Multi-Site Enterprise Network

Build a segmented enterprise network with VLANs, OSPF routing, and ACL security.

Introduction

30 Second Summary

Every time you send an email at work or access a shared drive, your traffic flows through a network that keeps departments separated, routes data between offices, and blocks unauthorized access. Someone had to design and configure all of that.

In this project, you will build a multi-site enterprise network from scratch using Cisco Packet Tracer. You will segment departments into VLANs, configure dynamic routing between two office sites, and enforce security policies with access control lists.

What You'll Build

A simulated enterprise network spanning two sites (HQ and Branch) with department segmentation, dynamic routing via OSPF, and a security policy enforced by an ACL.

By the end of this project, you'll have:

  • A working inter-VLAN routing setup at HQ using router-on-a-stick, allowing Sales and Engineering departments to communicate through a single router.
  • A single-area OSPF configuration that dynamically discovers routes between HQ and Branch so both sites can reach each other without manually entered static routes.
  • An extended ACL security policy that blocks Branch users from accessing sensitive Engineering resources while still permitting access to Sales.
  • Secret Mission: Expand the network with multi-area OSPF by adding a second Branch in a separate OSPF area with inter-area route summarization.

Are there any prerequisites?

You need a basic understanding of IP addresses and subnet masks, and familiarity with typing commands in a CLI. You also need Cisco Packet Tracer installed (version 8.2.2 or later) with a free SkillsForAll.com or NetAcad account.

Build the Network Topology

Every enterprise network begins as a physical layout. You need routers to connect sites together, switches to connect devices within each site, and cables linking everything.

In this step, you'll build a two-site topology in Cisco Packet Tracer. The headquarters (HQ) site gets a router, a switch, and four PCs. The Branch site gets a router, a switch, and two PCs.

In this step, get ready to:
  • Place routers, switches, and PCs on the workspace.
  • Cable all devices together with the correct port connections.
  • Assign static IP addresses and default gateways to all six PCs.
Place network devices on the workspace

Your topology needs two Cisco 2911 routers (one per site), two Cisco 2960 switches (one per site), and six generic PCs split between the sites.

  • Open Cisco Packet Tracer.
  • In the bottom-left device panel, click the Network Devices category (the icon that looks like a router).
  • Click the Routers subcategory.
  • Find 2911 in the device list and drag it onto the left side of the workspace.
  • Drag a second 2911 router onto the right side of the workspace.
  • Click the Switches subcategory.
  • Find 2960 and drag one switch below the left router, and another below the right router.
  • Click the End Devices category (the icon that looks like a PC monitor).
  • Drag four PC devices below the left switch (these are the HQ PCs).
  • Drag two PC devices below the right switch (these are the Branch PCs).

Now rename each device so the topology is easy to read.

  • Click the text label below the left router and rename it to HQ-R1.
  • Rename the right router to BR-R1.
  • Rename the left switch to HQ-SW1.
  • Rename the right switch to BR-SW1.
  • Rename the four HQ PCs to PC1, PC2, PC3, and PC4 (left to right).
  • Rename the two Branch PCs to PC5 and PC6.

Why this layout?

HQ has four PCs because it hosts two departments (Sales and Engineering) with two PCs each. The Branch office has a single department (Staff) with two PCs.

Keeping HQ devices on the left and Branch devices on the right makes your topology visually match a real network diagram.

Cable all devices using copper straight-through cables

Cables define which devices can talk to each other and which specific ports they use. The port numbers matter because later steps reference them when configuring VLANs and trunking.

  • Click the Connections category in the bottom-left panel (the lightning bolt icon).
  • Select Copper Straight-Through (the solid black line).

Now connect each pair of devices using the exact ports listed below.

  • Click HQ-SW1 and select port FastEthernet0/1. Then click HQ-R1 and select port GigabitEthernet0/0.
  • Click HQ-R1 and select port GigabitEthernet0/1. Then click BR-R1 and select port GigabitEthernet0/1. This is the WAN link between sites.
  • Click BR-SW1 and select port FastEthernet0/1. Then click BR-R1 and select port GigabitEthernet0/0.
  • Click PC1 and select FastEthernet0. Then click HQ-SW1 and select FastEthernet0/2.
  • Connect PC2 (FastEthernet0) to HQ-SW1 port FastEthernet0/3.
  • Connect PC3 (FastEthernet0) to HQ-SW1 port FastEthernet0/4.
  • Connect PC4 (FastEthernet0) to HQ-SW1 port FastEthernet0/5.
  • Connect PC5 (FastEthernet0) to BR-SW1 port FastEthernet0/2.
  • Connect PC6 (FastEthernet0) to BR-SW1 port FastEthernet0/3.

After a few seconds, the link lights on all switch-to-PC connections should turn green. The router links will stay red/orange because the router interfaces are administratively shut down by default.

Why are the router link lights red?

Cisco routers ship with all interfaces in a "shutdown" state. You'll enable them in Step 3 when you configure IP addresses on the router interfaces. For now, the red lights are expected.

Don't see a port in the list?

If a port doesn't appear when you click a device, it's already in use by another cable. Double-check which port you selected on the previous connection. You can delete a cable by clicking it and pressing the Delete key.

If you see no GigabitEthernet ports on a router, make sure you placed a 2911 model (not a 1941 or 2901 which have fewer ports).

Help me troubleshoot my Packet Tracer cabling

Assign static IP addresses to all PCs

Each PC needs an IP address and a default gateway so it knows where to send traffic destined for other networks. The gateway address will point to the router interface serving that PC's subnet.

You'll configure PC1 first with detailed steps. The remaining PCs follow the same process with different values.

  • Click on PC1 to open its configuration window.
  • Click the Desktop tab at the top.
  • Click IP Configuration.
  • Make sure Static is selected (not DHCP).
  • Enter 192.168.10.10 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 192.168.10.1 in the Default Gateway field.
  • Close the PC1 window.

Repeat the same process for the remaining five PCs using these values:

  • PC2: IP 192.168.10.11, Subnet Mask 255.255.255.0, Gateway 192.168.10.1.
  • PC3: IP 192.168.20.10, Subnet Mask 255.255.255.0, Gateway 192.168.20.1.
  • PC4: IP 192.168.20.11, Subnet Mask 255.255.255.0, Gateway 192.168.20.1.
  • PC5: IP 192.168.30.10, Subnet Mask 255.255.255.0, Gateway 192.168.30.1.
  • PC6: IP 192.168.30.11, Subnet Mask 255.255.255.0, Gateway 192.168.30.1.

What's the pattern in these addresses?

PC1 and PC2 are in the 192.168.10.0/24 subnet. These are the Sales department PCs. PC3 and PC4 are in the 192.168.20.0/24 subnet for the Engineering department. PC5 and PC6 are in the 192.168.30.0/24 subnet at the Branch office.

Each subnet's gateway (.1 address) will be configured on the router in Step 3. For now, the PCs just know where to send traffic. The router that actually answers at that gateway address doesn't exist yet.

  • Save your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Name the file something memorable like enterprise-network.pkt and save it to your Desktop.
  • To verify a PC's IP, click on any PC, go to Desktop > IP Configuration, and confirm the address matches the values above.

IP address not saving?

Make sure you selected Static instead of DHCP. If DHCP is selected, the fields will be grayed out and your typed values won't stick.

Double-check that you haven't accidentally swapped the subnet mask and gateway fields. The subnet mask is always 255.255.255.0 for all PCs in this project.

Help me fix my PC IP configuration in Packet Tracer

Your physical topology is complete. All devices are placed, cabled, and addressed. Next up, you'll configure VLANs on the switches to logically separate Sales and Engineering traffic at HQ.

Configure VLANs and Trunking on the Switches

Your topology is built and every PC has an IP address. Now it's time to create logical boundaries between departments so their traffic stays separate.

VLANs let you segment a single physical switch into multiple isolated broadcast domains. Without them, every device on HQ-SW1 shares the same network, meaning Sales traffic would flood Engineering ports and vice versa.

In this step, get ready to:
  • Create VLANs for Sales, Engineering, and Staff departments.
  • Assign switch ports to the correct VLANs.
  • Configure an 802.1Q trunk link between HQ-SW1 and HQ-R1.
Create VLANs and assign access ports on HQ-SW1

HQ has two departments that need their own network segment: Sales (VLAN 10) and Engineering (VLAN 20). You'll create both VLANs on HQ-SW1, then assign each PC's port to the correct VLAN.

  • Click on HQ-SW1 in your Packet Tracer workspace.
  • Click the CLI tab to open the switch's command line.
  • Enter privileged exec mode and global configuration by running these commands:
enable
configure terminal

! Create VLAN 10 for the Sales department
vlan 10
name Sales
exit

! Create VLAN 20 for the Engineering department
vlan 20
name Engineering
exit

What does this code do?

Each VLAN gets a numeric ID and a descriptive name. The ID is what the switch uses internally to tag frames. The name is just for your reference when reading configurations.

  • enable moves from user mode to privileged exec mode (full access).
  • configure terminal enters global configuration mode where you can make changes.
  • vlan 10 creates VLAN 10 and enters VLAN config mode for it.
  • name Sales assigns the human-readable name.

You won't see a visible change yet. The VLANs are created but no ports are assigned to them. The next commands handle port assignment.

  • Assign PC1 and PC2's ports (Fa0/2 and Fa0/3) to VLAN 10, and PC3 and PC4's ports (Fa0/4 and Fa0/5) to VLAN 20 by running these commands:
! Assign Fa0/2 and Fa0/3 to VLAN 10 (Sales)
interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 10
exit

! Assign Fa0/4 and Fa0/5 to VLAN 20 (Engineering)
interface range FastEthernet0/4-5
switchport mode access
switchport access vlan 20
exit

What are access ports?

An access port belongs to exactly one VLAN and carries traffic for that VLAN only. End devices like PCs always connect to access ports.

  • interface range FastEthernet0/2-3 selects multiple ports at once so you can configure them together.
  • switchport mode access tells the port it connects to a single end device, not another switch.
  • switchport access vlan 10 assigns the port to VLAN 10.
  • Verify your VLAN and port assignments by running this command:
end
show vlan brief

You should see VLAN 10 (Sales) with ports Fa0/2 and Fa0/3 listed, and VLAN 20 (Engineering) with ports Fa0/4 and Fa0/5 listed.

VLANs showing but ports still in VLAN 1?

  • Check for typos in the VLAN number. If you typed switchport access vlan 100 instead of vlan 10, the port will be assigned to a non-existent VLAN and stay inactive.
  • Make sure you included switchport mode access before the VLAN assignment. Without it, the port may negotiate a different mode.

Help me troubleshoot why my switch ports are not showing up in the correct VLAN after running show vlan brief on HQ-SW1.

Configure the trunk port on HQ-SW1

HQ-SW1's Fa0/1 port connects to HQ-R1, the router that will handle traffic between VLANs. A trunk port carries traffic for multiple VLANs over a single physical link using 802.1Q tagging.

  • Configure Fa0/1 as a trunk port that allows only VLANs 10 and 20 by running these commands:
configure terminal

! Configure the uplink to HQ-R1 as a trunk port
interface FastEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
exit

What does this code do?

A trunk link tags each frame with its VLAN ID so the router knows which VLAN the traffic belongs to. Restricting the allowed VLANs to 10 and 20 is a security best practice. It prevents VLAN hopping attacks by blocking any unexpected VLAN traffic from crossing the link.

  • Verify the trunk is working by running:
end
show interfaces trunk

You should see Fa0/1 listed as a trunk port with 802.1q encapsulation and VLANs 10 and 20 in the allowed list.

No trunk showing up?

  • If the output is empty, double check that you typed switchport mode trunk on Fa0/1. Without that command, the port stays in access mode and won't appear in the trunk list.
  • Make sure the cable between HQ-SW1 Fa0/1 and HQ-R1 GigabitEthernet0/0 is still connected. A disconnected port won't show trunking status.

Help me figure out why my trunk port is not showing in the show interfaces trunk output.

Why restrict VLANs on the trunk?

By default, a trunk allows all VLANs (1-4094). Explicitly allowing only VLANs 10 and 20 reduces your attack surface. If someone creates an unauthorized VLAN, its traffic won't reach the router.

✔️ Awesome, I've got everything!

Great. Make sure you've saved your progress in Packet Tracer before moving on.

ⓧ I'd like to double check the full code

Here is the complete configuration you should have entered on HQ-SW1:

enable
configure terminal

vlan 10
name Sales
exit

vlan 20
name Engineering
exit

interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 10
exit

interface range FastEthernet0/4-5
switchport mode access
switchport access vlan 20
exit

interface FastEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
exit

end
Configure BR-SW1 with VLAN 30 and access ports

The Branch office has a simpler setup. All Branch PCs belong to one department (Staff), so BR-SW1 only needs a single VLAN. Since there is only one VLAN, the uplink to BR-R1 uses a regular access port instead of a trunk.

  • Click on BR-SW1 in your Packet Tracer workspace.
  • Click the CLI tab.
  • Create VLAN 30, assign all ports, and configure the uplink by running these commands:
enable
configure terminal

! Create VLAN 30 for Branch staff
vlan 30
name Staff
exit

! Assign PC ports to VLAN 30
interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 30
exit

! Assign the uplink to BR-R1 as an access port in VLAN 30
interface FastEthernet0/1
switchport mode access
switchport access vlan 30
exit

Why is the uplink an access port here?

Trunk ports are needed only when multiple VLANs must cross a single link. BR-SW1 has just one VLAN (30), so there is nothing to tag. Setting Fa0/1 as a regular access port in VLAN 30 keeps the configuration simple and avoids unnecessary trunking overhead.

  • Verify your configuration by running:
end
show vlan brief

You should see VLAN 30 (Staff) with ports Fa0/1, Fa0/2, and Fa0/3 listed.

Fa0/1 not appearing in VLAN 30?

  • If Fa0/1 still appears under VLAN 1 in the output, re-enter global config and run the switchport access vlan 30 command on that interface specifically.
  • Make sure you did not accidentally type switchport mode trunk on Fa0/1. Trunk ports do not appear in the show vlan brief output.

Help me troubleshoot why Fa0/1 on BR-SW1 is not showing in VLAN 30.

✔️ Awesome, I've got everything!

Great. Save your Packet Tracer file before continuing.

ⓧ I'd like to double check the full code

Here is the complete configuration you should have entered on BR-SW1:

enable
configure terminal

vlan 30
name Staff
exit

interface range FastEthernet0/2-3
switchport mode access
switchport access vlan 30
exit

interface FastEthernet0/1
switchport mode access
switchport access vlan 30
exit

end

Both switches are now segmented into their respective VLANs. Next up, you'll configure HQ-R1 to route traffic between VLAN 10 and VLAN 20 using subinterfaces. This is the "router-on-a-stick" pattern that makes inter-VLAN communication possible.

Configure Router-on-a-Stick and WAN Interfaces

Your switches now know which ports belong to which VLANs. PCs in VLAN 10 can talk to each other, and PCs in VLAN 20 can talk to each other. But traffic between VLANs is completely blocked because Layer 2 switches do not route between broadcast domains.

To solve this, you will configure router-on-a-stick on HQ-R1. This technique uses a single physical interface split into virtual subinterfaces, one per VLAN, so the router can route traffic between VLANs over a single trunk link. You will also configure the WAN link connecting HQ to the Branch site.

In this step, get ready to:
  • Configure subinterfaces on HQ-R1 for inter-VLAN routing.
  • Configure the WAN link between HQ-R1 and BR-R1, and the Branch LAN interface.
  • Verify that PCs in different VLANs can ping each other through the router.
Configure subinterfaces on HQ-R1 for inter-VLAN routing

Router-on-a-stick works by creating virtual subinterfaces on a single physical port. Each subinterface is assigned to a VLAN using 802.1Q encapsulation and gets its own IP address, which becomes the default gateway for that VLAN's PCs.

  • Click on HQ-R1 in your topology to open its properties.
  • Select the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode by running these commands:
enable
configure terminal
  • Enable the physical GigabitEthernet0/0 interface without assigning an IP address by running these commands:
! Enable the physical interface (no IP here - subinterfaces get the IPs)
interface GigabitEthernet0/0
no shutdown
exit

Why no IP address on the physical interface?

In router-on-a-stick, the physical interface acts as a carrier for tagged VLAN traffic. Each subinterface handles a specific VLAN's traffic, so the IP addresses go on the subinterfaces instead.

  • Create the subinterface for VLAN 10 (Sales) by running these commands:
! Subinterface for VLAN 10 (Sales)
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

What does this code do?

The interface GigabitEthernet0/0.10 command creates a virtual subinterface. The .10 is just a label that matches the VLAN number for readability.

The encapsulation dot1Q 10 command tells the router to tag traffic on this subinterface with VLAN 10. The IP address becomes the default gateway for all PCs in VLAN 10.

  • Create the subinterface for VLAN 20 (Engineering) by running these commands:
! Subinterface for VLAN 20 (Engineering)
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

What does this code do?

This follows the same pattern as the VLAN 10 subinterface. The encapsulation dot1Q 20 tags traffic for VLAN 20, and 192.168.20.1 becomes the default gateway for Engineering PCs.

  • Verify the subinterfaces are up by running:
do show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all showing up in both the Status and Protocol columns.

Seeing 'administratively down' on GigabitEthernet0/0?

Make sure you ran no shutdown on the physical GigabitEthernet0/0 interface. Subinterfaces inherit the physical interface's state, so if the physical port is down, all subinterfaces stay down too.

Help me figure out why my subinterfaces are down on HQ-R1.

Configure the WAN link and Branch router interfaces

HQ-R1 can now route between VLANs, but it still cannot reach the Branch site. You need to configure the point-to-point WAN link between the two routers and set up BR-R1's LAN interface.

  • On HQ-R1 (you should still be in global configuration mode), configure the WAN interface by running these commands:
! WAN link to Branch (point-to-point /30 subnet)
interface GigabitEthernet0/1
ip address 10.0.0.1 255.255.255.252
no shutdown
exit

Why a /30 subnet for the WAN link?

A /30 subnet provides exactly 2 usable host addresses, which is all you need for a point-to-point link between two routers. This is a best practice for conserving IP address space on WAN connections.

  • Close the HQ-R1 CLI window.
  • Click on BR-R1 in your topology to open its properties.
  • Select the CLI tab.
  • Enter privileged EXEC mode and global configuration mode by running:
enable
configure terminal
  • Configure BR-R1's WAN interface (the other end of the link to HQ) by running these commands:
! WAN link to HQ (other end of the /30 subnet)
interface GigabitEthernet0/1
ip address 10.0.0.2 255.255.255.252
no shutdown
exit
  • Configure BR-R1's LAN interface (connecting to the Branch switch and VLAN 30) by running these commands:
! LAN interface for Branch Staff network
interface GigabitEthernet0/0
ip address 192.168.30.1 255.255.255.0
no shutdown
exit

Why no subinterfaces on BR-R1?

The Branch only has one VLAN (Staff, VLAN 30). Router-on-a-stick is only needed when a single physical link must carry traffic for multiple VLANs. With one VLAN, a simple routed interface with a directly assigned IP address is all you need.

  • Verify BR-R1's interfaces are up by running:
do show ip interface brief

You should see GigabitEthernet0/0 and GigabitEthernet0/1 both showing up in both Status and Protocol columns.

Interfaces showing 'down' on BR-R1?

Check that you ran no shutdown on both interfaces. Also confirm the cables are connected correctly in the topology. GigabitEthernet0/1 should connect to HQ-R1's GigabitEthernet0/1, and GigabitEthernet0/0 should connect to BR-SW1's Fa0/1.

Help me troubleshoot my BR-R1 interfaces showing as down.

Verify inter-VLAN routing at HQ

The real test of router-on-a-stick is whether PCs in different VLANs can now communicate through the router. PC1 is in VLAN 10 (Sales) and PC3 is in VLAN 20 (Engineering). If the subinterfaces are working, a ping between them should succeed.

  • Close the BR-R1 CLI window.
  • Click on PC1 in your topology.
  • Select the Desktop tab.
  • Click Command Prompt.
  • Ping PC3 (in VLAN 20) by running:
ping 192.168.20.10

First ping might timeout

The first one or two ping packets may show Request timed out. This is normal. The router and switch need to learn MAC addresses through ARP before forwarding frames. Subsequent pings should show replies.

You should see replies from 192.168.20.10 with a message like Reply from 192.168.20.10: bytes=32 time<1ms TTL=127. At least 3 out of 4 pings should succeed.

  • Now confirm the subinterface status on HQ-R1. Click on HQ-R1 and select the CLI tab.
  • Run this command from any mode (privileged EXEC or higher):
show ip interface brief

You should see all four entries showing up in both columns: GigabitEthernet0/0 (no IP, which is expected), GigabitEthernet0/0.10 with 192.168.10.1, GigabitEthernet0/0.20 with 192.168.20.1, and GigabitEthernet0/1 with 10.0.0.1.

Ping from PC1 to PC3 failing completely?

Check that PC1's default gateway is set to 192.168.10.1 and PC3's default gateway is set to 192.168.20.1. Without the correct gateway, PCs cannot send traffic to the router.

Also confirm that HQ-SW1's trunk port (Fa0/1) allows VLANs 10 and 20. If the trunk is misconfigured, tagged frames from the router's subinterfaces will be dropped by the switch.

Help me debug why my inter-VLAN ping is failing between PC1 and PC3.

✔️ Awesome, I've got everything!

Great. Double check you have saved your Packet Tracer topology file before moving on.

ⓧ I'd like to double check the full configuration

Here is the full configuration you should have on HQ-R1 at this point:

! HQ-R1 Configuration
! Physical interface - no IP, just enabled
interface GigabitEthernet0/0
 no shutdown

! Subinterface for VLAN 10 (Sales)
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0

! Subinterface for VLAN 20 (Engineering)
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0

! WAN link to Branch
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
 no shutdown

And here is the full configuration you should have on BR-R1:

! BR-R1 Configuration
! WAN link to HQ
interface GigabitEthernet0/1
 ip address 10.0.0.2 255.255.255.252
 no shutdown

! LAN interface for Branch Staff network
interface GigabitEthernet0/0
 ip address 192.168.30.1 255.255.255.0
 no shutdown

Inter-VLAN routing is working at HQ, and both sites have their interfaces up. Next, you will configure OSPF so the routers can dynamically discover each other's networks and route traffic between sites.

Configure Single-Area OSPF

Inter-VLAN routing works at HQ, but try pinging from a Branch PC to an HQ PC right now. It fails. Neither router knows about the other site's networks, so packets have nowhere to go.

You could add static routes manually, but that does not scale. Instead, you will enable OSPF, a dynamic routing protocol that lets routers discover each other and automatically share their connected networks.

In this step, get ready to:
  • Enable OSPF on HQ-R1 and advertise all connected networks.
  • Enable OSPF on BR-R1 to form an adjacency with HQ-R1.
  • Verify cross-site connectivity from Branch to HQ.
Enable OSPF on HQ-R1 and advertise all networks

OSPF needs two things on each router: a process ID to start the protocol, and network statements that tell OSPF which interfaces to activate on. The wildcard mask in each network statement works like an inverted subnet mask.

  • Click on HQ-R1 and open the CLI tab.
  • Enter OSPF configuration mode and advertise all three networks by typing the following commands:
enable
configure terminal
! Start OSPF process 1 and enter router config mode
router ospf 1
! Advertise the Sales VLAN subnet
network 192.168.10.0 0.0.0.255 area 0
! Advertise the Engineering VLAN subnet
network 192.168.20.0 0.0.0.255 area 0
! Advertise the WAN link between HQ and Branch
network 10.0.0.0 0.0.0.3 area 0
end

What do these commands do?

router ospf 1 starts OSPF process 1 on this router. The process ID (1) is locally significant. It does not need to match the other router, but using the same number is convention.

Each network statement tells OSPF to activate on interfaces matching that IP range. The wildcard mask 0.0.0.255 matches a /24 subnet. The wildcard 0.0.0.3 matches a /30 subnet (only 4 addresses).

area 0 places all interfaces in the backbone area. Single-area OSPF uses area 0 for everything.

You will not see any adjacency messages yet. HQ-R1 is sending OSPF hello packets on the WAN link, but BR-R1 is not running OSPF to respond.

Seeing an error when entering commands?

  • If you see Invalid input detected, make sure you are in global configuration mode (the prompt should show HQ-R1(config)#) before typing router ospf 1.
  • If you see % Incomplete command, check that each network statement has all four parts: the network address, the wildcard mask, the word area, and the area number 0.

Help me troubleshoot my OSPF configuration on HQ-R1

Enable OSPF on BR-R1 and advertise all networks

Now that HQ-R1 is sending hello packets on the WAN link, enabling OSPF on BR-R1 will trigger an adjacency. Both routers will exchange their routing tables automatically.

  • Click on BR-R1 and open the CLI tab.
  • Enable OSPF and advertise both connected networks by typing the following commands:
enable
configure terminal
! Start OSPF process 1
router ospf 1
! Advertise the Branch Staff subnet
network 192.168.30.0 0.0.0.255 area 0
! Advertise the WAN link
network 10.0.0.0 0.0.0.3 area 0
end

What should I see?

After you type the second network statement, you should see a log message similar to:

%OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on GigabitEthernet0/1 from LOADING to FULL

This means the two routers have successfully formed an OSPF adjacency and exchanged their complete routing databases. FULL state is the goal.

No adjacency message appeared?

  • Confirm both routers have the WAN link network statement: network 10.0.0.0 0.0.0.3 area 0. OSPF forms adjacencies over shared links.
  • Check that the WAN interfaces are both up. On each router, run show ip interface brief and verify Gi0/1 shows up/up.
  • Ensure both sides use the same area. If one router advertises the WAN in area 0 and the other in area 1, they will not become neighbors.

Help me figure out why my OSPF adjacency is not forming

Verify OSPF operation and end-to-end connectivity

The adjacency message is a good sign, but you should confirm the routing tables actually have the remote networks before testing with a ping.

  • On HQ-R1's CLI, verify the neighbor relationship by typing:
show ip ospf neighbor

You should see BR-R1 listed with a state of FULL. This confirms both routers have exchanged their complete link-state databases.

  • Check what routes OSPF has learned by typing:
show ip route ospf

What should I see in the routing table?

On HQ-R1, you should see a route marked with O (indicating OSPF-learned) pointing to 192.168.30.0/24 via 10.0.0.2. This means HQ-R1 now knows how to reach the Branch network.

On BR-R1, running the same command would show O routes for 192.168.10.0/24 and 192.168.20.0/24 via 10.0.0.1. Both sites now have full reachability.

  • Now test real traffic. Click on PC5 (Branch, 192.168.30.10).
  • Open the Desktop tab, then click Command Prompt.
  • Ping PC1 in the Sales VLAN at HQ by typing:
ping 192.168.10.10

What about the first ping timeout?

The first ping in the set of four may show Request timed out. This is normal. The router needs to perform ARP resolution to map the next-hop IP to a MAC address, which takes longer than the first ping's timeout.

The remaining pings (3 out of 4) should show Reply from 192.168.10.10. That confirms full cross-site connectivity through OSPF.

All pings failing from PC5?

  • Verify PC5's default gateway is set to 192.168.30.1. Without a gateway, the PC cannot send traffic to remote subnets.
  • On BR-R1, run show ip route and confirm you see O routes for the 192.168.10.0 and 192.168.20.0 networks. If not, re-check your OSPF network statements.
  • Check that HQ-R1's subinterfaces are still up. Run show ip interface brief on HQ-R1 and confirm Gi0/0.10 and Gi0/0.20 both show up/up.

Help me troubleshoot why my Branch PC cannot ping HQ

✔️ My pings are succeeding

Excellent. Your two sites are now dynamically routing traffic through OSPF. Save your Packet Tracer file.

ⓧ I'd like to double check the full configuration

Compare your OSPF configuration on both routers against the reference below.

! ==============================
! HQ-R1 OSPF Configuration
! ==============================
enable
configure terminal
router ospf 1
network 192.168.10.0 0.0.0.255 area 0
network 192.168.20.0 0.0.0.255 area 0
network 10.0.0.0 0.0.0.3 area 0
end

! ==============================
! BR-R1 OSPF Configuration
! ==============================
enable
configure terminal
router ospf 1
network 192.168.30.0 0.0.0.255 area 0
network 10.0.0.0 0.0.0.3 area 0
end

Both sites can now reach each other dynamically. Next up, you will lock down this connectivity with an ACL that blocks Branch users from accessing the Engineering VLAN while still allowing them into Sales.

Apply an Extended ACL for Security

Your network can now route traffic dynamically between HQ and Branch using OSPF. Every PC on either site can reach every other PC. That is great for connectivity, but terrible for security.

In a real enterprise, not every department should be reachable by every user. Branch staff have no business accessing Engineering resources at HQ. In this step, you will use an extended ACL to block Branch traffic from reaching the Engineering VLAN while still allowing access to Sales.

In this step, get ready to:
  • Design and create an extended ACL that denies Branch-to-Engineering traffic.
  • Apply the ACL to the correct interface and direction on HQ-R1.
  • Test the ACL by verifying blocked and permitted traffic from Branch.
Design and create the extended ACL on HQ-R1

Your security goal is simple: deny the Branch network (192.168.30.0/24) from reaching Engineering (192.168.20.0/24), but permit everything else. This requires matching both a source and a destination address in the same rule.

Why an extended ACL instead of a standard ACL?

Standard ACLs can only filter based on the source IP address. If you used a standard ACL to block Branch (192.168.30.0/24), you would block Branch from reaching ALL destinations, including Sales.

Extended ACLs match both source and destination, letting you write precise rules like "deny traffic FROM Branch TO Engineering only." This is why extended ACLs are the tool for granular security policies.

  • Click on HQ-R1 in your Packet Tracer topology.
  • Click the CLI tab.
  • Enter global configuration mode by running these commands:
enable
configure terminal
  • Create the extended ACL with a deny rule and a permit-all rule by running these commands:
access-list 100 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip any any

What do these commands do?

The first line creates ACL number 100 (extended ACLs use numbers 100-199). It denies all IP traffic where the source is 192.168.30.0/24 (Branch) and the destination is 192.168.20.0/24 (Engineering).

The 0.0.0.255 values are wildcard masks. They work like an inverted subnet mask, telling the router which bits to check (0 = must match) and which to ignore (255 = any value).

The second line permits all other traffic. Without it, the implicit "deny all" at the end of every ACL would block everything.

  • Confirm the ACL was created by running:
do show access-lists

You should see two lines under "Extended IP access list 100": the deny rule and the permit rule. The hit counters will both show 0 matches since no traffic has been filtered yet.

Not seeing the access list?

Make sure you are in global configuration mode (the prompt should show HQ-R1(config)#). If you see HQ-R1# without "(config)", type configure terminal first.

Check for typos in the wildcard masks. They should be 0.0.0.255 (not 255.255.255.0, which is the subnet mask). Help me troubleshoot my extended ACL creation.

Apply the ACL to the correct interface

An ACL does nothing until you apply it to an interface. For extended ACLs, the best practice is to apply them as close to the traffic source as possible. The closest point to Branch traffic entering HQ-R1 is the GigabitEthernet0/1 interface (the WAN link), in the inbound direction.

  • Apply ACL 100 inbound on the WAN interface by running these commands:
interface g0/1
ip access-group 100 in
exit

What does this do?

The ip access-group 100 in command tells the router to check every packet arriving on G0/1 against ACL 100 before routing it. The "in" keyword means traffic is filtered as it enters the interface. This stops denied Branch traffic before it ever reaches the Engineering subinterface.

Why inbound on G0/1 and not outbound on G0/0.20?

Applying the ACL inbound on G0/1 catches Branch traffic the moment it arrives at HQ-R1. The router does not waste processing cycles routing packets that will be dropped anyway. This "filter close to source" principle is the standard placement rule for extended ACLs.

  • Confirm the ACL is applied by running:
do show ip interface g0/1

Look for the line that says "Inbound access list is 100". This confirms ACL 100 is actively filtering inbound traffic on G0/1.

Inbound access list shows "not set"?

Make sure you entered the ip access-group 100 in command while inside the interface configuration for g0/1 (the prompt should show HQ-R1(config-if)#). If you ran it in global config mode, it would have been rejected.

Help me figure out why my ACL is not applied to the interface.

Test and verify ACL behavior

The ACL is live. Now you need to prove it works by testing two scenarios: a ping that should be blocked and a ping that should succeed.

  • Click on PC5 (Branch, 192.168.30.10) in your topology.
  • Click the Desktop tab, then click Command Prompt.
  • Test the blocked path by pinging Engineering (PC3) with this command:
ping 192.168.20.10

This ping should fail. You should see "Destination host unreachable" or "Request timed out" messages. The ACL is blocking Branch traffic destined for Engineering.

  • Now test the permitted path by pinging Sales (PC1) with this command:
ping 192.168.10.10

This ping should succeed with replies from 192.168.10.10. The ACL only blocks traffic to Engineering. All other traffic passes through the permit ip any any rule.

  • Click on HQ-R1 and open the CLI tab.
  • Verify the ACL hit counters by running:
show access-lists

You should see a match count next to the deny rule (showing packets were blocked) and a match count next to the permit rule (showing packets were allowed through). These hit counters confirm the ACL is actively filtering traffic.

What should I see in the output?

The output will look similar to this:

Extended IP access list 100
    10 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255 (4 match(es))
    20 permit ip any any (4 match(es))

Your exact match numbers will vary depending on how many pings you sent. The key point is that both lines show a non-zero count, proving both rules are being hit.

Pings to Engineering are still succeeding?

Double-check that you applied the ACL to g0/1 (the WAN interface) and not to g0/0 or a subinterface. Run show ip interface g0/1 and confirm it says "Inbound access list is 100".

Also verify the ACL direction is in, not out. If you accidentally applied it outbound, remove it with no ip access-group 100 out under the interface, then re-apply with ip access-group 100 in. Help me troubleshoot why my ACL is not blocking traffic.

✔️ Awesome, I've got everything!

Great. Double check you have saved your Packet Tracer topology file.

ⓧ I'd like to double check the full configuration

Here is the complete HQ-R1 configuration at this point. Compare it against yours by running show running-config on HQ-R1.

! HQ-R1 Running Configuration (relevant sections)
!
interface GigabitEthernet0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.252
 ip access-group 100 in
 no shutdown
!
router ospf 1
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.3 area 0
!
access-list 100 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip any any

Your enterprise network is complete. You have VLANs segmenting departments, OSPF routing traffic dynamically between sites, and an ACL enforcing a real security policy. Next up is the Secret Mission, where you will expand this network with multi-area OSPF.

Secret mission

Multi-Area OSPF with Route Summarization

Your single-area OSPF network works great for two sites. But what happens when the company opens a second branch office? In real enterprise networks, OSPF is divided into multiple areas to keep routing tables manageable. Can you expand your network with a new area and configure inter-area route summarization?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your topology file as-is, save a backup copy, or delete it entirely.

Resources you used:

  • Packet Tracer topology file (.pkt) saved on your local machine.
  • 2x Cisco 2911 routers (HQ-R1 and BR-R1) configured within the topology.
  • 2x Cisco 2960 switches (HQ-SW1 and BR-SW1) configured within the topology.
  • 6x PCs (PC1 through PC6) with static IP configurations.
  • OSPF routing, VLAN, and ACL configurations stored in device running-configs.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with your network topology or want to use it as a reference for future labs.

  • Save your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.
  • Your configurations persist inside the .pkt file whenever you save.

Pause - I'll come back to this later

Save the topology and close Packet Tracer. Your entire network configuration is stored inside the .pkt file, so you can reopen it any time without losing progress.

  • Save your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Close Cisco Packet Tracer.
  • When you return, double-click the .pkt file to reopen the full topology with all configurations intact.

Delete - I don't want to use this again

Remove the project file entirely from your machine. Since everything lives in a single .pkt file, deletion is straightforward.

  • Close Cisco Packet Tracer if it is still open.
  • Navigate to the folder where you saved your .pkt file.
  • Delete the .pkt file by moving it to the Trash (macOS) or Recycle Bin (Windows).
  • Empty the Trash or Recycle Bin to permanently remove the file.

That's a Wrap!

That's a Wrap!

Nice work! You just built a multi-site enterprise network from scratch, complete with VLAN segmentation, dynamic routing, and security policies.

You've learned how to:

  • Segmented an HQ network into VLANs and configured router-on-a-stick inter-VLAN routing using subinterfaces with 802.1Q encapsulation.
  • Configured single-area OSPF for dynamic route discovery between two sites connected by a WAN link.
  • Applied an extended ACL to enforce a security policy blocking Branch users from accessing Engineering while permitting access to Sales.
  • Extended the network with multi-area OSPF and inter-area route summarization.

Ready to quiz yourself?