Small Office Network with Static Routing

Build a two-site office network in Packet Tracer using static routing.

Introduction

30 Second Summary

Every company with more than one office faces the same challenge: how do devices at one location talk to devices at another? The answer is routing, and understanding it is the single most tested skill on the CCNA exam.

In this project, you will build a two-site office network in Cisco Packet Tracer with routers, switches, and PCs. You will configure IP addresses, add static routes, and verify end-to-end connectivity between all devices.

What You'll Build

A simulated small office network connecting a Headquarters (HQ) site to a Branch office through two routers, two switches, and four PCs, all linked by a point-to-point WAN connection with static routes enabling cross-site communication.

By the end of this project, you'll have:

  • A complete Packet Tracer topology (.pkt file) with all devices cabled and configured.
  • A documented IP addressing table covering three subnets: two LANs and one WAN link.
  • Working static routes with verified end-to-end connectivity, proving any PC can ping any other PC across sites.
  • Secret Mission: Harden your routers with passwords, SSH access, and a login banner.

Are there any prerequisites?

You need a basic understanding of what IP addresses are and Cisco Packet Tracer installed on your computer. No prior router configuration experience is required.

Build the Physical Topology

Before you can configure anything, you need to build the physical network. Real network engineers start every project by racking hardware and running cables.

In this step, you will place routers, switches, and PCs into Cisco Packet Tracer, connect them with the correct cable types, and document an IP addressing plan. This gives you the physical foundation that the rest of the project builds on.

In this step, get ready to:
  • Place and rename all network devices (routers, switches, and PCs).
  • Cable every device using the correct cable types.
  • Document your IP addressing table for the entire network.
Place the network devices

Every network starts with the hardware. You will place two routers (one per site), two switches (one per site), and four PCs (two per site) into the workspace.

  • In Packet Tracer, confirm you are in the Logical Workspace (the default view when Packet Tracer opens).
  • Look at the bottom of the screen. You will see the device panel (called the Network Component Box).
  • Click the Network Devices category icon in the device panel.
  • Click the Routers subcategory.
  • Find the 1941 router in the device list. Click it, then click in the workspace to place it. Repeat so you have two 1941 routers.
  • Click the Switches subcategory.
  • Find the 2960 switch. Click it, then click in the workspace to place it. Repeat so you have two 2960 switches.
  • Click the End Devices category icon in the device panel.
  • Find the PC (PC-PT) device. Place four PCs into the workspace.
  • Arrange the devices so that HQ devices (one router, one switch, two PCs) are on the left side of the workspace and Branch devices (one router, one switch, two PCs) are on the right.

Now rename each device so the topology is easy to read.

  • Double-click the label text beneath the first router (it will say something like Router0). Type HQ-Router and press Enter.
  • Rename the second router to Branch-Router.
  • Rename the first switch (on the left) to HQ-Switch.
  • Rename the second switch (on the right) to Branch-Switch.
  • Leave the PCs with their default names: PC0 and PC1 on the left (HQ), PC2 and PC3 on the right (Branch).

What is a 1941 router?

The Cisco 1941 is a router model with GigabitEthernet interfaces. It is the standard router used in CCNA study materials because the exam tests GigabitEthernet interface naming conventions.

The 2960 is a Layer 2 switch commonly used in CCNA labs. It has FastEthernet ports for connecting end devices and GigabitEthernet uplinks for connecting to routers.

Can't find the 1941 or 2960?

If you do not see these models, use the search field at the top of the device panel. Type 1941 or 2960 and it will filter directly to that device.

If legacy equipment is hidden in your Packet Tracer preferences, go to Options > Preferences and uncheck the option to hide legacy equipment.

Help me find the 1941 router in Packet Tracer

Cable the devices

Choosing the correct cable type is a skill tested on the CCNA exam. Different cable types connect devices that operate at different layers of the network.

Why does cable type matter?

A Copper Straight-Through cable connects devices at different OSI layers (for example, a router to a switch, or a switch to a PC).

A Copper Cross-Over cable connects devices at the same OSI layer (for example, router to router, or PC to PC). Your WAN link between two routers uses a cross-over cable.

  • In the device panel at the bottom, click the Connections category (the lightning bolt icon).
  • Select Copper Straight-Through cable.
  • Click HQ-Router and select port GigabitEthernet0/0. Then click HQ-Switch and select port FastEthernet0/1.
  • Click HQ-Switch port FastEthernet0/2 and connect it to PC0 port FastEthernet0.
  • Click HQ-Switch port FastEthernet0/3 and connect it to PC1 port FastEthernet0.
  • Click Branch-Router port GigabitEthernet0/0 and connect it to Branch-Switch port FastEthernet0/1.
  • Click Branch-Switch port FastEthernet0/2 and connect it to PC2 port FastEthernet0.
  • Click Branch-Switch port FastEthernet0/3 and connect it to PC3 port FastEthernet0.

Now connect the WAN link between the two routers.

  • In the Connections category, select Copper Cross-Over cable.
  • Click HQ-Router and select port GigabitEthernet0/1. Then click Branch-Router and select port GigabitEthernet0/1.

You should now see link lights (small colored indicators) on every connection. They will be red or amber because the router interfaces are not configured yet. This is expected.

Don't see any link lights?

Make sure you selected the correct port on each device. If you connected to the wrong port, click the cable and press Delete on your keyboard, then redo the connection.

Check that you used a Copper Straight-Through cable for router-to-switch and switch-to-PC connections, and a Copper Cross-Over cable for the router-to-router WAN link.

Help me troubleshoot my cable connections in Packet Tracer

Create your IP addressing table

Before configuring any device, network engineers document an IP addressing plan. This prevents conflicts and makes troubleshooting easier. Your network has three segments: two LANs and one WAN link.

  • Open a text file or grab a piece of paper. Write down the following addressing plan:
HQ LAN: 192.168.1.0/24
  HQ-Router G0/0:  192.168.1.1
  PC0:             192.168.1.10
  PC1:             192.168.1.11

Branch LAN: 192.168.2.0/24
  Branch-Router G0/0:  192.168.2.1
  PC2:                 192.168.2.10
  PC3:                 192.168.2.11

WAN Link: 10.0.0.0/30
  HQ-Router G0/1:      10.0.0.1
  Branch-Router G0/1:  10.0.0.2

Why /30 for the WAN link?

A /30 subnet provides exactly 2 usable host addresses. This is standard practice for point-to-point links between two routers because it wastes only 2 IP addresses instead of 252 (which a /24 would waste).

This is explicitly tested in CCNA subnetting questions. It teaches you that not every subnet needs to be a /24.

What does /24 mean?

The /24 after an IP address is the subnet mask in CIDR notation. It means the first 24 bits identify the network and the last 8 bits identify hosts. This gives you 254 usable addresses per subnet (plenty for a small office LAN).

A /30 uses 30 bits for the network portion, leaving only 2 bits for hosts. That means 2 usable addresses, which is perfect for a WAN link connecting exactly two routers.

Keep this addressing table handy. You will use it in every remaining step of this project.

Your physical topology is complete. Next up, you will bring these devices to life by configuring IP addresses on the router interfaces.

Configure the Routers

Your topology is built and all the cables are in place. Now it is time to bring these routers to life by assigning IP addresses to their interfaces.

Without IP addresses, the router interfaces cannot send or receive traffic. You will use the Cisco IOS command-line interface (CLI) to configure each router's hostname, disable DNS lookups, and assign the IP addresses from your addressing table.

In this step, get ready to:
  • Configure HQ-Router with its hostname and interface IP addresses.
  • Configure Branch-Router with its hostname and interface IP addresses.
  • Verify all interfaces show up/up status with correct IP addresses.
Configure HQ-Router

Each router needs a hostname so you can identify it, and IP addresses on both its LAN and WAN interfaces. The LAN interface connects to the local switch and PCs. The WAN interface connects to the other router across your point-to-point link.

  • Click on HQ-Router in your topology to open its properties window.
  • Click the CLI tab at the top of the window.
  • Press Enter to get to the command prompt.
  • Enter these commands to set the hostname, disable DNS lookups, and configure both interfaces:
enable
configure terminal
hostname HQ-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
 no shutdown
 exit

What do these commands do?

  • enable enters privileged EXEC mode, which gives you full access to all router commands.
  • configure terminal enters global configuration mode where you can make changes to the router.
  • hostname HQ-Router sets the router's name so you can identify it in the CLI prompt.
  • no ip domain-lookup prevents the router from trying to resolve typos as DNS lookups, which would freeze your CLI for several seconds on every mistyped command.
  • ip address 192.168.1.1 255.255.255.0 assigns the HQ LAN gateway IP to interface G0/0.
  • ip address 10.0.0.1 255.255.255.252 assigns the WAN link IP with a /30 subnet mask to interface G0/1. The /30 mask (255.255.255.252) allows only two usable host addresses, which is perfect for a point-to-point link between two routers.
  • no shutdown activates the interface. Router interfaces are administratively shut down by default.
  • After entering all commands, check that your CLI prompt now reads HQ-Router(config)#.
  • Look at your topology. The link between HQ-Router and HQ-Switch should now show green link lights. The WAN link to Branch-Router stays orange because the other side is not yet configured.

Seeing an error after typing a command?

  • If you see % Invalid input detected, check for typos. IOS commands must be typed exactly.
  • If the CLI freezes for a few seconds and shows Translating...domain server, you typed the no ip domain-lookup command after the typo. Enter the command earlier in your sequence next time. Press Ctrl+Shift+6 to break out of the lookup.
  • If your prompt still shows Router> instead of HQ-Router(config)#, make sure you entered enable and configure terminal before the other commands.

Help me troubleshoot my HQ-Router configuration in Packet Tracer

Configure Branch-Router

Branch-Router follows the same pattern as HQ-Router, but with different IP addresses matching your Branch LAN subnet and the other end of the WAN link.

  • Click on Branch-Router in your topology.
  • Click the CLI tab and press Enter to get to the command prompt.
  • Enter these commands to configure the hostname and both interfaces:
enable
configure terminal
hostname Branch-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.2 255.255.255.252
 no shutdown
 exit

What is different on Branch-Router?

The structure is identical to HQ-Router. The only differences are the IP addresses.

  • G0/0 gets 192.168.2.1 (the Branch LAN gateway) instead of the HQ LAN address.
  • G0/1 gets 10.0.0.2 (the other end of the WAN link). Both routers share the same 10.0.0.0/30 subnet, with one IP each.
  • Confirm your prompt now reads Branch-Router(config)#.
  • Look at your topology. All link lights should now be green, including the WAN link between the two routers.

WAN link still showing orange?

  • Both sides of a link must have their interfaces activated with no shutdown for the link to go green. Double-check that you entered no shutdown on GigabitEthernet0/1 on both routers.
  • If you accidentally exited configuration mode, type configure terminal again, then enter the interface commands.

Help me figure out why my WAN link is still orange in Packet Tracer

Verify router interfaces

Before moving on, you need to confirm that every interface is up and has the correct IP address. The show ip interface brief command gives you a quick summary table of all interfaces.

  • On HQ-Router, run this command from global configuration mode:
do show ip interface brief

Why use do before the command?

The show ip interface brief command is a privileged EXEC command. If you are still in global configuration mode (your prompt ends with (config)#), you need the do prefix to run it without leaving config mode.

Alternatively, you can type end to exit configuration mode first, then run show ip interface brief without the do prefix.

  • Confirm that both GigabitEthernet0/0 and GigabitEthernet0/1 show up in the Status column and up in the Protocol column.
  • Confirm that the IP addresses match your addressing table: 192.168.1.1 on G0/0 and 10.0.0.1 on G0/1.
  • Repeat the same check on Branch-Router by clicking on it, opening the CLI tab, and running do show ip interface brief.
  • Confirm Branch-Router shows 192.168.2.1 on G0/0 and 10.0.0.2 on G0/1, both up/up.

Seeing down/down on an interface?

  • If the Status shows administratively down, you missed the no shutdown command on that interface. Enter the interface again with interface GigabitEthernet0/0 (or 0/1) and type no shutdown.
  • If the IP address column shows unassigned, you need to re-enter the ip address command on that interface.

Help me fix my router interface that shows down or unassigned

✔️ Awesome, I've got everything!

Great. Both routers are configured and all interfaces are up.

ⓧ I'd like to double check the full commands

Here are the complete commands for each router up to this point.

HQ-Router:

enable
configure terminal
hostname HQ-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
 no shutdown
 exit

Branch-Router:

enable
configure terminal
hostname Branch-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.2 255.255.255.252
 no shutdown
 exit

Both routers are alive and talking across the WAN link. Next, you will assign IP addresses to the PCs and test whether devices on the same LAN can reach each other.

Configure End Devices and Verify LAN Connectivity

Your routers are configured and talking to each other across the WAN link. Now it is time to bring the end users online.

In this step, you will assign static IP addresses to all four PCs and then test whether devices on the same site can communicate. You will also discover what happens when you try to reach a device on the other site.

In this step, get ready to:
  • Configure all four PCs with static IP addresses and default gateways.
  • Verify that devices within each site can communicate using ping.
  • Discover why traffic cannot cross between sites yet.
Configure PC IP addresses

Each PC needs three pieces of information to communicate on the network: an IP address, a subnet mask, and a default gateway.

  • Click on PC0 in the topology to open its configuration window.
  • Click the Desktop tab at the top.
  • Click IP Configuration.
  • In the IP Address field, enter 192.168.1.10.
  • In the Subnet Mask field, enter 255.255.255.0.
  • In the Default Gateway field, enter 192.168.1.1.

What is a default gateway?

The default gateway is the IP address of the router interface on the same LAN. When a PC needs to send traffic to a network it is not directly connected to, it forwards the packet to this gateway address.

For the HQ PCs, the default gateway is HQ-Router's G0/0 interface (192.168.1.1). For the Branch PCs, it is Branch-Router's G0/0 interface (192.168.2.1).

Now configure the remaining three PCs using the same process.

  • Click PC1, go to Desktop > IP Configuration.
  • Enter IP Address: 192.168.1.11, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.1.1.
  • Click PC2, go to Desktop > IP Configuration.
  • Enter IP Address: 192.168.2.10, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.2.1.
  • Click PC3, go to Desktop > IP Configuration.
  • Enter IP Address: 192.168.2.11, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.2.1.

✔️ Awesome, I've got everything!

Great. Double check that you have closed each PC's configuration window before moving on.

ⓧ I'd like to double check the full addressing

Here is the complete IP addressing reference for all four PCs:

PC0: IP 192.168.1.10, Mask 255.255.255.0, Gateway 192.168.1.1
PC1: IP 192.168.1.11, Mask 255.255.255.0, Gateway 192.168.1.1
PC2: IP 192.168.2.10, Mask 255.255.255.0, Gateway 192.168.2.1
PC3: IP 192.168.2.11, Mask 255.255.255.0, Gateway 192.168.2.1

Link lights still orange on a PC?

If you see orange link lights between a PC and its switch, wait about 30 seconds. Packet Tracer's STP convergence can cause switch ports to stay orange briefly before turning green.

If the light stays red, verify that you used a straight-through copper cable (not a cross-over cable) between the PC and the switch.

Why are my PC link lights still orange or red?

Test LAN connectivity within each site

With IP addresses assigned, you can now verify that devices on the same LAN segment can reach each other using the ping command.

  • Click on PC0 to open its configuration window.
  • Go to the Desktop tab and click Command Prompt.
  • Ping PC1 by typing this command:
ping 192.168.1.11

You should see replies from 192.168.1.11. The first request may time out, which is normal.

Why does the first ping time out?

When a device pings another device for the first time, it needs to discover the destination's MAC address using ARP (Address Resolution Protocol). While ARP resolves the address, the first ICMP packet is dropped. Subsequent pings succeed because the MAC address is now cached.

  • Now click on PC2 and open Desktop > Command Prompt.
  • Ping PC3 by typing this command:
ping 192.168.2.11

You should see replies from 192.168.2.11. Both sites now have working internal connectivity.

Now try reaching across sites. On PC0's Command Prompt, type this:

ping 192.168.2.10

This ping will fail. You should see "Request timed out" for every attempt. This is expected.

LAN pings failing within the same site?

If pings between PC0 and PC1 (or PC2 and PC3) are failing, check these common causes:

  • Verify the IP addresses and subnet masks are typed correctly on both PCs. A single digit off will break connectivity.
  • Make sure you entered the correct default gateway. HQ PCs use 192.168.1.1 and Branch PCs use 192.168.2.1.
  • Confirm the link lights between each PC and its switch are green. If not, check your cable connections.

Help me troubleshoot why my LAN pings are failing in Packet Tracer.

Understand why cross-site pings fail

The cross-site ping failed because HQ-Router does not know where to send traffic destined for the 192.168.2.0/24 network. You can see this by examining the router's routing table.

  • Click on HQ-Router and switch to the CLI tab.
  • If you are in global configuration mode, type end to return to privileged EXEC mode.
  • View the routing table by typing this command:
show ip route

What does the routing table show?

You should see only directly connected networks, marked with a "C" in the output. HQ-Router knows about 192.168.1.0/24 (its LAN) and 10.0.0.0/30 (the WAN link).

Notice that 192.168.2.0/24 (the Branch LAN) does not appear anywhere. When a packet arrives destined for 192.168.2.10, the router has no matching entry and drops it. This is why the cross-site ping failed.

This is the core problem that static routes will solve in the next step.

You have confirmed that each site works independently. The missing piece is a way to tell each router how to reach the other site's network. In the next step, you will add static routes to complete the picture and achieve full end-to-end connectivity.

Configure Static Routes and Achieve Full Connectivity

In the last step, you proved that each site's LAN works independently. PC0 can ping PC1 at HQ, and PC2 can ping PC3 at the Branch.

Cross-site pings fail because each router only knows about networks directly attached to it. Static routing solves this by manually telling each router where to forward packets destined for remote networks.

In this step, get ready to:
  • Add static routes to both routers.
  • Verify the updated routing tables.
  • Test full end-to-end connectivity and save your configurations.
Add static routes to both routers

A static route is a manual entry in the routing table that says: "To reach this network, send packets to this next-hop address." You need one on each router pointing to the other site's LAN.

  • Click on HQ-Router in your topology.
  • Go to the CLI tab and press Enter to get a command prompt.
  • Enter global configuration mode and add the static route by entering these commands:
enable
configure terminal
ip route 192.168.2.0 255.255.255.0 10.0.0.2

What does this static route do?

The command ip route 192.168.2.0 255.255.255.0 10.0.0.2 tells HQ-Router: "To reach any address in the 192.168.2.0/24 network (the Branch LAN), forward packets to 10.0.0.2."

The address 10.0.0.2 is Branch-Router's WAN interface. It is the next hop on the path to the Branch LAN.

  • Now click on Branch-Router in your topology.
  • Go to the CLI tab and press Enter to get a command prompt.
  • Enter global configuration mode and add the static route by entering these commands:
enable
configure terminal
ip route 192.168.1.0 255.255.255.0 10.0.0.1

What does this static route do?

This command tells Branch-Router: "To reach any address in the 192.168.1.0/24 network (the HQ LAN), forward packets to 10.0.0.1."

The address 10.0.0.1 is HQ-Router's WAN interface. Without this route, Branch-Router would drop any return traffic headed for the HQ site.

Getting an invalid input error?

Make sure you are in global configuration mode (your prompt ends with (config)#). If you see just Router# or Router>, type enable and then configure terminal to get there.

Also double-check that you typed the IP address and subnet mask with correct spacing. There should be a space between each number group.

help me fix an invalid input error on my Cisco router

Verify routing tables

Now that both routers have static routes, the routing tables should show new entries. You can verify this without leaving global configuration mode by using the do prefix.

  • On HQ-Router, run this command from global configuration mode:
do show ip route

You should see three types of entries in the output:

  • C 192.168.1.0/24 (directly connected, HQ LAN).
  • C 10.0.0.0/30 (directly connected, WAN link).
  • S 192.168.2.0/24 [1/0] via 10.0.0.2 (your new static route, marked with "S").
  • Switch to Branch-Router's CLI tab and run the same command:
do show ip route

You should see C 192.168.2.0/24, C 10.0.0.0/30, and S 192.168.1.0/24 [1/0] via 10.0.0.1.

What do C and S mean in the routing table?

The letter at the start of each entry tells you how the router learned about that network. C means "directly connected." The router discovered these networks automatically because its own interfaces are in them.

S means "static." You manually told the router about this network. The [1/0] shows the administrative distance (1) and metric (0) of the route.

Don't see an S route?

If show ip route only shows C entries, the static route command was not accepted. Return to global configuration mode and re-enter the ip route command. Check that the network address, mask, and next-hop IP are exactly as shown above.

help me figure out why my static route is not showing up

Test end-to-end connectivity and save

With static routes in place, every device should now be able to reach every other device across sites. Time to prove it with cross-site pings.

  • Click on PC0 in your topology.
  • Go to the Desktop tab.
  • Open Command Prompt.
  • Ping PC2 at the Branch site by typing:
ping 192.168.2.10

You should see replies from 192.168.2.10. The first ping may time out due to ARP. That is normal.

  • Still on PC0, ping PC3 to confirm the entire Branch LAN is reachable:
ping 192.168.2.11
  • Now click on PC2 in your topology.
  • Go to the Desktop tab, then open Command Prompt.
  • Ping PC0 at HQ by typing:
ping 192.168.1.10
  • Still on PC2, ping PC1 to confirm full HQ LAN reachability:
ping 192.168.1.11

All four pings should return successful replies. Your two-site network now has full end-to-end connectivity.

Why test pings from both directions?

Routing works in one direction at a time. A packet from PC0 to PC2 uses HQ-Router's static route to reach the Branch LAN. The reply from PC2 back to PC0 uses Branch-Router's static route to reach the HQ LAN.

If you only added a route on one router, pings would leave but replies would never come back. Testing from both sites proves both directions work.

Now save your router configurations so they persist across reboots.

  • Switch back to HQ-Router's CLI tab.
  • Exit global configuration mode and save by entering these commands:
end
copy running-config startup-config

When prompted to confirm the filename, press Enter to accept the default.

  • Switch to Branch-Router's CLI tab and enter the same commands:
end
copy running-config startup-config

Press Enter to confirm the filename.

What does copy running-config startup-config do?

Cisco routers keep two configuration files. The running-config is the active configuration in RAM. The startup-config lives in NVRAM (non-volatile RAM) and loads every time the router boots.

Without this save, a router reboot would erase all your work. Your static routes and interface configurations would be gone.

  • Save your Packet Tracer file by pressing Ctrl+S (Windows/Linux).

Cross-site pings still failing?

If pings within each site work but cross-site pings time out, check these common causes:

  • Run show ip route on both routers. If either is missing an S entry, re-enter the static route command from global configuration mode.
  • Verify the next-hop address is correct. HQ-Router must point to 10.0.0.2 and Branch-Router must point to 10.0.0.1.
  • Check that PCs have the correct default gateway. PC0 and PC1 should use 192.168.1.1. PC2 and PC3 should use 192.168.2.1.

help me troubleshoot why my cross-site pings are failing

✔️ Awesome, I've got everything!

Great. Double check you have saved both your router configurations and your Packet Tracer file.

ⓧ I'd like to double check the full configuration

Here is the complete command sequence for each router, including everything from Step 2 through Step 4:

enable
configure terminal
hostname HQ-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
 no shutdown
 exit
ip route 192.168.2.0 255.255.255.0 10.0.0.2
end
copy running-config startup-config
enable
configure terminal
hostname Branch-Router
no ip domain-lookup
interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.0
 no shutdown
 exit
interface GigabitEthernet0/1
 ip address 10.0.0.2 255.255.255.252
 no shutdown
 exit
ip route 192.168.1.0 255.255.255.0 10.0.0.1
end
copy running-config startup-config

And the PC IP addressing:

PC0: IP 192.168.1.10, Mask 255.255.255.0, Gateway 192.168.1.1
PC1: IP 192.168.1.11, Mask 255.255.255.0, Gateway 192.168.1.1
PC2: IP 192.168.2.10, Mask 255.255.255.0, Gateway 192.168.2.1
PC3: IP 192.168.2.11, Mask 255.255.255.0, Gateway 192.168.2.1

Your two-site network is fully operational. Every device can reach every other device across the WAN link. Next up, the Secret Mission challenges you to harden these routers with passwords and SSH access.

Secret mission

Secure Your Network Devices

Your network works, but anyone can access your routers without a password. Harden both routers with encrypted passwords, SSH-only remote access, and a login warning banner. This maps directly to the CCNA Security Fundamentals domain (15% of the exam).

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your project files for future practice, close Packet Tracer to free up memory, or delete everything entirely.

Resources you used:

  • Packet Tracer .pkt file (your saved network topology).
  • IP addressing table (paper notes or text file).

Keep everything running

No action needed. Choose this if you plan to continue practicing or want to extend the topology with additional routers, VLANs, or dynamic routing protocols.

  • Your .pkt file stays on your Desktop ready to reopen anytime.
  • Your IP addressing table is a handy reference for future projects in this series.

Pause - I'll come back to this later

Close Packet Tracer to free up system memory. Your saved file stays intact for when you return.

  • Make sure you have already saved your topology (File > Save).
  • Close Packet Tracer.
  • Your .pkt file remains on disk. Double-click it to reopen the full topology later.

Delete - I don't want to use this again

Remove all project files from your machine. You can always rebuild the topology from scratch using this project guide.

  • Close Packet Tracer if it is still open.
  • Delete your saved .pkt file from your Desktop (or wherever you saved it).
  • Delete any IP addressing table notes or text files you created.

Nice Work!

Nice Work!

Nice work! You just built a fully functional two-site office network in Cisco Packet Tracer, complete with routers, switches, PCs, and end-to-end connectivity across a WAN link.

These are foundational networking skills that map directly to the CCNA exam. You now have hands-on experience with the commands and concepts tested across 45% of the exam (Network Fundamentals + IP Connectivity).

You've learned how to:

  • Build a two-site network topology with routers, switches, and PCs, then design an IP addressing scheme using separate LAN subnets and a /30 WAN point-to-point link.
  • Configure Cisco routers via the IOS CLI: hostnames, interface IP addresses, no shutdown, and static routes to enable cross-site communication.
  • Verify connectivity using ping, show ip interface brief, and show ip route, and understand why packets cannot cross network boundaries without a route.
  • Secret Mission: Hardened routers with enable secret, console and VTY passwords, SSH access, password encryption, and a MOTD banner.

Ready to quiz yourself?