Build a Small Office Network

Configure VLANs, routing, DHCP, and ACLs in Cisco Packet Tracer.

Introduction

30 Second Summary

Every office has departments that need to share a network but keep their traffic separate. A company's HR team shouldn't be able to browse the IT server room, even digitally.

In this project, you will build a segmented office network in Cisco Packet Tracer. Three departments each sit on their own VLAN, connected by a router that assigns IP addresses via DHCP and enforces security with an ACL.

What You'll Build

A fully functional three-department network with VLAN segmentation, inter-VLAN routing, automatic IP addressing, and ACL security, all configured from the Cisco IOS CLI.

By the end of this project, you'll have:

  • Three VLANs on a Cisco 2960 switch, segmenting traffic between Sales, HR, and IT departments.
  • A Cisco 2911 router performing inter-VLAN routing with 802.1Q subinterfaces and serving as a DHCP server for all departments.
  • An extended ACL blocking the HR department from reaching the IT subnet while allowing all other traffic.
  • Secret Mission: Expand the network with a second switch and trunk link to prove you can scale a VLAN-based design.

Are there any prerequisites?

This project assumes a basic understanding of IP addresses and subnetting. You'll also need a free account at skillsforall.com, which you'll create in Step 1.

Before We Start

Before We Start...

Install Cisco Packet Tracer and Create Your Account

Building a network from scratch requires a simulation environment where you can place routers, switches, and PCs without buying physical hardware. Packet Tracer is a free network simulation tool from Cisco that lets you design, configure, and test network topologies right on your computer.

In this step, you'll create a free account, download Packet Tracer 9.0.0, and get it running so you're ready to start designing your office network.

In this step, get ready to:
  • Create a free SkillsForAll account.
  • Download and install Cisco Packet Tracer 9.0.0.
  • Launch Packet Tracer and verify it opens to a blank workspace.
Create your free SkillsForAll account

Packet Tracer requires you to sign in with a free Cisco account every time you launch it. You'll create this account first so it's ready when you need it.

  • Open your browser and go to skillsforall.com.
  • Click Sign Up in the top right corner of the page.
  • Enter your email address and create a password.
  • Complete the registration form with your name and details.
  • Check your email inbox for a verification email from Cisco and click the confirmation link.

Once you've confirmed your email, your SkillsForAll dashboard should load in the browser.

Not seeing the verification email?

Check your spam or junk folder. The email comes from Cisco or SkillsForAll and can take a few minutes to arrive.

If you already have a Cisco Networking Academy (NetAcad) account, you can use those credentials instead of creating a new SkillsForAll account.

Help me troubleshoot my SkillsForAll account creation

Download and install Cisco Packet Tracer

With your account ready, you can now download the Packet Tracer installer from Cisco's resource hub.

  • Navigate to the Packet Tracer download page.
  • Find the Windows 64-bit installer and click to download it.
  • Once the download finishes, open the .exe installer file.
  • Accept the License Agreement.
  • Choose your install location or keep the default.
  • Click Install and wait for the installation to complete.

The installation takes a minute or two. You should see a progress bar followed by a completion message.

What are the system requirements?

Packet Tracer runs on Windows 8.1, 10, or 11 (64-bit). You need at least 4 GB of RAM and 1.4 GB of free disk space.

Packet Tracer is also available for macOS and Linux. If you're on one of those platforms, select the matching installer from the same download page.

Installer not running or download blocked?

Some browsers block .exe downloads. Check your browser's download bar or notification for an option to Keep the file.

If Windows SmartScreen warns you about the file, click More info and then Run anyway. The installer is an official Cisco download.

Help me troubleshoot my Packet Tracer installation

Launch Cisco Packet Tracer and sign in

Now that Packet Tracer is installed, you need to sign in before you can use it. This is where your SkillsForAll account comes in.

  • Press Cmd+Space (macOS) or the Windows key (Windows) to open your search bar.
  • Type Packet Tracer and press Enter to open it.

Packet Tracer opens a sign-in window before showing the workspace.

  • Enter your SkillsForAll email and password.
  • Click Sign In.
  • If prompted about multi-user mode, select No. You don't need multi-user mode for this project.

You should now see Packet Tracer's main workspace. It's a large blank canvas with a device panel at the bottom and a toolbar at the top.

What should I see?

The workspace is the large white area in the center of the screen. This is where you'll drag and drop routers, switches, and PCs to build your network.

The bottom panel shows categories of devices you can add, like Network Devices and End Devices. You'll use these in the next step.

Packet Tracer won't open or sign-in fails?

Make sure you're connected to the internet. Packet Tracer needs a network connection to verify your SkillsForAll credentials on first launch.

If sign-in keeps failing, try logging into skillsforall.com in your browser first to confirm your credentials work. Then try Packet Tracer again.

Help me troubleshoot Packet Tracer sign-in issues

Your simulation environment is ready to go. Next up, you'll place routers, switches, and PCs on the workspace and cable them together to form your office network.

Design the Network Topology

Cisco Packet Tracer is installed and you're signed in. Time to start building your office network.

Every network begins with a physical topology. In this step, you'll place a router, a switch, and six PCs on the workspace, cable them together, and plan the IP addresses for each department.

In this step, get ready to:
  • Place a router, a switch, and six PCs on the workspace.
  • Cable each device to the switch using the correct port assignments.
  • Document the IP addressing plan for three VLANs.
Place devices on the workspace

Your network needs three types of devices: a router to connect departments, a switch to link individual PCs, and PCs representing employees in each department. Cisco Packet Tracer's bottom panel is where you find and place all of these.

  • Look at the bottom-left corner of the Packet Tracer window. Click the Network Devices category icon (it looks like a small router).
  • Click Routers in the subcategory row that appears.
  • Click the 2911 router in the device list.
  • Click anywhere on the workspace to place it.
  • Click Switches in the subcategory row (still under Network Devices).
  • Click the 2960 switch in the device list.
  • Click on the workspace to place it near the router.
  • Click End Devices in the bottom-left category icons.
  • Click the PC device in the device list.
  • Click on the workspace six times to place six PCs below the switch.

Each PC has a default label like PC0 or PC1. You need to rename them so you can tell which department each PC belongs to.

  • Click on the first PC (labeled PC0) to open its properties window.
  • Click the Config tab.
  • In the Display Name field, replace the existing text with PC-Sales1.
  • Close the properties window by clicking the X in its top-right corner.
  • Repeat for each remaining PC, renaming them to: PC-Sales2, PC-HR1, PC-HR2, PC-IT1, and PC-IT2.

Arrange PCs by department

Drag your PCs into three groups of two: Sales PCs on the left, HR PCs in the middle, IT PCs on the right. This visual grouping makes it much easier to follow along as you configure VLANs later.

You should now see 8 devices on the workspace: 1 router, 1 switch, and 6 labeled PCs arranged in three department groups.

Cable the devices

Devices on the workspace can't communicate until you connect them with cables. You'll use Copper Straight-Through cables for every connection in this step, which is the standard cable type for connecting PCs to switches and switches to routers.

  • Click the Connections category in the bottom-left panel (the lightning bolt icon).
  • Click Copper Straight-Through (the solid black line icon).
  • Click on PC-Sales1.
  • Select FastEthernet0 from the port menu that appears.
  • Click on the switch.
  • Select FastEthernet0/2 from the port menu.

A cable now connects PC-Sales1 to the switch on port FastEthernet0/2. Repeat this same process for the remaining five PCs using these port assignments:

  • PC-Sales2 (FastEthernet0) to switch port FastEthernet0/3.
  • PC-HR1 (FastEthernet0) to switch port FastEthernet0/4.
  • PC-HR2 (FastEthernet0) to switch port FastEthernet0/5.
  • PC-IT1 (FastEthernet0) to switch port FastEthernet0/6.
  • PC-IT2 (FastEthernet0) to switch port FastEthernet0/7.

Now connect the switch to the router. This is the uplink that will carry traffic between all departments.

  • With Copper Straight-Through still selected, click on the switch.
  • Select GigabitEthernet0/1 from the port menu.
  • Click on the router.
  • Select GigabitEthernet0/0 from the port menu.

What should the link lights look like?

Each cable endpoint shows a small colored triangle. Green means the port is active and connected. Orange means the switch port is still initializing (this takes about 30 seconds).

The router side of the switch-to-router cable will show a red triangle. This is expected. Router interfaces are turned off by default in Cisco IOS and you'll enable it in a later step.

After about 30 seconds, all six PC-to-switch cables should show green triangles on both ends. The switch-to-router cable should show green on the switch side and red on the router side.

Don't see green triangles on your PC connections?

  • Make sure you selected Copper Straight-Through as the cable type, not Crossover or another option.
  • Double-check that you selected the PC's FastEthernet0 port and the correct switch port from the lists above.
  • Wait at least 30 seconds. Switch ports go through an initialization process before they turn green.
  • To remove a wrong cable, click the Delete tool (the X icon in the right-side toolbar), then click the cable.

Still stuck? Ask for help here: Why aren't my cable connections turning green in Packet Tracer?

Review the IP addressing plan

Before you touch the CLI, you need a clear IP addressing plan. Each department gets its own VLAN, and each VLAN gets its own subnet so that traffic stays isolated.

Here is the addressing plan you'll configure across the next few steps:

  • VLAN 10 (Sales): subnet 192.168.10.0/24, default gateway 192.168.10.1.
  • VLAN 20 (HR): subnet 192.168.20.0/24, default gateway 192.168.20.1.
  • VLAN 30 (IT): subnet 192.168.30.0/24, default gateway 192.168.30.1.

What does /24 mean?

The /24 means the first 24 bits of the IP address identify the network, leaving the last 8 bits for device addresses. This gives each department up to 254 usable IP addresses (from .1 to .254).

The gateway address (ending in .1) is the address the router uses on each VLAN. Every PC in that VLAN sends traffic through this gateway to reach other departments.

Why separate subnets for each department?

Putting Sales, HR, and IT on different subnets means a broadcast from a Sales PC stays within the Sales network. HR never sees it, and IT never sees it.

This isolation also lets you enforce security rules later. For example, you can block HR from reaching IT's servers without affecting Sales at all.

Your physical topology is built and your IP plan is locked in. Next up, you'll open the switch's CLI to create VLANs and assign each port to the right department.

Configure VLANs and Trunking on the Switch

Your network topology is built. All six PCs are cabled to the switch, and the switch is connected to the router.

Right now, every device on the switch shares the same broadcast domain, meaning traffic from Sales can reach HR and IT with no restrictions. In this step, you'll create three VLANs on the switch to segment traffic by department, then set up a trunk link so VLAN traffic can reach the router.

What is a VLAN?

A VLAN (Virtual Local Area Network) divides a single physical switch into multiple isolated networks. Devices on one VLAN cannot communicate with devices on another VLAN unless a router connects them.

This is how real offices keep department traffic separated for security and performance, even when everyone plugs into the same switch.

In this step, get ready to:
  • Create three VLANs (Sales, HR, IT) on the switch.
  • Assign each PC's switch port to the correct VLAN.
  • Configure a trunk link between the switch and router to carry tagged VLAN traffic.
Create three VLANs on the switch

You'll configure the switch using the Cisco IOS command-line interface (CLI) built into Packet Tracer. Each VLAN gets a numeric ID and a human-readable name so you can tell them apart later.

  • Click on the switch in your workspace to open its device window.
  • Click the CLI tab at the top of the device window.
  • Press Enter once if you see a blank screen to bring up the command prompt.
  • Create the three VLANs by entering these commands:
enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name HR
exit
vlan 30
name IT
exit

What do these commands do?

  • `enable` switches from basic user mode to privileged EXEC mode, which gives you access to configuration commands.
  • `configure terminal` enters global configuration mode, where you can change the switch's settings.
  • `vlan 10` creates a new VLAN with ID 10 and drops you into VLAN configuration mode.
  • `name Sales` assigns a descriptive name to the VLAN. This is optional but makes output much easier to read.
  • `exit` returns you to global config mode so you can create the next VLAN.
  • Verify your VLANs were created by running this command:
do show vlan brief

You should see VLANs 10 (Sales), 20 (HR), and 30 (IT) listed alongside the default VLAN 1. No ports are assigned to them yet, so the Ports column for VLANs 10, 20, and 30 will be empty.

Why does the command start with do?

You're currently in global configuration mode (Switch(config)#). The show commands only work in privileged EXEC mode. Adding do before a show command lets you run it without leaving config mode.

Not seeing VLANs 10, 20, and 30?

  • Make sure you typed vlan 10 (not vlan10 without the space). The space between vlan and the number is required.
  • If you see Invalid input detected, you may not be in global config mode. Type configure terminal to re-enter it.
  • Still stuck? Help me troubleshoot my VLAN creation commands.
Assign switch ports to VLANs

Each PC connects to a specific port on the switch. You need to tell the switch which VLAN each port belongs to by configuring it as an access port. An access port carries traffic for only one VLAN.

  • Assign ports to their VLANs by entering these commands (you should still be in config mode):
interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 10
exit
interface range FastEthernet0/4-5
switchport mode access
switchport access vlan 20
exit
interface range FastEthernet0/6-7
switchport mode access
switchport access vlan 30
exit

What do these commands do?

  • `interface range FastEthernet0/2-3` selects multiple ports at once. This saves you from configuring each port individually.
  • `switchport mode access` tells the port it will connect to a single end device (like a PC), not to another switch.
  • `switchport access vlan 10` assigns the port to VLAN 10 (Sales). Any device plugged into this port joins the Sales VLAN automatically.

The same pattern repeats for HR (VLAN 20 on ports Fa0/4-5) and IT (VLAN 30 on ports Fa0/6-7).

  • Confirm the ports are assigned by running this command:
do show vlan brief

This time, you should see ports listed next to each VLAN. VLAN 10 (Sales) shows Fa0/2 and Fa0/3. VLAN 20 (HR) shows Fa0/4 and Fa0/5. VLAN 30 (IT) shows Fa0/6 and Fa0/7.

Ports still showing under VLAN 1?

  • Double check that you typed switchport access vlan 10 (not just switchport access without the VLAN number).
  • Make sure you ran switchport mode access before switchport access vlan 10. The mode must be set first.
  • If a port shows under the wrong VLAN, re-enter the interface and reassign it with the correct switchport access vlan command.
  • Still stuck? Help me troubleshoot my port-to-VLAN assignments.
Configure the trunk port

Your VLANs are isolated on the switch, which is exactly what you want. But for PCs in different VLANs to reach each other (when allowed), traffic needs to flow from the switch to the router. A trunk port carries traffic for multiple VLANs over a single cable using 802.1Q tags that identify which VLAN each packet belongs to.

  • Configure the link to the router as a trunk by entering these commands:
interface GigabitEthernet0/1
switchport mode trunk
exit
end

What do these commands do?

  • `interface GigabitEthernet0/1` selects the port connected to the router (the cable you ran in the previous step).
  • `switchport mode trunk` tells this port to carry tagged traffic for all VLANs. Each packet gets a small 802.1Q header so the router knows which VLAN it came from.
  • `end` exits all configuration modes and returns you to privileged EXEC mode (Switch#).
  • Verify the full VLAN and trunk configuration by running these two commands:
show vlan brief

You should see VLANs 10, 20, and 30 with their assigned ports. Notice that Gi0/1 no longer appears under VLAN 1. That is because it is now a trunk port and carries traffic for all VLANs instead of belonging to just one.

  • Now confirm the trunk is active by running:
show interfaces trunk

You should see Gi0/1 listed as a trunk port with 802.1q encapsulation and a status of trunking. VLANs 1, 10, 20, and 30 should appear in the allowed VLANs section.

Trunk not showing in show interfaces trunk?

  • Make sure you configured GigabitEthernet0/1 (the port connected to the router), not a different port.
  • Verify the cable between the switch and router is plugged into Gi0/1 on the switch side. Hover over the cable endpoint on the switch to check the port name.
  • The trunk may show as not-trunking if the router's physical interface is still shut down. That is expected for now. The router gets configured in the next step.
  • Need more help? Help me troubleshoot my trunk configuration.

✔️ Awesome, I've got everything!

Great work. Make sure you see VLANs 10, 20, and 30 with the correct ports in show vlan brief and Gi0/1 listed in show interfaces trunk before moving on.

ⓧ I'd like to double check the full commands

Here are all the switch CLI commands from this step combined. Compare them against what you entered.

enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name HR
exit
vlan 30
name IT
exit
interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 10
exit
interface range FastEthernet0/4-5
switchport mode access
switchport access vlan 20
exit
interface range FastEthernet0/6-7
switchport mode access
switchport access vlan 30
exit
interface GigabitEthernet0/1
switchport mode trunk
exit
end

Your switch now knows which ports belong to which departments, and the trunk link is ready to carry tagged VLAN traffic. Next up, you'll configure the router to connect these three VLANs together using inter-VLAN routing.

Configure Inter-VLAN Routing on the Router

Your switch is now segmenting traffic into three VLANs with a trunk link ready to carry tagged frames to the router.

Right now, devices in different VLANs cannot communicate with each other. The switch intentionally isolates their traffic, but there's nothing connecting those separate networks yet. You'll fix that by configuring the router to bridge all three VLANs using a technique called router-on-a-stick.

In this step, get ready to:
  • Bring up the router's physical interface.
  • Create three subinterfaces with 802.1Q encapsulation for inter-VLAN routing.
  • Verify the router's routing table shows connected routes for all three VLAN subnets.
Bring up the router's physical interface

Cisco router interfaces are shut down by default. Before you can create subinterfaces, the physical interface they live on needs to be enabled.

  • Click on the router in your workspace to open its configuration window.
  • Click the CLI tab at the top of the window.
  • Enable the GigabitEthernet0/0 interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit

What do these commands do?

  • enable enters privileged exec mode, which gives you access to configuration commands.
  • configure terminal enters global configuration mode where you can change the router's settings.
  • interface GigabitEthernet0/0 selects the physical port that the switch is connected to.
  • no shutdown turns the interface on. Without this, the port stays administratively disabled.
  • exit returns you to global configuration mode so you can continue configuring.

You should see a message in the CLI that says %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up.

Not seeing the link-up message?

  • Make sure the cable between the switch's GigabitEthernet0/1 port and the router's GigabitEthernet0/0 port is connected. You should see a green triangle on both ends of the cable in the workspace.
  • Check that you typed GigabitEthernet0/0 (with a capital G and capital E) and not a different interface number.
  • Help me troubleshoot my router interface not coming up.
Create subinterfaces for each VLAN

A subinterface is a virtual interface that lives on top of a single physical port. You'll create one subinterface per VLAN, each with its own IP address that acts as the default gateway for that department.

Why router-on-a-stick instead of a Layer 3 switch?

Layer 3 switches can route between VLANs directly without a separate router. However, router-on-a-stick is the standard pattern taught at the CCNA level because it clearly separates routing from switching.

Entry-level networking interviews expect you to know this pattern. Once you master it, moving to Layer 3 switching is a natural next step.

  • Create the Sales department (VLAN 10) subinterface by entering these commands:
! Create subinterface for VLAN 10 (Sales)
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

What does this code do?

  • interface GigabitEthernet0/0.10 creates subinterface .10 on the physical port. The .10 number is a convention that matches the VLAN ID for easy identification.
  • encapsulation dot1Q 10 tells the router to tag traffic on this subinterface with VLAN 10 using the 802.1Q trunking protocol.
  • ip address 192.168.10.1 255.255.255.0 assigns the gateway IP for the Sales VLAN. This is the address Sales PCs will use to reach other networks.

You won't see output confirming the subinterface yet. The next commands add the remaining two subinterfaces, and you'll verify all three together afterwards.

Seeing an invalid input error?

  • Make sure your prompt shows Router(config)# before entering the subinterface command. If it shows Router# instead, type configure terminal first.
  • Check for typos in GigabitEthernet0/0.10. The dot before 10 is required to create a subinterface.
  • Create the HR department (VLAN 20) and IT department (VLAN 30) subinterfaces using the same pattern:
! Create subinterface for VLAN 20 (HR)
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

! Create subinterface for VLAN 30 (IT)
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What's happening here?

These commands follow the exact same pattern as the Sales subinterface. Each one tags traffic with a different VLAN ID (20 for HR, 30 for IT) and assigns the matching gateway IP from your addressing plan.

The router now has three virtual gateways on a single physical port. You'll verify all three in the next substep.

Entered the wrong VLAN number or IP?

  • You can re-enter the commands for any subinterface to overwrite the previous values. Just type the interface command again and re-enter the correct encapsulation and ip address lines.
  • Double-check that VLAN 20 maps to 192.168.20.1 and VLAN 30 maps to 192.168.30.1. Mixing these up is a common mistake.

✔️ Awesome, I've got everything!

Great. Make sure you've entered all three subinterface blocks before moving on to verification.

ⓧ I'd like to double check the full commands

Here are all the router commands you've entered so far in this step, from top to bottom.

enable
configure terminal

! Bring up the physical interface
interface GigabitEthernet0/0
no shutdown
exit

! Create subinterface for VLAN 10 (Sales)
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

! Create subinterface for VLAN 20 (HR)
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

! Create subinterface for VLAN 30 (IT)
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit
Verify the router configuration

Time to confirm all three subinterfaces are up and the router knows how to reach each VLAN subnet.

  • Exit configuration mode and check the interface status by entering these commands:
end
show ip interface brief

What should I see?

You should see a table listing all interfaces on the router. Look for these four rows:

  • GigabitEthernet0/0 with status up and protocol up (no IP address assigned to the physical interface).
  • GigabitEthernet0/0.10 with IP 192.168.10.1, status up, protocol up.
  • GigabitEthernet0/0.20 with IP 192.168.20.1, status up, protocol up.
  • GigabitEthernet0/0.30 with IP 192.168.30.1, status up, protocol up.
  • Check the routing table to confirm the router has learned routes for all three subnets by running:
show ip route

What should I see in the routing table?

Look for three lines marked with a C on the left side. The C stands for "connected," meaning the router is directly attached to these networks through its subinterfaces.

  • C 192.168.10.0/24 connected via GigabitEthernet0/0.10.
  • C 192.168.20.0/24 connected via GigabitEthernet0/0.20.
  • C 192.168.30.0/24 connected via GigabitEthernet0/0.30.

These connected routes are what allow the router to forward traffic between VLANs. Without them, the router would not know where to send packets destined for each department's subnet.

Subinterfaces showing down/down?

  • If any subinterface shows down for status or protocol, the physical interface GigabitEthernet0/0 is probably not up. Go back and run no shutdown on the physical interface.
  • If a connected route is missing from show ip route, the subinterface for that VLAN may not have an IP address. Run show running-config and look for the missing subinterface section.
  • If you see the wrong IP address on a subinterface, re-enter the interface command for that subinterface and type the correct ip address line to overwrite it.
  • Help me troubleshoot my router subinterfaces.

Your router can now route traffic between all three departments. Next up, you'll configure DHCP on the router so every PC automatically receives an IP address instead of needing manual configuration.

Configure DHCP on the Router

Your router now has three subinterfaces, each acting as a gateway for its VLAN. Departments can talk to each other through the router. But none of the PCs actually have IP addresses yet.

Manually assigning an IP address to every device gets tedious and error-prone as a network grows. DHCP solves this by letting the router hand out addresses automatically. In this step, you'll turn the router into a DHCP server for all three VLANs.

In this step, get ready to:
  • Exclude reserved IP addresses from DHCP assignment.
  • Create three DHCP pools for the Sales, HR, and IT VLANs.
  • Test that all six PCs receive the correct IP addresses and can ping across VLANs.
Exclude reserved addresses from the DHCP pools

Before creating DHCP pools, you need to tell the router which addresses to never hand out. The first few IPs in each subnet are typically reserved for gateways, servers, and management devices.

  • Click on the router in the workspace and go to the CLI tab.
  • Exclude the first 10 addresses in each VLAN's subnet by entering these commands:
enable
configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp excluded-address 192.168.30.1 192.168.30.10

What do these commands do?

Each ip dhcp excluded-address line reserves a range of addresses (.1 through .10) in a subnet. The router will never assign these to PCs.

Your gateway addresses (.1 for each VLAN) fall within this range, so they stay safely reserved. The remaining addresses (.11 and above) are available for the DHCP pools to hand out.

You won't see a visible change yet. The next substep creates the pools that use these excluded ranges.

Create the DHCP pools

Each VLAN needs its own DHCP pool. A pool defines the subnet, the default gateway, and the DNS server that PCs receive when they request an address.

  • Still in global configuration mode on the router, create all three DHCP pools by entering these commands:
! Sales department DHCP pool
ip dhcp pool Sales
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
exit

! HR department DHCP pool
ip dhcp pool HR
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
exit

! IT department DHCP pool
ip dhcp pool IT
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 8.8.8.8
exit

What does this configuration do?

  • ip dhcp pool Sales enters DHCP pool configuration mode and names the pool "Sales".
  • network tells the router which subnet this pool serves.
  • default-router is the gateway address PCs will use. This matches the router's subinterface IP for that VLAN.
  • dns-server 8.8.8.8 gives PCs Google's public DNS server for name resolution.
  • exit returns to global configuration mode before creating the next pool.

The pools are ready, but no PC has requested an address yet. You'll test this in the next substep.

Seeing an error when entering pool commands?

  • Make sure you are in global configuration mode (your prompt should show Router(config)#). If you see Router#, type configure terminal to re-enter config mode.
  • Check that you typed the network address and subnet mask on the same line with a space between them.

Help me troubleshoot my DHCP pool configuration in Cisco Packet Tracer

✔️ Awesome, I've got everything!

Great. Make sure you've entered all three pools (Sales, HR, and IT) before moving on to testing.

ⓧ I'd like to double check the full commands

Here are all the DHCP commands you should have entered on the router in this step. Compare these against what your CLI shows.

enable
configure terminal

! Exclude reserved addresses from each subnet
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp excluded-address 192.168.30.1 192.168.30.10

! Sales department DHCP pool
ip dhcp pool Sales
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
exit

! HR department DHCP pool
ip dhcp pool HR
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
exit

! IT department DHCP pool
ip dhcp pool IT
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 8.8.8.8
exit
Test DHCP on your PCs

The router is ready to hand out addresses. Now you need each PC to ask for one. You'll configure all six PCs to use DHCP, then run ping tests to confirm everything works.

  • Click on PC-Sales1 in the workspace.
  • Go to the Desktop tab at the top of the PC window.
  • Click IP Configuration.
  • Select the DHCP radio button.

After a moment, the IPv4 Address field should populate with 192.168.10.11. The Default Gateway field should show 192.168.10.1.

Why .11 and not .1?

You excluded addresses .1 through .10 in the previous substep. The first address the DHCP pool can hand out is .11. Each subsequent PC in the same VLAN gets the next available address (.12, .13, and so on).

  • Repeat the same process for the remaining five PCs. Click each PC, go to Desktop > IP Configuration, and select DHCP.

Here is what each PC should receive:

  • PC-Sales1: 192.168.10.11 with gateway 192.168.10.1.
  • PC-Sales2: 192.168.10.12 with gateway 192.168.10.1.
  • PC-HR1: 192.168.20.11 with gateway 192.168.20.1.
  • PC-HR2: 192.168.20.12 with gateway 192.168.20.1.
  • PC-IT1: 192.168.30.11 with gateway 192.168.30.1.
  • PC-IT2: 192.168.30.12 with gateway 192.168.30.1.

Now test connectivity. First, confirm each PC can reach its own gateway. Then confirm inter-VLAN routing still works by pinging across VLANs.

  • On PC-Sales1, go to Desktop > Command Prompt.
  • Ping the Sales VLAN gateway by entering this command:
ping 192.168.10.1

You should see four replies with TTL= values and 0% packet loss.

  • Now test inter-VLAN routing by pinging PC-HR1 from PC-Sales1. Enter this command:
ping 192.168.20.11

You should see four replies confirming that traffic is flowing from the Sales VLAN through the router and into the HR VLAN.

First ping might time out

The very first ping between two devices often shows one "Request timed out" before the remaining three succeed. This is normal. The router needs a moment to resolve the MAC address using ARP. Run the ping again and all four replies should come back.

  • Try one more test. From PC-Sales1, ping a PC in the IT department:
ping 192.168.30.11

Four replies confirm that all three VLANs can communicate through the router.

PC stuck on 0.0.0.0 or not getting an address?

  • Make sure the DHCP radio button is selected (not Static). Click it again if the fields stay empty.
  • Verify the router's physical interface is up. Click the router, go to CLI, and run show ip interface brief. All three subinterfaces should show "up" in both the Status and Protocol columns.
  • Check that the switch port for that PC is in the correct VLAN. On the switch CLI, run show vlan brief and confirm the port appears under the expected VLAN.
  • Confirm the trunk link between the switch and router is up. On the switch CLI, run show interfaces trunk and look for Gi0/1 in the output.

Help me figure out why my PCs aren't getting DHCP addresses in Packet Tracer

Ping between VLANs failing?

  • If the gateway ping works but cross-VLAN pings fail, check that all three router subinterfaces have the correct IP addresses and encapsulation. Run show running-config on the router and look for the interface GigabitEthernet0/0.10, .20, and .30 sections.
  • Try the ping a second time. The first attempt sometimes times out while ARP resolves.

Help me troubleshoot inter-VLAN ping failures in Packet Tracer

Every PC now has an address and can reach any other department on the network. Next up, you'll lock things down by adding a security policy that controls which departments can communicate.

Apply an ACL Security Policy

Your router is now a full-service DHCP server, automatically handing out IP addresses to every department. Every PC can ping every other PC across VLANs.

In a real office, unrestricted access between departments is a security risk. In this step, you will create an Access Control List that blocks the HR department from reaching the IT subnet while keeping all other traffic flowing.

In this step, get ready to:
  • Create an extended ACL to deny traffic from HR to IT.
  • Apply the ACL to the router's HR subinterface.
  • Test the security policy with ping commands from multiple departments.
Create the extended ACL

An ACL is a set of rules that tells the router which traffic to allow and which to block. An extended ACL can filter based on source address, destination address, and protocol, which is exactly what you need to block HR-to-IT traffic specifically.

  • Click on the router in your workspace.
  • Go to the CLI tab.
  • Enter privileged EXEC mode and global configuration mode, then create the ACL by running these commands:
enable
configure terminal

! Block all IP traffic from HR (VLAN 20) to IT (VLAN 30)
access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255

! Allow all other traffic (overrides the implicit deny at the end)
access-list 100 permit ip any any

What do these commands do?

  • access-list 100 creates an extended ACL numbered 100. Extended ACLs (numbered 100-199) can filter by both source and destination.
  • deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255 blocks all IP traffic from the HR subnet to the IT subnet.
  • 0.0.0.255 is a wildcard mask. It is the inverse of the subnet mask 255.255.255.0. It tells the router to match any host in the /24 subnet.
  • permit ip any any allows everything else through. Without this line, the ACL's implicit "deny all" at the end would block all traffic.
  • Verify the ACL was created by running this command (the do prefix lets you run show commands from within config mode):
do show access-lists

You should see Extended IP access list 100 with two entries: the deny rule and the permit rule.

Not seeing access list 100?

  • Make sure you typed access-list 100 (with a hyphen). Typing accesslist or access list (without the hyphen) will not work.
  • Check that you were in global configuration mode (the prompt should show Router(config)#) when you entered the commands. If you were in a subinterface or interface config mode, exit back to Router(config)# and try again.
  • Confirm the wildcard mask is 0.0.0.255 (not 255.255.255.0). ACLs use wildcard masks, not subnet masks.

Help me troubleshoot my ACL configuration in Cisco Packet Tracer.

Apply the ACL to the HR subinterface

Creating an ACL alone does not block any traffic. You need to apply it to a specific interface and direction to activate it.

Why apply inbound on the HR subinterface?

Best practice for extended ACLs is to place them as close to the source of the traffic as possible. Since the traffic you want to block originates from HR devices, applying the ACL inbound on GigabitEthernet0/0.20 (the HR subinterface) catches it before the router even processes it.

  • Still in global configuration mode on the router, apply ACL 100 to the HR subinterface by running these commands:
! Enter the HR VLAN subinterface
interface GigabitEthernet0/0.20

! Apply ACL 100 to inbound traffic (traffic arriving from HR devices)
ip access-group 100 in
exit

What does this do?

  • ip access-group 100 in tells the router to check every packet entering this subinterface against ACL 100.
  • The in keyword means the filter applies to traffic arriving from HR devices, not traffic going toward them.

You will not see a visible change yet. The next substep uses ping tests to prove the ACL is working.

Seeing an error when applying the ACL?

  • Make sure you are inside the correct subinterface. Your prompt should show Router(config-subif)# after entering interface GigabitEthernet0/0.20.
  • Double-check the number matches: ip access-group 100 in must reference the same ACL number (100) you created in the previous substep.

Help me fix an error when applying an ACL to a subinterface in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure you typed exit after the ip access-group command so you are back in global configuration mode.

ⓧ I'd like to double check the full config

Here are all the ACL commands you entered on the router in this step.

enable
configure terminal

! Create the extended ACL
access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip any any

! Apply the ACL inbound on the HR subinterface
interface GigabitEthernet0/0.20
ip access-group 100 in
exit
Test the security policy

The ACL is live. Now you need to prove it works by running three ping tests that cover the allowed and blocked paths.

Your PCs received DHCP addresses starting at .11 in each subnet. The commands below use those expected addresses. If your PCs received different addresses, substitute your actual IP values.

Test 1: HR to Sales (should succeed).

  • Click on PC-HR1 in your workspace.
  • Go to the Desktop tab, then click Command Prompt.
  • Ping a Sales PC by running this command:
ping 192.168.10.11

You should see four replies from 192.168.10.11. This confirms HR can still reach Sales, which the ACL allows.

Test 2: HR to IT (should fail).

  • In the same Command Prompt on PC-HR1, ping an IT PC by running this command:
ping 192.168.30.11

This should fail. You will see Destination host unreachable or Request timed out messages. The ACL is blocking HR-to-IT traffic.

Test 3: Sales to IT (should succeed).

  • Close the PC-HR1 window.
  • Click on PC-Sales1 in your workspace.
  • Go to the Desktop tab, then click Command Prompt.
  • Ping an IT PC by running this command:
ping 192.168.30.11

You should see four replies. Sales-to-IT traffic is not affected by the ACL because the deny rule only matches traffic from the HR subnet (192.168.20.0/24).

Finally, verify the ACL hit counts on the router.

  • Close the PC-Sales1 window.
  • Click on the router and go to the CLI tab.
  • View the ACL with hit counts by running these commands:
end
show access-lists

You should see Extended IP access list 100 with numbers in parentheses next to the deny and permit lines. These are the hit counts showing how many packets matched each rule.

What do the hit counts mean?

The deny line's count shows how many packets from HR were blocked from reaching IT. The permit line's count shows how many packets were allowed through, including HR-to-Sales pings and Sales-to-IT pings.

In production networks, administrators review these counters regularly to confirm security policies are working as intended.

HR can still ping IT?

  • Run show access-lists on the router. If the deny line has zero hits, the ACL is not being matched. Check that you applied it to GigabitEthernet0/0.20 (not GigabitEthernet0/0.10 or GigabitEthernet0/0.30).
  • Confirm the direction is in, not out. Run show running-config and look for ip access-group 100 in under the GigabitEthernet0/0.20 section.
  • Verify the source and destination subnets in the deny rule are correct. The source should be 192.168.20.0 0.0.0.255 (HR) and the destination should be 192.168.30.0 0.0.0.255 (IT). If they are reversed, the rule blocks IT-to-HR instead of HR-to-IT.

Help me debug my ACL security policy in Packet Tracer.

Sales cannot ping IT?

  • Make sure you did not accidentally apply the ACL to GigabitEthernet0/0 (the physical interface) instead of GigabitEthernet0/0.20 (the HR subinterface). Applying it on the physical interface would filter all VLAN traffic.
  • Check that the permit ip any any line exists in your ACL. Without it, all traffic is denied by default.

Help me troubleshoot why Sales PCs cannot reach IT PCs.

Secret mission

Expand the Network with a Second Switch

Your three-department network runs on a single switch. But real offices have departments that span multiple floors and wiring closets, each with their own switch. Can you add a second switch, extend VLANs across both, and prove the network still works end to end?

Before you go

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your resources as they are, pause by saving your work, or delete everything entirely.

Resources you used:

  • Cisco Packet Tracer application (installed on your computer).
  • SkillsForAll account (used to sign in to Packet Tracer).
  • Your network topology file (.pkt file) containing the router, switch, PCs, VLANs, DHCP, and ACL configurations.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with your network topology or want to try the Secret Mission.

  • Keep Cisco Packet Tracer installed on your machine.
  • Save your topology by pressing Cmd+S (macOS) or Ctrl+S (Windows) so you can reopen it anytime.
  • Your SkillsForAll account stays active at no cost.

Pause - I'll come back to this later

Save your work and optionally close Packet Tracer to free up system memory. You can reopen your topology file later and pick up right where you left off.

  • Save your topology file by clicking File, then Save As. Choose a location you can find easily, like your Desktop.
  • Close Cisco Packet Tracer to free up memory.
  • To resume, double-click your .pkt file or open it from inside Packet Tracer. All your device configurations will be preserved.

Delete - I don't want to use this again

Remove all project files and optionally uninstall Packet Tracer to start completely fresh.

  • Delete your .pkt topology file from your computer.
  • To uninstall Cisco Packet Tracer on Windows, open Settings.
  • Select Apps, then Apps & features. Find Cisco Packet Tracer in the list and click Uninstall.
  • On macOS, drag the Cisco Packet Tracer app from your Applications folder to the Trash.
  • Your SkillsForAll account is free to keep. No need to delete it unless you want to.

Mission accomplished

That's a Wrap!

Nice work! You just built and secured a multi-department office network from scratch using Cisco Packet Tracer.

You've learned how to:

  • Segmented network traffic by department using three VLANs, 802.1Q trunking, and the router-on-a-stick pattern for inter-VLAN routing.
  • Configured the router as a DHCP server to automatically assign IP addresses to every device across all three departments.
  • Enforced a security policy using an extended ACL that blocks the HR department from reaching the IT subnet.
  • Expanded the network with a second switch and trunk link, proving you can scale a VLAN-based network across multiple switches.

Ready to quiz yourself?