Retail Network: Segmented LAN

Build a segmented retail LAN with VLANs, trunks, and multilayer routing.

Introduction

30 Second Summary

Retail stores rely on many connected devices. Clear boundaries keep each business role in its proper part of the network.

In this project, you will build a small retail store network in Cisco Packet Tracer. You will use VLANs to separate store roles before activating Layer 3 routing on the 3560 core.

What You'll Build

You will rerun a previously failed POS-to-manager ping and watch replies arrive through your segmented retail network.

By the end of this project, you'll have:

  • A labeled store topology where you can trace every wired endpoint to FRONT-SW, BACK-SW, or CORE-SW.
  • A segmented LAN where you can inspect access ports plus trunk uplinks to prove each business role stays in the correct VLAN.
  • Working inter-VLAN routing that turns the failed POS-to-manager test into successful ping replies through the 3560 core.
  • Secret Mission: A dedicated SERVICES VLAN 50 that isolates the printer role without breaking manager-to-printer reachability.

Do I need any experience before starting?

You need basic familiarity with Cisco IOS, VLANs, and IPv4 subnetting.

Cisco Packet Tracer should already be installed on your Mac with a working sign-in.

Before We Start

Before you place the first device, lock in the purpose of this retail network. Your plan separates POS, self-checkout, staff, and guest traffic before routing connects the store roles deliberately.

Build and Cable the Retail Topology

Every VLAN assignment later in this lab needs to map to a real store device. A clear physical layout makes each switch-port decision traceable.

In this step, you'll turn the blank Cisco Packet Tracer workspace into the store's physical layout. The finished layout gives every wired device a known access-switch port.

In this step, get ready to:
  • Place the core, access, edge, and external infrastructure.
  • Place each store endpoint around its access switch.
  • Cable every active LAN link to its designated switch port.
Place and label the infrastructure

The multilayer switch forms the center of the store LAN. The two access switches sit beside it so each business area has a clear path to the core.

  • Select Switches in the Device-Type Selection Box.
  • Drag one 3560-24PS from the Device-Specific Selection Box to the center of the Logical workspace.
  • Drag two 2960-24TT switches into the Logical workspace.
  • Position one 2960-24TT to the left of the core switch.
  • Position the other 2960-24TT to the right of the core switch.
  • Select Routers in the Device-Type Selection Box.
  • Drag two 2911 routers to the right side of the workspace.
  • Select End Devices in the Device-Type Selection Box.

You should now see three switches plus two routers in the workspace. The core switch sits between the two access switches.

  • Drag one Server-PT beside the routers.
  • Rename the 3560-24PS to CORE-SW through the display label below its icon.
  • Rename the left 2960-24TT to FRONT-SW through the display label below its icon.
  • Rename the right 2960-24TT to BACK-SW through the display label below its icon.
  • Rename the two routers EDGE-RTR and ISP-RTR through their display labels.
  • Rename the server PAYMENT-SERVER through its display label.

Why Stage the Edge Devices?

The routers and payment server reserve space for later Internet and payment-connectivity work. Keeping them unconnected prevents unfinished edge links from distracting you during the LAN build.

Place and label the store endpoints

The endpoint layout turns switch ports into recognizable store roles. Front-of-store systems belong around FRONT-SW. Back-office systems belong around BACK-SW.

  • Select End Devices in the Device-Type Selection Box.
  • Place ten PC-PT devices around the access switches.
  • Position seven of the PCs near FRONT-SW.
  • Position three of the PCs near BACK-SW.
  • Place one access point near the front-of-store group.
  • Place one laptop beside the staged edge equipment.

The workspace now has endpoint groups around both access switches. The laptop remains beside the future edge network.

  • Rename four front-of-store PCs POS1, POS2, POS3, and POS4.
  • Rename three front-of-store PCs SCO1, SCO2, and SCO3.
  • Rename the back-office PCs MANAGER, INVENTORY, and PRINTER.
  • Rename the access point GUEST-AP.
  • Rename the laptop GUEST-LAPTOP.

Why Use a PC for the Printer Role?

The PRINTER PC represents a network printer role. Its standard static-address tools make the later connectivity tests consistent with every other wired endpoint.

Cable the store LAN

The endpoint links define which access ports serve each store role. The two switch uplinks connect those access layers to the central core.

  • Select Connections in the Device-Type Selection Box.
  • Select Copper Straight-Through in the Device-Specific Selection Box.
  • Connect POS1 through POS4 in order to FRONT-SW ports FastEthernet0/1 through FastEthernet0/4.
  • Connect SCO1 through SCO3 in order to FRONT-SW ports FastEthernet0/5 through FastEthernet0/7.
  • Connect GUEST-AP to FRONT-SW port FastEthernet0/8.
  • Connect MANAGER to BACK-SW port FastEthernet0/1.
  • Connect INVENTORY to BACK-SW port FastEthernet0/2.
  • Connect PRINTER to BACK-SW port FastEthernet0/3.

What Do These Links Establish?

This lab uses Copper Straight-Through for every endpoint-to-switch connection. Each selected FastEthernet port now identifies the business role attached to it.

The switch-to-switch uplinks use a different cable type. These links provide the physical path that later carries the store's separated traffic to the core.

  • Select Copper Cross-Over in the Device-Specific Selection Box.
  • Connect FRONT-SW GigabitEthernet0/1 to CORE-SW GigabitEthernet0/1.
  • Connect BACK-SW GigabitEthernet0/1 to CORE-SW GigabitEthernet0/2.
  • Keep EDGE-RTR, ISP-RTR, PAYMENT-SERVER, and GUEST-LAPTOP unconnected.

The switch uplinks can remain amber for about a minute while they converge. That short pause is normal.

Before you inspect the links, which connected devices do you expect to show green at both ends?

  • Inspect every connected endpoint link in the Logical workspace.
  • Inspect both switch uplinks in the Logical workspace.

You'll see green link lights on every connected endpoint link plus both switch uplinks. The staged edge devices and guest laptop remain visibly unconnected.

Link Lights Still Amber or Red?

Confirm that endpoint links use Copper Straight-Through. Confirm that both switch uplinks use Copper Cross-Over.

Recheck each selected switch port against the port map above. The routers, payment server, and guest laptop should still have no connections.

Help me trace a Packet Tracer link that is not turning green.

Your blank workspace is now a traceable retail LAN. Every active store device has a physical path to the correct access switch.

Your store layout is cabled and ready. Next up, you'll separate its business roles into dedicated VLANs.

Segment the Store Devices

Your cabled store is now visible in Cisco Packet Tracer. The green links prove that every connected device has a physical path into the network.

Every endpoint still belongs to the default broadcast domain. This step creates role-based VLANs before the routing layer is ready.

In this step, get ready to:
  • Create the same six VLANs on all three switches.
  • Assign each endpoint-facing access port to its business-role VLAN.
  • Address three test hosts to expose the intended cross-VLAN boundary.
Create the VLAN set

Each switch stores its own VLAN database through Cisco IOS. Matching databases give every switch the same names for each store role.

  • Select CORE-SW in the Logical workspace.
  • Open its command-line interface.
  • Configure its hostname and VLAN database by entering:
enable
configure terminal
hostname CORE-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
end
show vlan brief

What does this configuration do?

  • The first two lines enter privileged EXEC mode and global configuration mode.
  • The hostname line aligns the command prompt with the switch label in your topology.
  • Each vlan line creates or selects one broadcast domain.
  • Each name line gives that VLAN its business-role label.
  • The final line displays the VLAN database for verification.

You should see VLANs 10, 20, 30, 40, 99, and 999 listed as active with their matching names.

  • Switch back to FRONT-SW in the Logical workspace.
  • Open its command-line interface.
  • Configure its hostname and matching VLAN database by entering:
enable
configure terminal
hostname FRONT-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
end
show vlan brief

Why match the front switch?

The same VLAN IDs must represent the same store roles wherever they appear. The final verification line confirms that FRONT-SW has all six active VLANs.

You should see the same six named VLANs in the FRONT-SW summary.

  • Switch back to BACK-SW in the Logical workspace.
  • Open its command-line interface.
  • Configure its hostname and matching VLAN database by entering:
enable
configure terminal
hostname BACK-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
end
show vlan brief

Why match the back switch?

The shared VLAN database prepares BACK-SW to recognize every store role. The final verification line confirms that all six VLANs are active.

All three switches should now list the same six named VLANs as active.

Missing a VLAN from the summary?

  • Return to global configuration mode on the switch with the missing entry.
  • Re-enter the VLAN number from the configuration block.
  • Re-enter the matching VLAN name.
  • Run the final verification line again.

Ask for help with the switch output if the entry is still missing: Help me compare my Cisco IOS VLAN configuration with the required retail VLAN set.

Assign the endpoint-facing access ports

An access port places endpoint traffic into one VLAN. Interface ranges apply the same access settings to contiguous ports with fewer commands.

  • Return to the FRONT-SW command-line interface.
  • Assign its POS ports to VLAN 10 by entering the configuration below.
  • Assign its self-checkout ports to VLAN 20 through the same configuration.
  • Assign its guest access point port to VLAN 40 through the same configuration:
enable
configure terminal
interface range fastethernet 0/1 - 4
 switchport mode access
 switchport access vlan 10
interface range fastethernet 0/5 - 7
 switchport mode access
 switchport access vlan 20
interface fastethernet 0/8
 switchport mode access
 switchport access vlan 40
end
show vlan brief

How are the front ports divided?

  • Ports FastEthernet0/1 through FastEthernet0/4 carry the four POS terminals in VLAN 10.
  • Ports FastEthernet0/5 through FastEthernet0/7 carry the three self-checkout terminals in VLAN 20.
  • Port FastEthernet0/8 carries the guest access point in VLAN 40.

The VLAN summary should place ports FastEthernet0/1 through FastEthernet0/4 under POS. It should place ports FastEthernet0/5 through FastEthernet0/7 under SCO.

You should also see FastEthernet0/8 under GUEST.

  • Return to the BACK-SW command-line interface.
  • Assign its three back-office ports to VLAN 30 by entering:
enable
configure terminal
interface range fastethernet 0/1 - 3
 switchport mode access
 switchport access vlan 30
end
show vlan brief

How are the back-office ports grouped?

Ports FastEthernet0/1 through FastEthernet0/3 now belong to STAFF VLAN 30. Those ports connect the manager endpoint, inventory endpoint, and initial printer role.

The BACK-SW summary should list FastEthernet0/1 through FastEthernet0/3 under STAFF.

Port listed under the wrong VLAN?

  • Compare the affected port number with the retail port plan.
  • Return to global configuration mode on the correct access switch.
  • Reapply the access mode to the affected port.
  • Reapply the required VLAN assignment to the affected port.

Ask for help if a port remains in the wrong group: Help me troubleshoot a Cisco switch access port that appears under the wrong VLAN.

Address three hosts and test the boundary

Static IPv4 settings create two test paths through the segmented store. One path stays inside the POS role while the other crosses into STAFF.

  • Select POS1 in the Logical workspace.
  • Select Desktop.
  • Select IP Configuration.
  • Enter 10.10.10.11 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 10.10.10.1 in the Default Gateway field.

You should see all three POS1 addressing fields populated with the values you entered.

  • Return to the Logical workspace.
  • Select POS2.
  • Select Desktop.
  • Select IP Configuration.
  • Enter 10.10.10.12 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 10.10.10.1 in the Default Gateway field.

You should see POS2 using a second address in the same POS subnet.

  • Return to the Logical workspace.
  • Select MANAGER.
  • Select Desktop.
  • Select IP Configuration.
  • Enter 10.10.30.11 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 10.10.30.1 in the Default Gateway field.

The three test hosts are addressed. POS1 and POS2 use the POS subnet while MANAGER uses the STAFF subnet.

  • Return to POS1 in the Logical workspace.
  • Select Desktop.
  • Select Command Prompt.

Before you run this check, do you expect two POS devices on the same subnet to communicate?

  • Test the path from POS1 to POS2 by running:
ping 10.10.10.12

What should you see?

You should receive replies from 10.10.10.12. The successful result proves that the two POS access ports share VLAN 10.

  • Repeat the command once if the first result is incomplete.

No replies from POS2?

  • Confirm that POS1 uses the address 10.10.10.11.
  • Confirm that POS2 uses the address 10.10.10.12.
  • Confirm that both endpoints use the mask 255.255.255.0.
  • Confirm that both connected switch ports appear under POS VLAN 10.

Ask for help if the same-VLAN test still fails: Help me troubleshoot a failed ping between POS1 and POS2 in VLAN 10.

Before you run the next check, do you think POS1 can reach a host in the STAFF subnet with the current switch configuration?

  • Test the path from POS1 to MANAGER by running:
ping 10.10.30.11

This failure is intentional

You should see the requests fail. The access ports enforce the VLAN boundary while no Layer 3 routing service exists to connect the POS and STAFF subnets.

This failed test is evidence that your segmentation works. A later step adds the gateway interfaces that make this same path routable.

✔️ Awesome, I've got everything!

Great work. Your three switches share the VLAN set, the access ports match the store roles, and the two ping tests prove the boundary.

ⓧ I'd like to double check the full code

Compare each switch with the cumulative command sequence below. Then compare the three endpoint addresses with the final checklist.

enable
configure terminal
hostname CORE-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
end
show vlan brief

CORE-SW checkpoint

The core switch has six active VLANs with the required names. No endpoint-facing access ports are assigned on this switch.

enable
configure terminal
hostname FRONT-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
interface range fastethernet 0/1 - 4
 switchport mode access
 switchport access vlan 10
interface range fastethernet 0/5 - 7
 switchport mode access
 switchport access vlan 20
interface fastethernet 0/8
 switchport mode access
 switchport access vlan 40
end
show vlan brief

FRONT-SW checkpoint

The front switch places four POS ports in VLAN 10. It places three self-checkout ports in VLAN 20.

The guest access point port belongs to VLAN 40.

enable
configure terminal
hostname BACK-SW
vlan 10
 name POS
vlan 20
 name SCO
vlan 30
 name STAFF
vlan 40
 name GUEST
vlan 99
 name MGMT
vlan 999
 name NATIVE
interface range fastethernet 0/1 - 3
 switchport mode access
 switchport access vlan 30
end
show vlan brief

BACK-SW checkpoint

The back switch places MANAGER, INVENTORY, and PRINTER access ports in STAFF VLAN 30.

  • POS1 uses IPv4 address 10.10.10.11. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.10.1.
  • POS2 uses IPv4 address 10.10.10.12. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.10.1.
  • MANAGER uses IPv4 address 10.10.30.11. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.30.1.

That boundary is working exactly as designed. Next, you will turn the switch uplinks into trunks that preserve each VLAN as traffic moves toward the core.

Build the Trunk Uplinks

Your role-based VLANs now separate the store endpoints. Each access switch still needs a path that carries those VLANs to CORE-SW.

An 802.1Q trunk preserves each VLAN's identity while carrying traffic across one switch-to-switch link. VLAN 999 becomes the native VLAN on all four trunk interfaces.

In this step, get ready to:
  • Configure both CORE-SW uplinks as static trunks.
  • Configure the uplink on each access switch with native VLAN 999.
  • Verify trunk state and recheck endpoint VLAN membership.
Configure the core uplinks

CORE-SW is the meeting point for both access switches. Its two uplinks must become static trunks so they can carry the store VLANs.

  • Return to the Logical workspace in Cisco Packet Tracer.
  • Select CORE-SW.
  • Select the CLI tab.
  • Press Enter to place the cursor at the command prompt.
  • Configure both core-facing uplinks by entering these commands:
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 999
end

What do these commands do?

  • The enable command enters privileged EXEC mode.
  • The configure terminal command enters global configuration mode.
  • Each interface command selects one physical uplink on CORE-SW.
  • The switchport mode trunk command places the selected interface into permanent trunking mode.
  • The switchport trunk native vlan 999 command assigns native traffic to VLAN 999.

Your prompt returns to CORE-SW#. You may briefly see a message about a native-VLAN mismatch while the access-side ports still use their previous setting.

Core trunk commands not accepted?

Confirm that you selected CORE-SW. Check that each interface command names GigabitEthernet0/1 or GigabitEthernet0/2.

Check that you entered privileged EXEC mode before global configuration mode. Help me troubleshoot the trunk commands on CORE-SW.

Configure the access-switch uplinks

Each trunk needs matching settings at both ends of its cable. The access switches use the same uplink interface and native VLAN.

  • Select FRONT-SW.
  • Select the CLI tab.
  • Configure its core-facing uplink by entering these commands:
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
end

How does this complete the link?

The command set converts GigabitEthernet0/1 into a static trunk. Its native VLAN now matches VLAN 999 on the connected core interface.

The default allowed-VLAN list remains unchanged. The trunk can carry every store VLAN created earlier.

  • Select BACK-SW.
  • Select the CLI tab.
  • Repeat the same command block on its GigabitEthernet0/1 uplink.

Good progress. Both ends of each uplink now use static trunking with native VLAN 999.

Still seeing a native-VLAN warning?

Confirm that VLAN 999 exists on all three switches. Check that every trunk interface uses VLAN 999 as its native VLAN.

Verify that you configured GigabitEthernet0/1 on each access switch. Help me find a native-VLAN mismatch in my retail topology.

Verify trunks and VLAN membership

Trunk verification confirms the operational state of each uplink. It also shows whether every link uses the expected native VLAN.

  • Select CORE-SW.
  • Select the CLI tab.

Before you check, how many trunking interfaces do you expect CORE-SW to report?

  • Verify trunk state on CORE-SW by entering:
show interfaces trunk

What does this command show?

The show interfaces trunk command displays operational trunk interfaces. It also reports the native VLAN and allowed VLAN information for each trunk.

You should see GigabitEthernet0/1 and GigabitEthernet0/2 with a trunking status. Both entries should use native VLAN 999.

  • Select FRONT-SW.
  • Select the CLI tab.
  • Run the same trunk verification command.
  • Select BACK-SW.
  • Select the CLI tab.
  • Run the same trunk verification command.

Each access switch should show GigabitEthernet0/1 with a trunking status. Every reported trunk should use native VLAN 999.

Missing a trunk interface?

Check both ends of the missing link. A trunk requires the connected core interface and access interface to use the intended trunk settings.

Confirm that the physical uplinks still connect the ports from your topology map. Help me troubleshoot a missing interface in show interfaces trunk.

The access ports must retain their earlier VLAN assignments after the uplinks become trunks. The trunk interfaces should stay outside the access-port membership lists.

  • Verify VLAN membership on FRONT-SW by entering:
show vlan brief

What should remain unchanged?

The show vlan brief command lists active VLANs and their access-port membership. A trunk interface does not appear as an access port under one VLAN.

  • Repeat the VLAN membership check on BACK-SW.

On FRONT-SW, the POS ports should remain in VLAN 10. The SCO ports should remain in VLAN 20.

The guest access-point port should remain in VLAN 40. On BACK-SW, the three endpoint ports should remain in VLAN 30.

Seeing an endpoint under the wrong VLAN?

Compare the displayed access-port membership with the assignments from the previous step. Confirm that neither access-switch trunk uses a FastEthernet endpoint port.

Check that each uplink uses GigabitEthernet0/1. Help me check the VLAN membership on my access switches.

✔️ Awesome, I've got everything!

Excellent. CORE-SW reports two trunks. Each access switch reports one trunk with native VLAN 999.

ⓧ I'd like to double check the full code

The complete trunk command sets for the three switches are shown below.

CORE-SW trunk commands
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
interface GigabitEthernet0/2
 switchport mode trunk
 switchport trunk native vlan 999
end
show interfaces trunk

What should match on CORE-SW?

Both core uplinks use static trunk mode. Both interfaces use VLAN 999 as the native VLAN.

Access-switch trunk commands
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
end
show interfaces trunk

What should match on both access switches?

Run this command set on FRONT-SW and BACK-SW. Each switch should report one trunk on GigabitEthernet0/1 with native VLAN 999.

Your trunks now carry the store VLANs to the core while preserving their identities. Next, you will make CORE-SW the default gateway that routes between them.

Route Between the Store VLANs

Your retail topology in Cisco Packet Tracer now carries each VLAN over verified 802.1Q trunks to CORE-SW. POS1 still cannot reach MANAGER because the core has no Layer 3 gateway interfaces.

This step turns CORE-SW into the default gateway for every store subnet. Switch virtual interfaces provide those gateway addresses.

Inter-VLAN routing then moves traffic between the separated networks. The failed POS-to-STAFF test becomes your proof that the routing layer works.

In this step, get ready to:
  • Configure one gateway SVI for each routed store VLAN.
  • Enable Layer 3 forwarding on CORE-SW.
  • Repeat the POS-to-STAFF connectivity test through the new gateways.
Build the SVI gateway plan

Each SVI uses the .1 address from its VLAN subnet. The three configured test hosts already use these addresses as their default gateways.

  • Return to the CORE-SW command line from earlier.
  • Build all five gateway interfaces by entering this command sequence:
enable
configure terminal

interface vlan 10
 ip address 10.10.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

interface vlan 30
 ip address 10.10.30.1 255.255.255.0
 no shutdown

interface vlan 40
 ip address 10.10.40.1 255.255.255.0
 no shutdown

interface vlan 99
 ip address 10.10.99.1 255.255.255.0
 no shutdown
end

What does this configuration do?

  • Each interface block gives one VLAN its default-gateway address.
  • The subnet mask gives every gateway a /24 network.
  • The no shutdown line enables each SVI.
  • Display the SVI addresses and operational states by running:
show ip interface brief

How do I read the interface summary?

The summary pairs every SVI with the gateway address you configured. An SVI becomes operational when its VLAN is active through an access port or forwarding trunk.

You should see Vlan10, Vlan20, Vlan30, Vlan40, and Vlan99 with their gateway addresses. Each operational SVI should show both status fields as up.

Seeing an SVI down?

Confirm that the matching VLAN still exists on CORE-SW. Check that the trunks from the previous step remain active.

Confirm that the affected interface includes no shutdown. A missing interface command leaves that gateway unavailable.

Help me troubleshoot an SVI that is not up on CORE-SW.

Enable Layer 3 forwarding

The SVIs give CORE-SW an address inside each store subnet. IPv4 forwarding lets the switch move packets from one SVI to another.

  • Enable routing and inspect the resulting Layer 3 state by entering this command sequence:
configure terminal
ip routing
end
show ip interface brief
show ip route

What does this command sequence prove?

  • The ip routing line enables IPv4 forwarding on the multilayer switch.
  • The interface summary confirms which gateway interfaces are operational.
  • The routing table confirms which store networks are directly connected to the core.

The routing table should now list the active SVI subnets as directly connected networks. This confirms that CORE-SW has a route into each active store VLAN.

Missing a connected route?

Check the interface summary for the SVI tied to the missing subnet. A connected route only appears while that SVI is operational.

Confirm that the SVI has the planned address. Confirm that the corresponding VLAN remains active on a forwarding link.

Help me find a missing connected route on CORE-SW.

Repeat the cross-VLAN test

POS1 still uses 10.10.10.1 as its default gateway. MANAGER still uses 10.10.30.1 as its default gateway.

  • Select POS1 in the Logical workspace.
  • Select Desktop.
  • Select Command Prompt.

Before you test the route, do you expect this attempt to match the failure from Step 2?

  • Test the route from POS1 to MANAGER by entering this command:
ping 10.10.30.11

What does this test prove?

You should receive replies from 10.10.30.11. POS1 sends off-subnet traffic to its gateway on CORE-SW.

The core forwards the packets into VLAN 30 through its STAFF gateway. MANAGER can return the replies through that same routing path.

That is the routing layer working: POS1 can now reach MANAGER through CORE-SW.

Still seeing the ping fail?

Repeat the test once if the first attempt is incomplete. The initial attempt can pause while address resolution finishes.

Confirm that POS1 still uses 10.10.10.1 as its gateway. Confirm that MANAGER still uses 10.10.30.1 as its gateway.

Help me troubleshoot the failed POS1-to-MANAGER ping.

✔️ Awesome, I've got everything!

Your five gateway SVIs are configured on CORE-SW. Layer 3 routing now carries traffic successfully from POS1 to MANAGER.

ⓧ I'd like to double check the full code

This reference contains the complete Layer 3 configuration added to CORE-SW in this step.

interface vlan 10
 ip address 10.10.10.1 255.255.255.0
 no shutdown

interface vlan 20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

interface vlan 30
 ip address 10.10.30.1 255.255.255.0
 no shutdown

interface vlan 40
 ip address 10.10.40.1 255.255.255.0
 no shutdown

interface vlan 99
 ip address 10.10.99.1 255.255.255.0
 no shutdown

ip routing

What should match?

Each interface block contains the gateway address for its store VLAN. The final line enables routing between those gateway interfaces.

Your core now routes traffic between the wired store VLANs. Next, you'll address the remaining endpoints and validate the complete store LAN.

Validate and Save the Store LAN

Your successful POS1-to-MANAGER test proved that CORE-SW can route between the POS network and the STAFF network.

A single successful ping can still hide an addressing mistake elsewhere. You will test every wired role before saving the Packet Tracer lab for follow-on work.

In this step, get ready to:
  • Complete the static addressing for every remaining wired endpoint.
  • Run the wired connectivity matrix across the store VLANs.
  • Preserve the completed lab state.
Address the remaining wired endpoints

Static IPv4 addressing gives each wired endpoint an identity within its assigned subnet. The default gateway points each endpoint toward its matching SVI on CORE-SW.

Use the wired address plan

  • POS3 uses IPv4 address 10.10.10.13. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.10.1.
  • POS4 uses IPv4 address 10.10.10.14. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.10.1.
  • SCO1 uses IPv4 address 10.10.20.11. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.20.1.
  • SCO2 uses IPv4 address 10.10.20.12. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.20.1.
  • SCO3 uses IPv4 address 10.10.20.13. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.20.1.
  • INVENTORY uses IPv4 address 10.10.30.12. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.30.1.
  • PRINTER uses IPv4 address 10.10.30.13. Its subnet mask is 255.255.255.0. Its default gateway is 10.10.30.1.
  • Select POS3 in the Logical workspace.
  • Click Desktop.
  • Click IP Configuration.
  • Enter the three values listed for POS3.
  • Compare the three displayed values with the address plan.
  • Close the device window.
  • Repeat this workflow for POS4, SCO1, SCO2, SCO3, INVENTORY, and PRINTER.

Good progress. Every wired endpoint now has a static address from its assigned store subnet.

Run the routed test matrix

The test matrix checks local switching within one VLAN. It also checks inter-VLAN routing through CORE-SW.

  • Select POS1 in the Logical workspace.
  • Click Desktop.
  • Click Command Prompt.

Before you run these tests, do you expect both destinations to reply even though only one shares the POS VLAN?

  • Test the local POS path and the routed SCO path by running these commands:
ping 10.10.10.14
ping 10.10.20.11

What should you see?

  • Replies from 10.10.10.14 confirm that POS1 can reach POS4 within VLAN 10.
  • Replies from 10.10.20.11 confirm that POS1 can reach SCO1 through the routing on CORE-SW.
  • Close the POS1 device window.
  • Select SCO1 in the Logical workspace.
  • Click Desktop.
  • Click Command Prompt.
  • Test the routed path to MANAGER by running this command:
ping 10.10.30.11

What should you see?

You should receive replies from 10.10.30.11. This proves that traffic can travel from VLAN 20 to VLAN 30 through CORE-SW.

  • Close the SCO1 device window.
  • Select MANAGER in the Logical workspace.
  • Click Desktop.
  • Click Command Prompt.
  • Test the local STAFF path to PRINTER by running this command:
ping 10.10.30.13

What should you see?

You should receive replies from 10.10.30.13. This confirms that MANAGER can reach the printer-role endpoint within VLAN 30.

That is the full wired matrix working. Your POS terminals, self-checkout systems, staff devices, and printer role can now use the intended network paths.

Missing a reply?

  • Repeat the failed ping once in case the first request was incomplete while address resolution finished.
  • Compare the source endpoint's IPv4 profile with the address plan.
  • Check the source endpoint's access port against the VLAN assignment table.
  • Confirm that the relevant trunk remains operational.
  • Confirm that the relevant SVI on CORE-SW reports up/up.

Need another pair of eyes? Help me diagnose a failed ping in my segmented Packet Tracer store LAN.

Save the device and activity state

The running configuration holds the settings currently operating on each switch. Copying it to the startup configuration preserves those settings for the next time the device starts.

The CLI may ask you to confirm the destination after the save command. Its displayed default targets the startup configuration.

Before you run the save command, what state do you expect the startup configuration to hold afterward?

  • Return to the CORE-SW CLI from earlier.
  • Save its running configuration by running this command:
copy system:running-config nvram:startup-config

What does this command do?

This copies the active running configuration into nonvolatile startup storage. The switch can use that saved configuration after a restart.

  • Press Enter if the CLI asks you to confirm the displayed destination.
  • Repeat the save sequence on FRONT-SW.
  • Repeat the save sequence on BACK-SW.

Each completed copy preserves the switch's current VLAN, port, trunk, or routing configuration in startup storage.

The switch copies preserve the device configurations. A .pkt file preserves the complete Packet Tracer workspace.

  • Click File in the Packet Tracer menu bar.
  • Click Save As….
  • Choose your Desktop as the save location.
  • Enter segmented-store-lan.pkt as the file name.
  • Confirm that Save as type shows Packet Tracer Activity File (*.pkt).

Before you complete the save, what file do you expect to see on your Desktop?

  • Click Save.
  • Keep EDGE-RTR, ISP-RTR, PAYMENT-SERVER, GUEST-AP, and GUEST-LAPTOP in the saved workspace for follow-on labs.

You should see segmented-store-lan.pkt on your Desktop. The activity now contains the completed routed retail topology.

Your saved store LAN

  • All wired endpoints have static /24 addressing with the matching SVI on CORE-SW as their default gateway.
  • The POS, SCO, STAFF, GUEST, MGMT, and NATIVE VLAN configuration remains in place across the three switches.
  • The static trunks retain native VLAN 999. The core SVIs retain IP routing.
  • The wired test matrix succeeds for POS1 to POS4, POS1 to SCO1, SCO1 to MANAGER, and MANAGER to PRINTER.
  • The running configurations on CORE-SW, FRONT-SW, and BACK-SW are copied to startup configuration.
  • The complete topology is saved as a .pkt file with the staged follow-on devices still available.

Your segmented store LAN is fully routed. Its verified configuration is now saved for the next lab.

Secret mission

Isolate the Store Printer

The printer still shares STAFF VLAN 30 with the manager and inventory systems. Move it into a dedicated SERVICES VLAN while preserving routed reachability from MANAGER.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Packet Tracer with no ongoing costs. Choose whether to keep the activity available, close it for later, or delete the saved file.

Resources you used:

  • Open Packet Tracer session containing the complete routed retail LAN.
  • Saved .pkt activity file containing the topology and device configurations.

Keep everything running

No action needed. Choose this if you want to continue building the retail network in the follow-on labs.

  • Keep the current Packet Tracer session open.
  • Keep the saved .pkt activity file on your Mac.
  • Reuse the saved topology when you add Guest Wi-Fi, Internet access, payment-server connectivity, or security controls.

Pause - I'll come back to this later

Close Packet Tracer to free up your Mac's memory. Your saved activity keeps the topology and startup configurations ready for later.

  • In the Packet Tracer session from earlier, save the current activity.
  • Close Packet Tracer.
  • Keep the saved .pkt activity file on your Mac for the follow-on labs.

Delete - I don't want to use this again

Deleting the activity permanently removes the topology once the file leaves your Mac. Your Packet Tracer installation and sign-in remain available for future projects.

  • Close Packet Tracer if it is still running.
  • Use macOS file search to locate the saved .pkt activity file from this project.
  • Delete the saved .pkt activity file from your Mac.
  • Confirm the activity file no longer appears in the folder where you saved it.

Nice Work!

Nice Work!

You did it! You built a routed retail LAN in Cisco Packet Tracer with a separate network boundary for every store role.

You've learned how to:

  • Built a store topology around CORE-SW, FRONT-SW, and BACK-SW. Labeled every infrastructure device plus endpoint by its retail role. Cabled each wired endpoint to its assigned access port.
  • Separated POS, self-checkout, staff, guest, management, native, and services traffic with role-based VLANs. Proved the boundary through the designed POS-to-STAFF ping failure.
  • Configured static 802.1Q trunks with native VLAN 999. Created switch virtual interfaces for the store subnets. Enabled inter-VLAN routing on the 3560 core. Validated successful pings across every wired business role.
  • Completed the printer isolation Secret Mission. Moved PRINTER into SERVICES VLAN 50. Confirmed routed reachability from MANAGER.

Ready to quiz yourself?