Secure a Three-Site Network with RIP

Build a secured three-site enterprise network with RIPv2 dynamic routing.

Introduction

30 Second Summary

When a company opens a second or third office, every new site needs to talk to every other site. Manually programming those routes into every router gets tedious fast, and leaving all those devices wide open is a security nightmare.

In this project, you will build a secured three-site enterprise network in Cisco Packet Tracer where routers learn routes automatically via RIPv2, PCs get their addresses from DHCP, and every device is locked down with passwords, encryption, and port security.

What You'll Build

By the end, you can open a web browser on any PC at any site, type www.company.com, and watch the page load after traffic routes dynamically across two WAN hops, through DNS resolution, past secured routers and switches.

By the end of this project, you'll have:

  • A fully routed three-site network where you can browse www.company.com from any PC at any site, with RIPv2 automatically routing traffic across two WAN links without a single static route.
  • Routers that discover routes on their own. You can run show ip route and see routes learned dynamically, proving no manual maintenance is needed as the network grows.
  • Every router and switch hardened with security. Try to access privileged mode without the password and get denied. View the config and see encrypted passwords instead of plaintext.
  • Secret Mission: Add a standard ACL to block the Finance team from reaching the company servers while leaving all other traffic flowing normally.

Are there any prerequisites?

You need Cisco Packet Tracer installed on your machine with a free Cisco NetAcad account. All work in this project happens inside Packet Tracer, so no cloud accounts or additional software are required.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Build the Three-Site Topology

Every network starts with a physical foundation. Before you can configure routing, security, or services, you need to place the actual devices and connect them with cables.

In this step, you will build the complete three-site topology from scratch. You will place 12 devices across three sites, cable them together, and map out the IP addressing plan that guides the rest of the project.

In this step, get ready to:
  • Place and cable all 12 devices across the three sites.
  • Label every device and organize the workspace by site.
  • Review the IP addressing plan for VLANs, LANs, and WAN links.
Place and cable all devices

Your network has three sites connected in a chain. Site A is a large office with two departments. Site B hosts the company servers. Site C is a smaller branch office.

You will place three routers, three switches, four PCs, and two servers. Then you will connect them all with Copper Straight-Through cables.

  • In the bottom panel of Cisco Packet Tracer, click the Network Devices category (the icon that looks like a router/switch).
  • Click the Routers subcategory in the row below.
  • Find 2911 in the device list and click it.
  • Click three times in the workspace to place three Router 2911 devices.
  • Press Esc to deselect the placement tool.

You should see three router icons on your workspace. Now add the switches.

  • Click the Switches subcategory in the bottom panel.
  • Find 2960-24TT in the device list and click it.
  • Click three times in the workspace to place three Switch 2960 devices.
  • Press Esc to deselect.

Six devices are now on your workspace. Next, add the end devices.

  • Click the End Devices category in the bottom panel.
  • Find PC in the device list and click it.
  • Click four times in the workspace to place four PCs.
  • Find Server in the same End Devices list and click it.
  • Click twice in the workspace to place two servers.
  • Press Esc to deselect.

All 12 devices are now placed. You should count 3 routers, 3 switches, 4 PCs, and 2 servers on the workspace.

What are all these devices for?

Each site has a router (to route traffic between sites) and a switch (to connect local devices together). PCs represent employees at each office. The two servers at Site B will host DNS and a company website.

Now connect the devices with cables. You will use Copper Straight-Through cables for all connections in this topology.

  • Click the Connections category in the bottom panel (the lightning bolt icon).
  • Click Copper Straight-Through (the solid black line).

How does cabling work in Packet Tracer?

After selecting a cable type, click the first device and choose a port from the popup menu. Then click the second device and choose its port. A cable line appears between the two devices with link-light indicators on each end.

Hold Ctrl (Windows/Linux) or Cmd (macOS) after selecting the cable type to make multiple connections without re-selecting the cable each time.

Start with the three LAN connections (router to switch at each site):

  • Click the first router, select GigabitEthernet0/0. Click the first switch, select GigabitEthernet0/1.
  • Click the second router, select GigabitEthernet0/0. Click the second switch, select GigabitEthernet0/1.
  • Click the third router, select GigabitEthernet0/0. Click the third switch, select GigabitEthernet0/1.

Three cables now connect each router to its local switch. Next, add the two WAN links between routers:

  • Click the first router, select GigabitEthernet0/1. Click the second router, select GigabitEthernet0/1.
  • Click the second router, select GigabitEthernet0/2. Click the third router, select GigabitEthernet0/1.

The router-to-router WAN links are in place. Finally, connect the end devices to their switches:

  • Click the first PC, select FastEthernet0. Click the first switch, select FastEthernet0/1.
  • Click the second PC, select FastEthernet0. Click the first switch, select FastEthernet0/2.
  • Click the third PC, select FastEthernet0. Click the second switch, select FastEthernet0/1.
  • Click the first server, select FastEthernet0. Click the second switch, select FastEthernet0/2.
  • Click the second server, select FastEthernet0. Click the second switch, select FastEthernet0/3.
  • Click the fourth PC, select FastEthernet0. Click the third switch, select FastEthernet0/1.
  • Press Esc to exit the cabling tool.

All 11 cables are connected. You should see link-light indicators (small colored triangles) on each end of every cable. They will start amber and turn green within about 60 seconds for the switch-to-PC connections.

Don't see link lights on a cable?

If a cable has no link lights, you may have selected the wrong port. Click the link light near the device to unplug the cable, then click the device again and choose the correct interface.

If link lights are red on both ends, check that you used Copper Straight-Through (not Crossover) for all connections.

Help me troubleshoot my cable connections.

Label and organize the workspace

Right now your workspace has 12 devices with default names like Router0, Switch1, and PC3. You need to rename them and arrange them into clear site groupings so the topology is readable.

  • Double-click the label text under the first router (it says something like Router0).
  • Type R1 and press Enter.
  • Repeat for all devices using these names:
  • Routers: R1, R2, R3.
  • Switches: SW1, SW2, SW3.
  • PCs: PC1, PC2, PC3, PC4.
  • Servers: DNS-Server, Web-Server.

Now arrange the devices into three site groups by dragging them into position.

  • Drag R1, SW1, PC1, and PC2 to the left side of the workspace. This is Site A.
  • Drag R2, SW2, PC3, DNS-Server, and Web-Server to the center of the workspace. This is Site B.
  • Drag R3, SW3, and PC4 to the right side of the workspace. This is Site C.

Finally, add labels for the WAN links so the topology is self-documenting.

  • Press N on your keyboard to activate the Place Note tool.
  • Click on the workspace near the cable between R1 and R2.
  • Type WAN Link 1 and click away to place it.
  • Click near the cable between R2 and R3.
  • Type WAN Link 2 and click away to place it.
  • Press Esc to return to the Select tool.
  • Save your work by pressing Ctrl+S (or Cmd+S on macOS).
  • Choose a location like your Desktop and name the file three-site-network.pkt.

Your workspace now shows a clear left-center-right layout with labeled sites and WAN links.

Accidentally placed a device in the wrong spot?

Press Esc to switch to the Select tool, then drag any device to reposition it. Cables stay attached as you move devices around.

Help me rearrange my three-site topology.

Review the IP addressing plan

Before configuring anything, you need a clear picture of which IP addresses go where. This plan drives every configuration step that follows.

Why plan IP addresses ahead of time?

With three sites, multiple VLANs, and two WAN links, a single IP conflict can break connectivity across the entire network. A written plan prevents overlap and makes troubleshooting much faster.

Here is the complete addressing plan for your network:

Site A uses two VLANs to separate departments:

  • VLAN 10 (Sales): 192.168.10.0/24, gateway 192.168.10.1.
  • VLAN 20 (Engineering): 192.168.20.0/24, gateway 192.168.20.1.

Site B is a flat network (no VLANs) hosting the servers:

  • Subnet: 192.168.30.0/24, gateway 192.168.30.1.
  • DNS-Server: 192.168.30.10.
  • Web-Server: 192.168.30.11.

Site C has one VLAN for the Finance team:

  • VLAN 40 (Finance): 192.168.40.0/24, gateway 192.168.40.1.

The two WAN links use small /30 subnets (only 2 usable addresses each):

  • WAN Link 1: 10.10.10.0/30 with R1 at 10.10.10.1 and R2 at 10.10.10.2.
  • WAN Link 2: 10.10.10.4/30 with R2 at 10.10.10.5 and R3 at 10.10.10.6.

What is a /30 subnet?

A /30 subnet (mask 255.255.255.252) provides exactly 2 usable host addresses. This is the standard choice for point-to-point WAN links between routers because you only need one IP on each end.

What are VLANs?

A VLAN (Virtual LAN) separates a single physical switch into multiple logical networks. Site A uses VLANs to keep Sales traffic separate from Engineering traffic even though both departments share the same switch.

You do not need to configure anything yet. This plan is your reference for every step ahead.

Before moving on, take a moment to predict: do you think all your cable link indicators have turned green by now?

  • Look at your workspace and check that all cable indicators between switches and PCs are green (not amber or red).
  • Confirm you see 12 devices arranged in three groups with labels matching the names above.
  • Confirm both WAN Link 1 and WAN Link 2 notes are visible on the workspace.

What should I see?

The cables between switches and PCs or servers turn green within about 60 seconds. The cables between routers will stay red or amber until you configure the router interfaces in the next step. This is expected.

Some cable indicators are still amber after 60 seconds?

Switch-to-PC links may stay amber for up to a minute while the switch port goes through its Spanning Tree process. Wait 90 seconds and they should turn green.

Router-to-switch and router-to-router cables will NOT turn green yet. Router interfaces default to shutdown in Packet Tracer. You will enable them in the next step.

Help me understand which links should be green right now.

Your physical topology is complete. Next up, you will bring this network to life by configuring the LAN interfaces at each site so devices can actually communicate.

Configure the LANs at Each Site

Your topology is built and cabled. Every device is in place, but none of them can actually talk to each other yet.

Each site needs its local network configured before any cross-site routing can work. Site A has two departments (Sales and Engineering) that need separate broadcast domains, which means VLANs and a technique called Router on a Stick to route between them. Sites B and C each have a simpler flat network with a single subnet.

In this step, get ready to:
  • Configure VLANs, access ports, and a trunk on SW1 at Site A.
  • Create Router on a Stick subinterfaces on R1 to route between VLANs.
  • Bring up LAN interfaces on R2 and R3, then verify local connectivity at all three sites.
Configure VLANs, trunk, and Router on a Stick at Site A

Site A has two departments sharing one switch. Without VLANs, every device on SW1 would be in the same broadcast domain. VLANs separate Sales traffic from Engineering traffic at Layer 2, and the router's subinterfaces handle routing between them.

  • Click on SW1 to open it, then go to the CLI tab.
  • Create the VLANs, assign access ports, and configure the trunk by entering these commands:
enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name Engineering
exit
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
exit
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
exit
end

What does this configuration do?

  • Creates VLAN 10 (Sales) and VLAN 20 (Engineering) as separate broadcast domains on the switch.
  • Assigns FastEthernet0/1 to VLAN 10 so PC1 (Sales) only sees Sales traffic.
  • Assigns FastEthernet0/2 to VLAN 20 so PC2 (Engineering) is isolated from Sales.
  • Configures GigabitEthernet0/1 as a trunk carrying both VLANs up to R1. A trunk tags each frame with its VLAN number so the router knows which subnet it belongs to.
  • Verify the VLANs were created by running:
show vlan brief

You should see VLAN 10 (Sales) with Fa0/1 listed under its ports, and VLAN 20 (Engineering) with Fa0/2.

VLANs not showing the correct ports?

  • Make sure you typed switchport mode access before switchport access vlan on each port.
  • Check that GigabitEthernet0/1 does NOT appear under either VLAN. Trunk ports are listed separately under the trunk section, not under individual VLANs.
  • If you see errors, re-enter global configuration mode with configure terminal and repeat the interface commands.

Still stuck? Help me troubleshoot my SW1 VLAN configuration in Cisco Packet Tracer.

Now you need to configure R1 so it can route traffic between VLAN 10 and VLAN 20. Router on a Stick uses subinterfaces on a single physical interface, each tagged with a different VLAN using 802.1Q encapsulation.

  • Click on R1 to open it, then go to the CLI tab.
  • Enable the physical interface and create the subinterfaces by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end

What does this configuration do?

  • The physical interface Gi0/0 must be brought up with no shutdown first. Without it, all subinterfaces stay down.
  • Subinterface Gi0/0.10 is tagged with VLAN 10 using encapsulation dot1Q 10. Any frame arriving on the trunk tagged with VLAN 10 gets routed through this subinterface.
  • Each subinterface gets its own IP address, acting as the default gateway for that VLAN's PCs.
  • Verify the subinterfaces came up by running:
show ip interface brief

You should see GigabitEthernet0/0 as up/up, plus GigabitEthernet0/0.10 and GigabitEthernet0/0.20 both showing status up and protocol up with their respective IP addresses.

Subinterfaces showing down/down?

  • The physical interface GigabitEthernet0/0 must be no shutdown for subinterfaces to come up. Go back and check it is enabled.
  • Make sure the cable between R1 Gi0/0 and SW1 Gi0/1 shows green indicators on both ends. An orange dot means it is still negotiating.
  • Confirm you used encapsulation dot1Q (not dot1q with a lowercase Q). Packet Tracer accepts both, but verify the VLAN number matches.

Need more help? Help me fix my Router on a Stick subinterfaces on R1. They are showing down.

Configure LAN interfaces at Site B and Site C

Sites B and C each use a flat network with no VLANs. Their router LAN interfaces just need an IP address and to be brought up.

  • Click on R2 and go to the CLI tab.
  • Configure R2's LAN interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.168.30.1 255.255.255.0
no shutdown
exit
end
  • Click on R3 and go to the CLI tab.
  • Configure R3's LAN interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.168.40.1 255.255.255.0
no shutdown
exit
end

Why is this simpler than Site A?

Sites B and C have all devices in a single subnet. There are no VLANs to separate, so no trunking or subinterfaces are needed. One IP address on the router's LAN interface is enough to serve as the default gateway for all devices on that site.

  • Run show ip interface brief on R2 and R3 to confirm GigabitEthernet0/0 shows up/up with the correct IP address on each router.

Interface showing administratively down?

  • This means no shutdown was not applied. Enter the interface configuration again and run the command.
  • If you see the IP address as unassigned, you may have exited the interface before applying the ip address command. Re-enter the interface and configure it.

Need help? Help me troubleshoot my R2 or R3 LAN interface that is not coming up.

Verify local connectivity at each site

The router interfaces are up, but you have not proven that a PC can actually reach its gateway. Assigning temporary static IPs to a few PCs lets you test local connectivity before DHCP is configured in a later step.

  • Click on PC1 and go to the Desktop tab.
  • Click IP Configuration.
  • Select Static.
  • Enter IP Address: 192.168.10.100, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.10.1.
  • Go to the Desktop tab and click Command Prompt.

Before you run the ping, what do you expect to happen? Will PC1 be able to reach 192.168.10.1 (R1's VLAN 10 subinterface)?

  • Test connectivity to R1's VLAN 10 gateway by typing:
ping 192.168.10.1

You should see replies coming back from 192.168.10.1. This proves PC1 can reach R1 through SW1's VLAN 10 and the trunk link.

  • Now repeat the same process for PC3 at Site B. Click on PC3, go to Desktop > IP Configuration.
  • Select Static and enter IP Address: 192.168.30.100, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.30.1.
  • Open Command Prompt on PC3 and run:
ping 192.168.30.1
  • Repeat for PC4 at Site C. Click on PC4, go to Desktop > IP Configuration.
  • Select Static and enter IP Address: 192.168.40.100, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.40.1.
  • Open Command Prompt on PC4 and run:
ping 192.168.40.1

All three pings should succeed with replies. Each PC can reach its local gateway, proving the LAN configuration at every site is working.

  • Now switch all three PCs back to DHCP. On each PC (PC1, PC3, PC4), go to Desktop > IP Configuration and select DHCP.

Why switch back to DHCP?

The static IPs were only for testing. In Step 4, you will configure DHCP pools on the routers so every PC gets its address automatically. Leaving PCs on static would bypass DHCP entirely.

Ping request timed out?

  • Double-check that the PC's default gateway matches the router's interface IP exactly. For PC1 it must be 192.168.10.1, not 192.168.10.100.
  • On SW1, verify the trunk is working by running show interfaces trunk. You should see Gi0/1 listed with VLANs 10 and 20 allowed.
  • Wait for all cable indicators to turn green. A new connection can take 30-60 seconds to fully come up in Packet Tracer (STP convergence).
  • On R1, run show ip interface brief and confirm both subinterfaces show up/up with their correct IPs.

Still stuck? My PC cannot ping its default gateway in Packet Tracer. Help me troubleshoot VLAN and subinterface connectivity.

Every site's LAN is up and verified. Next up, you will bring up the WAN links between routers and configure RIPv2 so all three sites can reach each other automatically.

Configure WAN Links and RIPv2

Your three sites now have working LANs. Each PC can reach its local gateway, and VLANs at Site A keep Sales and Engineering traffic separate.

These sites are still isolated from each other. Manually adding static routes would require 4 routes on R2 alone, and every new subnet means updating every router by hand. RIPv2 solves this by letting routers discover and share routes automatically.

In this step, get ready to:
  • Bring up the WAN interfaces connecting the three sites.
  • Configure RIPv2 dynamic routing on all three routers.
  • Verify routes are learned automatically across all sites.
Bring up the WAN interfaces

Before routers can exchange routing information, the physical links between them need IP addresses. You have two WAN links to configure: R1-to-R2 and R2-to-R3.

Why /30 subnets for WAN links?

A point-to-point link between two routers only needs 2 usable IP addresses. A /30 subnet mask (255.255.255.252) provides exactly 2 host addresses, which avoids wasting IP space.

  • Click on R1 and go to the CLI tab.
  • Configure the WAN interface toward R2 by entering these commands:
enable
configure terminal
interface GigabitEthernet0/1
ip address 10.10.10.1 255.255.255.252
no shutdown
exit

What do these commands do?

  • interface GigabitEthernet0/1 enters configuration mode for R1's WAN-facing interface.
  • ip address 10.10.10.1 255.255.255.252 assigns the first usable address from the 10.10.10.0/30 subnet.
  • no shutdown activates the interface so it can send and receive traffic.
  • Click on R2 and go to the CLI tab.
  • Configure R2's interface facing R1 by entering these commands:
enable
configure terminal
interface GigabitEthernet0/1
ip address 10.10.10.2 255.255.255.252
no shutdown
exit
  • Return to R1's CLI and verify the first WAN link by running:
ping 10.10.10.2

You should see replies from 10.10.10.2, confirming the R1-to-R2 WAN link is up.

Ping fails or times out?

  • Verify you used the correct subnet mask (255.255.255.252) on both R1 and R2.
  • Run show ip interface brief on both routers and confirm Gi0/1 shows up for both Status and Protocol.
  • Check that R1 uses 10.10.10.1 and R2 uses 10.10.10.2. Swapped addresses will prevent communication.

Help me troubleshoot why my WAN ping between R1 and R2 is failing in Packet Tracer.

Now configure the second WAN link between R2 and R3.

  • Return to R2's CLI and configure the interface facing R3:
configure terminal
interface GigabitEthernet0/2
ip address 10.10.10.5 255.255.255.252
no shutdown
exit
  • Click on R3 and go to the CLI tab.
  • Configure R3's WAN interface toward R2:
enable
configure terminal
interface GigabitEthernet0/1
ip address 10.10.10.6 255.255.255.252
no shutdown
exit
  • Verify the second WAN link from R3's CLI:
ping 10.10.10.5

You should see replies from 10.10.10.5, confirming the R2-to-R3 WAN link is active. Both WAN links are now operational.

Configure RIPv2 on all three routers

The WAN links carry traffic, but routers still don't know about remote subnets. RIPv2 is a dynamic routing protocol that lets routers advertise their directly connected networks and learn about networks from their neighbors.

Why RIPv2 instead of OSPF or EIGRP?

RIP is the simplest dynamic routing protocol to configure. It requires only router rip, version 2, no auto-summary, and network statements.

OSPF requires area concepts, and EIGRP involves complex metric calculations. RIP is the appropriate first step into dynamic routing.

  • Click on R1 and go to the CLI tab.
  • Configure RIPv2 by entering these commands:
configure terminal
router rip
version 2
no auto-summary
network 192.168.10.0
network 192.168.20.0
network 10.0.0.0
exit

What do these commands do?

  • router rip enters RIP configuration mode and enables the RIP process.
  • version 2 specifies RIPv2, which supports subnet masks (unlike RIPv1).
  • no auto-summary prevents RIP from summarizing subnets to classful boundaries. Without this, your /30 WAN subnets could be incorrectly advertised as a single 10.0.0.0/8 route.
  • Each network statement tells RIP which interfaces to activate on and which subnets to advertise. network 10.0.0.0 uses the classful address and covers all 10.x.x.x interfaces on this router.
  • Click on R2 and go to the CLI tab.
  • Configure RIPv2 on R2:
enable
configure terminal
router rip
version 2
no auto-summary
network 192.168.30.0
network 10.0.0.0
exit

Why does R2 only need one network 10.0.0.0 statement?

R2 has two WAN interfaces (Gi0/1 at 10.10.10.2 and Gi0/2 at 10.10.10.5). Both fall within the classful 10.0.0.0 network, so a single network 10.0.0.0 statement enables RIP on both WAN interfaces at once.

  • Confirm RIP is running on R2 by entering:
show ip protocols

You should see output confirming RIP version 2 is active and listing the networks being advertised. This proves the RIP process is running before you configure the last router.

  • Click on R3 and go to the CLI tab.
  • Configure RIPv2 on R3:
enable
configure terminal
router rip
version 2
no auto-summary
network 192.168.40.0
network 10.0.0.0
exit

Seeing an error when entering network commands?

  • Make sure you're in router configuration mode (the prompt should show (config-router)#).
  • Use classful network addresses only (e.g. network 192.168.40.0 not network 192.168.40.0/24). RIP does not accept a subnet mask in the network command.

Help me troubleshoot my RIPv2 configuration in Cisco Packet Tracer.

Verify RIP-learned routes

RIP sends routing updates every 30 seconds. Give the routers a moment to exchange their route tables before checking.

  • Wait about 30 seconds for RIP to converge.
  • Click on R1 and go to the CLI tab.

Before you run the next command, think about what you expect to see. R1 knows about its own directly connected networks (192.168.10.0, 192.168.20.0, 10.10.10.0). What remote networks should RIP have taught R1 about?

  • Check R1's routing table by running:
show ip route

Look for lines marked with R on the left side. These are routes learned via RIP.

What should I see?

R1's routing table should now include these RIP-learned routes:

  • R 192.168.30.0/24 (Site B's LAN, learned from R2).
  • R 192.168.40.0/24 (Site C's LAN, learned via R2 from R3).
  • R 10.10.10.4/30 (the second WAN link between R2 and R3).

Routes marked C are directly connected networks. Routes marked R were discovered automatically by RIP. No static routes were needed.

Now test that traffic can actually cross both WAN hops. Do you think a ping from R1 to R3's LAN interface (192.168.40.1, two hops away) will succeed?

  • From R1's CLI, ping R3's LAN gateway:
ping 192.168.40.1

You should see successful replies from 192.168.40.1. This proves RIPv2 is routing traffic from Site A across R2 to Site C without a single static route.

Not seeing R routes or ping fails?

  • If no R routes appear, wait another 30 seconds and run show ip route again. RIP updates are sent every 30 seconds.
  • Run show ip protocols on each router to confirm RIP is active and the correct networks are listed.
  • Check that no auto-summary is configured on all three routers. Without it, subnets may be incorrectly summarized.
  • Verify all WAN interfaces are up with show ip interface brief. A down interface means RIP has no neighbor on that link.

Help me figure out why RIP routes aren't appearing in my routing table in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Confirm you've saved each router's config by running copy running-config startup-config on R1, R2, and R3 if you want your work to persist.

ⓧ I'd like to double check the full config

Here is the complete WAN and RIP configuration for each router. Compare against what you entered above.

R1 WAN and RIP configuration:

interface GigabitEthernet0/1
 ip address 10.10.10.1 255.255.255.252
 no shutdown
!
router rip
 version 2
 no auto-summary
 network 192.168.10.0
 network 192.168.20.0
 network 10.0.0.0

R2 WAN and RIP configuration:

interface GigabitEthernet0/1
 ip address 10.10.10.2 255.255.255.252
 no shutdown
!
interface GigabitEthernet0/2
 ip address 10.10.10.5 255.255.255.252
 no shutdown
!
router rip
 version 2
 no auto-summary
 network 192.168.30.0
 network 10.0.0.0

R3 WAN and RIP configuration:

interface GigabitEthernet0/1
 ip address 10.10.10.6 255.255.255.252
 no shutdown
!
router rip
 version 2
 no auto-summary
 network 192.168.40.0
 network 10.0.0.0

Your three-site network now routes traffic dynamically. Next up, you'll configure DHCP, DNS, and a web server so PCs can actually browse a website by name across these routes.

Configure DHCP, DNS, and Web Server

Your three routers now discover routes to every subnet automatically through RIPv2. A packet from Site A can reach Site C without a single static route. The routing infrastructure is complete.

But PCs still have no IP addresses, and there is no website to browse. In this step, you will configure DHCP to hand out IPs automatically, set up a DNS server so PCs can resolve names to addresses, and build a web server so any PC at any site can browse www.company.com by name.

In this step, get ready to:
  • Configure DHCP pools on all three routers so PCs get IP addresses automatically.
  • Set up a DNS server and web server at Site B with static IPs and services.
  • Browse www.company.com from PCs at Site A and Site C, proving the full network works end to end.
Configure DHCP pools on all routers

DHCP lets routers assign IP addresses to PCs automatically. Each router needs a pool that defines the network, default gateway, and DNS server to hand out.

  • Click on R1 and go to the CLI tab.
  • Enter global configuration mode by typing:
enable
configure terminal
  • Configure DHCP for Site A's two VLANs by entering these commands:
! Exclude gateway and reserved IPs from each pool
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10

! Pool for VLAN 10 - Sales department
ip dhcp pool VLAN10-Sales
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.30.10

! Pool for VLAN 20 - Engineering department
ip dhcp pool VLAN20-Engineering
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 192.168.30.10

What does this configuration do?

The excluded-address lines reserve the first 10 IPs in each subnet for routers and servers. DHCP will never hand these out to PCs.

Each pool defines a subnet (network), the gateway PCs should use (default-router), and the DNS server address (dns-server). The DNS server lives at Site B, which is reachable from any site thanks to RIPv2.

  • Verify R1's DHCP pools are configured by running:
do show ip dhcp pool

You should see two pools listed: VLAN10-Sales and VLAN20-Engineering, each showing the correct network and subnet mask.

Not seeing both pools?

Make sure you typed both ip dhcp pool commands. If only one pool appears, re-enter the missing pool configuration. Check that you are still in global configuration mode (the prompt shows R1(config)#).

Help me troubleshoot my DHCP pool configuration on R1.

  • Now click on R2 and go to the CLI tab.
  • Enter global configuration mode and configure DHCP for Site B:
enable
configure terminal

! Exclude gateway and server IPs (30.1 through 30.15)
ip dhcp excluded-address 192.168.30.1 192.168.30.15

! Pool for Site B LAN
ip dhcp pool SITE-B
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
 dns-server 192.168.30.10

Why exclude up to .15 at Site B?

Site B hosts the DNS server (192.168.30.10) and the web server (192.168.30.11). Reserving the first 15 addresses gives room for the gateway, both servers, and a few spare addresses for future static devices.

  • Click on R3 and go to the CLI tab.
  • Enter global configuration mode and configure DHCP for Site C:
enable
configure terminal

! Exclude gateway and reserved IPs
ip dhcp excluded-address 192.168.40.1 192.168.40.10

! Pool for VLAN 40 - Finance department
ip dhcp pool VLAN40-Finance
 network 192.168.40.0 255.255.255.0
 default-router 192.168.40.1
 dns-server 192.168.30.10
  • Verify R3's pool is configured by running:
do show ip dhcp pool

You should see one pool listed: VLAN40-Finance with network 192.168.40.0 and mask 255.255.255.0.

Configure DNS and Web Servers with static IPs

DHCP pools are ready, but the DNS-Server and Web-Server need static IP addresses. Servers should never get their addresses from DHCP because other devices rely on reaching them at a fixed location.

  • Click on DNS-Server to open its configuration window.
  • Go to the Config tab.
  • Click FastEthernet0 in the left panel.
  • Set the IP address to 192.168.30.10.
  • Set the Subnet Mask to 255.255.255.0.
  • Set the Default Gateway to 192.168.30.1.

Now enable the DNS service and add a record that maps the company website name to the web server's IP.

  • Go to the Services tab.
  • Click DNS in the left panel.
  • Turn the DNS service ON.
  • In the Name field, type www.company.com.
  • In the Address field, type 192.168.30.11.
  • Click Add to save the A record.

What is an A record?

An A record maps a human-readable domain name to an IP address. When a PC asks "where is www.company.com?", the DNS server replies with 192.168.30.11. The PC then sends its web request to that IP.

Now configure the Web-Server with a static IP and a webpage to serve.

  • Click on Web-Server to open its configuration window.
  • Go to the Config tab.
  • Click FastEthernet0 in the left panel.
  • Set the IP address to 192.168.30.11.
  • Set the Subnet Mask to 255.255.255.0.
  • Set the Default Gateway to 192.168.30.1.
  • Go to the Services tab.
  • Click HTTP in the left panel.
  • Make sure the HTTP service is turned ON.
  • Click index.html in the file list to edit it.
  • Replace the existing HTML content with the following:
<html>
<body>
<h1>Welcome to Company.com - Secured Network!</h1>
</body>
</html>
  • Click Save to store the webpage.

What did you just build?

You now have a complete web hosting setup at Site B. The DNS server translates www.company.com into the web server's IP. The web server responds with your custom page. Any PC that can reach Site B (all of them, thanks to RIPv2) can now browse by name.

Typo in the IP addresses?

Double check that the DNS-Server is 192.168.30.10 and the Web-Server is 192.168.30.11. If these are swapped, the DNS A record will point to the wrong device and web browsing will fail.

Help me check my DNS and Web Server IP configuration.

Test end-to-end connectivity

Everything is in place. DHCP pools are ready on all routers, DNS can resolve names, and the web server has a page to serve. Time to prove it all works together.

  • Click on PC1 (Site A).
  • Go to the Desktop tab.
  • Click IP Configuration.
  • Confirm DHCP is selected. You should see an IP address appear in the 192.168.10.0/24 range, with gateway 192.168.10.1 and DNS server 192.168.30.10.
  • Repeat this check for PC2 (should get an address in 192.168.20.0/24), PC3 (should get an address in 192.168.30.0/24), and PC4 (should get an address in 192.168.40.0/24).

PC showing 0.0.0.0 or not getting an address?

If DHCP is selected but the PC shows 0.0.0.0, try toggling to Static and back to DHCP to force a new request. If it still fails, check that the router's LAN interface is up and the DHCP pool's network matches the subnet the PC is on.

Help me figure out why my PC is not getting a DHCP address.

All four PCs should now have valid IP addresses. Time for the real test. Before you try this, predict what will happen when PC4 at Site C tries to browse www.company.com. Will the page load? How many hops does the traffic need to cross?

  • On PC4 (Site C), go to the Desktop tab.
  • Click Web Browser.
  • Type www.company.com in the URL bar and press Go.

The page loads with the heading "Welcome to Company.com - Secured Network!" displayed. That single page load proves five things worked together: DHCP gave PC4 an IP, DNS resolved the name, RIPv2 routed traffic across two WAN hops from Site C through Site B, and the web server responded.

  • Now open the Web Browser on PC1 (Site A) and browse www.company.com to confirm Site A can also reach the website.

Both PCs display the company webpage. Your full network is operational.

Page not loading?

Check these in order:

  • Verify the PC has a DNS server address of 192.168.30.10 in its IP Configuration. If blank, the DHCP pool is missing the dns-server line.
  • Verify the DNS A record points to 192.168.30.11 (not .10). If wrong, delete the record and re-add it.
  • Verify the Web-Server's gateway is 192.168.30.1. Without a gateway, the server cannot send responses back to remote sites.

Help me troubleshoot why www.company.com is not loading.

Your three-site network is fully functional. Any PC at any site can browse the company website by name. Next up, you will lock down every device so no one can access a router or switch without a password.

Harden All Devices with Security

Your three-site network is fully operational. PCs can browse www.company.com from any site, RIPv2 handles all routing automatically, and DHCP assigns addresses without manual intervention.

But there is a critical problem. Right now, anyone who clicks on any router can type enable and get full administrative access with no password. There is no warning banner, no encrypted passwords in the config, and no limit on which devices can connect to switch ports. In this step, you'll lock down every device.

In this step, get ready to:
  • Secure all three routers with passwords, encryption, and a login banner.
  • Configure port security on every switch access port and shut down unused ports.
  • Verify that unauthorized access is blocked and all passwords are encrypted.
Secure all three routers

Before making any changes, try accessing R1's privileged mode to see the security gap firsthand.

  • Click on R1 in your topology.
  • Select the CLI tab.
  • Press Enter to get to the prompt, then type:
enable

You land immediately in privileged EXEC mode (the R1# prompt). No password, no challenge. Anyone with access to this device has full control.

Now let's fix this. The security commands you apply will set a privileged-mode password, encrypt stored passwords, add a legal warning banner, and require authentication on the console and remote access lines.

  • Enter global configuration mode on R1 by running:
configure terminal
  • Apply the following security configuration on R1:
enable secret Cisco123
service password-encryption
banner motd # Authorized Access Only. Unauthorized access is prohibited. #
line console 0
 password Console123
 login
 exit
line vty 0 4
 password Telnet123
 login
 exit

What does this configuration do?

  • enable secret Cisco123 sets a password for privileged EXEC mode, encrypted with MD5 (type 5).
  • service password-encryption encrypts all clear-text passwords in the running config so they cannot be read by someone glancing at the screen.
  • banner motd displays a legal warning to anyone who connects to the device.
  • line console 0 protects the physical console port with a password.
  • line vty 0 4 protects the virtual terminal lines used for remote (Telnet/SSH) access.
  • Return to privileged EXEC mode by running:
end
  • Verify the security by closing R1's window (click the X), then clicking on R1 again and selecting the CLI tab.
  • Press Enter and you should see the banner message appear.
  • Type enable and confirm you are now prompted for a password.
  • Enter Cisco123 to access privileged mode.

Not seeing the banner or password prompt?

Make sure you typed login under each line configuration. Without login, the password is set but never actually required.

Also confirm you used enable secret (not enable password). The secret keyword provides MD5 encryption.

help me troubleshoot why my router is not prompting for a password after I configured security

R1 is secured. Now apply the exact same configuration to R2 and R3.

  • Click on R2, select the CLI tab, and enter global configuration mode:
enable
configure terminal
  • Apply the same security configuration:
enable secret Cisco123
service password-encryption
banner motd # Authorized Access Only. Unauthorized access is prohibited. #
line console 0
 password Console123
 login
 exit
line vty 0 4
 password Telnet123
 login
 exit
  • Type end to return to privileged EXEC mode.
  • Repeat the same process on R3. Click R3, open the CLI tab, enter enable, then configure terminal, and paste the same security commands.
  • Type end when done.
Configure port security on all switches

Router passwords protect administrative access. Port security protects the physical network by limiting each switch port to one approved device.

If someone plugs an unauthorized device into a secured port, the port shuts down automatically. You'll configure this on every access port across all three switches.

  • Click on SW1 and select the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode:
enable
configure terminal
  • Configure port security on Fa0/1 by running:
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky

What do these port security commands do?

  • switchport mode access ensures the port is an access port. Port security only works on access ports, not trunk ports.
  • switchport port-security maximum 1 limits the port to learning one MAC address.
  • switchport port-security violation shutdown disables the port if a second device is connected.
  • switchport port-security mac-address sticky remembers the first device's MAC address and saves it to the running config.
  • Apply the same port security configuration to Fa0/2 by running:
interface FastEthernet0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
  • Now shut down all unused ports on SW1 to prevent unauthorized devices from connecting:
interface range FastEthernet0/3-24
 shutdown
  • Type end to return to privileged EXEC mode.
  • Verify port security is active on Fa0/1 by running:
show port-security interface Fa0/1

You should see Port Security listed as Enabled and Maximum MAC Addresses set to 1.

Port security shows as disabled?

Make sure the port is set to access mode with switchport mode access before enabling port security. Port security cannot be enabled on trunk ports or ports in dynamic mode.

help me troubleshoot why port security won't enable on my Cisco switch in Packet Tracer

SW1 is secured. Now repeat for SW2 and SW3.

  • Click on SW2, select the CLI tab, and enter global configuration mode:
enable
configure terminal
  • Configure port security on all three access ports (Fa0/1, Fa0/2, Fa0/3) by running:
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
interface FastEthernet0/2
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
interface FastEthernet0/3
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
  • Shut down all unused ports on SW2:
interface range FastEthernet0/4-24
 shutdown
  • Type end to return to privileged EXEC mode.
  • Click on SW3, select the CLI tab, and enter global configuration mode:
enable
configure terminal
  • Configure port security on Fa0/1 (the only access port with a device connected):
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
  • Shut down all unused ports on SW3:
interface range FastEthernet0/2-24
 shutdown
  • Type end to return to privileged EXEC mode.
Verify security is enforced

Every router is secured and every switch port is locked down. Time to prove it all works end to end.

  • Close the SW3 window.
  • Click on R1 and select the CLI tab.
  • Press Enter to get a fresh prompt.

Before you type anything, predict what you expect to see. Will the banner appear? Will enable let you straight in like before?

  • Observe the banner message displayed on the screen.
  • Type enable and press Enter.

You are now prompted for a password. Type the wrong password on purpose and press Enter. Access is denied.

  • Type Cisco123 to log in to privileged EXEC mode.
  • Run the following to inspect the configuration:
show running-config
  • Scroll through the output and confirm that no passwords appear in plain text. The enable secret line shows a type 5 (MD5) hash. The line passwords show type 7 encrypted strings.

What is the difference between type 5 and type 7 encryption?

Type 5 uses MD5 hashing, which is a one-way function. Even if someone reads the config file, they cannot reverse the hash back to the original password.

Type 7 is a simple reversible cipher created by service password-encryption. It stops casual shoulder-surfing but is not cryptographically strong. That is why enable secret (type 5) is used for the most critical password.

  • Now verify port security. Click on SW1, select the CLI tab, enter privileged mode, and run:
show port-security interface Fa0/1

You should see port security enabled with a maximum of 1 MAC address and the violation action set to shutdown.

Passwords still showing in plain text?

If line passwords appear unencrypted, confirm you ran service password-encryption in global configuration mode on that router. This command must be applied before the passwords will display as encrypted.

help me figure out why my Cisco router passwords are showing in plain text in the running config

Your entire network is now hardened. Every router requires authentication and every switch port is locked to a single device. Next up, you'll take on the Secret Mission and control which traffic flows where with access control lists.

Secret mission

Block Finance from the Servers

Your network is hardened against unauthorized device access, but any PC at any site can still reach every subnet. The Finance team at Site C has no business accessing the sensitive servers at Site B. Can you write an ACL to block them without breaking anything else?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely inside Cisco Packet Tracer on your local machine, so there are no cloud resources or ongoing costs.

Resources you used:

  • Cisco Packet Tracer topology file (.pkt) saved on your machine.

Keep everything running

No action needed. Choose this if you are still actively building or plan to extend the network further.

  • Your .pkt file stays wherever you saved it.
  • You can reopen it any time in Cisco Packet Tracer to continue working.

Pause - I'll come back to this later

Save your progress and close Packet Tracer to free up system memory. You can pick up right where you left off.

  • In Packet Tracer, click File, then Save to store your current topology.
  • Close Cisco Packet Tracer.
  • When you return, double-click your .pkt file to reopen the topology with all configurations intact.

Delete - I don't want to use this again

Remove all project resources and start fresh. This permanently deletes your topology and all device configurations.

  • Close Cisco Packet Tracer.
  • Delete your .pkt topology file. On macOS or Linux, run the following command (replacing the filename with your actual file name):
rm ~/Desktop/your-file-name.pkt

On Windows, right-click the file in File Explorer and select Delete.

Nice Work!

Nice Work!

You just built and secured a three-site enterprise network from scratch. Any PC at any site can now browse a company website by name, traffic routes itself automatically, and no one gets into a device without a password.

Here's what you learned:

  • Built a three-site network with RIPv2 dynamic routing across three routers, eliminating the need for manually typed static routes as the network grows.
  • Deployed DHCP, DNS, and a web server so any PC at any site can browse www.company.com by name across two WAN hops.
  • Hardened every router with enable secret, console/VTY passwords, login banners, and service password-encryption. Locked down every switch with port security limiting each access port to one MAC address.
  • Secret Mission: Created a standard ACL to block the Finance team from reaching the servers at Site B while leaving all other traffic paths intact.

Ready to quiz yourself?