Build a Gaming Center Network

Build a segmented gaming center network with VLANs, LACP, DHCP, and PAT.

Introduction

30 Second Summary

A busy gaming center needs fast connections without letting every device share the same open network. One failed cable should not knock an entire gaming zone offline.

In this project, you will design a segmented gaming center network in Cisco Packet Tracer. You will prove that its clients can reach a simulated public server through a resilient path.

What You'll Build

You will demo gaming PCs reaching a public server even after one physical uplink is disconnected.

By the end of this project, you'll have:

  • A hierarchical gaming center topology that clearly shows the core, access, edge, ISP, wireless, client, and public-server layers.
  • Four separated client networks using VLANs. Wired gaming stations plus guest and staff laptops receive automatic addresses through DHCP.
  • Resilient uplinks built with LACP EtherChannels that keep traffic moving when one member link is disconnected. You can also show private client traffic reaching the public server through PAT.
  • Secret Mission: Add an extended ACL that blocks gaming clients from the staff network without breaking their internet access.

Are there any prerequisites?

You need your existing Cisco Packet Tracer installation plus your Cisco Networking Academy account. This project assumes basic familiarity with Cisco IOS, subnetting, and VLAN configuration.

Before We Start

This checkpoint locks in your goal before any hands-on work begins. You are building a segmented gaming center network that proves resilient VLAN connectivity plus private-client PAT access to 198.51.100.10.

Lay Out and Cable the Gaming Center

A blank Cisco Packet Tracer workspace hides the role of every device. A clear physical hierarchy makes each path visible before configuration begins.

You will build a hierarchical topology for the gaming center. You will start with one core uplink per access switch to create a clear baseline for later resilience testing.

In this step, get ready to:
  • Arrange the routers, switches, wireless devices, clients, and public server.
  • Cable each local client group to its access switch.
  • Create the initial physical path from the core to the public server.
Build the device hierarchy

The layout places the access switches below the core. The edge devices extend toward the simulated public server.

  • Press Cmd+Space on macOS or the Windows key on Windows to open system search.
  • Type Cisco Packet Tracer into the search field to find the installed application.
  • Press Enter to open Cisco Packet Tracer.
  • Press Cmd+Shift+S on macOS or Ctrl+Shift+S on Windows to open Save As.
  • Enter gaming-center-network.pkt as the filename.
  • Click Save to create the project file.

Your blank workspace is now protected by a saved project file. Every device you add from here becomes part of gaming-center-network.pkt.

The searchable field in the Network Component Box helps you find each exact model. Place the devices in layers so each cable remains easy to trace.

  • Place two 2911 routers across the upper-right area of the workspace.
  • Place one 3560-24PS switch near the center of the workspace.
  • Place two 2960-24TT switches below the multilayer switch.
  • Place one PC below each access switch.
  • Place one AccessPoint-PT beside each PC.
  • Place one laptop near each access point.
  • Place one Server-PT to the right of the routers.

How do device names work?

A device's Display Name appears beneath it in the workspace. You can change this value through the device's Config tab.

The names identify the device roles at a glance. Clear labels make later configuration checks easier to follow.

  • Set the left 2911 router's Display Name to EDGE in its Config tab.
  • Set the right 2911 router's Display Name to ISP in its Config tab.
  • Set the 3560-24PS switch's Display Name to CORE-MLS in its Config tab.
  • Set the left 2960-24TT switch's Display Name to ACCESS-A in its Config tab.
  • Set the right 2960-24TT switch's Display Name to ACCESS-B in its Config tab.
  • Press Cmd+S on macOS or Ctrl+S on Windows to save the labeled topology.

You should see CORE-MLS above both access switches. The path toward the public server should pass through EDGE before reaching ISP.

Cable the access layer

The access layer brings local devices onto the wired network. Its first uplinks provide the only path to the core at this stage.

  • Select Connections in the Network Component Box.
  • Select Copper Cross-Over for the switch-to-switch uplinks.
  • Connect CORE-MLS FastEthernet0/1 to ACCESS-A FastEthernet0/1.
  • Connect CORE-MLS FastEthernet0/3 to ACCESS-B FastEthernet0/1.

Why use two cable types?

Copper cross-over carries Ethernet between devices at the same network layer. Copper straight-through connects end devices or access points to switches.

Using the correct cable type gives each link a working physical path.

  • Select Copper Straight-Through for the local device connections.
  • Connect the left PC's FastEthernet0 interface to ACCESS-A FastEthernet0/3.
  • Connect the right PC's FastEthernet0 interface to ACCESS-B FastEthernet0/3.
  • Connect the left access point's Port 0 interface to ACCESS-A GigabitEthernet0/1.
  • Connect the right access point's Port 0 interface to ACCESS-B GigabitEthernet0/1.

You should now see a cable from each PC to its local access switch. Each access point should have its own wired connection.

The unused interfaces become the second members of the resilient uplinks later. Keeping them empty preserves the single-link baseline needed for the next test.

  • Leave CORE-MLS FastEthernet0/2 uncabled.
  • Leave CORE-MLS FastEthernet0/24 uncabled.
  • Leave FastEthernet0/2 on each access switch uncabled.

Access cables connected to the wrong ports?

  • Select the incorrect cable near the device to unplug it.
  • Reconnect the cable using the interface shown in the instructions.
  • Check that each PC uses FastEthernet0 on the client side.
  • Help me check my access-layer cabling.
Complete the edge path

The remaining cables create a physical route from the core to the simulated public server. Later steps add the addressing that makes this path carry client traffic.

  • Select Copper Straight-Through in the connection choices.
  • Connect CORE-MLS GigabitEthernet0/1 to EDGE GigabitEthernet0/1.
  • Select Copper Cross-Over in the connection choices.
  • Connect EDGE GigabitEthernet0/0 to ISP GigabitEthernet0/0.
  • Connect ISP GigabitEthernet0/1 to the public server's FastEthernet0 interface.

Router interfaces need an active port state before their link indicators can turn green. Enable the four router interfaces used by this path.

  • In the EDGE device window's Config tab, set GigabitEthernet0/0 Port Status to On.
  • In the EDGE device window's Config tab, set GigabitEthernet0/1 Port Status to On.
  • In the ISP device window's Config tab, set GigabitEthernet0/0 Port Status to On.
  • In the ISP device window's Config tab, set GigabitEthernet0/1 Port Status to On.

The switch links can remain amber for about a minute while the topology converges. That short wait is expected.

Before you inspect the workspace, which links do you expect to turn green once the physical path is ready?

  • Wait for the connection indicators to finish changing state.
  • Inspect the first link from CORE-MLS to each access switch.
  • Inspect the path from CORE-MLS through both routers to the public server.

You should see green connection indicators on both first core-to-access links. You should also see green indicators along the router and public-server path.

  • Press Cmd+S on macOS or Ctrl+S on Windows to save gaming-center-network.pkt.

That is the physical skeleton complete. Your saved gaming center now has every device and initial cable required for configuration.

Connection indicators not turning green?

  • Check that each cable endpoint uses the exact interface listed above.
  • Confirm that all four router interfaces have Port Status set to On.
  • Wait a little longer if a switch link remains amber during convergence.
  • Help me find the incorrect link in my topology.

✔️ Awesome, I've got everything!

Great work. Confirm that gaming-center-network.pkt is saved before continuing.

ⓧ I'd like to double check the topology

Saved Packet Tracer topology containing ISP, EDGE, CORE-MLS, ACCESS-A, ACCESS-B, two PCs, two access points, two laptops, and one server with the initial single uplinks and router/server links cabled.

  • Confirm that the file is named gaming-center-network.pkt.
  • Confirm that the workspace contains two 2911 routers named ISP and EDGE.
  • Confirm that the workspace contains one 3560-24PS switch named CORE-MLS.
  • Confirm that the workspace contains two 2960-24TT switches named ACCESS-A and ACCESS-B.
  • Confirm that the workspace contains two PCs, two access points, two laptops, and one server.
  • Confirm that CORE-MLS FastEthernet0/1 connects to ACCESS-A FastEthernet0/1.
  • Confirm that CORE-MLS FastEthernet0/3 connects to ACCESS-B FastEthernet0/1.
  • Confirm that each PC connects to FastEthernet0/3 on its local access switch.
  • Confirm that each access point connects to GigabitEthernet0/1 on its local access switch.
  • Confirm that CORE-MLS GigabitEthernet0/1 connects to EDGE GigabitEthernet0/1.
  • Confirm that EDGE GigabitEthernet0/0 connects to ISP GigabitEthernet0/0.
  • Confirm that ISP GigabitEthernet0/1 connects to the public server.
  • Confirm that the second access uplinks remain uncabled.

Your physical hierarchy is ready. Next up, you will segment the gaming floor with VLANs before testing the limits of a single uplink.

Segment the Floor with VLANs

Your physical topology is ready in Cisco Packet Tracer. Each access switch currently has one path through the core.

A flat VLAN can carry traffic until segmentation or an uplink failure changes the path. You will prove that simple network works before exposing both limitations.

In this step, get ready to:
  • Create five VLANs across the core and access switches.
  • Prove same-VLAN connectivity between the gaming PCs.
  • Observe a single-uplink outage followed by a failed cross-VLAN ping.
Build the Layer 2 segments

Each VLAN creates a separate broadcast domain. A trunk carries several VLANs across one physical uplink.

Why use trunks here?

The core needs to receive traffic from every client network through each access-switch uplink. Allowing VLANs 10,20,30,40,99 keeps that list consistent across the topology.

  • Click CORE-MLS in the workspace.
  • Select the CLI tab.
  • Configure the core VLAN database and active uplinks by entering the commands below:
enable
configure terminal
hostname CORE-MLS
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
interface FastEthernet0/3
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
end

What does this configuration do?

  • The five vlan sections create the gaming, wireless, staff, and management segments on CORE-MLS.
  • The two interface sections make the active access-switch uplinks operate as trunks.
  • The allowed list limits those trunks to the five VLANs used by the gaming center.
  • Check that the CLI returns to the privileged prompt after the final command.

You should see the CORE-MLS prompt with no rejected commands.

Core configuration rejected?

  • Confirm that you selected the 3560-24PS named CORE-MLS.
  • Check that the uplinks use FastEthernet0/1 and FastEthernet0/3.
  • Re-enter only the command section that the CLI rejected.
  • Help me troubleshoot the CORE-MLS VLAN and trunk configuration.
  • Close the CORE-MLS device window.
  • Click ACCESS-A in the workspace.
  • Select the CLI tab.
  • Configure its VLANs and gaming port by entering the commands below:
enable
configure terminal
hostname ACCESS-A
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 10
 no shutdown
end

How is ACCESS-A divided?

  • The VLAN definitions match the core so both switches recognize the same segment numbers.
  • The uplink on FastEthernet0/1 carries all five VLANs to the core.
  • The access port on FastEthernet0/3 places PC-A in VLAN 10.
  • Check that the CLI returns to the privileged prompt after the final command.

You should see the ACCESS-A prompt with the connected interfaces left enabled.

PC-A port not configured?

  • Confirm that PC-A is physically connected to FastEthernet0/3 on ACCESS-A.
  • Check that the access VLAN value is 10.
  • Help me check the ACCESS-A trunk and PC-A access-port configuration.
  • Close the ACCESS-A device window.
  • Click ACCESS-B in the workspace.
  • Select the CLI tab.
  • Configure its VLAN database and active uplink by entering the commands below:
enable
configure terminal
hostname ACCESS-B
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
end

What does this configuration prepare?

  • The matching VLAN database gives ACCESS-B the same five network segments.
  • The trunk on FastEthernet0/1 carries those segments to CORE-MLS.
  • PC-B remains ready for the temporary same-VLAN test.
  • Check that the CLI returns to the privileged prompt after the final command.

You should see the ACCESS-B prompt with its first uplink enabled.

ACCESS-B trunk not accepted?

  • Confirm that the active uplink is FastEthernet0/1.
  • Check that every VLAN number is separated by a comma in 10,20,30,40,99.
  • Help me troubleshoot the ACCESS-B VLAN and trunk configuration.

PC-B needs to join PC-A's VLAN for the first connectivity test. The switch configuration panel provides a quick way to make that temporary assignment.

  • Select the Config tab on ACCESS-B.
  • Select FastEthernet0/3 in the interface list.
  • Set VLAN Switch Mode to Access.
  • Select VLAN 10 from the access VLAN list.

You should see VLAN 10 selected for FastEthernet0/3.

Test the flat gaming network

Both PC ports now belong to the same VLAN. Static addresses in the same subnet let you test this Layer 2 path before adding gateways or routing.

  • Click PC-A in the workspace.
  • Select the Desktop tab.
  • Open IP Configuration.
  • Select Static.
  • Enter 10.10.10.21 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Close the PC-A window.

PC-A now uses 10.10.10.21/24 as its temporary static address.

  • Click PC-B in the workspace.
  • Select the Desktop tab.
  • Open IP Configuration.
  • Select Static.
  • Enter 10.10.10.22 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Close the PC-B window.

PC-B now uses 10.10.10.22/24 inside the same subnet as PC-A.

Before you run the first test, do you expect two hosts in the same VLAN and subnet to exchange replies?

  • Return to PC-A.
  • Select the Desktop tab.
  • Open Command Prompt.
  • Test the path to PC-B by running:
ping 10.10.10.22

What does this test prove?

The ping sends ICMP echo requests from PC-A to PC-B. Replies prove that VLAN 10 crosses both trunks through the core.

You should receive replies from 10.10.10.22. The first request can time out while the devices learn addressing information, so repeat the test once if later requests succeed.

No replies from PC-B?

  • Confirm that PC-A uses 10.10.10.21 with subnet mask 255.255.255.0.
  • Confirm that PC-B uses 10.10.10.22 with subnet mask 255.255.255.0.
  • Check that both PC switch ports are assigned to VLAN 10.
  • Help me troubleshoot the failed same-VLAN ping between PC-A and PC-B.

That first win matters. VLAN 10 now carries gaming traffic across the whole switched path.

Before you disable the only ACCESS-A uplink, do you expect PC-A to retain another path to PC-B?

  • Click ACCESS-A in the workspace.
  • Select the Config tab.
  • Select FastEthernet0/1 in the interface list.
  • Set Port Status to Off.
  • Return to PC-A's Command Prompt.
  • Test the same destination again by running:
ping 10.10.10.22

Why does the same path fail now?

PC-A has lost the only physical path from ACCESS-A to the core. The VLAN configuration remains correct, but no second uplink exists to carry the frames.

You should see the ping fail while FastEthernet0/1 is off. This is the intended single point of failure.

Ping still succeeds?

  • Confirm that you disabled FastEthernet0/1 on ACCESS-A.
  • Confirm that the intentionally empty second access uplink remains uncabled.
  • Run the ping again after the previous replies finish scrolling.
  • Help me verify the intended ACCESS-A single-uplink failure.
  • Return to the Config tab on ACCESS-A.
  • Select FastEthernet0/1 in the interface list.
  • Set Port Status to On.
  • Wait for the connection indicators to return to green.
  • Return to PC-A's Command Prompt.
  • Confirm that the restored uplink carries traffic by running:
ping 10.10.10.22

What does the recovery prove?

Replies confirm that the VLAN configuration survived the temporary outage. Restoring the single uplink restores the only available switched path.

You should receive replies from 10.10.10.22 again.

Uplink not recovering?

  • Confirm that Port Status is set to On for ACCESS-A FastEthernet0/1.
  • Wait for the connection indicator to finish converging before repeating the ping.
  • Help me restore connectivity after re-enabling the ACCESS-A uplink.
Separate PC-B from PC-A

The flat network has proved its basic path and its physical weakness. Moving PC-B into VLAN 20 creates a real boundary between the gaming zones.

  • Click ACCESS-B in the workspace.
  • Select the CLI tab.
  • Move PC-B's switch port into its final gaming VLAN by entering:
enable
configure terminal
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
end

What changes on ACCESS-B?

The access port on FastEthernet0/3 now places PC-B traffic into VLAN 20. PC-A remains in VLAN 10.

  • Check that the CLI returns to the privileged prompt after the final command.

You should see the ACCESS-B prompt with no rejected commands.

PC-B still assigned to VLAN 10?

  • Confirm that you configured FastEthernet0/3 on ACCESS-B.
  • Check that the final access VLAN value is 20.
  • Help me move ACCESS-B FastEthernet0/3 from VLAN 10 to VLAN 20.
  • Click PC-B in the workspace.
  • Select the Desktop tab.
  • Open IP Configuration.
  • Replace the current IPv4 Address with 10.10.20.21.
  • Keep the Subnet Mask set to 255.255.255.0.
  • Close the PC-B window.

PC-B now uses 10.10.20.21/24 in gaming VLAN 20.

Before you test the new address, do you expect the core to move traffic between VLANs without any configured gateways?

  • Return to PC-A's Command Prompt.
  • Test the new PC-B address by running:
ping 10.10.20.21

Why does the cross-VLAN ping fail?

VLANs 10 and 20 are separate broadcast domains. CORE-MLS has no switched virtual interfaces or IP routing configuration yet.

The failed ping is the intended result. It proves that VLAN membership alone provides separation without creating a route between the segments.

Cross-VLAN ping succeeds unexpectedly?

  • Confirm that PC-A still uses 10.10.10.21.
  • Confirm that PC-B now uses 10.10.20.21.
  • Check that PC-B's FastEthernet0/3 access port belongs to VLAN 20.
  • Help me verify the intended cross-VLAN failure between PC-A and PC-B.

✔️ Awesome, I've got everything!

Your three switches now have matching VLAN databases. The final access-port assignments place PC-A in VLAN 10 and PC-B in VLAN 20.

ⓧ I'd like to double check the full code

Compare each switch against the complete configuration below.

enable
configure terminal
hostname CORE-MLS
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
interface FastEthernet0/3
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
end

CORE-MLS end state

This configuration gives the core all five VLANs. Its two current access-switch links carry the same allowed VLAN list.

enable
configure terminal
hostname ACCESS-A
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 10
 no shutdown
end

ACCESS-A end state

This configuration carries the five VLANs on the core uplink. It places PC-A's port in gaming VLAN 10.

enable
configure terminal
hostname ACCESS-B
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 no shutdown
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
end

ACCESS-B end state

This configuration carries the five VLANs on the core uplink. It places PC-B's port in gaming VLAN 20.

  • Click File in the Packet Tracer menu bar.
  • Click Save to update gaming-center-network.pkt.

Your saved workspace now contains the five VLANs, both active trunks, and the final gaming access-port assignments.

You have proved that segmentation works and that each access switch still depends on one fragile uplink. Next up, you will replace those single links with negotiated EtherChannels that survive a member-link failure.

Build Resilient LACP EtherChannels

The last connectivity test exposed a weak point in the gaming center network. One disconnected uplink removed the only path between an access switch and the core.

In this step, you will use LACP to combine two physical links into each EtherChannel. Cisco Packet Tracer then treats each pair as one resilient logical trunk.

In this step, get ready to:
  • Cable a second physical uplink from each access switch to the core.
  • Build two negotiated LACP EtherChannels carrying all five VLANs.
  • Disconnect one member link while same-VLAN traffic continues.
Cable the second uplink paths

Each access switch already has one trunk to the core. A second matching link gives LACP another physical path to place inside the logical bundle.

  • Connect CORE-MLS FastEthernet0/2 to ACCESS-A FastEthernet0/2 using the same cable type as the first access uplink.
  • Connect CORE-MLS FastEthernet0/24 to ACCESS-B FastEthernet0/2 using the same cable type as the first access uplink.
  • Wait for the four uplink indicators to finish converging.

The indicators can take a moment to settle while the switches recalculate their paths. You should see both new physical connections attached to their intended ports.

Build the negotiated trunk bundles

LACP forms a bundle only when the member ports use compatible trunk settings. Both ends also use active mode so each switch initiates negotiation.

  • Return to the CLI on ACCESS-A.
  • Add both uplinks to channel group 1 by entering these commands:
enable
configure terminal
interface FastEthernet0/1
 channel-group 1 mode active
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
end

What does this configuration do?

  • The channel-group 1 mode active command places both physical ports into the same negotiated bundle.
  • The second physical port receives the same trunk settings as the existing uplink.
  • The Port-channel1 interface carries VLANs 10,20,30,40,99 as one logical trunk.
  • Return to the CLI on CORE-MLS.
  • Build the matching channel group 1 configuration by entering these commands:
enable
configure terminal
interface FastEthernet0/1
 channel-group 1 mode active
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
end

How does the first bundle form?

The core places its two ACCESS-A links into channel group 1. Matching trunk settings allow the two switches to negotiate Port-channel1 successfully.

  • Confirm the first bundle from CORE-MLS by running:
show etherchannel summary

What should the first summary show?

You should see Po1 as a Layer 2 LACP port-channel in use. Its two FastEthernet member ports should appear bundled into the logical interface.

Is Po1 missing a bundled member?

  • Check that FastEthernet0/2 is connected between CORE-MLS and ACCESS-A.
  • Confirm that both physical ports allow VLANs 10,20,30,40,99.
  • Confirm that both switches use channel group 1 with active mode.
  • Help me troubleshoot why Po1 is not bundling in my Packet Tracer LACP configuration.
  • Return to the CLI on ACCESS-B.
  • Add both uplinks to channel group 2 by entering these commands:
enable
configure terminal
interface FastEthernet0/1
 channel-group 2 mode active
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
end

What changes on ACCESS-B?

ACCESS-B uses channel group 2 so its logical trunk stays separate from the ACCESS-A bundle. Both member ports carry the same five VLANs through Port-channel2.

  • Switch back to the CLI on CORE-MLS.
  • Build the matching channel group 2 configuration by entering these commands:
enable
configure terminal
interface FastEthernet0/3
 channel-group 2 mode active
interface FastEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
end

How does the second bundle form?

The core combines FastEthernet0/3 with FastEthernet0/24 inside channel group 2. This creates an independent logical trunk to ACCESS-B.

Prove one cable can fail safely

The summary command reveals whether LACP accepted every member port. The traffic test then proves that the logical bundle remains available after one physical path disappears.

Before you check the core, do you expect both port-channels to show two bundled members?

  • Check both bundles on CORE-MLS by running:
show etherchannel summary

How to read the final summary

  • You should see Po1 as a Layer 2 LACP port-channel in use with the two ACCESS-A member ports bundled.
  • You should see Po2 as a Layer 2 LACP port-channel in use with the two ACCESS-B member ports bundled.
  • The protocol column confirms that negotiation uses LACP.
  • Run the same summary command on ACCESS-A.
  • Run the same summary command on ACCESS-B.

ACCESS-A should show Po1 with two bundled members. ACCESS-B should show Po2 with two bundled members.

Does a port appear outside the bundle?

  • Compare the allowed VLAN list on both ends of the affected physical link.
  • Confirm that every member is configured as a trunk.
  • Confirm that the channel-group number matches on both ends of the bundle.
  • Help me identify why an EtherChannel member is not bundled.
  • Temporarily return ACCESS-B FastEthernet0/3 to VLAN 10 using the interface configuration workflow from the previous step.
  • Temporarily return PC-B to the static address 10.10.10.22 with subnet mask 255.255.255.0 using the IPv4 workflow from the previous step.
  • Repeat the earlier same-VLAN connectivity test from PC-A to PC-B.

You should receive replies while all four EtherChannel member links are connected.

  • Disconnect the physical link between CORE-MLS FastEthernet0/2 and ACCESS-A FastEthernet0/2.

Before you repeat the test, do you think losing one member will interrupt the logical trunk?

  • Repeat the same connectivity test from PC-A to PC-B.

You should continue receiving replies through the remaining member of Po1. That single-cable weakness is now removed.

  • Reconnect CORE-MLS FastEthernet0/2 to ACCESS-A FastEthernet0/2.
  • Confirm that Po1 returns to two bundled members using the summary command from above.
  • Restore ACCESS-B FastEthernet0/3 to VLAN 20.
  • Restore PC-B to the static address 10.10.20.21 with subnet mask 255.255.255.0.
  • Repeat the previous cross-VLAN connectivity test to confirm that PC-B is back in its VLAN 20 test state.

The cross-VLAN test should still fail because inter-VLAN routing has not been configured. The EtherChannels now carry the VLANs reliably without changing that routing boundary.

  • Save the updated topology back to gaming-center-network.pkt.

✔️ Awesome, I've got everything!

Great. Confirm that gaming-center-network.pkt is saved with both redundant uplinks connected.

ⓧ I'd like to double check the full code

Compare the complete ACCESS-A configuration with this reference.

enable
configure terminal
hostname ACCESS-A
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 10
 no shutdown
end

ACCESS-A reference

Use this complete configuration for comparison. It preserves the VLAN 10 client port while adding the two-member Port-channel1 trunk.

Compare the complete ACCESS-B configuration with this reference.

enable
configure terminal
hostname ACCESS-B
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
end

ACCESS-B reference

Use this complete configuration for comparison. It preserves the VLAN 20 client port while adding the two-member Port-channel2 trunk.

Compare the complete CORE-MLS configuration with this reference.

enable
configure terminal
hostname CORE-MLS
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface FastEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
end

CORE-MLS reference

Use this complete configuration for comparison. The core terminates Po1 for ACCESS-A plus Po2 for ACCESS-B.

Both access switches now have negotiated trunk bundles that survive one member-link failure. Next, you will add the Layer 3 gateways that move traffic between the segmented client networks.

Route VLANs and Connect Wireless Clients

Your LACP bundles now keep both access switches connected when one member link fails. The gaming center has a resilient Layer 2 foundation.

Each VLAN still forms an isolated network. DHCP broadcasts also stop when they reach the multilayer core.

In this step, you will create gateway interfaces on CORE-MLS. DHCP relay will carry address requests to EDGE. Separate wireless networks will bring the guest laptop and staff laptop online.

In this step, get ready to:
  • Route traffic between the five VLANs through CORE-MLS.
  • Provide centralized DHCP leases from EDGE.
  • Connect guest and staff laptops to separate wireless networks.
Enable inter-VLAN routing and connect EDGE

A switched virtual interface gives each VLAN an IPv4 gateway on CORE-MLS. Enabling routing lets the core forward packets between those gateways.

Why use the multilayer core?

CORE-MLS can route between its local VLANs through SVIs. EDGE can focus on centralized DHCP now and internet translation later.

This keeps internal forwarding on the device that already carries every VLAN.

  • Select CORE-MLS in the Cisco Packet Tracer workspace from earlier.
  • Switch to its command-line area.
  • Enable Layer 3 routing and create the five SVI gateways by entering:
enable
configure terminal
ip routing
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan30
 ip address 10.10.30.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan40
 ip address 10.10.40.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan99
 ip address 10.10.99.1 255.255.255.0
 no shutdown
end

What does this configuration do?

  • The ip routing command enables IPv4 forwarding between the SVIs.
  • Each SVI uses the first usable address in its subnet as the client gateway.
  • The four ip helper-address 10.255.0.1 entries relay client DHCP requests to EDGE.
  • Vlan99 provides a gateway for switch management traffic.

Before you test the earlier failed path, do you expect PC-A to reach PC-B now that both VLANs have gateways?

  • Select PC-A in the topology.
  • Select the Desktop tab.
  • Select Command Prompt.
  • Test the cross-VLAN path by running:
ping 10.10.20.21

What should you see?

You should receive replies from PC-B. This proves CORE-MLS now forwards traffic between VLAN 10 and VLAN 20.

The first request can time out while address resolution completes. Run the same check again before treating one missed reply as a fault.

Cross-VLAN ping still failing?

  • Confirm PC-A still uses VLAN 10 addressing with gateway 10.10.10.1.
  • Confirm PC-B still uses 10.10.20.21 with gateway 10.10.20.1.
  • Check that the VLAN 10 access port remains on ACCESS-A.
  • Check that the VLAN 20 access port remains on ACCESS-B.
  • Ask for help with my failed inter-VLAN ping.

The core also needs a routed transit link to EDGE. A static route sends unknown destinations toward that router.

  • Return to the CORE-MLS command-line area.
  • Convert GigabitEthernet0/1 into a routed port by entering:
enable
configure terminal
interface GigabitEthernet0/1
 no switchport
 ip address 10.255.0.2 255.255.255.252
 no shutdown
ip route 0.0.0.0 0.0.0.0 10.255.0.1
end

How does the core reach EDGE?

  • The no switchport command turns the physical interface into a Layer 3 port.
  • The address 10.255.0.2 places CORE-MLS on the routed transit subnet.
  • The default route points all nonlocal destinations to EDGE at 10.255.0.1.
  • Switch to the EDGE command-line area.
  • Address the other end of the transit link and add the return route by entering:
enable
configure terminal
hostname EDGE
interface GigabitEthernet0/1
 ip address 10.255.0.1 255.255.255.252
 no shutdown
ip route 10.10.0.0 255.255.0.0 10.255.0.2
end

How does EDGE return traffic?

  • The address 10.255.0.1 places EDGE on the same transit subnet as CORE-MLS.
  • The summary route sends every internal 10.10.0.0/16 destination back through CORE-MLS.
  • Both directions now have an explicit path.

Before you inspect the routing tables, which next hop do you expect each device to use for remote networks?

  • Return to CORE-MLS.
  • Display its routing table by running:
show ip route

What should CORE-MLS show?

You should see connected routes for the VLAN and transit subnets. You should also see a default route through 10.255.0.1.

  • Return to EDGE.
  • Display its routing table by running:
show ip route

What should EDGE show?

You should see the connected transit subnet. You should also see the internal summary route through 10.255.0.2.

Missing a route?

  • Confirm the CORE-MLS default route uses 10.255.0.1 as its next hop.
  • Confirm the EDGE summary route uses 10.255.0.2 as its next hop.
  • Check that both transit interfaces show enabled link indicators.
  • Ask for help with my missing Packet Tracer static route.
Centralize DHCP for the wired clients

DHCP relay forwards each client request with enough subnet context for EDGE to choose the correct pool. The excluded ranges reserve addresses 10.10.10.1 through 10.10.10.20 and the matching range in every client subnet.

  • Return to the EDGE command-line area.
  • Create the four centralized DHCP pools by entering:
enable
configure terminal
ip dhcp excluded-address 10.10.10.1 10.10.10.20
ip dhcp excluded-address 10.10.20.1 10.10.20.20
ip dhcp excluded-address 10.10.30.1 10.10.30.20
ip dhcp excluded-address 10.10.40.1 10.10.40.20
ip dhcp pool GAMING_A
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
ip dhcp pool GAMING_B
 network 10.10.20.0 255.255.255.0
 default-router 10.10.20.1
ip dhcp pool WIFI_GUEST
 network 10.10.30.0 255.255.255.0
 default-router 10.10.30.1
ip dhcp pool STAFF
 network 10.10.40.0 255.255.255.0
 default-router 10.10.40.1
end

How do the pools stay separated?

  • Each pool defines one client subnet.
  • Each default-router value matches the SVI gateway on CORE-MLS.
  • The excluded ranges prevent EDGE from leasing gateway addresses or reserved infrastructure addresses.
  • The relay source lets EDGE select the pool that belongs to the requesting VLAN.
  • Confirm that EDGE recognizes all four pools by running:
show ip dhcp pool

What should the pool summary show?

You should see GAMING_A, GAMING_B, WIFI_GUEST, and STAFF listed as separate pools.

  • Select PC-A in the topology.
  • Select the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.
  • Select PC-B in the topology.
  • Select the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.

Both PCs should show addresses above .20 in their assigned subnets. Their default gateways should match the corresponding SVI addresses.

  • Return to EDGE.
  • Display the new wired-client leases by running:
show ip dhcp binding

What should the binding table show?

You should see one lease from the gaming zone A subnet. You should also see one lease from the gaming zone B subnet.

That proves the client broadcasts crossed CORE-MLS through DHCP relay.

PC not receiving a lease?

  • Confirm the PC access port belongs to the intended VLAN.
  • Confirm the corresponding SVI contains ip helper-address 10.255.0.1.
  • Confirm EDGE has a pool whose network matches that VLAN.
  • Ask for help with my missing DHCP lease.
Add management addressing and wireless clients

VLAN 99 gives each access switch a management address. The access-point ports place guest wireless traffic in VLAN 30 and staff wireless traffic in VLAN 40.

  • Switch to the ACCESS-A command-line area.
  • Configure its access-point port and management SVI by entering:
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 30
 no shutdown
interface Vlan99
 ip address 10.10.99.11 255.255.255.0
 no shutdown
ip default-gateway 10.10.99.1
end

What changes on ACCESS-A?

  • The access-point port carries guest traffic in VLAN 30.
  • The management SVI gives ACCESS-A the address 10.10.99.11.
  • The default gateway sends management traffic to CORE-MLS.
  • Switch to the ACCESS-B command-line area.
  • Configure its access-point port and management SVI by entering:
enable
configure terminal
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 40
 no shutdown
interface Vlan99
 ip address 10.10.99.12 255.255.255.0
 no shutdown
ip default-gateway 10.10.99.1
end

What changes on ACCESS-B?

  • The access-point port carries staff traffic in VLAN 40.
  • The management SVI gives ACCESS-B the address 10.10.99.12.
  • The default gateway sends management traffic to CORE-MLS.

You should see active link indicators between both access switches and their access points. Each wireless bridge now leads into a different VLAN.

Wireless security depends on matching the SSID, authentication method, encryption type, and passphrase on both ends. A mismatch in any one value prevents association.

  • Select the access point connected to ACCESS-A.
  • Select its wireless interface settings.
  • Enter GC-GUEST in the SSID field.
  • Select WPA2-PSK for Authentication.
  • Select AES for Encryption Type.
  • Enter GamingCenterLab in the PassPhrase field.
  • Select the guest laptop.
  • Select the Desktop tab.
  • Select PC Wireless.
  • Connect to GC-GUEST from the available wireless networks.
  • Enter GamingCenterLab when the wireless profile requests the passphrase.
  • Return to the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.

The guest laptop should show an address from 10.10.30.0/24 with gateway 10.10.30.1.

  • Select the access point connected to ACCESS-B.
  • Select its wireless interface settings.
  • Enter GC-STAFF in the SSID field.
  • Select WPA2-PSK for Authentication.
  • Select AES for Encryption Type.
  • Enter StaffCenterLab in the PassPhrase field.
  • Select the staff laptop.
  • Select the Desktop tab.
  • Select PC Wireless.
  • Connect to GC-STAFF from the available wireless networks.
  • Enter StaffCenterLab when the wireless profile requests the passphrase.
  • Return to the Desktop tab.
  • Select IP Configuration.
  • Select DHCP.

The staff laptop should show an address from 10.10.40.0/24 with gateway 10.10.40.1.

Laptop not associating?

  • Confirm the laptop selected the SSID from its matching access point.
  • Confirm both ends use WPA2-PSK authentication.
  • Confirm both ends use AES encryption.
  • Re-enter the matching passphrase with the same capitalization.
  • Ask for help with my Packet Tracer wireless association.

Before the final check, do you expect EDGE to show leases from two wired subnets and two wireless subnets?

  • Return to the EDGE command-line area.
  • Display every active client lease by running:
show ip dhcp binding

What should the final binding table show?

You should see leases from all four client subnets. The table proves that wired and wireless DHCP requests reached the centralized EDGE service.

Before the inter-VLAN test, do you expect PC-A to reach PC-B using the new DHCP leases?

  • Return to PC-A's Command Prompt.
  • Test PC-B's first available DHCP address by running:
ping 10.10.20.21

What does the successful ping prove?

You should receive replies from PC-B. The result proves that DHCP addressing and inter-VLAN routing now work together.

  • Select File in Packet Tracer.
  • Select Save to update gaming-center-network.pkt.

That is a major network milestone. Your wired and wireless clients now receive centralized leases and communicate through the multilayer core.

✔️ Awesome, I've got everything!

Great. Confirm that gaming-center-network.pkt is saved with the working leases and wireless associations.

ⓧ I'd like to double check the full code

Compare each device with these cumulative configurations.

enable
configure terminal
hostname ACCESS-A
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 10
 no shutdown
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 30
 no shutdown
interface Vlan99
 ip address 10.10.99.11 255.255.255.0
 no shutdown
ip default-gateway 10.10.99.1
end
enable
configure terminal
hostname ACCESS-B
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode access
 switchport access vlan 20
 no shutdown
interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 40
 no shutdown
interface Vlan99
 ip address 10.10.99.12 255.255.255.0
 no shutdown
ip default-gateway 10.10.99.1
end
enable
configure terminal
hostname CORE-MLS
ip routing
vlan 10
 name GAMING-A
vlan 20
 name GAMING-B
vlan 30
 name WIFI-GUEST
vlan 40
 name STAFF
vlan 99
 name MANAGEMENT
interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface FastEthernet0/2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 1 mode active
 no shutdown
interface Port-channel1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface FastEthernet0/3
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface FastEthernet0/24
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
 channel-group 2 mode active
 no shutdown
interface Port-channel2
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30,40,99
interface Vlan10
 ip address 10.10.10.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan30
 ip address 10.10.30.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan40
 ip address 10.10.40.1 255.255.255.0
 ip helper-address 10.255.0.1
 no shutdown
interface Vlan99
 ip address 10.10.99.1 255.255.255.0
 no shutdown
interface GigabitEthernet0/1
 no switchport
 ip address 10.255.0.2 255.255.255.252
 no shutdown
ip route 0.0.0.0 0.0.0.0 10.255.0.1
end
enable
configure terminal
hostname EDGE
ip dhcp excluded-address 10.10.10.1 10.10.10.20
ip dhcp excluded-address 10.10.20.1 10.10.20.20
ip dhcp excluded-address 10.10.30.1 10.10.30.20
ip dhcp excluded-address 10.10.40.1 10.10.40.20
ip dhcp pool GAMING_A
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
ip dhcp pool GAMING_B
 network 10.10.20.0 255.255.255.0
 default-router 10.10.20.1
ip dhcp pool WIFI_GUEST
 network 10.10.30.0 255.255.255.0
 default-router 10.10.30.1
ip dhcp pool STAFF
 network 10.10.40.0 255.255.255.0
 default-router 10.10.40.1
interface GigabitEthernet0/1
 ip address 10.255.0.1 255.255.255.252
 no shutdown
ip route 10.10.0.0 255.255.0.0 10.255.0.2
end
ACCESS-A access point: SSID GC-GUEST; Authentication WPA2-PSK; Encryption Type AES; PassPhrase GamingCenterLab.
ACCESS-B access point: SSID GC-STAFF; Authentication WPA2-PSK; Encryption Type AES; PassPhrase StaffCenterLab.
PC-A, PC-B, guest laptop, and staff laptop use DHCP.

Your segmented floor now has resilient uplinks, routed VLANs, centralized DHCP, and separate guest and staff wireless access. Next up, you will extend this working internal network to the simulated internet.

Reach the Internet with NAT and PAT

Your Cisco Packet Tracer topology now routes traffic between every client VLAN. Each wired or wireless client also has a DHCP lease.

Private client addresses still stop at the outside path. In this step, you will use Network Address Translation and Port Address Translation to carry that traffic through one WAN address.

In this step, get ready to:
  • Configure the simulated ISP network and public server.
  • Build the outside path through EDGE with NAT and PAT.
  • Prove public connectivity through active translation entries.
Configure the simulated ISP and public server

The ISP router connects EDGE to a separate public server network. That server gives you a controlled destination for testing the complete path.

  • Select ISP in the topology.
  • Open the router's command-line panel.
  • Press Enter if the router asks you to begin the session.
  • Configure both ISP interfaces by entering the commands below:
enable
configure terminal
hostname ISP
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
 no shutdown
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 no shutdown
end

What does this configuration do?

  • The 203.0.113.1 interface becomes the ISP endpoint for the routed link to EDGE.
  • The 198.51.100.1 interface becomes the gateway for the simulated public server network.
  • The no shutdown lines enable both interfaces.

The public server needs a static IPv4 configuration in the ISP's public subnet. Its gateway points back to ISP.

  • Select the public Server-PT device in the topology.
  • Open the server's IPv4 configuration panel.
  • Set its address to 198.51.100.10.
  • Set its subnet mask to 255.255.255.0.
  • Set its default gateway to 198.51.100.1.
  • Return to the ISP command-line panel.

Before you test the public segment, what result do you expect from a server connected directly to ISP?

  • Test the public server from ISP by running:
ping 198.51.100.10

What does this test prove?

The ping checks the local path from ISP to the public server. Replies prove that the public subnet has a working router interface plus a correctly addressed endpoint.

You should receive replies from 198.51.100.10. The first attempt can lose an echo while ARP resolves, so repeat the test once before investigating.

Public server not replying?

  • Check that the server uses 198.51.100.10 with the 255.255.255.0 subnet mask.
  • Check that the server gateway is 198.51.100.1.
  • Check that ISP GigabitEthernet0/1 is enabled.
  • Help me troubleshoot the public server connection.

✔️ Awesome, I've got everything!

Great. ISP can now reach the public server on its directly connected network.

ⓧ I'd like to double check the full code

Compare the complete ISP configuration with the reference below.

enable
configure terminal
hostname ISP
interface GigabitEthernet0/0
 ip address 203.0.113.1 255.255.255.252
 no shutdown
interface GigabitEthernet0/1
 ip address 198.51.100.1 255.255.255.0
 no shutdown
end
Build the outside route and translation boundary

A static route sends destinations that EDGE does not know toward ISP. This creates the outside path.

NAT marks the inside and outside interfaces. PAT uses an access control list to decide which private addresses can share EDGE's WAN address.

  • Switch back to the EDGE command-line panel.
  • Configure the WAN interface and default route by entering:
enable
configure terminal
interface GigabitEthernet0/0
 ip address 203.0.113.2 255.255.255.252
 no shutdown
ip route 0.0.0.0 0.0.0.0 203.0.113.1
end

How does the outside path work?

  • The address 203.0.113.2 places EDGE on the routed WAN link.
  • The next hop 203.0.113.1 sends unknown destinations to ISP.
  • The default route lets EDGE reach the public server network without adding a separate route for every outside subnet.

Before you test EDGE, do you expect the new default route to carry traffic to the public server?

  • Test the outside route and inspect the routing table by running:
ping 198.51.100.10
show ip route

What do these checks prove?

  • The ping proves that EDGE can send traffic through ISP to the public server.
  • The routing table shows the connected WAN network plus the default path through 203.0.113.1.

You should receive replies from the public server. You should also see a default route pointing to 203.0.113.1.

EDGE cannot reach the server?

  • Check that EDGE GigabitEthernet0/0 uses 203.0.113.2 with the 255.255.255.252 mask.
  • Check that ISP GigabitEthernet0/0 uses 203.0.113.1.
  • Repeat the ping once to allow address resolution to complete.
  • Help me troubleshoot the EDGE outside route.

The outside route works for EDGE itself. Client traffic now needs an inside role, an outside role, and an overload rule.

  • Add the NAT interface roles and PAT rule by entering:
enable
configure terminal
interface GigabitEthernet0/0
 ip nat outside
interface GigabitEthernet0/1
 ip nat inside
access-list 1 permit 10.10.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
end

How does the translation rule work?

  • EDGE treats GigabitEthernet0/1 as the private side of the translation boundary.
  • EDGE treats GigabitEthernet0/0 as the public side of the translation boundary.
  • ACL 1 matches every client network inside 10.10.0.0/16.
  • The overload rule translates matching traffic to 203.0.113.2.
  • Inspect the configured NAT boundary by running:
show ip nat statistics

What does this output confirm?

The statistics identify the inside and outside interfaces used by NAT. Active translations remain empty until matching client traffic crosses EDGE.

You should see GigabitEthernet0/1 as the inside interface. You should see GigabitEthernet0/0 as the outside interface.

NAT roles missing?

  • Check that the private link on EDGE is GigabitEthernet0/1.
  • Check that the ISP-facing link on EDGE is GigabitEthernet0/0.
  • Check that ACL 1 matches 10.10.0.0 with wildcard mask 0.0.255.255.
  • Help me check my NAT and PAT configuration.

✔️ Awesome, I've got everything!

Your EDGE router now has its inside boundary, outside boundary, PAT rule, and default route.

ⓧ I'd like to double check the full code

Compare the complete EDGE configuration with the reference below.

enable
configure terminal
hostname EDGE
ip dhcp excluded-address 10.10.10.1 10.10.10.20
ip dhcp excluded-address 10.10.20.1 10.10.20.20
ip dhcp excluded-address 10.10.30.1 10.10.30.20
ip dhcp excluded-address 10.10.40.1 10.10.40.20
ip dhcp pool GAMING_A
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
ip dhcp pool GAMING_B
 network 10.10.20.0 255.255.255.0
 default-router 10.10.20.1
ip dhcp pool WIFI_GUEST
 network 10.10.30.0 255.255.255.0
 default-router 10.10.30.1
ip dhcp pool STAFF
 network 10.10.40.0 255.255.255.0
 default-router 10.10.40.1
interface GigabitEthernet0/0
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 no shutdown
interface GigabitEthernet0/1
 ip address 10.255.0.1 255.255.255.252
 ip nat inside
 no shutdown
access-list 1 permit 10.10.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 10.10.0.0 255.255.0.0 10.255.0.2
ip route 0.0.0.0 0.0.0.0 203.0.113.1
end
Prove the complete path and save the lab

A PAT entry appears when matching inside traffic crosses EDGE. Testing from PC-A proves the client gateway, inter-VLAN path, outside route, and translation rule as one complete chain.

  • Select PC-B in the topology.
  • Use its current IP settings to record the leased address here: 10.10.20.x.
  • Select PC-A in the topology.
  • Open PC-A's command-line panel.

Before you run the checks, which destination do you expect to create a PAT translation on EDGE?

  • Test the gateway, PC-B, and public server by running:
ping 10.10.10.1
ping [[PC_B_ADDRESS="10.10.20.x"]]
ping 198.51.100.10

What does this sequence prove?

  • The first ping proves that PC-A can reach its SVI gateway.
  • The second ping proves that inter-VLAN routing still reaches PC-B.
  • The third ping sends private client traffic across EDGE to the public server.

You should receive replies from all three destinations. Repeat a ping once if its first echo is lost during address resolution.

One of the pings failing?

  • Check PC-A's current lease if its gateway ping fails.
  • Check that you entered PC-B's current leased address if only the inter-VLAN ping fails.
  • Check the EDGE default route and NAT roles if only the public-server ping fails.
  • Help me isolate the failed ping.
  • Return to the EDGE command-line panel immediately after the public-server ping.

Before you inspect EDGE, where do you expect PC-A's private address to appear in the translation table?

  • Inspect the active translation and final router state by running:
show ip route
show ip nat translations
show ip nat statistics

What should the final checks show?

  • The routing table contains the internal summary route plus the default route through ISP.
  • The translation table maps PC-A's inside-local address to 203.0.113.2.
  • The NAT statistics report active PAT activity created by the public-server ping.

That translation is the proof you were building toward. PC-A has reached 198.51.100.10 through EDGE's single translated WAN address.

Translation table empty?

  • Repeat the public-server ping from PC-A.
  • Return to EDGE immediately after the replies arrive.
  • Check that PC-A's address belongs to the 10.10.0.0/16 range matched by ACL 1.
  • Help me find the missing PAT translation.

Your live configuration works. Saving each device to startup configuration protects the router and switch commands, while saving the workspace preserves the topology.

  • Run the save command on CORE-MLS.
  • Run the same save command on ACCESS-A.
  • Run the same save command on ACCESS-B.
  • Run the same save command on EDGE.
  • Run the same save command on ISP.
copy running-config startup-config

Why save twice?

The command stores each Cisco device's active configuration in its startup configuration. The Packet Tracer workspace save stores the device layout plus the complete lab file.

  • Press Enter when each device asks you to accept the default destination.
  • Save the Packet Tracer workspace as gaming-center-network.pkt.
  • Confirm that gaming-center-network.pkt remains in its saved location.

Configuration not saving?

  • Check that you ran the command from privileged EXEC mode on each Cisco device.
  • Accept the default destination when the device asks for confirmation.
  • Save the Packet Tracer workspace separately after every device configuration is stored.
  • Help me save my Cisco device configurations and Packet Tracer file.

You have the complete internet edge working. Every client VLAN can now reach the public server through EDGE's translated WAN address.

Secret mission

Protect the Staff VLAN

Your routed gaming center currently lets gaming clients reach staff devices. Add an extended ACL that blocks both gaming VLANs from the staff network while preserving access to the simulated public server.

Clean Up Your Resources

Clean Up Your Resources

This local simulation creates no ongoing costs. Decide whether to keep the finished lab, close Cisco Packet Tracer for later, or remove the file entirely.

Resources you used:

  • The local gaming-center-network.pkt file containing the complete gaming center topology plus every saved device configuration.

Keep everything running

No action needed. Choose this if you are still testing the network or want to extend the lab.

  • Keep gaming-center-network.pkt in its current location on your Mac.
  • Leave Cisco Packet Tracer open while you continue testing the saved topology.

Pause - I'll come back to this later

Stop the simulation while preserving the full lab for later. Your startup configurations remain stored inside the saved workspace.

  • Return to the CLI on ISP, EDGE, CORE-MLS, ACCESS-A, and ACCESS-B.
  • Save each device's current running configuration by entering this command:
copy running-config startup-config

What does this command do?

  • The copy running-config startup-config command stores each device's current Cisco IOS configuration as its startup configuration.
  • Saving gaming-center-network.pkt afterward preserves the topology plus those configurations in one workspace file.
  • Confirm that each device returns to its CLI prompt without reporting a save error.

Configuration not saving?

Confirm that the device CLI is in privileged EXEC mode before entering the command. Help me save the Cisco IOS configuration.

  • Save gaming-center-network.pkt again.
  • Close Cisco Packet Tracer.

Delete - I don't want to use this again

Remove all project resources to start fresh. The deletion is limited to gaming-center-network.pkt, but it removes the full topology plus every saved device configuration.

  • Close Cisco Packet Tracer.
  • Use the search field in Finder to locate gaming-center-network.pkt on your Mac.
  • Select gaming-center-network.pkt in the search results.
  • Move the selected file to your Mac's trash.
  • Empty your Mac's trash to remove the file permanently.
  • Search for gaming-center-network.pkt again to confirm that the local project file is gone.

Nice Work!

Nice Work!

You did it! You built a segmented gaming center network in Cisco Packet Tracer that keeps traffic moving after a member-link failure.

You've learned how to:

  • Designed a hierarchical topology with five VLANs that separate two gaming zones, guest Wi-Fi, staff Wi-Fi, and device management.
  • Built two LACP EtherChannels that keep same-VLAN traffic flowing when one physical uplink member is disconnected.
  • Connected all four client networks to 198.51.100.10 through SVI gateways, DHCP relay, static routing, and PAT.
  • Completed the optional Secret Mission by applying the extended ACL BLOCK_GAMES_TO_STAFF to block gaming traffic from the staff VLAN while preserving public-server access.

Ready to quiz yourself?