Multi-VLAN Office Network Setup

Introduction

30 Second Summary

In a real office, you wouldn't want the sales team's file transfers slowing down the engineering team's code deployments. Network segmentation solves this by creating separate "lanes" of traffic on the same physical network.

In this project, you will build a multi-VLAN office network in Cisco Packet Tracer that segments two departments onto isolated broadcast domains and routes traffic between them using a single router link.

What You'll Build

A company network with two VLANs spanning two switches, connected by 802.1Q trunk links, with a Cisco router performing inter-VLAN routing through subinterfaces.

By the end of this project, you'll have:

• A working Packet Tracer topology with two switches, one router, and four PCs across two VLANs.
• Configured 802.1Q trunk links carrying tagged VLAN traffic between switches and up to the router.
• A proven router-on-a-stick setup with subinterfaces providing default gateways so PCs in different VLANs can successfully ping each other.
• Secret Mission: Add a Management VLAN and configure SSH for secure remote device administration.

Are there any prerequisites?

You need a basic understanding of what a router and a switch do. No prior VLAN or Cisco IOS CLI experience is required. This project covers CCNA 200-301 exam domains 1 through 3, which make up 65% of the exam weight.

Set Up Your Packet Tracer Topology

Every enterprise network starts with a physical foundation. Before you can configure VLANs or routing, you need devices placed, cabled, and given basic identities.

In this step, you will build the physical topology in Cisco Packet Tracer: one router, two switches, and four PCs representing a small two-department office. You will also configure hostnames and basic security on each device.

In this step, get ready to:

• Build the physical topology with a router, two switches, and four PCs.
• Configure hostnames and basic security settings on each network device.
• Verify all physical connections are active and working.

Build the physical topology

You need seven devices in total: one router to handle inter-VLAN routing, two switches to connect end devices, and four PCs representing users in two departments.

• In Packet Tracer, look at the bottom-left device panel. Click Network Devices (the icon that looks like a hub), then click Routers in the sub-category row.
• Find the 2911 router and drag it onto the workspace. This is your router.
• Click Network Devices again, then click Switches in the sub-category row.
• Find the 2960 switch and drag two of them onto the workspace. Place them below the router, side by side.
• Click End Devices in the device panel (the icon that looks like a PC monitor).
• Drag four PC icons onto the workspace. Place PC1 and PC2 below the left switch. Place PC3 and PC4 below the right switch.

What is the layout?

Your topology should look like a tree. The router sits at the top. The two switches sit in the middle row. The four PCs sit at the bottom, two under each switch.

The left switch is S1. The right switch is S2. PC1 and PC2 connect to S1. PC3 and PC4 connect to S2. S1 connects to both the router and S2.

Next, you will cable all devices together using Copper Straight-Through cables.

• Click the Connections icon in the bottom-left panel (the lightning bolt icon).
• Select Copper Straight-Through (the solid black line).
• Click the left switch (S1), select GigabitEthernet0/1, then click the router and select GigabitEthernet0/0.
• Click S1, select FastEthernet0/1, then click S2 and select FastEthernet0/1. This is the inter-switch link.
• Click S1, select FastEthernet0/2, then click PC1 and select FastEthernet0.
• Click S1, select FastEthernet0/3, then click PC2 and select FastEthernet0.
• Click S2, select FastEthernet0/2, then click PC3 and select FastEthernet0.
• Click S2, select FastEthernet0/3, then click PC4 and select FastEthernet0.

Why Copper Straight-Through cables?

Copper Straight-Through cables connect devices of different types: switch-to-router, switch-to-PC. Modern switches and Packet Tracer support auto-MDIX, so straight-through cables also work for switch-to-switch connections.

Wait about 30 seconds for the link lights to stabilize. The switch-to-switch and switch-to-PC links should turn green.

The router link light may show red

The red light on the router's GigabitEthernet0/0 port is expected. You will activate this interface in Step 4 when you configure inter-VLAN routing. For now, focus on ensuring all other links are green.

Configure hostnames and basic settings on each device

Each network device needs a hostname so you can identify it in the CLI. Basic security prevents unauthorized access to the device configuration.

• Click the router in the workspace to open its properties window.
• Click the CLI tab at the top of the properties window.
• If prompted "Would you like to enter the initial configuration dialog?", type no and press Enter.
• Configure R1 by entering these commands:

enable
configure terminal
hostname R1
no ip domain-lookup
enable secret class
line console 0
password cisco
login
exit
line vty 0 15
password cisco
login
exit
service password-encryption
end

What do these commands do?

• `enable` enters privileged EXEC mode. configure terminal enters global configuration mode where you can make changes.
• `hostname R1` sets the device name so the CLI prompt shows R1 instead of a generic label.
• `no ip domain-lookup` disables DNS lookups so mistyped commands don't cause a long delay while the device tries to resolve them as hostnames.
• `enable secret class` sets an encrypted password (class) required to enter privileged EXEC mode.
• `line console 0` and line vty 0 15 secure the console and remote access lines with the password cisco.
• `service password-encryption` encrypts all plain-text passwords stored in the configuration file.

• Close the router properties window by clicking the X in the top-right corner.
• Click the left switch (S1) in the workspace to open its properties window.
• Click the CLI tab. Press Enter if needed to get a prompt.
• Configure S1 by entering these commands:

enable
configure terminal
hostname S1
no ip domain-lookup
enable secret class
line console 0
password cisco
login
exit
line vty 0 15
password cisco
login
exit
service password-encryption
end

• Close the S1 properties window.
• Click the right switch (S2) in the workspace to open its properties window.
• Click the CLI tab. Press Enter if needed to get a prompt.
• Configure S2 by entering these commands:

enable
configure terminal
hostname S2
no ip domain-lookup
enable secret class
line console 0
password cisco
login
exit
line vty 0 15
password cisco
login
exit
service password-encryption
end

• Close the S2 properties window.

You should now see R1, S1, and S2 in the CLI prompts when you reopen each device. The hostname labels may also appear beneath each device icon in the workspace.

Seeing an error when typing commands?

• If you see a translating domain server message and a long pause, you forgot to type no ip domain-lookup. Wait for the timeout, then re-enter the command.
• If you see an Invalid input error, make sure you are in the correct mode. Type end to return to privileged EXEC mode, then start again with configure terminal.
• Help me debug this configuration error

Verify physical connectivity

Before moving on, confirm that your topology is wired correctly by checking the link lights in the Packet Tracer workspace.

• Look at the link lights (small colored dots) on each cable connection in the workspace.
• Confirm that all switch-to-switch and switch-to-PC links show green dots on both ends. Green means the link is up and forwarding traffic.
• Confirm that the S1-to-router link shows a green dot on the S1 side. The router side will show red because GigabitEthernet0/0 is administratively shut down (you will enable it in Step 4).
• If any switch-to-switch or switch-to-PC link shows orange dots, wait 30 seconds. Orange means STP (Spanning Tree Protocol) is still converging. The dots will turn green.

Links still showing red?

• Red dots on both ends of a switch-to-PC cable mean the cable is plugged into the wrong port. Click the cable to verify the port names match the connections listed above.
• If you accidentally used a Crossover cable instead of Copper Straight-Through, delete the cable (click it and press Delete) and reconnect with the correct cable type.
• Help me fix my red link lights

• Save your Packet Tracer file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
• Name the file VLAN-Lab.pkt and save it to your Desktop.

Your physical topology is ready and all devices have proper identities. Next up, you will create VLANs on both switches and assign ports to separate your Sales and Engineering departments.

Create VLANs and Assign Switch Ports

Your physical topology is in place and all devices can see each other at the hardware level. Right now, every port on both switches lives in the same broadcast domain (VLAN 1), meaning any device can talk to any other device.

In a real office, you want Sales traffic separated from Engineering traffic for security and performance. VLANs let you create these logical boundaries on a single physical switch. In this step, you will create two VLANs and assign each PC's port to the correct one.

In this step, get ready to:

• Create VLAN 10 (Sales) and VLAN 20 (Engineering) on both switches.
• Assign each PC's switch port to its department VLAN.
• Verify that VLAN assignments are correct and confirm that cross-VLAN pings fail as expected.

Create VLANs on both switches

A VLAN is a virtual LAN that groups ports together into their own broadcast domain, even if the ports share the same physical switch. You need to create the same VLANs on every switch that will carry that VLAN's traffic.

• Click on S1 in your topology to open its properties window.
• Click the CLI tab to access the command line.
• Enter global configuration mode and create both VLANs by running these commands:

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit

What do these commands do?

The vlan 10 command creates VLAN 10 and drops you into VLAN configuration mode. name Sales gives it a human-readable label so you can identify it later.

You repeat the same pattern for VLAN 20 (Engineering). The exit command returns you to global configuration mode between each VLAN.

• Verify the VLANs were created by running:

show vlan brief

You should see VLAN 10 (Sales) and VLAN 20 (Engineering) listed alongside the default VLAN 1. No ports are assigned to them yet.

• Now repeat the same VLAN creation on S2. Click on S2 in your topology and open its CLI tab.
• Create both VLANs on S2 by running:

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit

• Confirm the VLANs exist on S2 by running:

show vlan brief

You should see the same VLAN 10 and VLAN 20 listed here. Both switches now know about both departments.

Don't see your VLANs listed?

Make sure you ran enable and configure terminal before the vlan commands. VLAN creation only works in global configuration mode.

If you see an error, check that you typed vlan 10 (with a space between vlan and the number). help me troubleshoot my VLAN creation on a Cisco 2960 switch in Packet Tracer

Assign access ports to VLANs

Creating VLANs is only half the job. Each switch port that connects to a PC needs to be told which VLAN it belongs to. A port configured this way is called an access port because it provides access for a single VLAN only.

• Return to the S1 CLI. Assign FastEthernet0/2 (connected to PC1) to VLAN 10 by running:

configure terminal
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit

What does this code do?

• interface FastEthernet0/2 selects the specific port you want to configure.
• switchport mode access tells the port it will only carry traffic for one VLAN (not multiple).
• switchport access vlan 10 places that port into VLAN 10 (Sales).

• Now assign FastEthernet0/3 (connected to PC2) to VLAN 20 by running:

interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit

PC1 is now in the Sales department (VLAN 10) and PC2 is in Engineering (VLAN 20), even though they connect to the same physical switch.

• Switch to the S2 CLI. Assign FastEthernet0/2 (PC3) to VLAN 10 and FastEthernet0/3 (PC4) to VLAN 20 by running:

configure terminal
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit

Why the same VLAN numbers on both switches?

VLAN 10 on S1 and VLAN 10 on S2 represent the same logical network (Sales). When you eventually connect these switches with a trunk link, matching VLAN numbers let traffic flow between same-department PCs on different switches.

Seeing a command rejected?

If you see an "Invalid input" error, make sure you are in global configuration mode (your prompt should show S2(config)#) before entering the interface command. If your prompt shows S2>, you need to run enable first, then configure terminal.

help me fix a command error when assigning VLANs to switch ports in Packet Tracer

Verify VLAN assignments

Before moving on, you need to confirm that every port landed in the right VLAN. A single misassigned port means a PC ends up in the wrong department.

• On S1, run the verification command:

show vlan brief

• Confirm that Fa0/2 appears under VLAN 10 (Sales) and Fa0/3 appears under VLAN 20 (Engineering).
• On S2, run the same command:

show vlan brief

• Confirm that Fa0/2 appears under VLAN 10 and Fa0/3 appears under VLAN 20.

What should I see?

The output of show vlan brief shows a table with VLAN number, name, status, and assigned ports. You should see VLAN 10 (Sales) with the correct FastEthernet port listed, and VLAN 20 (Engineering) with its port listed. All other ports still appear under VLAN 1 (the default).

Now test that VLAN separation is actually working. Try pinging between PCs on different VLANs.

• Click on PC1 in the topology and go to the Desktop tab.
• Click Command Prompt.
• Try pinging PC3 (which is on the same VLAN 10, but on a different switch) by running:

ping 192.168.10.20

This ping should fail. Even though PC1 and PC3 are in the same VLAN, the link between S1 and S2 is not yet configured as a trunk, so VLAN 10 traffic cannot cross between switches.

Why does the same-VLAN ping fail?

The cable between S1 and S2 is currently a default access port in VLAN 1. It does not carry VLAN 10 or VLAN 20 traffic yet. You will fix this in the next step by configuring 802.1Q trunk links.

Ping succeeded when it should have failed?

If the ping works, the inter-switch port might still be in VLAN 1 with both PCs also accidentally left in VLAN 1. Run show vlan brief again on both switches and confirm the correct ports moved out of VLAN 1 and into VLAN 10 or VLAN 20.

help me figure out why my VLANs aren't isolating traffic in Packet Tracer

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete configuration you should have applied to each switch by the end of this step:

S1 configuration:

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit

S2 configuration:

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit

Your VLANs are created and every PC port knows which department it belongs to. Next up, you will configure trunk links so that VLAN traffic can flow between switches and up to the router.

Configure 802.1Q Trunk Links

Your VLANs exist on both switches, but right now they are isolated islands. Traffic from PC1 on S1 has no way to reach PC3 on S2, even though both PCs are in VLAN 10.

The missing piece is a trunk link. A trunk carries traffic for multiple VLANs over a single physical cable by tagging each frame with its VLAN ID using the 802.1Q standard. In this step, you will configure trunks between your switches and between S1 and the router, then prove that same-VLAN PCs can talk across switches.

In this step, get ready to:

• Configure an 802.1Q trunk between S1 and S2.
• Configure a trunk from S1 to the router R1.
• Assign IP addresses to all PCs and verify intra-VLAN connectivity.

Configure the inter-switch trunk (S1 to S2)

The link between S1 and S2 (FastEthernet0/1 on each side) needs to become a trunk so VLAN-tagged frames can pass between the two switches.

• Click on S1 in your topology, then select the CLI tab.
• Configure FastEthernet0/1 as a trunk that only allows VLANs 10 and 20 by entering these commands:

enable
configure terminal
interface FastEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end

What do these commands do?

• `switchport mode trunk` forces the port into trunking mode so it tags frames with VLAN information instead of belonging to a single VLAN.
• `switchport trunk allowed vlan 10,20` restricts the trunk to carry only VLANs 10 and 20. This is a security best practice that prevents unwanted VLANs from crossing the link.

• Now click on S2 and open the CLI tab.
• Configure S2's FastEthernet0/1 with the same trunk commands:

enable
configure terminal
interface FastEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end

• Verify the trunk on S1 by running this command in privileged exec mode:

show interfaces trunk

You should see FastEthernet0/1 listed as a trunk port with 802.1q encapsulation and VLANs 10,20 in the allowed list.

Don't see Fa0/1 as a trunk?

• Make sure you typed switchport mode trunk (not switchport mode access). Re-enter the interface and check with show running-config interface FastEthernet0/1.
• If you see an error about encapsulation, double-check you are on a 2960 switch. The 2960 only supports 802.1Q and does not require an encapsulation command.

Help me troubleshoot my trunk configuration on a Cisco 2960 switch in Packet Tracer

Configure the switch-to-router trunk (S1 to R1)

The router needs to receive tagged VLAN traffic from the switch so it can route between VLANs. The cable from S1 GigabitEthernet0/1 to R1 GigabitEthernet0/0 must also be a trunk.

• Return to the S1 CLI tab.
• Configure GigabitEthernet0/1 as a trunk allowing VLANs 10 and 20 by entering these commands:

configure terminal
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end

Why does the router link need to be a trunk?

In a router-on-a-stick design, one physical cable carries traffic for every VLAN. The router uses 802.1Q tags to tell which VLAN each frame belongs to, then routes between them using subinterfaces. Without trunking here, the router would only see untagged frames from a single VLAN.

• Verify the trunks on S1 by running:

show interfaces trunk

You should now see two trunk ports listed: Fa0/1 (to S2) and Gi0/1 (to R1). Both should show VLANs 10,20 in the allowed list.

Only see one trunk port on S1?

• Confirm you configured GigabitEthernet0/1 (not GigabitEthernet0/0). On the 2960 switch in Packet Tracer, the uplink port to the router is Gi0/1.
• The trunk may show as "not-trunking" if the other end (the router) has not yet been configured. This is normal at this stage. The trunk will become fully active once you configure the router in the next step.

Help me figure out why my GigabitEthernet0/1 trunk is not showing up on S1

Test intra-VLAN connectivity across the trunk

The trunks are in place. Now you need to assign IP addresses to each PC so you can test whether frames actually cross the inter-switch trunk correctly.

• Click on PC1 in your topology.
• Select the Desktop tab, then click IP Configuration.
• Enter the following values:

• IPv4 Address: 192.168.10.10.
• Subnet Mask: 255.255.255.0.
• Default Gateway: 192.168.10.1.

• Repeat for the remaining PCs using these values:

• PC2: IP 192.168.20.10, Subnet Mask 255.255.255.0, Gateway 192.168.20.1.
• PC3: IP 192.168.10.20, Subnet Mask 255.255.255.0, Gateway 192.168.10.1.
• PC4: IP 192.168.20.20, Subnet Mask 255.255.255.0, Gateway 192.168.20.1.

Why set a default gateway now?

The gateway IP (e.g. 192.168.10.1) is the address the router's subinterface will use once you configure it in the next step. Setting it now means the PCs are ready for inter-VLAN routing the moment the router is online.

• Test intra-VLAN connectivity by clicking on PC1, selecting the Desktop tab, and opening Command Prompt.
• Ping PC3 (same VLAN 10, different switch) by running:

ping 192.168.10.20

You should see replies from 192.168.10.20. This confirms the trunk between S1 and S2 is passing VLAN 10 traffic correctly.

• Now test inter-VLAN connectivity by pinging PC2 from PC1:

ping 192.168.20.10

This ping should fail (request timed out or destination host unreachable). This is expected because there is no router performing inter-VLAN routing yet.

Why does the cross-VLAN ping fail?

Switches forward frames based on MAC addresses within a single VLAN. To reach a device on a different VLAN (a different subnet), the frame must leave the switch, travel to a router, get routed to the destination subnet, and come back down.

You have not configured the router yet, so there is no path between VLAN 10 and VLAN 20. You will fix this in the next step.

Intra-VLAN ping from PC1 to PC3 failing?

• Verify PC1's IP is 192.168.10.10 and PC3's IP is 192.168.10.20. Both must be in the same subnet (255.255.255.0).
• Confirm both PC1 and PC3 are assigned to VLAN 10 by running show vlan brief on S1 and S2 respectively.
• Check that show interfaces trunk on both S1 and S2 shows Fa0/1 as an active trunk with VLAN 10 in the allowed list. If the first ping times out but the second succeeds, that is normal (ARP resolution takes one attempt).

Help me troubleshoot why my same-VLAN ping between PC1 and PC3 is failing across the trunk

✔️ Awesome, I've got everything!

Great. Make sure you have confirmed the intra-VLAN ping succeeds and the inter-VLAN ping fails before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete trunk configuration for each device at the end of this step.

S1 trunk configuration:

interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
!
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

S2 trunk configuration:

interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

PC IP addresses:

• PC1: 192.168.10.10/24, gateway 192.168.10.1.
• PC2: 192.168.20.10/24, gateway 192.168.20.1.
• PC3: 192.168.10.20/24, gateway 192.168.10.1.
• PC4: 192.168.20.20/24, gateway 192.168.20.1.

Your trunk links are working and same-VLAN PCs can communicate across switches. Next up, you will configure the router to perform inter-VLAN routing so that all four PCs can reach each other regardless of VLAN.

Configure Router-on-a-Stick Inter-VLAN Routing

Your trunk links are carrying tagged VLAN traffic between switches and up to the router. But right now, PCs in VLAN 10 still cannot talk to PCs in VLAN 20. That is because Layer 2 switches cannot route traffic between VLANs on their own.

In this step, you will configure router-on-a-stick inter-VLAN routing on R1. This technique uses a single physical router interface divided into logical subinterfaces, one per VLAN. Each subinterface acts as the default gateway for its VLAN, allowing traffic to flow between departments.

In this step, get ready to:

• Activate the router's physical interface so it can carry VLAN traffic.
• Create subinterfaces with 802.1Q encapsulation for VLAN 10 and VLAN 20.
• Test and verify inter-VLAN routing with ping and show commands.

Activate the physical interface on the router

Before creating subinterfaces, you need to bring up the physical interface that connects R1 to S1. This interface will not have its own IP address because all Layer 3 addressing happens on the subinterfaces instead.

• Click on R1 in your topology, then select the CLI tab.
• Enter privileged exec mode and then global configuration mode by running these commands:

enable
configure terminal

• Activate the GigabitEthernet0/0 interface by entering these commands:

interface GigabitEthernet0/0
no ip address
no shutdown

What do these commands do?

• interface GigabitEthernet0/0 enters the configuration for the physical interface connected to S1.
• no ip address ensures the physical interface has no Layer 3 address of its own. All IP addressing will live on the subinterfaces.
• no shutdown administratively enables the interface so it can pass traffic.

• Confirm the interface is active by checking the link light on the cable between R1 and S1 in the topology view. It should turn green.

Link light still orange or red?

Make sure you typed no shutdown on the correct interface (GigabitEthernet0/0, not 0/1 or 0/2).

Also verify the cable in your topology connects S1 Gi0/1 to R1 Gi0/0. Help me troubleshoot my router interface not coming up.

Create subinterfaces for each VLAN

A subinterface is a logical division of a physical interface. Each subinterface is tagged with a VLAN ID using 802.1Q encapsulation, so the router knows which VLAN each packet belongs to.

• While still in the R1 CLI in global configuration mode, create the subinterface for VLAN 10 by entering these commands:

interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0

What does this configure?

• interface GigabitEthernet0/0.10 creates subinterface .10 on the physical Gi0/0 port. The .10 suffix is a label that matches the VLAN number for clarity.
• encapsulation dot1Q 10 tells the router to tag frames on this subinterface with VLAN 10. This matches the trunk tagging on S1.
• ip address 192.168.10.1 255.255.255.0 assigns the default gateway address that PC1 and PC3 are already configured to use.

• Create the subinterface for VLAN 20 by entering these commands:

interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0

What does this configure?

This follows the same pattern as VLAN 10. Subinterface .20 is tagged with VLAN 20 and assigned 192.168.20.1 as the default gateway for PC2 and PC4.

• Return to privileged exec mode and verify both subinterfaces are active by running:

end
show ip interface brief

• Confirm that GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all show up in both the Status and Protocol columns.

Subinterface showing down/down?

If a subinterface shows down, the physical interface beneath it is not active. Go back and confirm you ran no shutdown on GigabitEthernet0/0 (the parent interface).

Also check that you typed encapsulation dot1Q (with a capital Q) followed by the correct VLAN number. Help me fix my subinterface status.

✔️ Awesome, I've got everything!

Great. Make sure you have exited configuration mode (you should see the R1# prompt) before moving on to testing.

ⓧ I'd like to double check the full configuration

Here is the complete set of commands you should have entered on R1 in this substep:

enable
configure terminal
interface GigabitEthernet0/0
no ip address
no shutdown
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
end

Test inter-VLAN routing

The moment of truth. With subinterfaces active, R1 can now receive a frame from one VLAN, strip the tag, route it, re-tag it for the destination VLAN, and send it back down the same physical link.

• Click on PC1 in your topology.
• Select the Desktop tab, then open Command Prompt.
• Ping PC2 (different VLAN, same switch) by running:

ping 192.168.20.10

• You should see replies coming back successfully. This proves that traffic from VLAN 10 is being routed to VLAN 20 through R1.

• Now ping PC4 (different VLAN, different switch) by running:

ping 192.168.20.20

• This should also succeed. The packet travels from PC1 through S1's trunk to R1, gets routed from VLAN 10 to VLAN 20, returns down the trunk to S1, crosses the inter-switch trunk to S2, and arrives at PC4.

• For a final test, click on PC3, open Desktop > Command Prompt, and ping PC4:

ping 192.168.20.20

• This ping succeeds even though both PCs are on the same switch. Because they are in different VLANs, the traffic must travel up to R1 for routing and come back down.

Why does same-switch traffic still go through the router?

A Layer 2 switch can only forward frames within the same VLAN. When PC3 (VLAN 10) sends a packet to PC4 (VLAN 20), S2 cannot bridge that traffic locally because they are in different broadcast domains.

The packet must travel up the trunk to R1, where the router examines the destination IP, routes it from the 192.168.10.0/24 subnet to the 192.168.20.0/24 subnet, and sends it back down the trunk tagged for VLAN 20.

• Return to the R1 CLI and view the routing table by running:

show ip route

• You should see two directly connected (C) routes: 192.168.10.0/24 via GigabitEthernet0/0.10 and 192.168.20.0/24 via GigabitEthernet0/0.20.

What is the routing table telling you?

The C entries in the routing table mean "directly connected." The router automatically learned these routes when you assigned IP addresses to the subinterfaces.

Any packet arriving for 192.168.10.0/24 gets forwarded out Gi0/0.10, and any packet for 192.168.20.0/24 gets forwarded out Gi0/0.20. No static routes or routing protocols are needed.

Pings failing with Request timed out?

• Verify the PC's default gateway matches the subinterface IP (192.168.10.1 for VLAN 10 PCs, 192.168.20.1 for VLAN 20 PCs).
• Run show ip interface brief on R1 and confirm all three entries (Gi0/0, Gi0/0.10, Gi0/0.20) show up/up.
• Run show interfaces trunk on S1 and confirm VLAN 10 and 20 are listed as allowed on the Gi0/1 trunk to the router.
• Try the ping a second time. The first ping sometimes fails because of ARP resolution delay.

Help me troubleshoot my inter-VLAN pings.

• Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.

Secret mission

Add Management VLAN and SSH Access

You have mastered VLAN segmentation and routing. Now secure the network like a real network engineer. Add a Management VLAN for device administration and configure SSH so you never have to rely on insecure Telnet.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your topology file for future practice, or delete it entirely.

Resources you used:

• Packet Tracer topology file (.pkt) saved on your computer.
• Router R1, switches S1 and S2, and PCs 1-4 configured inside the topology.

Keep everything running

No action needed. Choose this if you want to keep practising with your VLAN topology or extend it further.

• Your .pkt file stays on your computer wherever you saved it.
• You can reopen it anytime in Packet Tracer to review or modify your configurations.
• Consider saving a backup copy in case you want to experiment without losing your working state.

Pause - I'll come back to this later

Close Packet Tracer to free up system memory. Your saved topology file preserves all configurations.

• Save your topology by pressing Cmd+S (macOS) or Ctrl+S (Windows) in Packet Tracer.
• Close Packet Tracer.
• When you return, double-click the .pkt file to reopen your topology with all configurations intact.

Delete - I don't want to use this again

Remove all project files from your computer. This cannot be undone.

• Close Packet Tracer if it is still open.
• Locate the .pkt file you saved during this project.
• Delete the file by moving it to Trash (macOS) or the Recycle Bin (Windows), then empty the Trash or Recycle Bin.

Nice Work!

Nice Work!

You just built a fully functional multi-VLAN office network in Cisco Packet Tracer. Your network segments two departments onto separate broadcast domains and routes traffic between them using a single router interface.

You've learned how to:

• Build a multi-VLAN topology with 802.1Q trunk links carrying tagged traffic between switches and a router.
• Configure router-on-a-stick inter-VLAN routing using subinterfaces with dot1Q encapsulation to provide default gateways for each VLAN.
• Verify connectivity at each stage using Cisco IOS show commands and ping tests to prove intra-VLAN and inter-VLAN communication.
• Secret Mission: Added a Management VLAN with SSH access for secure remote device administration.

Ready to quiz yourself?