 and Fa0/2 listed, and VLAN 20 (Engineering) with ports Fa0/3 and Fa0/4 listed.

Why doesn't Gi0/1 appear in the output?

Trunk ports are not displayed in show vlan brief because they carry traffic for all VLANs rather than belonging to a single one. As long as you see your ports correctly assigned to VLANs 10 and 20, your trunk is working.

Ports still showing under VLAN 1?

  • Make sure you typed end first to return to the Switch# prompt. The show vlan brief command only works in privileged EXEC mode.
  • If ports still show under VLAN 1 (the default), re-enter configuration mode with configure terminal and double-check the switchport access vlan commands on each interface range.
  • Confirm the VLANs exist. Look for VLAN 10 and 20 in the list. If they are missing, re-create them with vlan 10 and vlan 20.

Help me fix my VLAN configuration on the switch

✔️ Awesome, I've got everything!

Great. Double check that your show vlan brief output shows Fa0/1 and Fa0/2 under VLAN 10 and Fa0/3 and Fa0/4 under VLAN 20.

ⓧ I'd like to double check the full commands

Here are all the commands you entered in this step, from start to finish:

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit
interface range fastethernet 0/1-2
switchport mode access
switchport access vlan 10
exit
interface range fastethernet 0/3-4
switchport mode access
switchport access vlan 20
exit
interface gigabitethernet 0/1
switchport mode trunk
exit
end
show vlan brief

Your switch now has two separate virtual networks running on the same physical hardware. Next up, you'll configure the router to route traffic between these VLANs so Sales and Engineering can still communicate when they need to.

Configure the Router for Inter-VLAN Routing

Your switch is now separating Sales and Engineering traffic into different VLANs. That solves the "keep departments separate" problem. But it creates a new one.

PCs in VLAN 10 cannot talk to PCs in VLAN 20 because VLANs are isolated by design. The router will bridge that gap by routing traffic between VLANs using a technique called router-on-a-stick. You will create virtual subinterfaces on one physical port, one per VLAN.

In this step, get ready to:
  • Bring up the router's physical interface using the CLI.
  • Create subinterfaces for each VLAN with IP addresses that serve as default gateways.
  • Verify all router interfaces show "up" status.
Access the router CLI and bring up the physical interface

Cisco routers ship with all interfaces in a "shutdown" state by default. Before creating subinterfaces, you need to activate the physical interface that connects to the switch.

  • Click the router on your canvas.
  • Click the CLI tab at the top of the router window.
  • Enter privileged EXEC mode and then global configuration mode by typing these commands:
enable
configure terminal
  • Bring up the physical GigabitEthernet0/0 interface by entering these commands:
interface gigabitethernet 0/0
no shutdown
exit

What do these commands do?

The enable command moves you from basic user mode into privileged EXEC mode, which gives you full access to the router. The configure terminal command enters global configuration mode where you can make changes.

The no shutdown command activates the interface. Without it, the physical port stays off and no traffic can flow through it.

You should see status messages confirming the interface changed state to up. These look similar to:

%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up

Not seeing the "up" messages?

Make sure the cable between the switch and router is connected properly. The link light on the router's GigabitEthernet0/0 port should be green.

If you see "administratively down" instead of "up", make sure you typed no shutdown (not just shutdown).

Why is my router interface still showing as down?

Create subinterfaces for each VLAN

A subinterface is a virtual division of a physical interface. Each subinterface handles traffic for one VLAN by using 802.1Q encapsulation to read the VLAN tag on incoming frames.

  • Create the subinterface for VLAN 10 (Sales) by entering these commands:
interface gigabitethernet 0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
exit

What does this code do?

  • The .10 after the interface name creates subinterface number 10. The number is a label you choose. Using the VLAN number as the subinterface number keeps things easy to remember.
  • The encapsulation dot1q 10 command tells this subinterface to process frames tagged with VLAN 10.
  • The ip address 192.168.10.1 255.255.255.0 assigns the gateway address for the Sales network. Every PC in VLAN 10 will use this as its default gateway.
  • Create the subinterface for VLAN 20 (Engineering) by entering these commands:
interface gigabitethernet 0/0.20
encapsulation dot1q 20
ip address 192.168.20.1 255.255.255.0
exit
end

What does this code do?

This follows the exact same pattern as VLAN 10. Subinterface .20 processes frames tagged with VLAN 20 and assigns 192.168.20.1 as the gateway for the Engineering network.

The end command exits all configuration modes and returns you to privileged EXEC mode.

Why router-on-a-stick instead of a Layer 3 switch?

Router-on-a-stick is a core CCNA topic that teaches exactly how inter-VLAN routing works at the conceptual level. It demonstrates encapsulation, trunking, and the relationship between Layer 2 and Layer 3 in a single configuration.

Layer 3 switching is faster in production, but it hides the mechanics. Learning subinterfaces first gives you a foundation that makes Layer 3 switching intuitive later.

Seeing "Invalid input detected"?

Make sure you are in global configuration mode (the prompt shows Router(config)#) before typing the interface command. If your prompt shows Router#, type configure terminal first.

Also check that you included the dot between 0/0 and the subinterface number (e.g. 0/0.10, not 0/010).

Help me fix an "Invalid input detected" error on my router subinterface commands.

Verify the router interfaces are up
  • Confirm all three interfaces are active by running this command:
show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all showing "up" in both the Status and Protocol columns.

How do I read this output?

The show ip interface brief command displays a table with six columns: Interface, IP-Address, OK?, Method, Status, and Protocol. You want to see up in both the Status and Protocol columns for each of your three interfaces.

If an interface shows "administratively down", it means the no shutdown command was not applied. If it shows "down" for Protocol, there may be a physical connection issue.

Subinterfaces showing "down"?

Subinterfaces inherit the physical state of their parent interface. If GigabitEthernet0/0 is down, the subinterfaces will also be down. Go back and make sure you ran no shutdown on GigabitEthernet0/0.

Also verify the switch trunk port is still connected. The cable between Switch Gi0/1 and Router Gi0/0 must be in place with a green link light.

Why are my router subinterfaces down in Packet Tracer?

✔️ Awesome, I've got everything!

Great. Make sure all three interfaces show "up" before moving on.

ⓧ I'd like to double check the full code

Here is the complete set of commands you should have entered on the router in this step:

enable
configure terminal
interface gigabitethernet 0/0
no shutdown
exit
interface gigabitethernet 0/0.10
encapsulation dot1q 10
ip address 192.168.10.1 255.255.255.0
exit
interface gigabitethernet 0/0.20
encapsulation dot1q 20
ip address 192.168.20.1 255.255.255.0
exit
end

After entering all commands, run show ip interface brief to confirm GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all show "up" in the Status and Protocol columns.

Your router is now the bridge between Sales and Engineering. Next, you will assign IP addresses to each PC and test that all four machines can communicate across VLANs.

Assign IP Addresses to PCs and Test Connectivity

Your network infrastructure is fully configured. The switch knows which ports belong to which VLAN, and the router has subinterfaces ready to route traffic between them. There is one missing piece: the PCs themselves have no idea what network they belong to.

In this step, you will give each PC a static IP address and a default gateway. Then you will prove your entire network works by pinging across VLANs and watching the packets travel hop-by-hop in Simulation mode.

In this step, get ready to:
  • Assign static IP addresses and gateways to all four PCs.
  • Test same-VLAN and cross-VLAN connectivity using ping.
  • Visualize packet flow in Simulation mode and save your topology.
Assign static IP addresses to each PC

Every device on a network needs an IP address to communicate. The IP address identifies the device, the subnet mask defines the size of the local network, and the default gateway tells the device where to send traffic destined for other networks.

Sales PCs (PC0 and PC1) will use addresses in the 192.168.10.0/24 network. Engineering PCs (PC2 and PC3) will use addresses in the 192.168.20.0/24 network.

  • Click PC0 on the canvas to open its configuration window.
  • Click the Desktop tab at the top of the window.
  • Click IP Configuration.
  • Make sure Static is selected (not DHCP).
  • In the IPv4 Address field, enter 192.168.10.10.
  • In the Subnet Mask field, enter 255.255.255.0.
  • In the Default Gateway field, enter 192.168.10.1.
  • Close the PC0 window.

What do these values mean?

The IP address 192.168.10.10 is PC0's unique identity on the Sales network. The subnet mask 255.255.255.0 tells PC0 that any address starting with 192.168.10 is a local neighbor.

The default gateway 192.168.10.1 is the router's subinterface address. When PC0 wants to reach the Engineering network, it sends traffic to this gateway, and the router forwards it to the correct VLAN.

Now repeat the same process for the remaining three PCs using the values below.

  • Click PC1, go to Desktop, then IP Configuration.
  • Set IPv4 Address to 192.168.10.11, Subnet Mask to 255.255.255.0, and Default Gateway to 192.168.10.1.
  • Click PC2, go to Desktop, then IP Configuration.
  • Set IPv4 Address to 192.168.20.10, Subnet Mask to 255.255.255.0, and Default Gateway to 192.168.20.1.
  • Click PC3, go to Desktop, then IP Configuration.
  • Set IPv4 Address to 192.168.20.11, Subnet Mask to 255.255.255.0, and Default Gateway to 192.168.20.1.

Why different subnets for each department?

Sales PCs use the 192.168.10.0/24 range and Engineering PCs use 192.168.20.0/24. This is called subnetting. Each VLAN gets its own IP range so the router can distinguish which traffic belongs to which department and route accordingly.

Don't see the IP Configuration option?

Make sure you clicked the Desktop tab (not the Config or Physical tab). The IP Configuration icon appears as a grid of options on the Desktop tab.

Help me troubleshoot my PC IP configuration in Packet Tracer.

Test same-VLAN and cross-VLAN connectivity

The moment of truth. You will use the ping command to verify that your network actually works. First you will test communication within the same VLAN (PC0 to PC1). Then you will test communication across VLANs (PC0 to PC2), which only works if your router is correctly routing between them.

  • Click PC0 to open its configuration window.
  • Click the Desktop tab.
  • Click Command Prompt.
  • Test same-VLAN connectivity by typing this command and pressing Enter:
ping 192.168.10.11

You should see four replies from 192.168.10.11 (PC1). This confirms that PC0 and PC1 can communicate within the Sales VLAN.

  • Now test cross-VLAN connectivity by pinging an Engineering PC:
ping 192.168.20.10

You should see four replies from 192.168.20.10 (PC2). This confirms that the router is successfully routing traffic between VLAN 10 and VLAN 20.

Why does cross-VLAN ping work?

PC0 is on the 192.168.10.0/24 network and PC2 is on 192.168.20.0/24. PC0 knows this is a different subnet, so it sends the packet to its default gateway (the router's subinterface at 192.168.10.1).

The router receives the packet on the VLAN 10 subinterface, looks up the destination, and forwards it out the VLAN 20 subinterface. The switch then delivers it to PC2. This is inter-VLAN routing in action.

Seeing Request timed out?

If the first one or two pings time out but the rest succeed, that is normal. The switch needs a moment to learn MAC addresses the first time.

If all pings fail for same-VLAN (PC0 to PC1), double-check that both PCs have the correct IP addresses and subnet masks. Also verify their switch ports are assigned to VLAN 10.

If same-VLAN pings work but cross-VLAN pings fail, check that the default gateway on each PC matches the router subinterface address. Also verify the router's subinterfaces are showing "up" status.

Help me debug why my ping is failing in Packet Tracer.

Visualize packet flow in Simulation mode and save your topology

Packet Tracer has a unique feature called Simulation mode that lets you watch packets travel hop-by-hop through your network. This is incredibly useful for understanding exactly how inter-VLAN routing works at the packet level.

  • In the bottom-right corner of the Packet Tracer workspace, click the Simulation tab (next to Realtime).
  • Click PC0, go to Desktop, then Command Prompt.
  • Type the following command and press Enter:
ping 192.168.20.10
  • Click the Capture / Forward button (or press the right arrow) in the Simulation Panel to advance the packet one hop at a time.
  • Watch the packet travel from PC0 to the switch, from the switch up to the router, back down from the router to the switch, and finally from the switch to PC2.

What is Simulation mode showing you?

You are watching the router-on-a-stick pattern in real time. The packet leaves PC0, hits the switch on a VLAN 10 access port, gets trunked up to the router, the router routes it from the VLAN 10 subinterface to the VLAN 20 subinterface, trunks it back down to the switch, and the switch delivers it out a VLAN 20 access port to PC2.

This is exactly how traffic flows in real enterprise networks that use router-on-a-stick for inter-VLAN routing.

  • Switch back to Realtime mode by clicking the Realtime tab in the bottom-right corner.
  • Save your topology by pressing Ctrl+S.
  • Choose a location on your Desktop and name the file office-network.pkt.

Packets not appearing in Simulation mode?

Make sure you switched to Simulation mode before typing the ping command. If you typed the ping in Realtime mode, the packets will complete instantly and you will not see them step through the network.

Also check that the Event List Filters in the Simulation Panel include ICMP. If ICMP is filtered out, the ping packets will not appear.

Help me see packets in Packet Tracer Simulation mode.

Your network is fully operational. Every PC can reach every other PC, whether they are in the same department or across departments. You configured all of this from scratch using the same CLI commands that network engineers use on real Cisco equipment every day. Next up, a Secret Mission that takes your network to the next level with automatic IP assignment.

Secret mission

Add DHCP So Devices Get IPs Automatically

In real office networks, nobody walks around typing IP addresses into every laptop and printer. Devices get their network settings automatically the moment they connect. Can you configure your router to hand out IP addresses on its own?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your files and software installed, or clean everything up.

Resources you used:

  • Cisco Packet Tracer application (installed on your PC).
  • Your saved .pkt topology file.
  • Free Cisco NetAcad account.

Keep everything running

No action needed. Choose this if you want to keep practicing with your network topology or build more labs in Packet Tracer.

  • Your .pkt file stays saved wherever you put it.
  • Packet Tracer remains installed and ready for future labs.
  • Your NetAcad account stays active for accessing more courses and newer versions of Packet Tracer.

Pause - I'll come back to this later

Close Packet Tracer to free up memory. Your topology file is already saved, so you can reopen it anytime.

  • Close Cisco Packet Tracer.
  • Your .pkt file remains on disk. Double-click it to reopen the lab later.

Delete - I don't want to use this again

Remove Packet Tracer and your topology file entirely.

  • Delete your saved .pkt topology file from your computer.
  • Uninstall Cisco Packet Tracer by opening Settings, selecting Apps, then Installed apps. Find Cisco Packet Tracer in the list, click the three-dot menu, and select Uninstall.
  • Your NetAcad account is free. You can leave it active at no cost, or visit your NetAcad profile settings to request account deletion if you prefer.

Nice Work!

Nice Work!

You just built a fully functional two-department office network from scratch using the Cisco IOS command-line interface. This is the same CLI that network engineers use every day on real enterprise equipment.

You've learned how to:

  • Built a two-department office network with VLANs, trunk ports, and a switch configured entirely through the CLI.
  • Configured inter-VLAN routing (router-on-a-stick) using subinterfaces and dot1Q encapsulation on a Cisco router.
  • Verified full end-to-end connectivity across VLANs using ping and visualized packet flow with Simulation mode.
  • Secret Mission: Configured DHCP pools on the router so devices receive IP addresses automatically, just like in a real office network.

Ready to quiz yourself?