Build a Dual-Stack Campus Network

Design a three-tier Cisco campus and route IPv4 and IPv6 between VLANs.

Introduction

30 Second Summary

A headquarters network can start with a few connected teams, then become harder to expand whenever a department grows. Without a clear structure, one change can disrupt people far beyond the room being updated.

In this project, you will design a three-tier campus network in Cisco Packet Tracer. Its pilot routes dual-stack traffic between Engineering and Finance after you diagnose a planned forwarding failure.

What You'll Build

You'll watch two department PCs exchange dual-stack replies through your campus after you isolate the missing Layer 3 function that first blocks them.

By the end of this project, you'll have:

A three-tier HQ map you can use to explain how each network layer supports growth.
A department addressing plan that shows how VLSM fits Engineering and Finance into one HQ block while each VLAN receives an IPv6 /64 prefix.
A reusable pilot checkpoint where Engineering exchanges IPv4 plus IPv6 replies with Finance through the corrected routing layer.
Secret Mission: Extend the pattern through ACCESS2 by bringing an HR VLAN online with IPv4 plus IPv6 connectivity to both original departments.

Are there any prerequisites?

You'll need Cisco Packet Tracer installed on Windows with a working Cisco login. This project assumes you know subnetting fundamentals plus basic Cisco IOS CLI navigation.

Before We Start

Before the hands-on work begins, lock in the campus network you are building and the business reason behind its design. You will create a scalable dual-stack headquarters pilot with separate core, distribution, and access roles so the network can grow beyond a flat LAN.

Validate and Save Your Lab Workspace

Your dual-stack campus depends on a multilayer switch that accepts the IPv6 forwarding commands used later. A capability check in Cisco Packet Tracer prevents a device mismatch from surfacing halfway through the build.

You will place DIST1 in a blank Logical workspace. You will test its IPv6 routing support before saving the project checkpoint.

In this step, get ready to:

Open a blank Logical workspace with a Cisco Catalyst 3650 switch named DIST1.
Verify that DIST1 accepts the IPv6 routing enable and disable commands.
Save the project as enterprise-hq-foundation.pkt in your selected Windows folder.

Place and name DIST1

The Logical workspace holds the campus topology you build throughout this project. DIST1 starts as the Layer 3 boundary for the pilot departments.

Press the Windows key to open the Windows search bar.
Type Cisco Packet Tracer and press Enter to open it.
Complete the sign-in process with your existing Cisco login if prompted.
Select the Logical workspace at the top of the canvas.

You should see an empty Logical canvas ready for the first network device.

Select the network device category in the lower-left device palette.
Select the switch subcategory.
Drag one Cisco Catalyst 3650 switch onto the Logical canvas.

You should now see one switch in the otherwise empty workspace.

Select the Cisco Catalyst 3650 switch on the canvas.
Select the Config tab in the device window.
Replace the current value in the Display Name box with DIST1.
Close the device window.

Good start. You should now see DIST1 beneath your first distribution switch.

Test IPv6 routing support

Packet Tracer can differ from physical Cisco devices in the commands it supports. This check proves that your selected switch accepts the IPv6 forwarding configuration required later.

Select DIST1 in the Logical workspace.
Select the CLI tab in the device window.
Click inside the CLI area to place the cursor at the prompt.

Before you run the check, do you expect DIST1 to accept both IPv6 commands?

Test IPv6 routing support by entering this exact command sequence:

enable
configure terminal
ipv6 unicast-routing
no ipv6 unicast-routing
end

What does this command check?

The enable command gives you access to privileged switch commands.
The configure terminal command moves the CLI into global configuration mode.
The ipv6 unicast-routing command tests whether DIST1 can enable IPv6 packet forwarding.
The no ipv6 unicast-routing command restores the disabled state required at this checkpoint.
The end command returns the CLI to privileged mode.

Inspect the CLI output from the command sequence.

You should return to the DIST1 prompt without an invalid-input message. The final no ipv6 unicast-routing command leaves IPv6 unicast routing disabled.

That clears the compatibility risk. DIST1 now supports the dual-stack routing work you complete later.

Are the IPv6 commands rejected?

Confirm that the placed device is a Cisco Catalyst 3650 switch.
Confirm that configure terminal ran before the IPv6 commands.
Stop the lab if either IPv6 command is still rejected.
Update Packet Tracer through Cisco's Resource Hub before continuing.

Ask for help to diagnose why the IPv6 routing commands are rejected on DIST1.

Save and verify the checkpoint

A saved .pkt checkpoint protects this validated starting point. Every later topology change builds on the same project file.

Select File in the Packet Tracer menu bar.
Select Save As.

The Save As window is now ready for your checkpoint details.

Choose a Windows folder that you can return to during the project.
Enter enterprise-hq-foundation.pkt as the file name.
Select Save.

Your checkpoint now has a permanent filename. The Packet Tracer title bar should include enterprise-hq-foundation.pkt.

Before you verify the checkpoint, do you expect both the saved file and the DIST1 label to be present?

Use Windows File Explorer to return to the folder you selected.

You should see enterprise-hq-foundation.pkt in that folder.

Switch back to Cisco Packet Tracer.

You should see an otherwise blank Logical workspace containing one Cisco Catalyst 3650 switch named DIST1.

Is the checkpoint incomplete?

Repeat the Save As action from Packet Tracer if the project file is absent.
Choose the intended Windows folder.
Enter enterprise-hq-foundation.pkt as the file name.
Select Save.
Return to the switch's Config tab if its label is missing.
Enter DIST1 in the Display Name box.
Save the Packet Tracer project again.

Ask for help to find or repair the saved Packet Tracer checkpoint.

✔️ Awesome, I've got everything!

Your validated DIST1 switch and saved Packet Tracer checkpoint are ready for the campus design.

ⓧ I'd like to double check the full code

Compare your lab with this complete checkpoint:

Confirm that the Logical workspace contains only one Cisco Catalyst 3650 switch.
Confirm that the switch display name is DIST1.
Confirm that the DIST1 CLI accepted ipv6 unicast-routing.
Confirm that the DIST1 CLI accepted no ipv6 unicast-routing.
Confirm that IPv6 unicast routing is currently disabled.
Confirm that your selected Windows folder contains enterprise-hq-foundation.pkt.

Your validated distribution switch is saved. Next, you'll expand this checkpoint into a three-tier HQ skeleton with a documented dual-stack address plan.

Design the Three-Tier HQ and Address Plan

The saved Cisco Packet Tracer workspace already proves DIST1 can support the pilot's IPv6 commands. Now it needs a campus structure that shows where each network role belongs.

A large campus becomes manageable when core, distribution, and access roles follow repeatable boundaries. A matching address hierarchy keeps growth from turning into one flat network.

In this step, get ready to:

Lay out the core, distribution, access, and endpoint rows.
Cable the core-to-distribution skeleton and pilot path.
Document the dual-stack address plan for Engineering and Finance.

Lay out the three-tier HQ

A three-tier campus design gives each row one job. That separation makes later routing or redundancy changes easier to place.

How do the three tiers divide the work?

Core switches connect the distribution blocks across the campus.
Distribution switches form the boundary for each campus building block.
Access switches provide the ports used by endpoint devices.

Select the Cisco Catalyst 3650 switch model from the lower-left device palette.
Place two switches in a core row above DIST1.

You should see two new switches above the existing distribution switch.

Place one more Cisco Catalyst 3650 switch to the right of DIST1.
Set the upper-left switch's Display Name to CORE1 in its Config tab.

CORE1 now anchors the left side of the core row.

Set the upper-right switch's Display Name to CORE2 in its Config tab.
Set the new distribution switch's Display Name to DIST2 in its Config tab.

The upper rows should now show CORE1 beside CORE2. DIST1 should sit beside DIST2 below them.

Select the Cisco 2960 switch model from the lower-left device palette.
Place two switches in an access row below the distribution switches.

You should see a new two-switch row below DIST1 and DIST2.

Set the left access switch's Display Name to ACCESS1 in its Config tab.
Set the right access switch's Display Name to ACCESS2 in its Config tab.

ACCESS1 and ACCESS2 now identify the campus edge where endpoint devices connect.

Select the PC endpoint type from the lower-left device palette.
Place two PCs in an endpoint row below ACCESS1.

You should see two endpoint PCs beneath the pilot access switch.

Set the left PC's Display Name to ENG-PC in its Config tab.
Set the right PC's Display Name to FIN-PC in its Config tab.

Good progress. Every device now has a clear role in the HQ hierarchy.

Cable the HQ skeleton and pilot path

The core-to-distribution links create the physical skeleton for future path redundancy. The pilot path connects one distribution switch to the department endpoints through ACCESS1.

Reserve DIST1 GigabitEthernet1/0/1 for the ACCESS1 uplink.
Select the automatic cable option from the lower-left connection tool.

Connect CORE1 to DIST1 using an available Gigabit Ethernet interface on each switch.
Connect CORE1 to DIST2 using an available Gigabit Ethernet interface on each switch.

You should see two cable lines running from CORE1 to the distribution row.

Connect CORE2 to DIST1 using an available Gigabit Ethernet interface on each switch.
Connect CORE2 to DIST2 using an available Gigabit Ethernet interface on each switch.

Four cable lines should now form the core-to-distribution skeleton. These links remain physically connected without advanced redundancy configuration.

Connect DIST1 GigabitEthernet1/0/1 to ACCESS1 GigabitEthernet0/1.

You should see the pilot uplink running from DIST1 to ACCESS1.

Connect ENG-PC to ACCESS1 FastEthernet0/6.
Connect FIN-PC to ACCESS1 FastEthernet0/18.

The pilot path should now contain three cable lines. One line joins DIST1 to ACCESS1. Two lines join the department PCs to ACCESS1.

Does a cable use the wrong port?

Remove the misplaced cable. Reconnect it using the exact ACCESS1 or DIST1 interface named above.

If the links still look wrong, help me check the Packet Tracer cable path and interface choices.

Document the dual-stack address plan

A Variable Length Subnet Masking plan gives each department an IPv4 block sized to its host requirement. The IPv6 plan gives each user VLAN its own /64 prefix inside the site block.

How do the allocations fit?

Engineering receives 10.10.10.0/25 for its 100-host requirement.
Finance receives 10.10.10.128/26 for its 50-host requirement.
The remaining 10.10.10.192/26 stays reserved for campus growth.
Each department receives one /64 IPv6 LAN prefix.

Place an HQ addressing note in empty space beside the topology using the note tool.
Enter exactly this dual-stack plan into the note:

IPv4 HQ block 10.10.10.0/24; Engineering 10.10.10.0/25 for 100 hosts; Finance 10.10.10.128/26 for 50 hosts; reserved growth 10.10.10.192/26. IPv6 site block 2001:db8:10::/48; Engineering 2001:db8:10:10::/64; Finance 2001:db8:10:20::/64.

What does this plan preserve?

Every department subnet stays inside the 10.10.10.0/24 HQ block.
The department IPv4 ranges remain separate from the reserved growth range.
Both IPv6 LAN prefixes stay inside the 2001:db8:10::/48 site block.

Save the existing enterprise-hq-foundation.pkt project from Packet Tracer's File menu.

Before the final check, picture the rows, links, and address boundaries you expect to see.

Inspect the Logical workspace from the core row down to the endpoint row.
Read the HQ addressing note beside the topology.

You should see two core switches above two distribution switches. Two access switches should sit below the distribution row.

Four links should form the core-to-distribution skeleton. The pilot path should join DIST1 to ACCESS1 and both department PCs.

The note should show non-overlapping IPv4 allocations. It should also show one IPv6 /64 prefix for each department.

Is the final layout incomplete?

Check that every required device has the exact Display Name shown above. Compare each pilot cable endpoint with the named interfaces before saving again.

If an item is still missing, help me compare my Packet Tracer HQ topology with the required end state.

That is the planning layer complete. Your HQ now has room to grow without losing its structure.

Next, you will create the Engineering and Finance VLANs. You will restrict the pilot trunk to those departments.

Build the Pilot VLAN and Trunk Layer

Your Cisco Packet Tracer topology now has a physical path between the two pilot PCs and DIST1. That path still needs logical boundaries for Engineering and Finance.

A VLAN creates a separate Layer 2 broadcast domain for each department. An 802.1Q trunk carries both VLANs between ACCESS1 and DIST1 over their existing cable.

In this step, get ready to:

Create the Engineering and Finance VLANs on ACCESS1 and DIST1.
Assign each endpoint port to its department VLAN.
Configure the restricted trunk and verify its Layer 2 state.

Create the department VLANs

Each switch needs a local definition for every VLAN it handles. Matching VLAN IDs keep the department boundaries consistent across the pilot path.

Return to the Logical workspace from earlier.
Select ACCESS1.
Select the CLI tab.
Press Enter to display the switch prompt.
Add both department VLANs to ACCESS1 by entering these commands:

enable
configure terminal
vlan 10
name ENGINEERING
exit
vlan 20
name FINANCE
end

What does this configuration do?

The vlan 10 command creates the Engineering broadcast domain.
The vlan 20 command creates the Finance broadcast domain.
The two name commands give each VLAN a readable department label.

Check the ACCESS1 VLAN table by entering this command:

show vlan brief

What should you see?

You should see VLAN 10 named ENGINEERING. You should also see VLAN 20 named FINANCE.

Missing a VLAN on ACCESS1?

Check that each name command was entered from the matching VLAN configuration prompt. Re-enter the VLAN block if a number or department name is different.

help me troubleshoot why a VLAN is missing from show vlan brief on a Cisco switch.

Return to the Logical workspace.
Select DIST1.
Select the CLI tab.
Press Enter to display the switch prompt.
Add the same department VLANs to DIST1 by entering these commands:

enable
configure terminal
vlan 10
name ENGINEERING
exit
vlan 20
name FINANCE
end

Why repeat the VLAN definitions?

A trunk can carry a VLAN only when the switches recognize that VLAN. Matching IDs let ACCESS1 and DIST1 treat tagged traffic as part of the same department boundary.

Check the DIST1 VLAN table by entering this command:

show vlan brief

What should you see on DIST1?

You should see ENGINEERING beside VLAN 10. You should see FINANCE beside VLAN 20.

Do the VLAN tables differ?

Compare the VLAN numbers with their names on both switches. Correct the switch whose table does not show the same two mappings.

help me compare the VLAN configuration on ACCESS1 and DIST1.

Assign the endpoint access ports

A static access port belongs to one VLAN. ACCESS1 uses this setting to place every untagged frame from a PC into the correct department.

Switch back to the ACCESS1 CLI from earlier.
Assign the port connected to ENG-PC by entering these commands:

configure terminal
interface FastEthernet0/6
switchport mode access
switchport access vlan 10
end

How does the Engineering port work?

The switchport mode access command makes the interface a permanent Layer 2 access port.
The switchport access vlan 10 command places frames from ENG-PC into the Engineering VLAN.

Confirm the Engineering port assignment by entering this command:

show vlan brief

What changed in the VLAN table?

You should see FastEthernet0/6 listed under VLAN 10. This proves ACCESS1 maps ENG-PC traffic to Engineering.

Is FastEthernet0/6 missing?

Check that you configured FastEthernet0/6 on ACCESS1. Confirm that the access VLAN value is 10.

help me troubleshoot why FastEthernet0/6 is not listed in VLAN 10.

Assign the port connected to FIN-PC by entering these commands:

configure terminal
interface FastEthernet0/18
switchport mode access
switchport access vlan 20
end

How does the Finance port work?

The static access mode keeps the endpoint port in one broadcast domain.
The switchport access vlan 20 command places frames from FIN-PC into the Finance VLAN.

Confirm both endpoint assignments by entering this command:

show vlan brief

What should the access layer show?

You should see FastEthernet0/6 under VLAN 10. You should see FastEthernet0/18 under VLAN 20.

Is a PC port in the wrong VLAN?

Re-enter the interface configuration for the misplaced port. Use VLAN 10 for ENG-PC or VLAN 20 for FIN-PC.

help me correct an ACCESS1 port that appears in the wrong VLAN.

Build and verify the restricted trunk

The uplink must transport traffic for both departments. Restricting its allowed list keeps unrelated VLANs off this pilot connection.

Configure the existing ACCESS1 uplink by entering these commands in its CLI:

configure terminal
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end

What does the ACCESS1 trunk configuration do?

The switchport mode trunk command makes the uplink carry tagged VLAN traffic.
The switchport trunk allowed vlan 10,20 command limits that traffic to Engineering and Finance.

Switch back to the DIST1 CLI from earlier.
Configure the existing DIST1 uplink by entering these commands:

configure terminal
interface GigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end

Why configure both ends?

Both interfaces need permanent trunk mode. Their matching allowed lists create one consistent Layer 2 path for VLANs 10 and 20.

Before you run these checks, picture the VLAN list you expect each trunk to carry.

Check the DIST1 VLAN table and trunk state by entering these commands:

show vlan brief
show interfaces trunk

What should DIST1 report?

You should see VLANs 10 and 20 with their department names. You should also see GigabitEthernet1/0/1 trunking with only 10,20 allowed.

Switch back to the ACCESS1 CLI.
Check the ACCESS1 VLAN table and trunk state by entering these commands:

show vlan brief
show interfaces trunk

What should ACCESS1 report?

You should see the two endpoint ports under their assigned VLANs. You should also see GigabitEthernet0/1 trunking with only 10,20 allowed.

Is the trunk missing or unrestricted?

Confirm that trunk mode is configured on both ends of the existing cable. Check that the allowed list contains 10,20 with no space after the comma.

help me troubleshoot the ACCESS1 to DIST1 restricted trunk.

That Layer 2 foundation is working. Engineering and Finance now have separate access ports connected through one restricted trunk.

Save the updated Packet Tracer project by pressing Ctrl+S.

Your enterprise-hq-foundation.pkt checkpoint now contains the two department VLANs and the restricted ACCESS1-DIST1 trunk.

✔️ Awesome, I've got everything!

Your VLAN tables and trunk checks match. Keep enterprise-hq-foundation.pkt saved before moving on.

ⓧ I'd like to double check the full code

ACCESS1 complete command sequence

enable
configure terminal
vlan 10
name ENGINEERING
exit
vlan 20
name FINANCE
exit
interface FastEthernet0/6
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/18
switchport mode access
switchport access vlan 20
exit
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end
show vlan brief
show interfaces trunk

How to compare ACCESS1

Confirm that the two access interfaces use different VLAN IDs. Confirm that the uplink uses trunk mode with the restricted allowed list.

DIST1 complete command sequence

enable
configure terminal
vlan 10
name ENGINEERING
exit
vlan 20
name FINANCE
exit
interface GigabitEthernet1/0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
end
show vlan brief
show interfaces trunk

How to compare DIST1

Confirm that DIST1 has both VLAN definitions. Confirm that its interface toward ACCESS1 uses the same restricted allowed list.

Your pilot now has clean Layer 2 boundaries from each PC to DIST1. Next, you will add dual-stack gateways and watch the first cross-VLAN tests expose the missing Layer 3 function.

Address the Pilot and Observe the Routing Failure

Your restricted trunk now carries Engineering and Finance traffic through Cisco Packet Tracer. Each department still needs a local gateway before its hosts can test the boundary between their VLANs.

Correct addresses let each PC prove local reachability. This step compares that local success with cross-VLAN traffic so the forwarding boundary becomes visible.

In this step, get ready to:

Configure dual-stack gateway interfaces for Engineering and Finance.
Assign the planned IPv4 and IPv6 settings to both pilot PCs.
Compare local gateway reachability with cross-VLAN reachability.

Configure the dual-stack gateway SVIs

A switched virtual interface gives a VLAN a gateway on a multilayer switch. One SVI per department keeps each gateway aligned with the addressing note.

Select DIST1 in the Logical workspace.
Select the CLI tab.
Apply the Engineering gateway values by entering these commands:

enable
configure terminal
interface vlan 10
ip address 10.10.10.1 255.255.255.128
ipv6 address 2001:db8:10:10::1/64
ipv6 address FE80::1 link-local
no shutdown
end

What does this configuration do?

The Vlan10 interface becomes Engineering's gateway on IPv4.
The global IPv6 address places the gateway inside Engineering's IPv6 prefix.
The link-local address gives Engineering hosts a gateway that stays on their local VLAN.
The no shutdown command enables the SVI.

Confirm that DIST1 accepts every command without marking a line as invalid.

Seeing a rejected SVI command?

Confirm that you selected the Cisco 3650 named DIST1. A 2960 does not provide the multilayer interface required here.

Check the spacing around vlan 10 and each IPv6 address. Enter the rejected line again after correcting the typo.

Help me diagnose the rejected DIST1 SVI command.

Apply the Finance gateway values by entering these commands:

configure terminal
interface vlan 20
ip address 10.10.10.129 255.255.255.192
ipv6 address 2001:db8:10:20::1/64
ipv6 address FE80::1 link-local
no shutdown
end

How does Finance stay separate?

The Vlan20 interface uses the first usable address from Finance's IPv4 subnet.
The Finance IPv6 address belongs to its dedicated /64 prefix.
The same FE80::1 link-local address can appear on both SVIs because the VLANs are separate networks.

Confirm that DIST1 accepts every Finance SVI command without marking a line as invalid.

Finance SVI command rejected?

Check that the interface number is 20. Confirm that the IPv4 mask ends in 192.

Compare the IPv6 prefix with the Finance entry in the HQ addressing note. The fourth group must be 20.

Help me compare my Vlan20 commands with the Finance addressing plan.

Address the pilot PCs

Each PC needs an address from its department subnet. Its default gateways point to the matching SVI on DIST1.

Why can both PCs use FE80::1?

A link-local IPv6 address only has meaning on its local network. Engineering reaches FE80::1 through VLAN 10.

Finance reaches its own FE80::1 through VLAN 20. The separate VLAN boundaries prevent ambiguity.

Select ENG-PC in the Logical workspace.
Select the Desktop tab.
Select IP Configuration.

Choose static IPv4 addressing.
Enter 10.10.10.10 as the IPv4 address.
Enter 255.255.255.128 as the subnet mask.
Enter 10.10.10.1 as the IPv4 gateway.

ENG-PC now has its IPv4 identity. Its IPv6 settings place it inside the same Engineering VLAN.

Choose static IPv6 addressing.
Enter 2001:db8:10:10::10 as the IPv6 address.
Enter 64 as the IPv6 prefix length.
Enter FE80::1 as the IPv6 gateway.
Return to the Desktop tab.
Select Command Prompt.
Test both Engineering gateways by running these commands:

ping 10.10.10.1
ping 2001:db8:10:10::1

What do these tests prove?

The first command checks the Engineering IPv4 gateway. The second command checks the Engineering IPv6 gateway.

Replies prove that ENG-PC reaches its access port. They also prove that VLAN 10 crosses the trunk to DIST1.

Strong baseline. ENG-PC can now reach both of its local gateways.

No replies from an Engineering gateway?

Compare the PC address with the Engineering subnet in the HQ note. Check that the IPv4 mask is 255.255.255.128.

Confirm that the IPv4 gateway is 10.10.10.1. Confirm that the IPv6 gateway is FE80::1.

Help me troubleshoot why ENG-PC cannot ping its local gateways.

Select FIN-PC in the Logical workspace.
Select the Desktop tab.
Select IP Configuration.

Choose static IPv4 addressing.
Enter 10.10.10.130 as the IPv4 address.
Enter 255.255.255.192 as the subnet mask.
Enter 10.10.10.129 as the IPv4 gateway.

FIN-PC now has its IPv4 identity. Its IPv6 settings place it inside the Finance VLAN.

Choose static IPv6 addressing.
Enter 2001:db8:10:20::20 as the IPv6 address.
Enter 64 as the IPv6 prefix length.
Enter FE80::1 as the IPv6 gateway.
Return to the Desktop tab.
Select Command Prompt.
Test both Finance gateways by running these commands:

ping 10.10.10.129
ping 2001:db8:10:20::1

What does Finance prove?

These replies confirm that FIN-PC reaches both addresses on Vlan20. VLAN 20 is carrying both protocol stacks to DIST1.

Both departments now have working local paths. You have enough evidence to test what happens at the boundary between them.

No replies from a Finance gateway?

Check that FIN-PC uses 255.255.255.192 as its IPv4 mask. Confirm that its IPv4 gateway is 10.10.10.129.

Compare the IPv6 address with the Finance prefix in the HQ note. Confirm that the IPv6 gateway is FE80::1.

Help me troubleshoot why FIN-PC cannot ping its local gateways.

Expose the Layer 3 boundary

What have the local tests ruled out?

Gateway replies confirm that both endpoint cables carry traffic.
Gateway replies confirm that each access port belongs to the intended VLAN.
Gateway replies confirm that the restricted trunk carries VLANs 10 and 20.
Gateway replies confirm that the endpoint addresses match their SVI addresses.

A controlled forwarding state makes the next comparison meaningful. You can test local traffic against traffic that must cross between two networks.

Return to the CLI tab on DIST1.
Set the planned forwarding state by entering these commands:

enable
configure terminal
no ip routing
no ipv6 unicast-routing
end

What do these commands establish?

The commands place IPv4 routing and IPv6 unicast forwarding in the disabled state required for this test. The gateway and cross-VLAN checks reveal which traffic that state permits.

Confirm that DIST1 accepts both routing commands without marking either line as invalid.

Routing command rejected?

Confirm that the prompt shows global configuration mode before entering either command. Check that you are configuring the Cisco 3650 named DIST1.

Help me troubleshoot why DIST1 rejects a routing command.

Before you rerun the local checks, do you expect this forwarding state to affect traffic that ends on ENG-PC's own gateways?

Return to the command prompt on ENG-PC.
Retest both local gateways by running these commands:

ping 10.10.10.1
ping 2001:db8:10:10::1

Why do local gateways still reply?

Both destination addresses belong to Vlan10 on DIST1. The traffic reaches the local gateway without crossing into another VLAN.

You should still receive replies from both Engineering gateways. This preserves the local baseline after routing is disabled.

Before you run the cross-VLAN checks, do you think DIST1 can move packets from Engineering into Finance in its current state?

Test the Finance PC over both protocol stacks by running these commands:

ping 10.10.10.130
ping 2001:db8:10:20::20

What path do these packets need?

Both destinations belong to Finance. DIST1 must move each packet from VLAN 10 into VLAN 20 for the test to succeed.

You will see unsuccessful results for both cross-VLAN tests. That contrast isolates the boundary between local gateway reachability and inter-VLAN forwarding.

This failure is the evidence

The failed pings are intentional. Your successful local tests have already ruled out the endpoint cables and access VLANs.

They have also ruled out the restricted trunk and gateway addressing. The remaining boundary is the disabled Layer 3 forwarding function on DIST1.

Return to the Logical workspace.
Select the note tool from the workspace toolbar.
Click beside the HQ addressing note.
Enter Local gateways reachable. Cross-VLAN IPv4 and IPv6 tests fail while routing is disabled.

Your workspace now records the symptom beside the design that produced it. Save this evidence in the existing project checkpoint.

Select File from the Packet Tracer menu bar.
Select Save As.
Choose the same Windows folder that holds your current checkpoint.
Enter enterprise-hq-foundation.pkt as the file name.
Select Save.
Confirm the overwrite prompt if Packet Tracer asks to replace the existing file.

The save window closes when the checkpoint is updated. Your project now contains both dual-stack endpoint configurations and the deliberately disabled routing state.

✔️ Awesome, I've got everything!

DIST1 now has both dual-stack SVIs. The pilot PCs can reach their own gateways while the cross-VLAN tests fail as designed.

ⓧ I'd like to double check the full code

Compare DIST1's relevant configuration with this cumulative reference.

vlan 10
 name ENGINEERING

vlan 20
 name FINANCE

interface gigabitethernet1/0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20

interface vlan 10
 ip address 10.10.10.1 255.255.255.128
 ipv6 address 2001:db8:10:10::1/64
 ipv6 address FE80::1 link-local
 no shutdown

interface vlan 20
 ip address 10.10.10.129 255.255.255.192
 ipv6 address 2001:db8:10:20::1/64
 ipv6 address FE80::1 link-local
 no shutdown

no ip routing
no ipv6 unicast-routing

You have captured a clean forwarding failure with working local paths on both protocol stacks. Next up, you will enable the missing routing functions and prove that Engineering can reach Finance.

Turn On Layer 3 and Prove Dual-Stack Routing

Your Cisco Packet Tracer pilot already proves that each department reaches its own gateway. The remaining cross-VLAN failure shows that DIST1 is missing Layer 3 forwarding.

Enabling IPv4 forwarding plus IPv6 forwarding resolves that boundary. You will inspect the routing evidence before testing traffic in both directions.

In this step, get ready to:

Enable dual-stack forwarding on DIST1.
Prove the repaired path from both PCs.
Preserve the verified pilot as a reusable checkpoint.

Enable dual-stack forwarding

DIST1 already owns an SVI for each department. Global forwarding lets the switch move packets between those directly connected VLAN interfaces.

Switch back to DIST1's CLI from earlier.
Enter global configuration mode.
Enable dual-stack forwarding by entering these commands:

ip routing
ipv6 unicast-routing

What do these commands enable?

The ip routing command lets DIST1 forward packets between its connected IPv4 networks.
The ipv6 unicast-routing command lets DIST1 forward IPv6 unicast packets between its VLAN interfaces.

Return to privileged EXEC mode.
Confirm DIST1 accepts both forwarding commands without rejecting either one.

Does DIST1 reject a command?

Check that you are configuring DIST1. ACCESS1 is the Layer 2 access switch.

If the IPv6 command is rejected on DIST1 then revisit the compatibility check from Step 1. Help me diagnose the rejected routing command.

Inspect the routes and VLAN interfaces

A routing table lists the networks that DIST1 can reach. The interface summaries confirm that both department gateways are ready to carry traffic.

Inspect the IPv4 routes plus IPv6 routes by running these commands:

show ip route
show ipv6 route
show ip interface brief
show ipv6 interface brief

How do these checks prove readiness?

The IPv4 routing table should include connected networks 10.10.10.0/25 plus 10.10.10.128/26.
The IPv6 routing table should include connected networks 2001:db8:10:10::/64 plus 2001:db8:10:20::/64.
The interface summaries should show Vlan10 plus Vlan20 as up/up.

Confirm both Engineering and Finance appear as connected IPv4 networks.
Confirm both Engineering and Finance appear as connected IPv6 networks.
Confirm Vlan10 plus Vlan20 show up/up.

Is a route or interface missing?

Recheck that both VLANs still exist on DIST1.
Recheck that the restricted ACCESS1-DIST1 trunk still carries VLAN 10 plus VLAN 20.
Recheck that each SVI still has its assigned IPv4 address plus IPv6 address.

Use the route output to isolate the missing network. Help me diagnose the missing route or down SVI.

Prove the fix and save the checkpoint

Those connected routes prove that DIST1 knows where both departments live. Cross-VLAN pings now test whether it can forward real traffic across both protocol stacks.

Before you test the repaired path, do you expect ENG-PC to receive replies from FIN-PC this time?

Switch back to ENG-PC's Command Prompt from earlier.
Test the Finance destination over both protocol stacks by running these commands:

ping 10.10.10.130
ping 2001:db8:10:20::20

What do these pings prove?

The first ping tests IPv4 forwarding from Engineering to Finance.
The second ping tests IPv6 forwarding across the same VLAN boundary.

You should see replies from FIN-PC in both tests. The failure from the previous step is now resolved.

Switch back to FIN-PC's Command Prompt from earlier.
Test the return path to Engineering by running these commands:

ping 10.10.10.10
ping 2001:db8:10:10::10

Why test the return path?

The reverse tests prove that communication works in both directions. They also confirm that each endpoint uses its own SVI as the return gateway.

You should see replies from ENG-PC in both tests. That is the routing boundary removed across IPv4 plus IPv6.

Are the cross-VLAN pings still failing?

Recheck the Layer 2 evidence from earlier. Both VLAN interfaces must also appear as up/up.

Confirm the connected routes exist before changing endpoint addresses. Help me trace the failed cross-VLAN ping.

Switch back to DIST1's CLI.
Save the running configuration to startup configuration by running this command:

copy running-config startup-config

Why save the device configuration?

The running configuration holds the active settings on DIST1. Copying it to startup configuration preserves those settings as the device checkpoint.

DIST1 should complete the copy before returning you to the CLI prompt.

Does the configuration fail to save?

Make sure DIST1 is at the privileged EXEC prompt before repeating the save command.

Wait for the copy to finish before entering another command. Help me save the DIST1 configuration.

A troubleshooting record preserves the chain from symptom to evidence. It makes the successful fix repeatable when a similar routing failure appears later.

Use the note tool from earlier to create a troubleshooting note beside the pilot topology.
Record the diagnosis by pasting this text into the note:

Symptom: Engineering-to-Finance IPv4 and IPv6 pings failed while each PC reached its local gateways.
Evidence: VLAN assignments, restricted trunk, SVI addressing, and endpoint addressing were correct.
Cause: DIST1 had no ip routing and no ipv6 unicast-routing configured.
Resolution: enabled ip routing and ipv6 unicast-routing, then verified successful bidirectional IPv4 and IPv6 cross-VLAN pings.

What does this record capture?

The symptom identifies the failed path. The evidence rules out the VLANs plus trunk plus endpoint addressing.

The cause names the disabled forwarding functions. The resolution records the successful bidirectional retest.

Save the current project from Cisco Packet Tracer's File menu.
Keep the filename enterprise-hq-foundation.pkt.
Return to the Windows folder selected in Step 1.
Confirm enterprise-hq-foundation.pkt remains listed in that folder.
Confirm the troubleshooting note remains visible in the Logical workspace.

Is the latest checkpoint missing?

Confirm that you saved the open project under the existing filename. Check the Windows folder selected when you first created the checkpoint.

Keep Cisco Packet Tracer open while you verify the note. Help me verify my saved Packet Tracer checkpoint.

You have turned the planned failure into a verified dual-stack campus pilot. Engineering and Finance can now communicate through DIST1 in both directions.

Secret mission

Extend the Pilot to a Second Access Switch

Your headquarters pilot already routes Engineering and Finance through one access switch. Extend the same campus pattern through ACCESS2 by adding a dual-stack HR VLAN that can reach both existing departments.

Clean Up Your Resources

Your saved Cisco Packet Tracer lab stays on your Windows computer with no ongoing costs. Choose the option below that matches your plans for the lab.

Resources you used:

Your enterprise-hq-foundation.pkt project file in the Windows folder you selected.

Keep everything running

No action needed. Choose this if you are still refining the campus pilot or plan to reuse it in a later networking project.

Keep enterprise-hq-foundation.pkt in the selected Windows folder.
Continue using the open Packet Tracer session if you want to keep building now.
Save future changes to the same project file so your checkpoint stays current.

Pause - I'll come back to this later

Pausing frees the memory used by the open Packet Tracer session. Your saved project remains ready for your return.

Confirm that enterprise-hq-foundation.pkt is present in the Windows folder you selected.
Close Cisco Packet Tracer using the window's close button.
Confirm that enterprise-hq-foundation.pkt remains in the selected Windows folder.
Double-click enterprise-hq-foundation.pkt when you return to resume the lab.

Delete - I don't want to use this again

Deleting is the cleanest option when you no longer need the campus lab.

Only the saved lab file is removed. Cisco Packet Tracer stays installed for future work.

Close Cisco Packet Tracer using the window's close button.
Navigate to the Windows folder you selected for the project.
Select enterprise-hq-foundation.pkt.
Press Shift+Delete to remove the file permanently.
Confirm permanent deletion if Windows asks.
Check that enterprise-hq-foundation.pkt no longer appears in the selected Windows folder.

Nice Work!

Excellent work! You built a three-tier headquarters pilot in Cisco Packet Tracer. Your saved enterprise-hq-foundation.pkt lab now routes both protocol stacks across all three departments.

You've learned how to:

Shape a three-tier campus design around repeatable core, distribution, access roles.
Translate department host requirements into a hierarchical addressing plan. Use VLSM for non-overlapping IPv4 subnets. Give every user VLAN its own IPv6 /64 prefix.
Configure restricted 802.1Q trunks for the pilot VLANs. Build dual-stack SVIs as their gateways. Diagnose a planned forwarding failure with Layer 2 evidence. Enable Layer 3 routing to restore cross-VLAN traffic.
Secret Mission: Extend the design pattern through ACCESS2. Bring HR VLAN 30 online with dual-stack addressing. Prove HR-PC can reach both original departments.

Ready to quiz yourself?