Build and Secure a Small Office Network

Segment a 3-department network with VLANs, routing, DHCP, and ACLs.

Introduction

30 Second Summary

Picture an office where every employee and every guest shares the same network. The intern's laptop can reach the payroll server, and a visitor on the Wi-Fi can snoop on engineering traffic.

In this project, you will build a three-department office network in Cisco Packet Tracer, segment it into isolated VLANs, and apply security rules that control exactly which departments can talk to each other.

What You'll Build

When you're done, you'll have a .pkt topology file you can open in front of an interviewer and walk them through live: how traffic flows between departments, how your router decides which VLAN can reach which, and how your ACL blocks guest devices from internal resources.

By the end of this project, you'll have:

A working VLAN-segmented network where three departments (Engineering, Sales, Guest) are fully isolated from each other's broadcast traffic, with automatic IP assignment via DHCP so any new device gets the correct address for its department.
A single router performing inter-VLAN routing using subinterfaces and 802.1Q trunking, letting you demonstrate exactly how controlled cross-department communication works.
An extended ACL security policy that blocks Guest VLAN devices from reaching Engineering or Sales resources, while permitting all other legitimate traffic.
Secret Mission: Extend the network with a branch office over a WAN link, diagnose a deliberate routing failure, and document your troubleshooting steps.

Are there any prerequisites?

You should have a basic understanding of IP addressing and subnetting, and be familiar with the Cisco CLI (commands like enable and configure terminal).

You also need a free Cisco Networking Academy (NetAcad) or Skills For All account to sign in to Packet Tracer.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters. This is the moment to commit to the goal before any hands-on configuration starts.

Set Up Packet Tracer and Build the Physical Topology

Every network starts as a physical layout. Before you can configure VLANs, routing, or security policies, you need devices on the table and cables between them.

In this step, you will place eight devices in Cisco Packet Tracer and wire them together to form the skeleton of your three-department office network.

In this step, get ready to:

Place a router, a switch, and six PCs in the workspace.
Connect all devices with the correct cable types.
Confirm the physical topology matches the network plan.

Place the network devices in the workspace

Your office network needs one router to make traffic decisions between departments, one switch to connect everyone on the same floor, and six PCs representing employees in three departments.

In Packet Tracer, look at the bottom-left device panel. Click the Network Devices category (the icon that looks like a small hub).
Click the Routers subcategory.
Find 2911 in the list. Click it, then click anywhere in the center workspace to place it.

You should see a router icon appear in the workspace labeled Router0.

Click the Switches subcategory in the same Network Devices panel.
Find 2960-24TT and place it to the right of your router.

A switch icon labeled Switch0 appears.

Click the End Devices category in the bottom-left panel (the icon that looks like a monitor).
Select PC from the list.
Click six times in the workspace to place six PCs. Arrange them in three pairs below the switch: two on the left (Engineering), two in the middle (Sales), two on the right (Guest).
Press Esc to stop placing devices.

You should now see eight devices in the workspace: Router0, Switch0, and PC0 through PC5.

Why these specific models?

The Cisco 2911 router supports subinterfaces for inter-VLAN routing, which you will configure in a later step. The Cisco 2960-24TT switch supports VLANs and trunking out of the box. These are the same models used in Cisco CCNA lab exercises.

Connect devices with cables

Physical cables determine which devices can talk to each other. You need one cable from the router to the switch (the trunk link), and six cables from the switch to the PCs (one per department workstation).

Click the Connections category in the bottom-left panel (the lightning bolt icon).
Select Copper Straight-Through cable (the solid black line).
Click Router0. In the port menu that appears, select GigabitEthernet0/0.
Click Switch0. In the port menu, select FastEthernet0/1.

A cable now connects the router to the switch. The link lights on both ends will be amber or red. That is normal because neither device is configured yet.

Now connect each PC to its assigned switch port. Use the same Copper Straight-Through cable for all six connections.

Click PC0 and select FastEthernet0. Then click Switch0 and select FastEthernet0/2.
Click PC1 and select FastEthernet0. Then click Switch0 and select FastEthernet0/3.
Click PC2 and select FastEthernet0. Then click Switch0 and select FastEthernet0/4.
Click PC3 and select FastEthernet0. Then click Switch0 and select FastEthernet0/5.
Click PC4 and select FastEthernet0. Then click Switch0 and select FastEthernet0/6.
Click PC5 and select FastEthernet0. Then click Switch0 and select FastEthernet0/7.
Press Esc to deselect the cable tool.

What is this port mapping?

Each pair of PCs maps to a future department VLAN. PC0 and PC1 on Fa0/2-Fa0/3 will become Engineering. PC2 and PC3 on Fa0/4-Fa0/5 will become Sales. PC4 and PC5 on Fa0/6-Fa0/7 will become Guest.

Keeping departments in contiguous port ranges makes VLAN assignment cleaner in the next step.

Can't see the port menu when clicking a device?

Make sure you selected a cable type from the Connections panel first. If you click a device without a cable selected, it opens the device config window instead of showing port options.

If you accidentally connected to the wrong port, click the cable and press Delete to remove it, then redo the connection.

Help me fix a cabling issue in Packet Tracer.

Verify the physical topology

Before moving forward, confirm every cable lands on the correct port. A wrong connection here causes silent failures later that are hard to diagnose.

Click the cable between Router0 and Switch0. Confirm the tooltip shows GigabitEthernet0/0 on the router end and FastEthernet0/1 on the switch end.
Click each PC-to-switch cable and verify the switch port matches this table:

PC0 connects to FastEthernet0/2 (Engineering).
PC1 connects to FastEthernet0/3 (Engineering).
PC2 connects to FastEthernet0/4 (Sales).
PC3 connects to FastEthernet0/5 (Sales).
PC4 connects to FastEthernet0/6 (Guest).
PC5 connects to FastEthernet0/7 (Guest).

All link lights will be amber or red at this stage. That is completely normal. No interfaces have been configured or enabled yet, so the links are not fully active.

Why are the link lights amber?

Amber means the port is in a transitioning state (like Spanning Tree blocking on the switch) or not yet configured. Once you apply IP addresses and enable interfaces in later steps, the lights turn green.

See a red X on a cable?

A red X usually means you used the wrong cable type. Router-to-switch and PC-to-switch connections require a Copper Straight-Through cable. Delete the cable and reconnect with the correct type.

Help me diagnose a red X on my Packet Tracer cable.

Your physical topology is complete. Next up, you will give every PC an IP address and prove they can all talk to each other on a flat network. That baseline will make the impact of VLANs obvious when you add them.

Connect Everything on a Flat Network and Verify Basic Connectivity

Your physical topology is in place with all devices connected. Before you segment the network into departments, you need to prove that the basic wiring works and that devices can actually talk to each other.

In this step, you will assign IP addresses to every PC on one shared subnet and confirm they can all communicate freely. This gives you a working baseline. It also reveals a critical security flaw that you will fix in the next step.

In this step, get ready to:

Assign static IP addresses to all six PCs on a single shared subnet.
Verify that any PC can ping any other PC across the flat network.
Identify the security limitation of a flat network design.

Assign static IPs to all PCs

Every PC needs an IP address on the same subnet so they can find and communicate with each other. You will use the 192.168.1.0/24 subnet for all six PCs.

Click on PC0 in your topology to open its configuration window.
Click the Desktop tab at the top of the window.
Click IP Configuration.
Make sure Static is selected (not DHCP).
In the IPv4 Address field, enter 192.168.1.10.
In the Subnet Mask field, enter 255.255.255.0.
Leave the Default Gateway field empty.
Close the PC0 window.

You should notice the link lights on the switch ports have turned green. This confirms Layer 1 (physical) connectivity is working.

Now repeat this process for the remaining five PCs using these addresses:

PC1: IP address 192.168.1.11, subnet mask 255.255.255.0.
PC2: IP address 192.168.1.20, subnet mask 255.255.255.0.
PC3: IP address 192.168.1.21, subnet mask 255.255.255.0.
PC4: IP address 192.168.1.30, subnet mask 255.255.255.0.
PC5: IP address 192.168.1.31, subnet mask 255.255.255.0.

Why no default gateway?

All six PCs are on the same subnet right now. A default gateway is only needed when a device wants to reach a DIFFERENT subnet. Since everyone shares 192.168.1.0/24, the switch handles all forwarding directly at Layer 2.

Test connectivity across the flat network

With all PCs configured, it is time to prove that any device can reach any other device. This is your first visible win.

Click on PC0 to open its configuration window.
Click the Desktop tab.
Click Command Prompt.

Before you run this next command, what do you think will happen when PC0 tries to reach PC4 on the other side of the network?

Run this ping command to test connectivity from PC0 to PC4:

ping 192.168.1.30

The first ping may time out while ARP resolves the destination MAC address. Subsequent pings should reply successfully with output showing replies from 192.168.1.30.

Now test a second path. Open PC2's Desktop > Command Prompt and run:

ping 192.168.1.30

This ping should also succeed. Every PC can reach every other PC because they all share one flat network.

Pings timing out for all four attempts?

If all four pings say "Request timed out" (not just the first one), check these common causes:

Verify the IP address was entered correctly on both the source and destination PCs. A single wrong digit will break connectivity.
Check that both PCs have subnet mask 255.255.255.0 set. A missing or wrong mask puts them on different logical networks.
Confirm the cable connections. Click on the cable between the switch and PC to verify the endpoints match your plan (correct port numbers on both sides).

Help me troubleshoot why my PCs cannot ping each other on the same subnet in Packet Tracer.

Notice the security problem with this flat design

Your pings prove that every PC can reach every other PC. That sounds like success, but think about what this means in a real office.

All six PCs share one broadcast domain. Any broadcast frame from PC4 (a guest device) reaches PC0 (an engineering workstation). In a real office, this means guest devices can sniff internal traffic and attempt to access engineering resources.

What is a broadcast domain?

A broadcast domain is the set of devices that all receive a broadcast frame sent by any one of them. On a flat switch network with no VLANs, every port is in the same broadcast domain.

This is the limitation you will solve next. VLANs split one physical switch into multiple isolated broadcast domains, so guest traffic never touches engineering ports.

Your flat network works perfectly at a connectivity level. Every device can reach every other device. But that is exactly the problem. Next up, you will segment this network into three isolated VLANs so that departments stay in their own lanes.

Segment the Network with VLANs

In the previous step, you confirmed every PC can reach every other PC on the flat network. You also spotted the core problem. Every broadcast from a Guest PC floods across to Engineering and Sales machines because all six devices share one broadcast domain.

VLANs solve this by carving a single physical switch into multiple isolated broadcast domains. In this step, you will create three VLANs on the switch and assign ports so each department's traffic stays contained to its own segment.

In this step, get ready to:

Create VLANs for Engineering, Sales, and Guest on the switch.
Assign switch ports to each VLAN so PCs are segmented by department.
Update PC IP addresses to match their new VLAN subnets and test connectivity.

Create three VLANs on the switch

Each department needs its own VLAN to keep its traffic isolated from the others. You will create VLAN 10 for Engineering, VLAN 20 for Sales, and VLAN 30 for Guest.

Click on the switch in your topology to open it, then select the CLI tab.
Enter privileged EXEC mode and then global configuration mode by typing these commands:

enable
configure terminal

Create the three VLANs by entering these commands:

vlan 10
name Engineering
exit
vlan 20
name Sales
exit
vlan 30
name Guest
exit

What do these commands do?

Each vlan <ID> command creates a new VLAN with that numeric ID. The name command gives it a human-readable label so you can identify departments at a glance.

The exit after each VLAN returns you to global configuration mode so you can define the next one.

Verify the VLANs exist by running this command (you can run it from config mode with the do prefix):

do show vlan brief

You should see VLANs 10 (Engineering), 20 (Sales), and 30 (Guest) listed in the table. No ports appear under them yet because you have not assigned any.

Not seeing your VLANs listed?

Make sure you typed do show vlan brief with the do prefix. Without it, the command will not run from configuration mode.

Double-check that each vlan command used the correct ID (10, 20, 30) and that you typed exit after each VLAN definition. Help me troubleshoot my VLAN creation on the Cisco 2960 switch in Packet Tracer.

Assign switch ports to VLANs

Creating VLANs is only half the job. You need to tell the switch which physical ports belong to each VLAN so traffic from connected PCs is tagged correctly.

Still in global configuration mode, assign ports to each VLAN by entering these commands:

interface range fa0/2-3
switchport mode access
switchport access vlan 10
exit
interface range fa0/4-5
switchport mode access
switchport access vlan 20
exit
interface range fa0/6-7
switchport mode access
switchport access vlan 30
exit

What do these commands do?

The interface range command selects multiple ports at once. switchport mode access tells the switch these ports connect to end devices (not other switches).

The switchport access vlan 10 command places those ports into VLAN 10. Only traffic from devices on VLAN 10 ports will stay within that VLAN's broadcast domain.

Exit configuration mode and verify the port assignments by running:

end
show vlan brief

You should now see ports Fa0/2 and Fa0/3 listed under VLAN 10, Fa0/4 and Fa0/5 under VLAN 20, and Fa0/6 and Fa0/7 under VLAN 30.

Ports still showing under VLAN 1?

If a port still appears under the default VLAN 1, the assignment did not take. Re-enter configure terminal and check that you selected the correct port range (e.g. interface range fa0/2-3 with no spaces around the dash).

Help me figure out why my switch ports are not moving to the correct VLAN.

Update PC IP addresses and test connectivity

Now that ports are segmented, each VLAN needs its own subnet. You will re-assign IP addresses on all six PCs so each department sits on a distinct network.

Click on PC0 in the topology, go to the Desktop tab, and open IP Configuration.
Change the IP address to 192.168.10.10 and the subnet mask to 255.255.255.0. Leave the default gateway blank.
Repeat for the remaining PCs using these addresses:

PC1: 192.168.10.11 (Engineering, VLAN 10).
PC2: 192.168.20.10 (Sales, VLAN 20).
PC3: 192.168.20.11 (Sales, VLAN 20).
PC4: 192.168.30.10 (Guest, VLAN 30).
PC5: 192.168.30.11 (Guest, VLAN 30).

Why new subnets?

VLANs isolate traffic at Layer 2, but IP addresses must also reflect the segmentation. Each VLAN gets its own subnet (192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24) so devices know which traffic is local and which needs routing.

First, confirm PCs within the same VLAN can still communicate. Click on PC0, go to Desktop > Command Prompt, and run:

ping 192.168.10.11

The ping should succeed (after possibly one timeout for ARP resolution). This confirms intra-VLAN connectivity still works.

Now for the real test. Before you run the next ping, ask yourself: do you think PC0 (Engineering) will be able to reach PC2 (Sales) now that they are on different VLANs and different subnets?

Still on PC0's Command Prompt, run:

ping 192.168.20.10

The ping fails with "Request timed out." That is exactly what should happen.

Why did the ping fail?

VLANs create separate broadcast domains on the switch. PC0 (VLAN 10) and PC2 (VLAN 20) are now as isolated as if they were on two physically separate switches.

Without a router to make forwarding decisions between VLANs, traffic has no path to cross from one VLAN to another. The switch simply will not forward frames between VLANs on its own.

Intra-VLAN ping also failing?

If PC0 cannot reach PC1 (both on VLAN 10), double-check that both PCs are on the correct subnet. PC0 should be 192.168.10.10 and PC1 should be 192.168.10.11, both with mask 255.255.255.0.

Also confirm in show vlan brief that both Fa0/2 and Fa0/3 are listed under VLAN 10. Help me troubleshoot why my same-VLAN PCs cannot ping each other.

✔️ Awesome, I've got everything!

Great. Double-check you have saved your topology file before moving on.

ⓧ I'd like to double check the full configuration

Confirm the following on your switch by running show vlan brief in privileged EXEC mode:

VLAN 10 (Engineering): ports Fa0/2 and Fa0/3.
VLAN 20 (Sales): ports Fa0/4 and Fa0/5.
VLAN 30 (Guest): ports Fa0/6 and Fa0/7.

Confirm PC IP addresses:

PC0: 192.168.10.10/24, PC1: 192.168.10.11/24.
PC2: 192.168.20.10/24, PC3: 192.168.20.11/24.
PC4: 192.168.30.10/24, PC5: 192.168.30.11/24.

Intra-VLAN pings (e.g. PC0 to PC1) succeed. Inter-VLAN pings (e.g. PC0 to PC2) time out.

Your network is now segmented. Guest devices can no longer see Engineering or Sales traffic at Layer 2. But you have also lost all cross-department communication. In the next step, you will bring controlled connectivity back by adding a router that decides which VLAN traffic is allowed to cross.

Restore Connectivity with Inter-VLAN Routing and DHCP

In the previous step, you proved that VLANs successfully isolate broadcast domains. Engineering, Sales, and Guest PCs can no longer talk to each other. That isolation is exactly what you wanted for security.

The problem is that legitimate cross-department communication is now impossible too. A Sales laptop cannot reach the Engineering file server, and no department can reach the internet gateway. You need a device that makes routing decisions between VLANs. In this step, you will configure a single router to bridge all three VLANs using a technique called router-on-a-stick. You will also add DHCP so that new devices get the correct IP address for their VLAN automatically.

In this step, get ready to:

Configure a trunk link between the switch and router so VLAN-tagged frames can pass through.
Create router subinterfaces with 802.1Q encapsulation for each VLAN.
Set up DHCP pools so every PC gets an IP address automatically.

Configure the trunk link on the switch

Right now, the port connecting the switch to the router (Fa0/1) is in its default state. It only carries traffic for one VLAN. To let all three VLANs reach the router, you need to turn that port into a trunk that carries tagged frames for VLANs 10, 20, and 30.

Click on the switch in your topology to open its CLI tab.
Configure the trunk port by entering these commands:

enable
configure terminal
interface fa0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
exit

What does this configuration do?

The switchport mode trunk command tells the port to tag all outgoing frames with their VLAN ID using the 802.1Q standard. The router can then read these tags and decide how to route the traffic.

The switchport trunk allowed vlan 10,20,30 line restricts the trunk to only carry your three VLANs. This is a security best practice. Without it, all VLANs (including default VLAN 1) would traverse the link.

Verify the trunk is active by running:

show interfaces trunk

You should see Fa0/1 listed as a trunk port with 802.1q encapsulation and VLANs 10, 20, 30 in the allowed list.

Not seeing Fa0/1 in the trunk output?

The show interfaces trunk command only displays ports with an active trunk connection. If the router's GigabitEthernet0/0 interface is still shut down, the trunk will not appear. You will bring that interface up in the next substep. Run the verification again after configuring the router.

help me troubleshoot why my trunk port is not showing up

Configure router-on-a-stick subinterfaces

Router-on-a-stick uses a single physical interface divided into virtual subinterfaces. Each subinterface handles one VLAN by matching the 802.1Q tag. The router reads the VLAN tag on each incoming frame, strips it, makes its routing decision, then re-tags the frame for the destination VLAN.

Click on the router in your topology to open its CLI tab.
Bring up the physical interface and create subinterfaces for each VLAN by entering these commands:

enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What do these subinterfaces do?

Each interface GigabitEthernet0/0.10 command creates a virtual interface that handles traffic for one VLAN. The encapsulation dot1Q 10 line tells the subinterface to match frames tagged with VLAN 10.

The IP address on each subinterface becomes the default gateway for that VLAN. When PC0 (Engineering) wants to reach PC2 (Sales), it sends the packet to 192.168.10.1 (its gateway), and the router forwards it out the subinterface for VLAN 20.

Verify the subinterfaces are up by running:

show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, GigabitEthernet0/0.20, and GigabitEthernet0/0.30 all showing "up" in both the Status and Protocol columns, with their assigned IP addresses.

Seeing "administratively down" on the subinterfaces?

If the physical interface GigabitEthernet0/0 is down, all its subinterfaces will also be down. Make sure you entered no shutdown on the physical interface (not on a subinterface). Go back into the physical interface and run it again.

help me fix my router subinterfaces showing down

Configure DHCP pools on the router

Static IPs work for small networks, but every time a new device joins, someone has to manually assign an address. DHCP lets the router hand out addresses automatically. Each VLAN gets its own pool so devices always receive an IP in the correct subnet.

Still in the router CLI, configure the excluded addresses and DHCP pools by entering these commands:

ip dhcp excluded-address 192.168.10.1 192.168.10.9
ip dhcp excluded-address 192.168.20.1 192.168.20.9
ip dhcp excluded-address 192.168.30.1 192.168.30.9
ip dhcp pool ENGINEERING
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
exit
ip dhcp pool SALES
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
exit
ip dhcp pool GUEST
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 8.8.8.8
exit

Why exclude addresses 1 through 9?

The ip dhcp excluded-address command reserves a range of addresses so the router never hands them out to clients. Addresses like 192.168.10.1 are already used by the router's subinterfaces (the gateways). Reserving .1 through .9 leaves room for other infrastructure devices like printers or servers that need fixed IPs.

Each pool's default-router tells client PCs where to send traffic destined for other networks. The dns-server 8.8.8.8 gives clients a public DNS server for name resolution.

Now switch all 6 PCs from static IP to DHCP. On each PC, click the PC, go to the Desktop tab, then open IP Configuration.
Select the DHCP radio button. After a moment, you should see an IP address, subnet mask, default gateway, and DNS server populate automatically.
Repeat this for all 6 PCs (PC0 through PC5).

Verify DHCP is working by clicking on PC4 (Guest), opening Desktop > Command Prompt, and running:

ipconfig

You should see PC4 has received an address in the 192.168.30.0/24 range (like 192.168.30.10), with a default gateway of 192.168.30.1 and DNS server 8.8.8.8.

PC showing 0.0.0.0 or not getting an address?

If a PC stays at 0.0.0.0, check that the PC's switch port is in the correct VLAN. Also verify the router's physical interface is up (show ip interface brief on the router should show all interfaces as up/up). Try toggling the PC's IP Configuration back to Static and then back to DHCP to force a new request.

help me troubleshoot why my PC is not getting a DHCP address

Before you test the cross-VLAN ping, think back to Step 3. When you tried pinging between VLANs, it failed. What do you think will happen now that the router has subinterfaces acting as gateways?

On PC0 (Engineering, VLAN 10), open Desktop > Command Prompt and run:

ping 192.168.20.10

The ping succeeds. Traffic from PC0 travels to the router via the VLAN 10 trunk tag, the router makes a routing decision, and sends it back down the trunk tagged for VLAN 20. Your three departments can now communicate through the router.

✔️ Pings are succeeding across VLANs

Your router-on-a-stick configuration is working. All three VLANs can reach each other through the router's subinterfaces, and DHCP is handing out correct addresses automatically.

ⓧ Pings still fail between VLANs

Work through these checks in order:

On the switch, run show interfaces trunk and confirm Fa0/1 appears with VLANs 10, 20, 30 allowed.
On the router, run show ip interface brief and confirm all subinterfaces show up/up with their IP addresses.
Confirm each PC received a gateway address (check ipconfig shows a default gateway matching the router subinterface IP for that VLAN).
Try pinging the gateway first. From PC0, run ping 192.168.10.1. If the gateway ping fails, the trunk or subinterface configuration has an error.

help me troubleshoot why inter-VLAN pings are failing after configuring router-on-a-stick

ⓧ Pings work within a VLAN but not across

This means Layer 2 is fine but the router is not routing between VLANs. Check these:

Verify the trunk is carrying all three VLANs. On the switch, run show interfaces trunk and look at the "Vlans allowed and active" line.
Verify encapsulation dot1Q was configured on each subinterface (not on the physical interface). Run show running-config on the router and look for the subinterface sections.
Make sure the VLAN numbers in the subinterface encapsulation match the VLANs on the switch (10, 20, 30).

help me fix inter-VLAN routing when intra-VLAN works but cross-VLAN does not

Your office network now has full controlled connectivity. Every department has its own subnet, DHCP assigns addresses automatically, and the router bridges VLANs as needed. But there is a problem. Right now, Guest PCs can freely ping Engineering and Sales machines. In the next step, you will lock down that access with an extended ACL.

Lock It Down with Extended ACLs

Your network now routes traffic between all three VLANs freely. Engineering, Sales, and Guest PCs can all ping each other without restriction.

In a real office, you would never want guest devices accessing internal Engineering or Sales resources. In this step, you will enforce a security policy using an extended ACL that blocks Guest VLAN traffic from reaching internal departments while keeping legitimate communication open.

In this step, get ready to:

Design an ACL policy restricting Guest VLAN access.
Create and apply a named extended ACL on the router.
Test the security policy from multiple VLANs.

Design your ACL policy

Before writing any commands, you need to define exactly what traffic to allow and deny. Your security policy has three rules:

Guest VLAN (192.168.30.0/24) must be blocked from reaching Engineering (192.168.10.0/24).
Guest VLAN (192.168.30.0/24) must be blocked from reaching Sales (192.168.20.0/24).
All other traffic (Engineering to Sales, Engineering to Guest, Sales to Guest) must be permitted to flow freely.

Why apply the ACL inbound on the Guest subinterface?

Extended ACLs should be placed close to the source of the traffic you want to deny. By applying the ACL inbound on GigabitEthernet0/0.30 (the Guest subinterface), you stop unwanted Guest traffic before it even enters the router's forwarding path.

This saves the router from processing packets it would eventually drop anyway.

Create and apply the extended ACL on the router

You will create a named extended ACL called GUEST-RESTRICT and apply it to the Guest subinterface in one CLI session.

Click on your router in the Packet Tracer topology to open it.
Select the CLI tab.
Enter the following commands to create the ACL and apply it to the Guest VLAN subinterface:

enable
configure terminal
ip access-list extended GUEST-RESTRICT
deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
permit ip any any
exit
interface GigabitEthernet0/0.30
ip access-group GUEST-RESTRICT in
exit
end

What does each command do?

ip access-list extended GUEST-RESTRICT creates a named extended ACL. Named ACLs are easier to read and edit than numbered ones.
deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 blocks all IP traffic from the Guest subnet to the Engineering subnet. The 0.0.0.255 is a wildcard mask matching any host in the /24 network.
permit ip any any allows all other traffic. Without this line, the implicit deny at the end of every ACL would block everything.
ip access-group GUEST-RESTRICT in applies the ACL to inbound traffic arriving on the Guest subinterface.

Verify the ACL was created by running:

show access-lists

You should see your GUEST-RESTRICT ACL listed with three entries: two deny rules and one permit rule. The match counts will show 0 since no traffic has been processed yet.

Not seeing the ACL in the output?

Make sure you typed ip access-list extended GUEST-RESTRICT (not just access-list). The ip prefix is required for named ACLs.
Confirm you exited the ACL sub-mode with exit before entering the interface configuration.
Check that you ran end to return to privileged EXEC mode before running show access-lists.

help me troubleshoot my ACL configuration in Packet Tracer

✔️ Awesome, I've got everything!

Great. Your ACL is created and applied. Time to test it.

ⓧ I'd like to double check the full config

Here is the complete ACL configuration that should now exist on your router:

ip access-list extended GUEST-RESTRICT
 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
 permit ip any any
!
interface GigabitEthernet0/0.30
 ip access-group GUEST-RESTRICT in

Test the security policy

The ACL is in place. Now you need to confirm it actually blocks what it should and permits what it should.

Click on PC4 (Guest VLAN 30) in your topology.
Go to Desktop > Command Prompt.

Before you run the ping, predict what will happen. Do you think PC4 (Guest) will successfully reach PC0 (Engineering) at 192.168.10.10?

Run this ping from PC4:

ping 192.168.10.10

The ping fails. You should see "Request timed out" or "Destination host unreachable." That is exactly what your ACL is enforcing.

Still on PC4, try pinging a Sales PC:

ping 192.168.20.10

This also fails. Guest is blocked from both internal departments.

Now click on PC0 (Engineering VLAN 10) and open Desktop > Command Prompt.
Ping a Sales PC from Engineering:

ping 192.168.20.10

This ping succeeds. Engineering and Sales can still communicate freely with each other.

From PC0, ping a Guest PC to confirm Engineering can still reach Guest:

ping 192.168.30.10

This also succeeds. The ACL only restricts traffic originating from the Guest VLAN, not traffic going to it.

Why can Engineering reach Guest but not the other way around?

The ACL is applied inbound on the Guest subinterface (Gi0/0.30). It only inspects traffic entering the router from the Guest VLAN.

Traffic from Engineering to Guest enters through Gi0/0.10, which has no ACL. The filter is directional, not bidirectional.

Return to the router CLI and verify the ACL hit counts:

show access-lists

You should see match counts in parentheses next to the deny rules, confirming packets were blocked. The output looks similar to:

Extended IP access list GUEST-RESTRICT
    deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 (4 matches)
    deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255 (4 matches)
    permit ip any any (8 matches)

What do the match counts mean?

Each number in parentheses shows how many packets hit that rule. Your exact counts may differ depending on how many pings you ran. Any number greater than 0 on the deny lines proves the ACL is actively blocking Guest traffic.

Save your running configuration to startup config so the ACL persists across reboots:

copy running-config startup-config

When prompted to confirm the filename, press Enter to accept the default.
Save your Packet Tracer topology by pressing Ctrl+S (or File > Save).

Pings from Guest are succeeding when they should fail?

Confirm the ACL is applied to the correct interface. Run show running-config | section GigabitEthernet0/0.30 and look for ip access-group GUEST-RESTRICT in.
Check the direction. The ACL must be applied in (inbound), not out. Outbound on this interface would filter traffic going TO Guest, not FROM Guest.
Verify the source subnet in your deny rules is 192.168.30.0 0.0.0.255 (the Guest subnet). A typo in the wildcard mask can silently break the rule.

help me figure out why my ACL is not blocking Guest VLAN traffic

Secret mission

Add a Branch Office and Troubleshoot a WAN Failure

Real network engineers manage multi-site topologies and diagnose failures under pressure. This mission extends your network with a second location connected over a WAN link, introduces a deliberate routing failure, and challenges you to diagnose it using systematic troubleshooting methodology.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project runs entirely locally using Cisco Packet Tracer, so there are no ongoing costs or cloud resources to manage.

Resources you used:

Your .pkt topology file saved on your machine.
Your troubleshooting report (saved in the .pkt file notes or as a separate text file).

Keep everything running

No action needed. Choose this if you plan to extend or demo this topology again soon.

Your .pkt file is saved locally on your machine. Open it anytime in Packet Tracer to demo or extend.
Consider uploading the .pkt file to a GitHub repository alongside a README documenting your topology, IP scheme, and security policy.
No processes are running in the background. Closing Packet Tracer stops everything.

Pause - I'll come back to this later

Since Packet Tracer runs entirely locally with no background processes, pausing is as simple as closing the application.

Make sure you have saved your .pkt file (File > Save or Ctrl+S).
Close Cisco Packet Tracer. Your topology, device configurations, and notes are all preserved inside the .pkt file.
When you return, double-click the .pkt file to reopen the full topology exactly where you left off.

Delete - I don't want to use this again

Remove your project files from your machine entirely.

Close Cisco Packet Tracer if it is still open.
Navigate to the folder where you saved your .pkt file (likely your Desktop).
Delete the .pkt topology file.
If you saved your troubleshooting report as a separate text file, delete that as well.
Empty your Recycle Bin (Windows) to fully remove the files.

What about Cisco Packet Tracer itself?

You do not need to uninstall Packet Tracer. It takes up minimal disk space and is useful for future networking practice or interviews.

If you do want to remove it, use Settings > Apps > Apps & features on Windows, find Cisco Packet Tracer in the list, and click Uninstall.

Nice Work!

Nice work! You just built a fully segmented, routed, and secured small office network from scratch in Cisco Packet Tracer.

You've learned how to:

Build a three-VLAN office network that isolates Engineering, Sales, and Guest departments into separate broadcast domains, then restore controlled connectivity using router-on-a-stick inter-VLAN routing with 802.1Q trunking.
Configure DHCP pools on a router for automatic IP assignment across multiple VLANs, with excluded address ranges protecting gateway IPs from being handed out to clients.
Apply an extended named ACL (GUEST-RESTRICT) that blocks Guest VLAN traffic from reaching internal department resources while permitting all other inter-VLAN communication.
Secret Mission: Extended the network with a WAN-connected branch office, diagnosed a deliberate interface failure using systematic troubleshooting tools (show ip interface brief, show ip route, ping, traceroute), and documented the resolution.

Ready to quiz yourself?