Connect Two Sites with Static Routing

Build a two-site network with VLANs, inter-VLAN routing, and static routes.

Introduction

30 Second Summary

Companies with multiple offices need their networks to talk to each other seamlessly. A sales team in one city should be able to access a company website hosted in another city just as easily as if it were sitting on their local network.

In this project, you will build a two-site enterprise network in Cisco Packet Tracer. You'll configure VLANs, Router on a Stick for inter-VLAN routing, static routes for cross-site connectivity, and set up DHCP, DNS, and a web server so any PC can browse a company website by name.

What You'll Build

A multi-site network connecting two physical locations over a WAN link, with Router on a Stick providing inter-VLAN routing at each site and static routes tying both sites together.

By the end of this project, you'll have:

  • A working two-site network with VLANs, 802.1Q trunks, and Router on a Stick providing inter-VLAN routing at each site.
  • Static routes enabling full connectivity between all VLANs across both sites over a point-to-point WAN link.
  • DHCP automatically assigning IPs to PCs, with a DNS server resolving domain names and a Web Server hosting a company webpage accessible from any PC on either site.
  • Secret Mission: Add a Guest VLAN to Site A with DHCP and extend routing so guests can also browse the company website.

Are there any prerequisites?

You need Cisco Packet Tracer installed on your computer. Packet Tracer requires a free Cisco NetAcad account to download and sign in.

Create your free account at netacad.com if you don't have one yet.

Build the Topology in Packet Tracer

Every enterprise network starts with a physical layout. Before you can configure VLANs or routing protocols, you need devices in place and cables connecting them.

In this step, you will place two routers, two switches, three PCs, and two servers in Cisco Packet Tracer. Then you will cable them into a two-site topology and review the IP addressing plan that guides the rest of the project.

In this step, get ready to:
  • Place all devices (2 routers, 2 switches, 3 PCs, 2 servers) and connect them with cables.
  • Organize the topology into two clear sites with a labeled WAN link in the middle.
  • Review the IP addressing scheme for all VLANs and the WAN link.
Place and cable all devices

Your topology needs nine devices total, split across two sites. Site A (left side) holds a router, a switch, and two PCs. Site B (right side) holds a router, a switch, one PC, and two servers.

Place the routers and switches
  • In the bottom toolbar, click Network Devices (the router icon).
  • Click Routers in the sub-category list.
  • Select 2911 and click on the workspace to place your first router.
  • Place a second 2911 router to the right of the first one, leaving space in the middle for the WAN link.
  • Click Switches in the sub-category list.
  • Select 2960-24TT and place one switch below the left router (Site A).
  • Place a second 2960-24TT switch below the right router (Site B).
Place the PCs and servers
  • Click End Devices in the bottom toolbar (the PC/phone icon).
  • Select PC and place two PCs below SW1 (Site A, left side).
  • Place a third PC below SW2 (Site B, right side).
  • Select Server from the End Devices list.
  • Place two servers below SW2, next to the third PC (both servers belong to Site B).
Rename your devices

Clear labels prevent wiring mistakes later.

  • Click the left router to open its properties.
  • In the Config tab, change the Display Name to R1.
  • Repeat for the right router, naming it R2.
  • Name the left switch SW1 and the right switch SW2.
  • Name the PCs from left to right: PC1, PC2 (both Site A), and PC3 (Site B).
  • Name the two servers DNS-Server and Web-Server.
Cable the devices together

All connections in this topology use Copper Straight-Through cables.

  • Click the Connections icon in the bottom toolbar (the lightning bolt).
  • Select Copper Straight-Through.
  • Click R1, select GigabitEthernet0/0, then click SW1 and select GigabitEthernet0/1.
  • Click R2, select GigabitEthernet0/0, then click SW2 and select GigabitEthernet0/1.
  • Click R1, select GigabitEthernet0/1, then click R2 and select GigabitEthernet0/1. This is the WAN link between sites.
  • Click PC1, select FastEthernet0, then click SW1 and select FastEthernet0/1.
  • Click PC2, select FastEthernet0, then click SW1 and select FastEthernet0/2.
  • Click PC3, select FastEthernet0, then click SW2 and select FastEthernet0/1.
  • Click DNS-Server, select FastEthernet0, then click SW2 and select FastEthernet0/2.
  • Click Web-Server, select FastEthernet0, then click SW2 and select FastEthernet0/3.

Why these specific devices?

The Router 2911 has three GigabitEthernet interfaces by default, which gives you enough ports for a trunk link and a WAN link without adding extra modules.

The Switch 2960-24TT is the standard CCNA lab switch with 24 FastEthernet ports and 2 GigabitEthernet uplinks. The GigabitEthernet ports connect to the router for trunking.

Seeing orange triangles on your cable links?

Orange indicators mean the interfaces are still initializing. Wait 30 to 60 seconds for them to turn green on the switch-to-PC and switch-to-server links.

The router-to-switch and router-to-router links will stay red or orange until you enable those interfaces with CLI commands in later steps. This is normal.

If a cable snaps to the wrong port, click the cable and press Delete, then reconnect to the correct port.

Help me fix a cabling issue in Packet Tracer.

Label and organize the topology

A clean layout makes troubleshooting much easier when you have nine devices and eight cables.

  • Drag all Site A devices (R1, SW1, PC1, PC2) to the left side of the workspace.
  • Drag all Site B devices (R2, SW2, PC3, DNS-Server, Web-Server) to the right side.
  • Position R1 and R2 at the same height so the WAN link cable runs horizontally between them.
  • Click the Place Note tool in the top toolbar (the "i" icon on the right side of the toolbar).
  • Click in the space between the two routers and type WAN Link - 10.10.10.0/30 to label the connection.

Keep routers at the top

A common convention is to place routers at the top, switches in the middle, and end devices (PCs, servers) at the bottom. This mirrors how traffic flows from LAN to WAN.

Review the addressing plan

Before configuring anything, you need a clear picture of which IPs belong to which network segment. This plan drives every configuration step that follows.

# Site A VLANs
VLAN 10 (Sales):        192.168.10.0/24   Gateway: 192.168.10.1
VLAN 20 (Engineering):  192.168.20.0/24   Gateway: 192.168.20.1

# Site B VLANs
VLAN 30 (HR):           192.168.30.0/24   Gateway: 192.168.30.1
VLAN 40 (Servers):      192.168.40.0/24   Gateway: 192.168.40.1

# WAN Link (point-to-point between R1 and R2)
WAN:                    10.10.10.0/30
  R1 (GigabitEthernet0/1):  10.10.10.1
  R2 (GigabitEthernet0/1):  10.10.10.2

# Static Server IPs (Site B, VLAN 40)
DNS-Server:             192.168.40.10
Web-Server:             192.168.40.11

What does this addressing plan tell you?

Each site has two VLANs, each with its own /24 subnet (254 usable IPs). The gateway IP (ending in .1) lives on the router's subinterface for that VLAN.

The WAN link uses a /30 subnet, which provides exactly 2 usable IPs. This is standard practice for point-to-point router links because you only need one IP per router end.

The DNS and Web servers get static IPs because other devices need to find them at a consistent address.

Why separate VLANs per department?

VLANs segment broadcast traffic so Sales traffic stays on VLAN 10 and Engineering traffic stays on VLAN 20. Without VLANs, every device on the switch would receive every broadcast frame, wasting bandwidth and creating security risks.

✔️ Awesome, I've got everything!

Great. Double check your device names match exactly (R1, R2, SW1, SW2, PC1, PC2, PC3, DNS-Server, Web-Server) and the WAN label is in place.

ⓧ I'd like to double check the full topology

Verify your topology matches this connection list:

# Devices
2x Router 2911:        R1 (Site A), R2 (Site B)
2x Switch 2960-24TT:   SW1 (Site A), SW2 (Site B)
3x PC:                 PC1 (Site A), PC2 (Site A), PC3 (Site B)
2x Server:             DNS-Server (Site B), Web-Server (Site B)

# Cables (all Copper Straight-Through)
R1 GigabitEthernet0/0  -->  SW1 GigabitEthernet0/1   (trunk link)
R2 GigabitEthernet0/0  -->  SW2 GigabitEthernet0/1   (trunk link)
R1 GigabitEthernet0/1  -->  R2 GigabitEthernet0/1    (WAN link)
PC1 FastEthernet0      -->  SW1 FastEthernet0/1
PC2 FastEthernet0      -->  SW1 FastEthernet0/2
PC3 FastEthernet0      -->  SW2 FastEthernet0/1
DNS-Server FastEthernet0 --> SW2 FastEthernet0/2
Web-Server FastEthernet0 --> SW2 FastEthernet0/3

# Layout
Site A on the left, Site B on the right
WAN link labeled in the middle: WAN Link - 10.10.10.0/30

Your physical topology is complete. Next up, you will configure VLANs on both switches and set up trunk ports so VLAN traffic can reach the routers.

Configure VLANs and Trunks

Your topology is built and cabled. Both sites have their devices connected, but right now every port on each switch lives in the same default VLAN.

In this step, you will create VLANs to segment traffic at each site and configure trunk links so tagged VLAN traffic can flow between the switches and routers.

In this step, get ready to:
  • Create VLANs and assign access ports on SW1 (Site A).
  • Create VLANs and assign access ports on SW2 (Site B).
  • Configure trunk ports on both switches to carry VLAN traffic to the routers.
Configure VLANs and access ports on SW1

Each switch needs VLANs created in its local database before ports can be assigned to them. SW1 at Site A uses VLAN 10 for the Sales team and VLAN 20 for Engineering.

  • Click on SW1 in your topology.
  • Select the CLI tab.
  • Enter the following commands to create VLANs and assign access ports:
SW1> enable
SW1# configure terminal
! Create VLAN 10 for the Sales team
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# exit
! Create VLAN 20 for Engineering
SW1(config)# vlan 20
SW1(config-vlan)# name Engineering
SW1(config-vlan)# exit
! Assign PC1's port to VLAN 10
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
! Assign PC2's port to VLAN 20
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit

What does this configuration do?

The vlan 10 command creates a VLAN in the switch's local database. The name Sales command gives it a human-readable label.

The switchport mode access command locks a port into access mode so it carries traffic for only one VLAN. The switchport access vlan 10 command assigns the port to VLAN 10.

  • Verify your VLAN configuration by running this command in privileged EXEC mode:
SW1# show vlan brief

You should see VLAN 10 (Sales) with Fa0/1 listed in the Ports column, and VLAN 20 (Engineering) with Fa0/2 listed.

Don't see your VLANs or ports listed?

  • Make sure you typed exit after each VLAN and interface configuration block. Without exit, subsequent commands may be entered in the wrong mode.
  • Check that you entered enable first to reach privileged EXEC mode. The configure terminal command only works from the SW1# prompt.
  • Trunk ports do not appear in the show vlan brief output. Only access ports are listed under each VLAN.

Still stuck? Help me troubleshoot my SW1 VLAN configuration in Packet Tracer.

Configure VLANs and access ports on SW2

SW2 at Site B uses VLAN 30 for the HR team and VLAN 40 for the Servers subnet. Both the DNS Server and Web Server connect to VLAN 40.

  • Click on SW2 in your topology.
  • Select the CLI tab.
  • Enter the following commands to create VLANs and assign access ports:
SW2> enable
SW2# configure terminal
! Create VLAN 30 for the HR team
SW2(config)# vlan 30
SW2(config-vlan)# name HR
SW2(config-vlan)# exit
! Create VLAN 40 for Servers
SW2(config)# vlan 40
SW2(config-vlan)# name Servers
SW2(config-vlan)# exit
! Assign PC3's port to VLAN 30
SW2(config)# interface FastEthernet0/1
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 30
SW2(config-if)# exit
! Assign both server ports to VLAN 40
SW2(config)# interface range FastEthernet0/2-3
SW2(config-if-range)# switchport mode access
SW2(config-if-range)# switchport access vlan 40
SW2(config-if-range)# exit

What does interface range do?

The interface range FastEthernet0/2-3 command lets you configure multiple ports at once. Instead of repeating the same access VLAN commands twice (once for Fa0/2, once for Fa0/3), this single block applies the configuration to both ports simultaneously.

  • Verify your VLAN configuration by running:
SW2# show vlan brief

You should see VLAN 30 (HR) with Fa0/1, and VLAN 40 (Servers) with Fa0/2 and Fa0/3 listed in the Ports column.

Ports still showing under VLAN 1?

  • If a port still appears under VLAN 1 (the default VLAN), the access VLAN assignment did not apply. Re-enter the interface and run switchport access vlan 30 or switchport access vlan 40 again.
  • Check for typos in the interface name. Packet Tracer requires the full FastEthernet0/1 syntax or the abbreviated fa0/1 form.

Still stuck? Help me troubleshoot my SW2 VLAN configuration in Packet Tracer.

Configure trunk ports on both switches

Access ports carry traffic for a single VLAN. A trunk port uses 802.1Q tagging to carry multiple VLANs over one physical link to the router.

  • Return to the SW1 CLI and enter the following trunk configuration:
! Configure the uplink to R1 as a trunk
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# exit
  • Switch to the SW2 CLI and enter the following trunk configuration:
! Configure the uplink to R2 as a trunk
SW2(config)# interface GigabitEthernet0/1
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk allowed vlan 30,40
SW2(config-if)# exit

What does this trunk configuration do?

The switchport mode trunk command sets the port to always trunk. On a 2960 switch, 802.1Q is the only supported encapsulation, so no additional encapsulation command is needed.

The switchport trunk allowed vlan 10,20 command restricts the trunk to carry only the VLANs you specify. This is a security best practice that prevents unwanted VLAN traffic from crossing the link.

  • Verify the trunk is active on SW1 by running:
SW1# show interfaces trunk
  • Verify the trunk is active on SW2 by running:
SW2# show interfaces trunk

On SW1, you should see GigabitEthernet0/1 listed with Mode on, Encapsulation 802.1q, Status trunking, and VLANs 10,20 in the allowed list. On SW2, you should see the same pattern with VLANs 30,40.

Why does show vlan brief not show trunk ports?

The show vlan brief command only lists access ports under each VLAN. Trunk ports carry multiple VLANs simultaneously, so they do not appear in any single VLAN's Ports column.

To see which VLANs are active on trunk links, use show interfaces trunk. Combining both commands gives you the complete VLAN picture on a switch.

Show interfaces trunk shows nothing?

  • This command only displays output when at least one trunk is actively established. If GigabitEthernet0/1 shows nothing, the router on the other end may not be connected or powered on. Check your cable between SW1 and R1 (or SW2 and R2).
  • Make sure the cable connects to GigabitEthernet0/1 on the switch, not a FastEthernet port.

Still stuck? Help me troubleshoot why my trunk is not showing up in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Double check you see the correct VLANs and ports on both switches before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete set of commands for both switches:

SW1 full configuration:

SW1> enable
SW1# configure terminal
SW1(config)# vlan 10
SW1(config-vlan)# name Sales
SW1(config-vlan)# exit
SW1(config)# vlan 20
SW1(config-vlan)# name Engineering
SW1(config-vlan)# exit
SW1(config)# interface FastEthernet0/1
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 10
SW1(config-if)# exit
SW1(config)# interface FastEthernet0/2
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 20
SW1(config-if)# exit
SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk allowed vlan 10,20
SW1(config-if)# exit

SW2 full configuration:

SW2> enable
SW2# configure terminal
SW2(config)# vlan 30
SW2(config-vlan)# name HR
SW2(config-vlan)# exit
SW2(config)# vlan 40
SW2(config-vlan)# name Servers
SW2(config-vlan)# exit
SW2(config)# interface FastEthernet0/1
SW2(config-if)# switchport mode access
SW2(config-if)# switchport access vlan 30
SW2(config-if)# exit
SW2(config)# interface range FastEthernet0/2-3
SW2(config-if-range)# switchport mode access
SW2(config-if-range)# switchport access vlan 40
SW2(config-if-range)# exit
SW2(config)# interface GigabitEthernet0/1
SW2(config-if)# switchport mode trunk
SW2(config-if)# switchport trunk allowed vlan 30,40
SW2(config-if)# exit

Both switches now have their VLANs segmented and trunk links ready. Next up, you will configure Router on a Stick so traffic can actually flow between VLANs.

Configure Router on a Stick

Your switches now have VLANs configured and trunks carrying tagged traffic up to the routers. The problem is that devices in different VLANs still cannot talk to each other.

That is where Router on a Stick comes in. By creating subinterfaces on each router's trunk-facing port, you give every VLAN its own default gateway. Traffic between VLANs routes through that single physical link.

In this step, get ready to:
  • Configure subinterfaces on R1 for VLAN 10 and VLAN 20.
  • Configure subinterfaces on R2 for VLAN 30 and VLAN 40.
  • Verify all subinterfaces are up with the correct IP addresses.
Configure subinterfaces on R1

A subinterface is a virtual interface created on top of a physical one. Each subinterface handles traffic for a single VLAN by tagging frames with 802.1Q encapsulation.

  • Click on R1 in your topology to open it.
  • Go to the CLI tab.
  • Enable the physical interface and create subinterfaces by entering these commands:
R1> enable
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit

What do these commands do?

  • no shutdown activates the physical GigabitEthernet0/0 interface. Without this, all subinterfaces beneath it stay down.
  • interface GigabitEthernet0/0.10 creates subinterface number 10. The number after the dot is just a label, but matching it to the VLAN ID keeps things readable.
  • encapsulation dot1Q 10 tells the subinterface to tag and untag frames for VLAN 10. This is the command that actually binds the subinterface to the VLAN.
  • ip address 192.168.10.1 255.255.255.0 assigns the default gateway IP that PCs in VLAN 10 will use.

You will not see any output from these commands. The router accepts them silently.

Seeing an error after encapsulation dot1Q?

  • Make sure you created the subinterface first with interface GigabitEthernet0/0.10. You cannot run encapsulation dot1Q on the physical interface itself.
  • Check that the physical interface GigabitEthernet0/0 has no shutdown applied before creating subinterfaces.

Help me troubleshoot my Router on a Stick subinterface configuration on R1 in Packet Tracer.

Configure subinterfaces on R2
  • Click on R2 in your topology to open it.
  • Go to the CLI tab.
  • Enable the physical interface and create subinterfaces for Site B's VLANs by entering these commands:
R2> enable
R2# configure terminal
R2(config)# interface GigabitEthernet0/0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface GigabitEthernet0/0.30
R2(config-subif)# encapsulation dot1Q 30
R2(config-subif)# ip address 192.168.30.1 255.255.255.0
R2(config-subif)# exit
R2(config)# interface GigabitEthernet0/0.40
R2(config-subif)# encapsulation dot1Q 40
R2(config-subif)# ip address 192.168.40.1 255.255.255.0
R2(config-subif)# exit

What is different on R2?

The structure is identical to R1. The only differences are the VLAN numbers (30 and 40 instead of 10 and 20) and the subnet addresses (192.168.30.0 and 192.168.40.0). Each subinterface becomes the default gateway for its respective VLAN at Site B.

Again, the router accepts these commands silently. You will verify everything in the next substep.

Typed the wrong IP address?

  • Re-enter the subinterface with interface GigabitEthernet0/0.30 (or whichever number), then type the correct ip address command. The new address overwrites the old one.
  • Double-check that VLAN 30 gets 192.168.30.1 and VLAN 40 gets 192.168.40.1. Swapping these will break routing later.

Help me fix an IP address mistake on my R2 subinterfaces.

Verify subinterfaces on both routers

Both routers should now have their physical interfaces up and their subinterfaces active with IP addresses assigned. Time to confirm.

  • On R1, exit configuration mode if you are still in it by typing end.
  • Run this command on R1:
show ip interface brief
  • Confirm that GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all show up in both the Status and Protocol columns.
  • Verify that GigabitEthernet0/0.10 shows IP 192.168.10.1 and GigabitEthernet0/0.20 shows IP 192.168.20.1.
  • Now run the same command on R2:
show ip interface brief
  • Confirm that GigabitEthernet0/0, GigabitEthernet0/0.30, and GigabitEthernet0/0.40 all show up in both columns.
  • Verify that GigabitEthernet0/0.30 shows IP 192.168.30.1 and GigabitEthernet0/0.40 shows IP 192.168.40.1.
  • Optionally, run show vlans on each router to verify VLAN-to-subinterface mappings.

Subinterface showing down/down?

  • Check that the physical interface GigabitEthernet0/0 has no shutdown applied. Subinterfaces inherit the physical interface's state.
  • Make sure the cable from the router's GigabitEthernet0/0 port connects to the switch's GigabitEthernet0/1 port. A missing or incorrect cable keeps the interface down.
  • Verify the switch trunk is active by running show interfaces trunk on the connected switch. If the trunk is not listed, the router interface stays down.

Help me figure out why my subinterface shows down/down in Packet Tracer.

Why does Router on a Stick use a single physical link?

A Layer 2 switch cannot route traffic between VLANs on its own. It needs a router to make forwarding decisions. Router on a Stick sends all inter-VLAN traffic up a single trunk link to the router, which routes it and sends it back down the same link to the destination VLAN.

This is simpler and cheaper than dedicating one physical router port per VLAN. The trade-off is that all inter-VLAN traffic shares one link's bandwidth.

✔️ Awesome, I've got everything!

Great. Make sure both routers show all subinterfaces as up/up before moving on.

ⓧ I'd like to double check the full code

Here is the complete set of commands for R1:

R1> enable
R1# configure terminal
R1(config)# interface GigabitEthernet0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface GigabitEthernet0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit

Here is the complete set of commands for R2:

R2> enable
R2# configure terminal
R2(config)# interface GigabitEthernet0/0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface GigabitEthernet0/0.30
R2(config-subif)# encapsulation dot1Q 30
R2(config-subif)# ip address 192.168.30.1 255.255.255.0
R2(config-subif)# exit
R2(config)# interface GigabitEthernet0/0.40
R2(config-subif)# encapsulation dot1Q 40
R2(config-subif)# ip address 192.168.40.1 255.255.255.0
R2(config-subif)# exit

Both routers now act as gateways for their local VLANs. Next, you will connect the two sites together with a WAN link and add static routes so traffic can flow between Site A and Site B.

Configure the WAN Link and Static Routes

Your routers can now route traffic between VLANs within each site. But Site A and Site B are still isolated islands. A PC in VLAN 10 can reach VLAN 20, but it has no path to reach VLAN 30 or the servers in VLAN 40.

In this step, you will bring up the WAN link between R1 and R2, then add static routes so every VLAN at one site knows how to reach every VLAN at the other site.

In this step, get ready to:
  • Assign IP addresses to the WAN interfaces and bring the link up.
  • Add static routes on both routers for full inter-site reachability.
  • Verify end-to-end routing with pings across sites.
Configure the point-to-point WAN link

The cable between R1 GigabitEthernet0/1 and R2 GigabitEthernet0/1 is already in place, but neither interface has an IP address yet. You will use a /30 subnet (10.10.10.0/30) which provides exactly two usable addresses. This is standard practice for point-to-point router links.

  • Click on R1, then go to the CLI tab.
  • Configure the WAN interface on R1 by entering these commands:
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ip address 10.10.10.1 255.255.255.252
R1(config-if)# no shutdown
R1(config-if)# exit

What does this code do?

You are configuring the physical interface that connects R1 to R2 over the WAN link.

  • interface GigabitEthernet0/1 selects the physical port cabled to R2.
  • ip address 10.10.10.1 255.255.255.252 assigns the first usable IP in the /30 subnet. The /30 mask (255.255.255.252) allows only two hosts.
  • no shutdown activates the interface. Router interfaces are administratively down by default.
  • Now click on R2, then go to the CLI tab.
  • Configure the WAN interface on R2 by entering these commands:
R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip address 10.10.10.2 255.255.255.252
R2(config-if)# no shutdown
R2(config-if)# exit

What does this code do?

This mirrors R1's configuration on R2's side of the WAN link. R2 gets the second usable IP in the /30 subnet (10.10.10.2). Both routers now share the same /30 network and can communicate directly.

  • Verify the WAN link is active by pinging R2 from R1. Return to R1's CLI and run:
R1# ping 10.10.10.2

You should see 5 reply packets with a success rate of 80% to 100%. The first packet may time out while ARP resolves the MAC address.

Ping fails with 0% success?

  • Make sure you ran no shutdown on both R1 and R2's GigabitEthernet0/1 interface. Without it, the interface stays administratively down.
  • Double-check the subnet mask is 255.255.255.252 on both sides. A mismatched mask means the routers think they are on different networks.
  • Run show ip interface brief on both routers to confirm GigabitEthernet0/1 shows status "up" and protocol "up".

Why can't my routers ping each other over the WAN link?

Configure static routes on both routers

The WAN link is up, but routers only know about networks directly connected to them. R1 has no idea that 192.168.30.0/24 or 192.168.40.0/24 exist on the other side. Static routes tell each router where to forward packets destined for remote networks.

  • On R1, add static routes pointing to Site B's networks by entering these commands:
R1(config)# ip route 192.168.30.0 255.255.255.0 10.10.10.2
R1(config)# ip route 192.168.40.0 255.255.255.0 10.10.10.2
  • On R2, add static routes pointing to Site A's networks by entering these commands:
R2(config)# ip route 192.168.10.0 255.255.255.0 10.10.10.1
R2(config)# ip route 192.168.20.0 255.255.255.0 10.10.10.1

What do these static routes do?

Each ip route command follows the pattern: ip route [destination-network] [subnet-mask] [next-hop-ip].

  • On R1, both routes use 10.10.10.2 as the next hop. This tells R1 to forward traffic for Site B's subnets to R2's WAN IP.
  • On R2, both routes use 10.10.10.1 as the next hop. This tells R2 to send traffic for Site A's subnets back to R1.
  • Without routes on BOTH routers, traffic can reach the remote site but the reply has no path back. Routing must work in both directions.

Typed a route wrong?

If you entered an incorrect route, remove it with the no prefix. For example: no ip route 192.168.30.0 255.255.255.0 10.10.10.2. Then re-enter the correct command.

Help me fix a static route I entered incorrectly on my Cisco router.

Verify routing tables

You have configured the WAN link and added static routes in both directions. Now you need to confirm the routing tables reflect all five networks (four VLANs plus the WAN) and that packets can actually cross from one site to the other.

  • On R1, view the routing table by running:
R1# show ip route

You should see connected routes (marked with C) for 192.168.10.0/24, 192.168.20.0/24, and 10.10.10.0/30. You should also see static routes (marked with S) for 192.168.30.0/24 and 192.168.40.0/24 pointing to 10.10.10.2.

  • On R2, view the routing table by running:
R2# show ip route

R2 should show connected routes for 192.168.30.0/24, 192.168.40.0/24, and 10.10.10.0/30. Its static routes for 192.168.10.0/24 and 192.168.20.0/24 should point to 10.10.10.1.

  • Test cross-site connectivity by pinging R2's subinterface from R1:
R1# ping 192.168.30.1

A successful reply confirms that R1 knows how to reach Site B's VLAN 30 subnet through the static route, and R2 knows how to send the reply back through its own static route.

Why ping a subinterface instead of the WAN IP?

You already tested the WAN link earlier by pinging 10.10.10.2. That only proves the direct link works. Pinging 192.168.30.1 (R2's VLAN 30 subinterface) proves the static routes are working. The packet must leave R1 via the WAN, arrive at R2, and R2 must recognize it as destined for a local interface.

Ping to 192.168.30.1 fails?

  • Run show ip route on R1 and confirm you see an S entry for 192.168.30.0/24. If it is missing, re-enter the static route command.
  • Make sure the next-hop IP in R1's static route is 10.10.10.2 (R2's WAN IP). A wrong next-hop means R1 sends the packet to a non-existent address.
  • Confirm R2's subinterfaces are still up by running show ip interface brief on R2. If GigabitEthernet0/0.30 is down, go back and re-enable the parent interface with no shutdown on GigabitEthernet0/0.

Help me troubleshoot why my cross-site ping is failing.

✔️ Awesome, I've got everything!

Great. Both routing tables show all five networks and cross-site pings succeed. Your two sites are fully connected.

ⓧ I'd like to double check the full configuration

Here is the complete WAN and routing configuration for both routers. Compare your setup against this:

R1 WAN and Static Routes:

! R1 WAN Interface
interface GigabitEthernet0/1
 ip address 10.10.10.1 255.255.255.252
 no shutdown

! R1 Static Routes to Site B
ip route 192.168.30.0 255.255.255.0 10.10.10.2
ip route 192.168.40.0 255.255.255.0 10.10.10.2

R2 WAN and Static Routes:

! R2 WAN Interface
interface GigabitEthernet0/1
 ip address 10.10.10.2 255.255.255.252
 no shutdown

! R2 Static Routes to Site A
ip route 192.168.10.0 255.255.255.0 10.10.10.1
ip route 192.168.20.0 255.255.255.0 10.10.10.1

Expected show ip route output on R1 should include:

  • C 192.168.10.0/24 (connected via Gi0/0.10).
  • C 192.168.20.0/24 (connected via Gi0/0.20).
  • C 10.10.10.0/30 (connected via Gi0/1).
  • S 192.168.30.0/24 via 10.10.10.2.
  • S 192.168.40.0/24 via 10.10.10.2.

Your two sites can now reach each other over the WAN. Next up, you will configure DHCP to automatically assign IP addresses to all PCs and set up DNS and web services so any PC can browse a company website by name.

Configure DHCP, DNS, and Web Server

Your routers now have full routing between both sites. Traffic can flow from any subnet to any other subnet thanks to the static routes you configured in the last step.

But there is a problem. No PC on either site actually has an IP address yet. Without DHCP, you would need to manually configure every single device. In this step, you will set up DHCP pools on both routers so PCs get addresses automatically, then deploy a DNS server and Web Server so users can browse a website by name instead of memorizing IP addresses.

In this step, get ready to:
  • Configure DHCP pools on R1 and R2 so all PCs receive IP addresses, gateways, and DNS server settings automatically.
  • Set up a DNS server and Web Server in Site B with static IPs and services enabled.
  • Verify full end-to-end connectivity by browsing a website by domain name from any PC on either site.
Configure DHCP pools on R1 and R2

A DHCP server automatically hands out IP addresses, default gateways, and DNS server information to any device that requests it. Your routers will act as the DHCP servers for their local VLANs.

  • Click on R1 in your topology to open its configuration window.
  • Select the CLI tab.
  • If you are not already in global configuration mode, type enable and then configure terminal to enter it.
  • Configure the DHCP excluded addresses and pools for Site A by entering these commands:
R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10
R1(config)# ip dhcp excluded-address 192.168.20.1 192.168.20.10
R1(config)# ip dhcp pool VLAN10-Sales
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.168.40.10
R1(dhcp-config)# exit
R1(config)# ip dhcp pool VLAN20-Engineering
R1(dhcp-config)# network 192.168.20.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.20.1
R1(dhcp-config)# dns-server 192.168.40.10
R1(dhcp-config)# exit

What do these commands do?

The ip dhcp excluded-address lines reserve the first 10 IPs in each subnet for static use. This prevents the router from giving away addresses you might need for gateways or servers.

Each ip dhcp pool block defines a pool of addresses to hand out. The network command sets which subnet the pool serves. The default-router command tells clients their gateway IP. The dns-server command tells clients where to send DNS queries.

The router automatically matches incoming DHCP requests to the correct pool based on which subinterface received the request.

  • Now click on R2 and open its CLI tab.
  • Enter global configuration mode if needed.
  • Configure the DHCP pool for Site B's HR VLAN by entering these commands:
R2(config)# ip dhcp excluded-address 192.168.30.1 192.168.30.10
R2(config)# ip dhcp pool VLAN30-HR
R2(dhcp-config)# network 192.168.30.0 255.255.255.0
R2(dhcp-config)# default-router 192.168.30.1
R2(dhcp-config)# dns-server 192.168.40.10
R2(dhcp-config)# exit

Why only one pool on R2?

VLAN 40 (Servers) uses static IPs because servers need predictable addresses that never change. The DNS Server and Web Server will get their IPs manually in the next substep. Only VLAN 30 (HR) has PCs that need DHCP.

Now set each PC to request an address via DHCP.

  • Click on PC1 in your topology.
  • Go to the Desktop tab.
  • Click IP Configuration.
  • Select the DHCP radio button.
  • Wait a moment for the IP address, subnet mask, default gateway, and DNS server fields to populate automatically.
  • Repeat the same steps for PC2 and PC3.
  • Verify DHCP leases on R1 by returning to R1's CLI and running:
R1# show ip dhcp binding

You should see entries for PC1 and PC2 with IPs in the 192.168.10.0/24 and 192.168.20.0/24 ranges.

  • Run the same command on R2 to confirm PC3 received an address:
R2# show ip dhcp binding

You should see an entry for PC3 with an IP in the 192.168.30.0/24 range.

PC not receiving an IP address?

  • Make sure the physical interface GigabitEthernet0/0 on the router is in the no shutdown state. The subinterfaces rely on the parent interface being up.
  • Confirm the trunk port on the switch is allowing the correct VLANs by running show interfaces trunk on the switch.
  • Double-check the DHCP pool's network statement matches the subinterface's subnet exactly.

Still stuck? Help me troubleshoot why my PC isn't getting a DHCP address from the router subinterface.

✔️ Awesome, I've got everything!

Great. All three PCs should now have IP addresses, gateways, and DNS server values assigned by DHCP.

ⓧ I'd like to double check the full config

Here is the complete DHCP configuration for both routers:

R1 DHCP configuration:

R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10
R1(config)# ip dhcp excluded-address 192.168.20.1 192.168.20.10
R1(config)# ip dhcp pool VLAN10-Sales
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.168.40.10
R1(dhcp-config)# exit
R1(config)# ip dhcp pool VLAN20-Engineering
R1(dhcp-config)# network 192.168.20.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.20.1
R1(dhcp-config)# dns-server 192.168.40.10
R1(dhcp-config)# exit

R2 DHCP configuration:

R2(config)# ip dhcp excluded-address 192.168.30.1 192.168.30.10
R2(config)# ip dhcp pool VLAN30-HR
R2(dhcp-config)# network 192.168.30.0 255.255.255.0
R2(dhcp-config)# default-router 192.168.30.1
R2(dhcp-config)# dns-server 192.168.40.10
R2(dhcp-config)# exit
Configure the DNS and Web Servers

Your PCs now have IP addresses, but they still cannot browse a website by name. You need a DNS server to translate domain names into IP addresses, and a Web Server to host the actual page.

  • Click on the DNS-Server device in your topology.
  • Go to the Config tab.
  • Click FastEthernet0 in the left panel (or whichever interface is connected).
  • Set the IP Address to 192.168.40.10.
  • Set the Subnet Mask to 255.255.255.0.
  • Set the Default Gateway to 192.168.40.1.

Now enable the DNS service and add a record.

  • Switch to the Services tab.
  • Click DNS in the left panel.
  • Make sure the DNS Service toggle is set to ON.
  • In the Name field, type www.company.com.
  • In the Address field, type 192.168.40.11.
  • Click Add to save the A record.

What is an A record?

An A record maps a human-readable domain name to an IP address. When a PC asks "where is www.company.com?", the DNS server looks up this record and replies with 192.168.40.11 so the PC knows where to send the web request.

Now configure the Web Server.

  • Click on the Web-Server device in your topology.
  • Go to the Config tab.
  • Click FastEthernet0 in the left panel.
  • Set the IP Address to 192.168.40.11.
  • Set the Subnet Mask to 255.255.255.0.
  • Set the Default Gateway to 192.168.40.1.
  • Switch to the Services tab.
  • Click HTTP in the left panel.
  • Make sure the HTTP service is set to ON.
  • Click (edit) next to index.html.
  • Replace the existing content with:
Welcome to Company.com - You have reached the web server!
  • Click Save to store the page content.

Why static IPs for the servers?

Servers need addresses that never change. If the DNS Server's IP shifted every time it rebooted, no device would know where to send DNS queries. The same applies to the Web Server since the DNS A record points to a specific IP.

DNS record not saving?

  • Make sure you typed the full domain name including www. at the front.
  • Confirm the DNS service toggle is ON before adding the record.

Need more help? Help me troubleshoot my DNS server configuration in Packet Tracer.

Test end-to-end connectivity

Everything is configured. Time to prove that DHCP, DNS, static routing, and Router on a Stick all work together by browsing the company website from a PC in Site A.

  • Click on PC1 in your topology.
  • Go to the Desktop tab.
  • Click Command Prompt.
  • Ping the Web Server to verify routing works by running:
ping 192.168.40.11

You should see replies coming back, confirming that traffic flows from Site A VLAN 10 all the way to Site B VLAN 40.

  • Close the Command Prompt and click Web Browser on the Desktop tab.
  • In the URL bar, type www.company.com and press Go.

The page should display the message: "Welcome to Company.com - You have reached the web server!"

What just happened behind the scenes?

PC1 sent a DNS query to 192.168.40.10 (the DNS Server it learned via DHCP). The DNS Server replied with 192.168.40.11 (the A record you created). PC1 then sent an HTTP request to that IP.

The request traveled from VLAN 10 on SW1, up the trunk to R1's subinterface, across the WAN link to R2 (using the static route), and down through R2's subinterface to VLAN 40 where the Web Server lives. The reply followed the reverse path.

  • Repeat the test from PC3 (Site B, VLAN 30).
  • Open PC3's Desktop tab, click Web Browser, type www.company.com, and press Go.

The same webpage should load, confirming that local Site B access also works.

  • Return to R1's CLI and run this command to see the active DHCP leases:
show ip dhcp binding

You should see entries showing the IP addresses leased to PC1 and PC2 along with their MAC addresses.

Web page not loading?

  • If the ping to 192.168.40.11 fails, the issue is routing. Check your static routes on both routers with show ip route.
  • If the ping works but browsing www.company.com fails, the issue is DNS. Verify the DNS Server's IP is 192.168.40.10 and the A record points to 192.168.40.11.
  • Make sure the PC's DNS server field (shown in IP Configuration) is 192.168.40.10. If it is blank, re-check the dns-server line in your DHCP pool.

Still stuck? Help me figure out why my PC can't browse www.company.com in Packet Tracer.

Secret mission

Add a Guest VLAN to Site A

Your two-site network is fully operational, but Site A only has Sales and Engineering VLANs. Can you add a Guest VLAN, configure DHCP, and update routing on BOTH routers so guests can browse www.company.com? This tests whether you truly understand how all the pieces connect end-to-end.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer on your local machine. There are no cloud resources or ongoing costs to worry about.

Decide whether to keep your topology file, close Packet Tracer for now, or delete the file entirely.

Resources you used:

  • Cisco Packet Tracer topology file (.pkt file saved on your machine).

Keep everything running

No action needed. Choose this if you want to keep experimenting with the topology or add more devices and VLANs.

  • Your .pkt file stays on your machine wherever you saved it.
  • You can reopen it anytime from File > Open in Packet Tracer.

Pause - I'll come back to this later

Save your work and close Packet Tracer to free up system memory. Your topology is preserved in the file.

  • In Packet Tracer, click File > Save to make sure your latest changes are saved.
  • Close Packet Tracer.
  • When you return, open the .pkt file and all your device configurations will still be there.

Delete - I don't want to use this again

Remove the topology file from your machine entirely. You can always rebuild it from scratch using this project.

  • Close Packet Tracer if it is still open.
  • Delete the .pkt topology file from wherever you saved it. In your terminal, navigate to the directory where you saved the file and run:
rm *.pkt

What does this command do?

This removes all Packet Tracer topology files in the current directory. If you saved the file somewhere specific, adjust the path accordingly.

Nice Work!

Nice Work!

You just built a fully routed multi-site enterprise network from scratch in Cisco Packet Tracer. Any PC at either site can now browse www.company.com by name, proving that every layer of your network is working together.

You've learned how to:

  • Build a multi-site network with VLANs, 802.1Q trunks, and Router on a Stick subinterfaces for inter-VLAN routing at each site.
  • Connect two sites over a point-to-point WAN link using a /30 subnet and configure static routes for full inter-site reachability.
  • Configure DHCP pools on routers, deploy a DNS server and Web Server, and verify end-to-end name resolution and web access across sites.
  • Secret Mission: Extended the network with a Guest VLAN, proving you understand how to add new networks and update routing on both ends for full connectivity.

Ready to quiz yourself?