Multi-Area OSPF Enterprise Network

Build a 3-site OSPF network with centralized data center services.

Introduction

30 Second Summary

When a company grows from one office to three, a single flat network stops scaling. Routing tables explode, broadcast traffic floods every link, and a single misconfiguration can take down the whole organization.

In this project, you will design and configure a 3-site enterprise network in Cisco Packet Tracer, using multi-area OSPF to keep routing efficient and a centralized data center to deliver DHCP, DNS, web, and email services to every department.

What You'll Build

A PC at your Branch Site pings a PC at the Main Site, the packet crosses two OSPF areas through the backbone, and every remote PC automatically receives its IP address from the central data center.

By the end of this project, you'll have:

A multi-area OSPF network where three sites (Data Center, Main Site, Branch Site) route traffic dynamically across Area Border Routers, proving end-to-end connectivity from any department to any other.
Centralized data center services where any PC at any site can browse the company website, resolve hostnames via DNS, transfer files via FTP, and send email.
Automatic IP addressing via DHCP relay delivering addresses from a single server to all 6 department subnets across the enterprise, proving that your routing and service infrastructure work together.
Secret Mission: Add OSPF route summarization on all ABRs to reduce routing table size and optimize backbone performance.

Are there any prerequisites?

You need Cisco Packet Tracer installed on your computer and basic familiarity with the Cisco IOS CLI (navigating between modes, typing commands). No cloud accounts or additional software are required.

Before We Start

Before we start building, let's take a moment to commit to what you're creating and why. Understanding the enterprise problem you're solving will make every configuration decision in the upcoming steps feel intentional.

Build the Physical Topology

Every network starts with physical hardware. Without devices correctly placed and cabled, no routing protocol or service configuration will function.

In this step, you will build the complete 3-site enterprise topology in Cisco Packet Tracer: a Data Center, a Main Site, and a Branch Site. By the end, all 29 devices will be connected and ready for configuration.

In this step, get ready to:

Place all 29 devices (routers, switches, PCs, and servers) across 3 sites.
Cable the WAN serial links and LAN Ethernet connections.
Verify that all physical link lights are green (except unconfigured serial links).

Place the Data Center devices

The Data Center is the backbone of your enterprise. It holds the core router, an L3 switch, an L2 switch, and 4 servers that will eventually serve the entire network.

In the bottom-left of Packet Tracer, click the Network Devices category, then select Routers.
Find the 2911 model and drag it onto the workspace on the left side. This will be R1-DC.
Click on R1-DC to open its properties, then click the Physical tab.
Click the power button on the router image to turn it off. You need to power down the device before adding hardware modules.
From the module list on the left of the Physical tab, find HWIC-2T and drag it into the first empty HWIC slot on the right side of the router chassis.
Click the power button again to turn the router back on. This gives R1-DC two serial interfaces: Se0/0/0 and Se0/0/1.

Why add the HWIC-2T module?

The 2911 router in Packet Tracer does not come with built-in serial ports. The HWIC-2T module adds two serial interfaces for WAN connections. Every router needs both ports because the three routers connect in a triangle: R1-DC connects to R2-MAIN and R3-BRANCH, R2-MAIN connects to R1-DC and R3-BRANCH, and R3-BRANCH connects to R1-DC and R2-MAIN.

Now switch to Switches in the Network Devices category.
Drag a 3560-24PS onto the workspace below R1-DC. This is your Layer 3 switch, MLS1-DC.
Drag a 2960 switch below MLS1-DC. This is your Layer 2 switch, SW-DC.
Switch to the End Devices category at the bottom of the screen.
Drag 4 Server devices below SW-DC. From left to right, these will be: DHCP/DNS Server, Web Server, FTP Server, and Email Server.

You should now see 7 devices in your Data Center area: 1 router, 1 L3 switch, 1 L2 switch, and 4 servers.

Place the Main Site and Branch Site devices

The Main Site represents a larger office with 4 departments. The Branch Site is a smaller office with 2 departments. Each site follows the same 3-tier pattern: router, L3 switch, then L2 switches with end devices.

From Routers, drag another 2911 to the center-right of the workspace for R2-MAIN.
Click R2-MAIN, go to the Physical tab, power it off, add a HWIC-2T module, and power it back on.
Drag a third 2911 to the far right for R3-BRANCH.
Add a HWIC-2T module to R3-BRANCH using the same power-off, insert, power-on procedure.
From Switches, drag a 3560-24PS below R2-MAIN for MLS2-MAIN.
Drag four 2960 switches below MLS2-MAIN. Name them SW-A1, SW-A2, SW-A3, and SW-A4 (left to right). Each represents a department.
Drag a 3560-24PS below R3-BRANCH for MLS3-BRANCH.
Drag two 2960 switches below MLS3-BRANCH for SW-B1 and SW-B2.

What are all these switch types?

The 3560-24PS is a Layer 3 switch that can route traffic between VLANs, just like a router. The 2960 is a Layer 2 switch that only forwards frames within a single VLAN.

Each site uses one L3 switch for inter-VLAN routing and one or more L2 switches for connecting end devices to their department VLAN.

Switch to the End Devices category.
Drag 2 PC devices below each Main Site L2 switch (SW-A1 through SW-A4). That is 8 PCs total for the Main Site.
Drag 2 PC devices below each Branch Site L2 switch (SW-B1 and SW-B2). That is 4 PCs total for the Branch Site.

Count your devices. You should have 29 total: 3 routers, 3 L3 switches, 7 L2 switches, 12 PCs, and 4 servers.

Missing a device or placed the wrong model?

Click on any device and check the model name in the bottom-left status bar. If you placed the wrong model, delete it (right-click and select Delete) and drag the correct one from the device list.

If a router does not show serial interfaces later, you likely forgot to add the HWIC-2T module. Click the router, go to the Physical tab, power off, add the module, and power back on.

Help me troubleshoot my device placement in Packet Tracer.

Cable the network

With all devices placed, you need to connect them with the correct cable types. WAN links between routers use serial cables. All other connections use copper straight-through Ethernet cables.

Click the lightning bolt icon (Connections) in the bottom-left of Packet Tracer to open the cable options.
Select the Serial DCE cable (looks like a zigzag line with a clock icon).
Click on R1-DC first, then select its Se0/0/0 port. Next, click on R2-MAIN and select its Se0/0/0 port. Because you clicked R1-DC first with the Serial DCE cable, R1-DC becomes the DCE side.
Select Serial DCE again. Click R1-DC and select Se0/0/1. Then click R3-BRANCH and select Se0/0/0. R1-DC is the DCE on this link too.
Select Serial DCE one more time. Click R2-MAIN and select Se0/0/1. Then click R3-BRANCH and select Se0/0/1. R2-MAIN is the DCE on this third link. All three routers are now connected in a triangle.

What is DCE vs DTE?

On a serial link, the DCE end provides the clock signal that controls the data rate. The DTE end receives that clock. In Packet Tracer, whichever device you click first with the Serial DCE cable becomes the DCE side.

In this triangle topology, R1-DC is the DCE on its links to R2-MAIN and R3-BRANCH, and R2-MAIN is the DCE on the link to R3-BRANCH. You will configure the clock rate on the DCE side of each link in the next step.

Now connect the LAN side of each site using copper straight-through cables.

Select the Copper Straight-Through cable from the Connections menu.
Connect R1-DC port Gig0/0 to MLS1-DC port Gig0/1.
Connect MLS1-DC port Gig0/2 to SW-DC port Gig0/1.
Connect the 4 servers to SW-DC: DHCP/DNS Server to Fa0/1, Web Server to Fa0/2, FTP Server to Fa0/3, Email Server to Fa0/4.

That completes the Data Center cabling. You should see green link lights on all those Ethernet connections.

Connect R2-MAIN port Gig0/0 to MLS2-MAIN port Gig0/1.
Connect MLS2-MAIN port Gig0/2 to SW-A1 port Gig0/1.
Connect MLS2-MAIN port Fa0/1 to SW-A2 port Gig0/1.
Connect MLS2-MAIN port Fa0/2 to SW-A3 port Gig0/1.
Connect MLS2-MAIN port Fa0/3 to SW-A4 port Gig0/1.
Connect 2 PCs to each Main Site L2 switch using ports Fa0/1 and Fa0/2 on the switch side.

The Main Site Ethernet connections should all show green link lights now.

Connect R3-BRANCH port Gig0/0 to MLS3-BRANCH port Gig0/1.
Connect MLS3-BRANCH port Gig0/2 to SW-B1 port Gig0/1.
Connect MLS3-BRANCH port Fa0/1 to SW-B2 port Gig0/1.
Connect 2 PCs to SW-B1 using ports Fa0/1 and Fa0/2.
Connect 2 PCs to SW-B2 using ports Fa0/1 and Fa0/2.

Seeing a red X when trying to connect?

If Packet Tracer says the cable cannot connect to a port, check that you selected the correct cable type. Serial DCE only works with serial ports. Copper Straight-Through only works with Ethernet ports (FastEthernet or GigabitEthernet).

If a serial port does not appear when you click the router, you forgot to add the HWIC-2T module. Power off the router in the Physical tab, add the module, then power it back on.

Help me fix my cabling issues in Packet Tracer.

Verify all connections

Before you predict what you should see, think about which connections have a clock signal configured and which do not.

Look at the link lights on all connections across your topology. What color do you expect the serial WAN links to be, and why?
Check the three serial links: R1-DC to R2-MAIN, R1-DC to R3-BRANCH, and R2-MAIN to R3-BRANCH. They should all show red (or orange) triangles. This is expected because no clock rate has been configured yet.
Check all other Ethernet connections (router-to-switch, switch-to-switch, switch-to-PC, switch-to-server). They should show green circles on both ends.
Click on any device (for example R1-DC) and select the CLI tab. It should open without errors, confirming the device is powered on and functional.

Why are the serial links red?

Serial links require a clock rate to be configured on the DCE end before the physical layer comes up. You will set the clock rate in Step 2 when you harden and configure the devices. For now, red serial link lights are completely normal.

🙋‍♀️ Ethernet links showing orange instead of green?

Orange (amber) link lights on switch ports mean the port is initializing (Spanning Tree Protocol convergence). Wait about 30 seconds and the lights should turn green. If they stay orange, verify you used a Copper Straight-Through cable for all switch-to-device connections.

Help me fix orange link lights on my switches.

Your physical network is in place. Next up, you will harden every device with hostnames, passwords, and banners to establish a professional security baseline.

Harden All Network Devices

Your physical topology is in place. Every device is cabled and powered on. Now you need to turn 13 anonymous boxes into identifiable, secured network infrastructure.

Right now, every device uses a generic hostname like "Switch" or "Router." With 13 network devices, troubleshooting is impossible when they all look the same. Naming each device and disabling unnecessary lookups establishes the professional baseline that every enterprise network needs.

In this step, get ready to:

Configure all 3 routers with hostnames, no ip domain-lookup, and banners.
Apply the same configuration pattern to all 10 switches.

Configure router R1-DC with the hardening template

Every router and switch in this network receives the same three commands. You will configure R1-DC first to learn the pattern, then repeat it across all remaining devices.

Click on R1-DC in your topology to open its properties.
Select the CLI tab to access the command line interface.
If prompted "Would you like to enter the initial configuration dialog?", type no and press Enter.
Enter privileged EXEC mode and then global configuration mode by entering the following commands:

enable
configure terminal

Apply the hardening configuration by entering the following commands:

hostname R1-DC
no ip domain-lookup
banner motd #Unauthorized access is prohibited#

What do these commands do?

hostname R1-DC gives the device a unique name so you can identify it in your topology.
no ip domain-lookup prevents the router from trying to resolve mistyped commands as hostnames, which causes annoying delays.
banner motd displays a legal warning to anyone connecting to the device.

Return to privileged EXEC mode and verify your configuration by running:

end
show running-config

You should see R1-DC as the hostname in your prompt. The banner text appears in the running configuration under banner motd.

Still seeing 'Router' as the hostname?

Make sure you entered configure terminal before typing the hostname command. Commands like hostname only work in global configuration mode (the prompt shows (config)#).

Help me troubleshoot my router hostname configuration.

Repeat hardening on R2-MAIN and R3-BRANCH

The pattern is identical for the other two routers. Only the hostname changes.

Click on R2-MAIN and open its CLI tab.
Enter privileged EXEC and global configuration mode, then apply the hardening commands:

enable
configure terminal
hostname R2-MAIN
no ip domain-lookup
banner motd #Unauthorized access is prohibited#

Click on R3-BRANCH and open its CLI tab.
Apply the same hardening commands, substituting the hostname:

enable
configure terminal
hostname R3-BRANCH
no ip domain-lookup
banner motd #Unauthorized access is prohibited#

On R3-BRANCH, run end and then show running-config to confirm the hostname and passwords are set correctly.

The prompt should now read R3-BRANCH#. All three routers are hardened.

Harden all 10 switches

The switch configuration pattern is identical to the routers. Only the hostname changes for each device.

Click on MLS1-DC and open its CLI tab.
Enter privileged EXEC and global configuration mode, then apply the switch hardening template:

enable
configure terminal
hostname MLS1-DC
no ip domain-lookup
banner motd #Unauthorized access is prohibited#

Run end and show running-config on MLS1-DC to confirm the configuration applied correctly.
Repeat this same process for the remaining 9 switches, substituting only the hostname. Open each device's CLI tab and enter the commands:

MLS2-MAIN (L3 switch at Main Site).
MLS3-BRANCH (L3 switch at Branch Site).
SW-DC (L2 switch at Data Center).
SW-A1, SW-A2, SW-A3, SW-A4 (L2 switches at Main Site).
SW-B1, SW-B2 (L2 switches at Branch Site).

Speed up repetitive configuration

You can copy the entire block of commands and paste it into each device's CLI tab. Just remember to change the hostname line each time. In Packet Tracer, right-click in the CLI window to paste.

After configuring all switches, click on SW-B2 (your last switch) and run show running-config to confirm it shows the correct hostname and encrypted passwords.

Seeing an error when pasting commands?

If you see % Invalid input detected, make sure you are in global configuration mode before pasting. The first line you paste should be hostname, not enable (which only works from user EXEC mode).

Help me fix invalid input errors when configuring my switches.

Before you finish, take one final look at R1-DC's full running configuration. What do you predict you will see for the passwords?

On R1-DC, run:

show running-config

The enable secret line shows a type 5 hash (starting with $1$). The console and VTY passwords appear as type 7 encrypted strings. The banner text and hostname are both present.

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file before moving on.

ⓧ I'd like to double check my configuration

Confirm the following on each device type:

All 3 routers (R1-DC, R2-MAIN, R3-BRANCH): hostname set, no ip domain-lookup, service password-encryption, enable secret class, banner motd, console password with login and logging synchronous, line vty 0 4 with password and login.
All 10 switches (MLS1-DC, MLS2-MAIN, MLS3-BRANCH, SW-DC, SW-A1 through SW-A4, SW-B1, SW-B2): same as routers but with line vty 0 15 instead.
R1-DC serial interfaces: Se0/0/0 and Se0/0/1 both have clock rate 128000 and no shutdown.
R2-MAIN: Se0/0/0 has no shutdown (DTE side). Se0/0/1 has clock rate 128000 and no shutdown (DCE side to R3-BRANCH).
R3-BRANCH: Se0/0/0 and Se0/0/1 both have no shutdown only (DTE on both links).

Every device in your network is now identifiable and secured. Next up, you will create the logical segmentation with VLANs and IP addressing so these devices can actually talk to each other.

Configure VLANs, Trunking, and IP Addressing

Your devices are hardened and secured, but right now every end device is a disconnected machine sitting on a flat, unaddressed network. Without logical segmentation, a server and a user PC share the same broadcast domain, and no device has an IP address to communicate with.

In this step, you will create VLANs to segment departments, configure trunking to carry multiple VLANs between switches, and assign IP addresses that will later become the routes OSPF advertises across areas.

In this step, get ready to:

Configure VLANs and access ports on all 6 Layer 2 switches.
Configure Layer 3 switches with SVIs, access/trunk ports, and routed uplinks.
Assign IP addresses to all router interfaces and verify local connectivity.

IP addressing table for this project

This project uses two private ranges: 10.0.0.0/8 for point-to-point links between routers and L3 switches, and 172.16.0.0/16 for all LAN subnets (VLANs where end devices live).

POINT-TO-POINT LINKS (10.x.x.x /30)
----------------------------------------------
Link                      Side A          Side B
R1-DC <-> MLS1-DC         10.1.0.1        10.1.0.2
R2-MAIN <-> MLS2-MAIN     10.2.0.1        10.2.0.2
R3-BRANCH <-> MLS3-BRANCH 10.3.0.1        10.3.0.2
R1-DC <-> R2-MAIN (WAN)   10.0.12.1       10.0.12.2
R1-DC <-> R3-BRANCH (WAN) 10.0.13.1       10.0.13.2
R2-MAIN <-> R3-BRANCH     10.0.23.1       10.0.23.2

LAN SUBNETS (172.16.x.x /24)
----------------------------------------------
Site         VLAN   Subnet            Gateway (SVI)
Data Center  10     172.16.10.0/24    172.16.10.254
Main Site    10     172.16.20.0/24    172.16.20.254
Main Site    20     172.16.21.0/24    172.16.21.254
Main Site    30     172.16.22.0/24    172.16.22.254
Main Site    40     172.16.23.0/24    172.16.23.254
Branch Site  10     172.16.30.0/24    172.16.30.254
Branch Site  20     172.16.31.0/24    172.16.31.254

Configure VLANs and access ports on L2 switches

Each L2 switch serves a single department. You will create the department VLAN, assign PC-facing ports as access ports in that VLAN, and set the uplink to the L3 switch as a trunk.

Start with the 4 Main Site L2 switches. Each one gets a single VLAN for its department, access ports for PCs, and a trunk uplink to MLS2-MAIN.

Click on SW-A1 and open its CLI tab.
Configure SW-A1 for the HR department by entering:

enable
configure terminal
vlan 10
 name HR
exit
interface range fa0/1-2
 switchport mode access
 switchport access vlan 10
exit
interface gig0/1
 switchport mode trunk
end

What do these commands do?

vlan 10 creates VLAN 10 and name HR gives it a human-readable label.
switchport mode access tells a port to carry only one VLAN (the one assigned with switchport access vlan 10).
switchport mode trunk allows the uplink to carry all VLANs tagged with 802.1Q headers.

Repeat this same pattern on SW-A2 with VLAN 20 named FINANCE.
Repeat on SW-A3 with VLAN 30 named ENGINEERING.
Repeat on SW-A4 with VLAN 40 named SALES.
On each switch, use interface range fa0/1-2 for the access ports and interface gig0/1 for the trunk uplink.

After configuring all 4, run show vlan brief on SW-A4 to confirm VLAN 40 (SALES) appears with Fa0/1 and Fa0/2 assigned.

Finally, configure the 2 Branch Site L2 switches.

Click on SW-B1 and configure it for VLAN 10 named HR using the same pattern (fa0/1-2 access, gig0/1 trunk).
Click on SW-B2 and configure it for VLAN 20 named SALES with the same pattern.
Run show vlan brief on SW-B2 to confirm VLAN 20 (SALES) with Fa0/1 and Fa0/2 assigned.

VLAN not showing ports?

If show vlan brief shows the VLAN but no ports assigned, make sure you entered both switchport mode access and switchport access vlan on the correct interface range.

Double check you typed fa0/1-2 (not fa0/1-4) on the Main Site and Branch switches. help me troubleshoot my VLAN port assignments in Packet Tracer

Configure L3 switches with SVIs, trunks, and routed uplinks

Layer 3 switches perform inter-VLAN routing using SVIs (Switch Virtual Interfaces). Each SVI acts as the default gateway for its VLAN's subnet. MLS1-DC connects servers directly on access ports, while MLS2-MAIN and MLS3-BRANCH use trunk ports to reach their downstream L2 switches.

Click on MLS1-DC and open the CLI tab.
Configure MLS1-DC with access ports for the servers, an SVI, and the routed uplink to R1-DC:

enable
configure terminal
ip routing
vlan 10
 name SERVERS
exit
interface range fa0/1-4
 switchport mode access
 switchport access vlan 10
exit
interface vlan 10
 ip address 172.16.10.254 255.255.255.0
 no shutdown
exit
interface gig0/1
 no switchport
 ip address 10.1.0.2 255.255.255.252
 no shutdown
end

What do these commands do?

ip routing enables Layer 3 forwarding on the switch. Without it, the switch only operates at Layer 2.
interface range fa0/1-4 with access mode places the server ports directly into VLAN 10. No separate L2 switch is needed because MLS1-DC handles both switching and routing for the Data Center.
interface vlan 10 creates an SVI. The IP address on this SVI (172.16.10.254) becomes the default gateway for all servers in VLAN 10.
no switchport on Gig0/1 converts it from a Layer 2 switchport into a Layer 3 routed port that can hold an IP address for the router uplink.

Verify MLS1-DC interfaces are up by running:

show ip interface brief

You should see VLAN 10 with IP 172.16.10.254 showing status up/up, and Gig0/1 with IP 10.1.0.2 showing up/up.

Next, configure the Main Site L3 switch. This one has 4 VLANs and multiple trunk ports, so the configuration is longer.

Click on MLS2-MAIN and open the CLI tab.
Enable routing and configure VLANs with trunk ports by entering:

enable
configure terminal
ip routing
vlan 10
 name HR
vlan 20
 name FINANCE
vlan 30
 name ENGINEERING
vlan 40
 name SALES
exit
interface gig0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
exit
interface range fa0/1-3
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

Now configure the SVIs and routed uplink on MLS2-MAIN:

configure terminal
interface vlan 10
 ip address 172.16.20.254 255.255.255.0
 no shutdown
interface vlan 20
 ip address 172.16.21.254 255.255.255.0
 no shutdown
interface vlan 30
 ip address 172.16.22.254 255.255.255.0
 no shutdown
interface vlan 40
 ip address 172.16.23.254 255.255.255.0
 no shutdown
exit
interface gig0/1
 no switchport
 ip address 10.2.0.2 255.255.255.252
 no shutdown
end

Why four SVIs?

Each department VLAN gets its own SVI with a unique subnet. HR PCs will use 172.16.20.254 as their gateway, Finance PCs will use 172.16.21.254, and so on.

The L3 switch routes traffic between these SVIs locally. Traffic destined for other sites will travel up through Gig0/1 to the router.

Verify all SVIs are active by running:

show ip interface brief

You should see all 4 VLAN interfaces (10, 20, 30, 40) with their IP addresses and status up/up. Gig0/1 should also show up/up with IP 10.2.0.2.

Click on MLS3-BRANCH and open the CLI tab.
Configure the Branch Site L3 switch by entering:

enable
configure terminal
ip routing
vlan 10
 name HR
vlan 20
 name SALES
exit
interface gig0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk
exit
interface fa0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
exit
interface vlan 10
 ip address 172.16.30.254 255.255.255.0
 no shutdown
interface vlan 20
 ip address 172.16.31.254 255.255.255.0
 no shutdown
exit
interface gig0/1
 no switchport
 ip address 10.3.0.2 255.255.255.252
 no shutdown
end

Run show ip interface brief on MLS3-BRANCH. Confirm VLAN 10 (172.16.30.254) and VLAN 20 (172.16.31.254) both show up/up.

SVI showing up/down?

An SVI stays down until at least one port in that VLAN is up. For MLS1-DC, the server access ports must be connected. For MLS2-MAIN and MLS3-BRANCH, the trunk port to the L2 switch must be configured on both ends.

If you see an error on the switchport mode trunk command, you likely forgot switchport trunk encapsulation dot1q first. The 3560 requires it before trunking can be enabled. help me troubleshoot my SVIs and trunk configuration

Configure router interfaces with IP addresses

The routers connect the sites together over WAN serial links and connect down to their L3 switches via GigabitEthernet. Each link uses a /30 subnet, which provides exactly 2 usable host addresses for a point-to-point connection.

Click on R1-DC and open the CLI tab.
Configure all 3 interfaces on R1-DC by entering:

enable
configure terminal
interface gig0/0
 ip address 10.1.0.1 255.255.255.252
 no shutdown
exit
interface se0/0/0
 ip address 10.0.12.1 255.255.255.252
 no shutdown
exit
interface se0/0/1
 ip address 10.0.13.1 255.255.255.252
 no shutdown
end

What is the addressing scheme?

This network uses two private address ranges. The 10.x.x.x/30 range handles all point-to-point links: router-to-router WAN serials and router-to-L3-switch uplinks. The 172.16.x.x/24 range handles internal LAN subnets where end devices live.

Gig0/0 (10.1.0.1/30) connects R1-DC to MLS1-DC (10.1.0.2/30). Se0/0/0 (10.0.12.1/30) is the WAN link to R2-MAIN. Se0/0/1 (10.0.13.1/30) is the WAN link to R3-BRANCH. The third WAN link uses 10.0.23.0/30 between R2-MAIN and R3-BRANCH. All three routers form a triangle with full redundancy.

Verify R1-DC can reach its L3 switch by running:

ping 10.1.0.2

You should see 5 successful replies confirming the LAN link between R1-DC and MLS1-DC is working.

Click on R2-MAIN and configure its interfaces:

enable
configure terminal
interface gig0/0
 ip address 10.2.0.1 255.255.255.252
 no shutdown
exit
interface se0/0/0
 ip address 10.0.12.2 255.255.255.252
 no shutdown
exit
interface se0/0/1
 ip address 10.0.23.1 255.255.255.252
 no shutdown
end

Click on R3-BRANCH and configure its interfaces:

enable
configure terminal
interface gig0/0
 ip address 10.3.0.1 255.255.255.252
 no shutdown
exit
interface se0/0/0
 ip address 10.0.13.2 255.255.255.252
 no shutdown
exit
interface se0/0/1
 ip address 10.0.23.2 255.255.255.252
 no shutdown
end

Before you run the verification pings, predict: will R2-MAIN be able to ping R1-DC across the serial WAN link?

On R2-MAIN, verify the LAN connection to its L3 switch:

ping 10.2.0.2

Still on R2-MAIN, verify the WAN link to R1-DC:

ping 10.0.12.1

Both pings should return 5 successful replies. The serial link lights should now turn green in the topology view.

On MLS2-MAIN, run the final verification command:

show ip interface brief

Confirm all 4 SVIs (VLAN 10, 20, 30, 40) and the routed uplink Gig0/1 all show up/up with their correct IP addresses.

Ping failing between router and L3 switch?

Check that both sides of the link share the same /30 subnet. For example, R1-DC Gig0/0 must be 10.1.0.1/30 and MLS1-DC Gig0/1 must be 10.1.0.2/30. A mismatched subnet mask or IP will cause the ping to fail.

Also confirm you ran no shutdown on every interface you configured. Cisco interfaces default to administratively down. help me troubleshoot pings failing between my router and L3 switch

✔️ Awesome, all pings succeed!

Your IP addressing is solid. Every router can reach its local L3 switch, and the WAN serial links are live.

ⓧ I'd like to double check the full configuration

Scroll up and confirm each device matches these reference configurations:

SW-A1: VLAN 10 (HR), Fa0/1-2 access VLAN 10, Gig0/1 trunk.
SW-A2: VLAN 20 (FINANCE), Fa0/1-2 access VLAN 20, Gig0/1 trunk.
SW-A3: VLAN 30 (ENGINEERING), Fa0/1-2 access VLAN 30, Gig0/1 trunk.
SW-A4: VLAN 40 (SALES), Fa0/1-2 access VLAN 40, Gig0/1 trunk.
SW-B1: VLAN 10 (HR), Fa0/1-2 access VLAN 10, Gig0/1 trunk.
SW-B2: VLAN 20 (SALES), Fa0/1-2 access VLAN 20, Gig0/1 trunk.
MLS1-DC: ip routing, VLAN 10 (SERVERS), Fa0/1-4 access VLAN 10, SVI 172.16.10.254/24, Gig0/1 routed 10.1.0.2/30.
MLS2-MAIN: ip routing, VLANs 10/20/30/40, SVIs 172.16.20-23.254/24, Gig0/2 and Fa0/1-3 trunks, Gig0/1 routed 10.2.0.2/30.
MLS3-BRANCH: ip routing, VLANs 10/20, SVIs 172.16.30.254 and 172.16.31.254, Gig0/2 and Fa0/1 trunks, Gig0/1 routed 10.3.0.2/30.
R1-DC: Gig0/0 = 10.1.0.1/30, Se0/0/0 = 10.0.12.1/30, Se0/0/1 = 10.0.13.1/30.
R2-MAIN: Gig0/0 = 10.2.0.1/30, Se0/0/0 = 10.0.12.2/30, Se0/0/1 = 10.0.23.1/30.
R3-BRANCH: Gig0/0 = 10.3.0.1/30, Se0/0/0 = 10.0.13.2/30, Se0/0/1 = 10.0.23.2/30.

Every site now has a fully addressed local network with VLANs segmenting departments and SVIs providing gateways. Next up, you will connect these isolated islands together with multi-area OSPF so that any device on any site can reach any other.

Configure Multi-Area OSPF

Your VLANs, trunks, and IP addresses are all in place. Each site can talk to its own Layer 3 switch. But right now, each site is a completely isolated island.

Multi-Area OSPF will dynamically advertise every subnet so that traffic can flow between all three sites. Multi-area design keeps each site's link-state database small and manageable as the network grows.

In this step, get ready to:

Configure OSPF on all 3 routers with correct area assignments.
Configure OSPF on all 3 L3 switches to advertise department subnets into their areas.
Verify OSPF adjacencies form and cross-site pings succeed.

Configure OSPF on all routers

Before configuring anything, prove to yourself that cross-site communication is broken right now.

Click on R2-MAIN in Packet Tracer to open its CLI.
Try pinging the Branch Site router's serial interface by entering this command in privileged EXEC mode:

ping 10.0.13.2

The ping fails. R2-MAIN has no idea how to reach 10.0.13.2 because no routing protocol is advertising that subnet.

OSPF will fix this. The Data Center router (R1-DC) lives entirely in Area 0 (the backbone). R2-MAIN and R3-BRANCH are Area Border Routers with their WAN-facing serial links in Area 0 and their LAN-facing links in their site's own area.

Click on R1-DC and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.13.0 0.0.0.3 area 0
 network 10.1.0.0 0.0.0.3 area 0

What does this config do?

The router ospf 1 command starts an OSPF process. The process ID (1) is locally significant and does not need to match between routers.

The router-id manually identifies this router in the OSPF domain. Each network statement uses a wildcard mask to match interfaces and places them into Area 0 (the backbone). R1-DC places all three of its connected subnets in Area 0 because it is the backbone router.

Click on R2-MAIN and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 2.2.2.2
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 0
 network 10.2.0.0 0.0.0.3 area 1

Why does R2-MAIN have two different areas?

R2-MAIN is an Area Border Router. Its serial WAN links (10.0.12.0/30 to R1-DC and 10.0.23.0/30 to R3-BRANCH) connect to the backbone in Area 0. Its LAN-facing link (10.2.0.0/30) connects to the Main Site in Area 1.

This split is what makes multi-area OSPF work. Each area maintains its own link-state database, and the ABR translates between them.

Return to R1-DC's CLI.
Run this command in privileged EXEC mode to check if an adjacency has formed:

show ip ospf neighbor

You should see R2-MAIN (router-id 2.2.2.2) listed with a state of FULL/-. This means the two routers have fully synchronized their link-state databases over the point-to-point serial link.

Click on R3-BRANCH and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 3.3.3.3
 network 10.0.13.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 0
 network 10.3.0.0 0.0.0.3 area 2

Return to R1-DC's CLI and run show ip ospf neighbor again.

You should now see two neighbors: 2.2.2.2 (R2-MAIN) and 3.3.3.3 (R3-BRANCH), both in FULL/- state. All three routers are now exchanging routing information across the backbone.

Not seeing FULL state?

Verify both serial interfaces are up/up by running show ip interface brief on both routers. If a serial link shows down, check that no shutdown was applied in Step 3.
Confirm the network statements use the correct wildcard mask (0.0.0.3 for /30 links). A wrong mask means OSPF will not match the interface.
Wait 10-15 seconds for Packet Tracer to converge, then check again.

Help me troubleshoot why my OSPF neighbors are not reaching FULL state.

Configure OSPF on all L3 switches

The routers can now exchange routes with each other, but the department subnets (like 172.16.20.0/24 for HR at the Main Site) are not yet advertised. Each L3 switch needs to run OSPF and announce its SVIs into the correct area.

Click on MLS1-DC and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 1.1.1.11
 network 10.1.0.0 0.0.0.3 area 0
 network 172.16.10.0 0.0.0.255 area 0

What do the wildcard masks mean?

The wildcard 0.0.0.3 matches a /30 point-to-point link (4 addresses). The wildcard 0.0.0.255 matches a full /24 subnet (256 addresses).

Each network statement tells OSPF which interfaces to activate on and which area those interfaces belong to.

Click on MLS2-MAIN and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 2.2.2.22
 network 10.2.0.0 0.0.0.3 area 1
 network 172.16.20.0 0.0.0.255 area 1
 network 172.16.21.0 0.0.0.255 area 1
 network 172.16.22.0 0.0.0.255 area 1
 network 172.16.23.0 0.0.0.255 area 1

Why are all networks in Area 1?

MLS2-MAIN sits entirely within the Main Site. Every interface it owns (the uplink to R2-MAIN and all four department SVIs) belongs to Area 1. Only R2-MAIN straddles the area boundary as the ABR.

Run this on R1-DC to confirm Main Site subnets are now appearing in the backbone routing table:

show ip route ospf

You should see O IA (OSPF Inter-Area) routes for 172.16.20.0/24, 172.16.21.0/24, 172.16.22.0/24, and 172.16.23.0/24 appearing via R2-MAIN. These are the Main Site department subnets being advertised across the area boundary.

Click on MLS3-BRANCH and enter global configuration mode.
Configure OSPF by entering these commands:

router ospf 1
 router-id 3.3.3.33
 network 10.3.0.0 0.0.0.3 area 2
 network 172.16.30.0 0.0.0.255 area 2
 network 172.16.31.0 0.0.0.255 area 2

Not seeing O IA routes on R1-DC?

Verify ip routing is enabled on the L3 switch. Without it, OSPF cannot run. Check with show running-config | include ip routing.
Make sure the uplink interface (Gig0/1) on each L3 switch has no switchport applied. OSPF needs a routed interface to form a neighbor relationship.
Check that area IDs match on both ends of a link. R2-MAIN's 10.2.0.0 network must be in the same area as MLS2-MAIN's 10.2.0.0 network (both Area 1).

Help me figure out why OSPF inter-area routes are not showing up on R1-DC.

✔️ Awesome, I've got everything!

Great. All 6 routing devices now have OSPF configured. Move on to the final verification below.

ⓧ I'd like to double check the full config

Here is the complete OSPF configuration for all routers:

! R1-DC
router ospf 1
 router-id 1.1.1.1
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.13.0 0.0.0.3 area 0
 network 10.1.0.0 0.0.0.3 area 0
!
! R2-MAIN
router ospf 1
 router-id 2.2.2.2
 network 10.0.12.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 0
 network 10.2.0.0 0.0.0.3 area 1
!
! R3-BRANCH
router ospf 1
 router-id 3.3.3.3
 network 10.0.13.0 0.0.0.3 area 0
 network 10.0.23.0 0.0.0.3 area 0
 network 10.3.0.0 0.0.0.3 area 2

Here is the complete OSPF configuration for all L3 switches:

! MLS1-DC
router ospf 1
 router-id 1.1.1.11
 network 10.1.0.0 0.0.0.3 area 0
 network 172.16.10.0 0.0.0.255 area 0
!
! MLS2-MAIN
router ospf 1
 router-id 2.2.2.22
 network 10.2.0.0 0.0.0.3 area 1
 network 172.16.20.0 0.0.0.255 area 1
 network 172.16.21.0 0.0.0.255 area 1
 network 172.16.22.0 0.0.0.255 area 1
 network 172.16.23.0 0.0.0.255 area 1
!
! MLS3-BRANCH
router ospf 1
 router-id 3.3.3.33
 network 10.3.0.0 0.0.0.3 area 2
 network 172.16.30.0 0.0.0.255 area 2
 network 172.16.31.0 0.0.0.255 area 2

Verify OSPF adjacencies and cross-site routing

All OSPF configuration is in place. Time to prove that the three isolated islands are now one connected enterprise network.

On R1-DC, run this command to check all OSPF neighbor relationships:

show ip ospf neighbor

You should see two neighbors in FULL/- state: router-id 2.2.2.2 (R2-MAIN) and router-id 3.3.3.3 (R3-BRANCH). Both are fully adjacent over point-to-point serial links.

Still on R1-DC, run this to view all OSPF-learned routes:

show ip route ospf

You should see O IA routes for all remote subnets: 172.16.20.0, 172.16.21.0, 172.16.22.0, 172.16.23.0 (Main Site departments) and 172.16.30.0, 172.16.31.0 (Branch Site departments). The O IA prefix means these routes crossed an area boundary through an ABR.

Now for the real test. Before you run the next command, predict: will a ping from MLS2-MAIN to MLS3-BRANCH's SVI succeed?

Click on MLS2-MAIN and run this ping in privileged EXEC mode:

ping 172.16.30.254

The ping succeeds. Because of the triangle topology, traffic goes directly from R2-MAIN to R3-BRANCH over the 10.0.23.0/30 serial link, then down to MLS3-BRANCH's VLAN 10 SVI. OSPF chose the shortest path (1 hop) instead of going through R1-DC (2 hops).

What just happened?

Before OSPF, a ping from R2-MAIN to 10.0.13.2 failed because no routing protocol was advertising subnets between sites. Now every department subnet at every site is reachable because OSPF propagates routes through the area hierarchy. The triangle topology also gives OSPF a direct R2-MAIN to R3-BRANCH path, providing redundancy if any single link fails.

R2-MAIN and R3-BRANCH act as Area Border Routers, translating Type 1/2 LSAs from their local area into Type 3 Summary LSAs for the backbone. R1-DC then passes those summaries to the other ABR, completing the loop.

🙋‍♀️ Cross-site ping failing?

Run show ip route ospf on MLS2-MAIN. If you see no routes, the L3 switch has not formed an adjacency with R2-MAIN. Confirm both use Area 1 for the 10.2.0.0 link.
If MLS2-MAIN shows routes but the ping still fails, check that MLS3-BRANCH also has OSPF configured. Both ends of the path must participate.
Try pinging the next hop first (ping 10.2.0.1 from MLS2-MAIN). If that fails, the router-to-switch link is the issue.

Help me debug why my cross-site ping is not working after configuring OSPF.

Your three isolated sites are now one unified, routed network. Next up, you will put this routing to work by configuring centralized data center services that every remote PC can reach.

Set Up Data Center Services and DHCP Relay

Your OSPF configuration proves that packets can route between all three sites. However, the network is not actually useful yet.

No PC has an IP address, and no centralized services exist. In this step, you will set up a DHCP server that hands out addresses to all 12 PCs across both remote sites, plus DNS, Web, FTP, and Email servers that turn this routing lab into a functional enterprise.

In this step, get ready to:

Configure centralized DHCP and DNS services in the Data Center.
Set up Web, FTP, and Email servers accessible from any site.
Enable DHCP relay so remote PCs receive addresses from the centralized server.

Configure the DHCP/DNS server

The DHCP/DNS server lives in the Data Center on VLAN 10. It will hand out IP addresses to all 6 department subnets at both remote sites, and resolve hostnames for the company's web, FTP, and email services.

Click on the DHCP/DNS Server in the Data Center (the first server connected to SW-DC).
Go to the Desktop tab.
Click IP Configuration.
Set the static IP to 172.16.10.1, subnet mask 255.255.255.0, default gateway 172.16.10.254, and DNS server 172.16.10.1.

Now configure the DHCP service with pools for each remote department subnet.

Switch to the Services tab.
Click DHCP in the left panel.
Turn the service ON.
Add the first pool with these values, then click Add:

Pool Name: MAIN-HR
Default Gateway: 172.16.20.254
DNS Server: 172.16.10.1
Start IP Address: 172.16.20.1
Subnet Mask: 255.255.255.0

Repeat the process to add the remaining 5 pools using the values in the table below. Click Add after each one.

DHCP pool values for all 6 subnets

MAIN-HR: Start 172.16.20.1, Mask 255.255.255.0, Gateway 172.16.20.254, DNS 172.16.10.1.
MAIN-FINANCE: Start 172.16.21.1, Mask 255.255.255.0, Gateway 172.16.21.254, DNS 172.16.10.1.
MAIN-ENGINEERING: Start 172.16.22.1, Mask 255.255.255.0, Gateway 172.16.22.254, DNS 172.16.10.1.
MAIN-SALES: Start 172.16.23.1, Mask 255.255.255.0, Gateway 172.16.23.254, DNS 172.16.10.1.
BRANCH-HR: Start 172.16.30.1, Mask 255.255.255.0, Gateway 172.16.30.254, DNS 172.16.10.1.
BRANCH-SALES: Start 172.16.31.1, Mask 255.255.255.0, Gateway 172.16.31.254, DNS 172.16.10.1.

Now configure the DNS service on the same server.

Click DNS in the left panel of the Services tab.
Turn the service ON.
Add an A record with Name www.company.com and Address 172.16.10.2, then click Add.
Add an A record with Name ftp.company.com and Address 172.16.10.3, then click Add.
Add an A record with Name mail.company.com and Address 172.16.10.4, then click Add.

Verify the server is reachable by clicking on MLS1-DC, opening the CLI tab, and running:

ping 172.16.10.1

You should see 4 successful replies confirming the DHCP/DNS server is reachable on the Data Center VLAN.

Ping to 172.16.10.1 failing?

Confirm the server's gateway is set to 172.16.10.254 (the MLS1-DC SVI for VLAN 10).
Make sure the server is connected to SW-DC on a port assigned to VLAN 10.
Check that the subnet mask is 255.255.255.0, not 255.255.255.252.

Help me troubleshoot why my server is unreachable on VLAN 10.

Configure Web, FTP, and Email servers

The remaining three servers all sit on the same VLAN 10 in the Data Center. Each provides a different enterprise service that remote PCs will access by hostname.

Click on the Web Server in the Data Center.
Go to the Desktop tab, then IP Configuration.
Set the IP to 172.16.10.2, subnet mask 255.255.255.0, gateway 172.16.10.254, DNS 172.16.10.1.
Switch to the Services tab and click HTTP in the left panel.
Confirm both HTTP and HTTPS are set to ON. Leave the default index.html as-is.

Click on the FTP Server.
Set its IP to 172.16.10.3, subnet mask 255.255.255.0, gateway 172.16.10.254, DNS 172.16.10.1 (same process via Desktop > IP Configuration).
Go to Services > FTP.
Turn the service ON.
Create a user with username admin and password admin. Check all permission boxes (Read, Write, Delete, Rename, List), then click Add.

Click on the Email Server.
Set its IP to 10.1.10.4, subnet mask 255.255.255.0, gateway 10.1.10.254, DNS 10.1.10.1.
Go to Services > EMAIL.
Turn both SMTP and POP3 services ON.
Set the domain name to company.com.
Create user user1 with password user1 and click Add (the + button).
Create user user2 with password user2 and click Add.

Quick-verify the Web Server is live. Click on the DHCP/DNS Server, go to Desktop > Web Browser, and type 10.1.10.2 in the URL field.

You should see the Packet Tracer default web page load. This confirms the Web Server is serving HTTP on VLAN 10.

Why test from the DHCP/DNS server?

Both servers are on the same VLAN 10 subnet, so this test does not require DHCP or routing. It confirms the Web Server's HTTP service is actually running before you involve the more complex cross-site path.

🙋‍♀️ Web page not loading?

Double-check that the Web Server's IP is 10.1.10.2 (not 10.1.10.1 which is the DHCP/DNS server).
Confirm HTTP is set to ON in the Web Server's Services tab.
Ensure both servers are connected to SW-DC on ports assigned to VLAN 10.

Help me figure out why the web server isn't responding.

Configure DHCP relay on remote site switches

Remote PCs broadcast DHCP Discover messages on their local VLAN. Those broadcasts cannot cross a router by default. The ip helper-address command on each SVI converts the broadcast into a unicast packet aimed at the DHCP server, so the centralized server can assign addresses to subnets it is not directly connected to.

Click on MLS2-MAIN and open the CLI tab.
Add the DHCP relay helper address to all 4 department SVIs by entering these commands:

enable
configure terminal
interface vlan 10
 ip helper-address 10.1.10.1
interface vlan 20
 ip helper-address 10.1.10.1
interface vlan 30
 ip helper-address 10.1.10.1
interface vlan 40
 ip helper-address 10.1.10.1
end

What does ip helper-address do?

When a PC on VLAN 10 sends a DHCP Discover broadcast, the SVI intercepts it and forwards a unicast copy to 10.1.10.1 (the DHCP server in the Data Center). The server replies with an offer for the matching pool, and the SVI relays it back to the PC.

Without this command, the broadcast never leaves the local VLAN and the PC never gets an address from the centralized server.

Now click on MLS3-BRANCH and open the CLI tab.
Add the DHCP relay helper address to both Branch SVIs by entering these commands:

enable
configure terminal
interface vlan 10
 ip helper-address 10.1.10.1
interface vlan 20
 ip helper-address 10.1.10.1
end

Verify the helper address is configured on MLS3-BRANCH by running:

show running-config | include helper

You should see two lines showing ip helper-address 10.1.10.1 (one for each SVI).

Now set all 12 PCs to receive their addresses via DHCP.

Click on any PC at the Branch Site (e.g., PC connected to SW-B1).
Go to Desktop > IP Configuration.
Select DHCP (instead of Static).

Within a few seconds, the PC should receive an IP in the 10.3.10.x range, a gateway of 10.3.10.254, and a DNS of 10.1.10.1. This proves the relay is working across OSPF areas.

Repeat this process for all remaining 11 PCs. Click each PC, go to Desktop > IP Configuration, and select DHCP.

Speed up DHCP assignments

If a PC shows 0.0.0.0 and does not receive an address after a few seconds, toggle the IP Configuration back to Static then back to DHCP to trigger a fresh DHCP Discover.

🙋‍♀️ PC stuck at 0.0.0.0?

Verify ip helper-address 10.1.10.1 is on the correct SVI (the VLAN that PC belongs to).
Check that the DHCP pool's gateway matches the SVI IP for that VLAN (e.g., BRANCH-HR pool gateway must be 10.3.10.254).
Make sure OSPF is still forming adjacencies. Run show ip ospf neighbor on the local router to confirm the WAN link is up.

Help me troubleshoot why DHCP relay is not working.

Time for the ultimate end-to-end test. Before you run it, predict: will a Branch Site PC be able to browse a website by hostname, given that DHCP, DNS, OSPF routing, and the web server are all separate systems that must work together?

Click on a Branch Site PC that has received a DHCP address.
Go to Desktop > Web Browser.
Type www.company.com in the URL field and press Go.

The Cisco Packet Tracer default web page loads. This single request just proved 4 systems working together: the PC got its IP from DHCP relay, resolved the hostname via DNS, OSPF routed the HTTP request across two area boundaries, and the Web Server responded.

What just happened end-to-end?

The Branch PC sent a DNS query for www.company.com to 10.1.10.1 (the DNS server in Area 0). OSPF routed it from Area 2 through the backbone.
The DNS server replied with 10.1.10.2 (the Web Server's IP).
The PC sent an HTTP GET to 10.1.10.2, again routed across areas by OSPF.
The Web Server sent the page back along the reverse OSPF path.

✔️ Awesome, I've got everything!

Great. Double check that all 12 PCs show DHCP-assigned addresses (not 0.0.0.0) and that at least one PC from each site can browse www.company.com.

ⓧ I'd like to double check the full configuration

Confirm each piece matches what you configured above:

DHCP/DNS Server: Static IP 10.1.10.1/24, gateway 10.1.10.254. DHCP ON with 6 pools (MAIN-HR, MAIN-FINANCE, MAIN-ENGINEERING, MAIN-SALES, BRANCH-HR, BRANCH-SALES). DNS ON with 3 A records.
Web Server: 10.1.10.2/24, HTTP ON.
FTP Server: 10.1.10.3/24, FTP ON, user admin with full permissions.
Email Server: 10.1.10.4/24, EMAIL ON, domain company.com, users user1 and user2.
MLS2-MAIN: ip helper-address 10.1.10.1 on VLANs 10, 20, 30, and 40.
MLS3-BRANCH: ip helper-address 10.1.10.1 on VLANs 10 and 20.

Your enterprise network is fully operational. Every remote PC receives an address automatically, resolves hostnames, browses the web, and routes traffic across multi-area OSPF. Next up, a secret challenge to optimize those routing tables.

Secret mission

OSPF Route Summarization on ABRs

Your enterprise network works, but R1-DC's routing table is cluttered with 6 individual /24 routes for remote subnets. In a real enterprise with hundreds of subnets per site, this does not scale. Can you configure OSPF route summarization on the Area Border Routers to collapse those routes into clean /16 summaries?

Clean Up Your Resources

This project runs entirely within Cisco Packet Tracer, so there are no cloud resources, subscriptions, or ongoing costs to worry about. Decide whether to keep your topology file, pause for later, or delete it entirely.

Resources you used:

Cisco Packet Tracer topology file (.pkt file) containing all 29 devices and their configurations.

Keep everything running

No action needed. Choose this if you plan to extend the topology, practice troubleshooting, or use it as a reference for future labs.

Save your topology by pressing Ctrl+S (or Cmd+S on macOS) in Packet Tracer.
Your .pkt file preserves all device configurations, OSPF adjacencies, and server settings exactly as you left them.
You can reopen and extend this topology at any time by double-clicking the file.

Pause - I'll come back to this later

Since Packet Tracer is a local application with no running processes, pausing simply means saving your file and closing the application.

Save your topology by pressing Ctrl+S (or Cmd+S on macOS).
Close Cisco Packet Tracer.
When you return, double-click the .pkt file to pick up exactly where you left off.

Delete - I don't want to use this again

Remove the project file from your computer entirely. This cannot be undone.

Close Cisco Packet Tracer without saving (click Don't Save if prompted).
Navigate to the folder where you saved the .pkt file.
Delete the .pkt file. On macOS, right-click and select Move to Trash. On Windows, right-click and select Delete.

Nice Work!

Nice work! You just designed, configured, and verified a production-style 3-site enterprise network from scratch in Cisco Packet Tracer.

You've learned how to:

Build a multi-area OSPF network with Area Border Routers connecting a Data Center backbone (Area 0), a Main Site (Area 1), and a Branch Site (Area 2) for dynamic, scalable routing across all sites.
Configure VLANs, SVIs, and inter-VLAN routing on Layer 3 switches to segment 6 department subnets while maintaining full connectivity through OSPF.
Deploy centralized data center services including DHCP with ip helper-address relay, DNS, Web, FTP, and Email servers accessible from every remote site across multiple OSPF areas.
Secret Mission: Implemented OSPF route summarization on ABRs using the area range command to collapse individual /24 routes into clean /16 summaries, optimizing the backbone routing table.

Ready to quiz yourself?