Three-Site OSPF Network in Packet Tracer

Build a routed enterprise network with OSPF, VLANs, and WAN failover.

Introduction

30 Second Summary

When a company has offices in multiple cities, every email, file transfer, and video call has to find its way across the network. If a cable gets cut or a router goes down, the network needs to figure out a new path on its own. That automatic rerouting is what a routing protocol like OSPF provides.

In this project, you will build a three-site enterprise network in Cisco Packet Tracer with a triangle WAN backbone running OSPF. You will configure VLANs, centralized DHCP, DNS, and a web server so that any PC on the network can browse a website by name.

What You'll Build

When you are done, you can open a web browser on any PC at any site and reach the data center's web server by name. Then you pull the plug on a WAN link and watch OSPF reroute traffic through the surviving path without any manual intervention.

By the end of this project, you'll have:

  • A triangle WAN connecting three site routers with OSPF, providing redundant paths between all sites.
  • Two user sites with department VLANs, inter-VLAN routing, and PCs that get their IPs automatically from a centralized DHCP server.
  • A data center site with DNS name resolution and an HTTPS web server reachable from every PC on the network.
  • Secret Mission: Prove OSPF's value by simulating a WAN link failure and verifying automatic failover through the triangle's alternate path.

Are there any prerequisites?

You should have a basic understanding of IP addressing and subnetting. You also need Cisco Packet Tracer installed and logged in via your Cisco Networking Academy account.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

Build the Physical Topology

Every network starts as a blank canvas. Before you can configure a single IP address or routing protocol, you need the physical foundation in place: devices on the workspace, hardware modules installed, and cables connecting everything together.

In this step, you will place all 17 devices in Cisco Packet Tracer, install serial interface modules on the routers, and cable the entire three-site network. By the end, you will have a fully wired topology ready for configuration.

In this step, get ready to:
  • Place and name all routers, switches, servers, and PCs.
  • Install HWIC-2T serial modules on all three routers.
  • Cable the WAN triangle, site links, and PC connections.
Place and name all devices

You will place devices from the device panel at the bottom of Packet Tracer. Each device category lives under a different icon in the panel.

  • In the bottom-left device panel, click the Network Devices category (the icon that looks like a router/switch).
  • Click the Routers subcategory.
  • Find 2911 in the device list and drag three of them onto the workspace, spacing them in a triangle formation.

Now rename each router using the Config tab.

  • Click the first router to open its properties window.
  • Go to the Config tab.
  • In the Display Name field, type R1 and press Enter.
  • Repeat for the other two routers, naming them R2 and R3.

You should see three routers labelled R1, R2, and R3 on your workspace.

What are these routers for?

R1 is your Data Center site router. R2 and R3 are the routers for User Site 2 and User Site 3. Together they form the triangle WAN backbone that connects all three sites.

Before you can cable the WAN links, each router needs a serial interface module installed. The 2911 router does not have serial ports by default.

  • Click R1 to open its properties.
  • Go to the Physical tab.
  • Click the power button on the router image to power it off. The green light turns off.
  • In the module list on the left, find HWIC-2T and drag it into any empty slot on the right side of the router.
  • Click the power button again to power the router back on.
  • Repeat for R2 and R3: power off, add HWIC-2T, power on.

What does the HWIC-2T module provide?

The HWIC-2T module adds two serial interfaces: Serial0/0/0 and Serial0/0/1. These are used for point-to-point WAN connections between routers. The router must be powered off before you can add hardware modules.

Module won't drop into the slot?

Make sure the router is powered off first. The power button must show the light as off. You cannot add modules to a running router in Packet Tracer.

Help me install the HWIC-2T module on my router.

Now place the Layer 3 switches.

  • In the device panel, click Network Devices, then the Switches subcategory.
  • Find 3560-24PS and drag three onto the workspace, one near each router.
  • Rename them using the Config tab: MLS1 (near R1), MLS2 (near R2), MLS3 (near R3).

Next, place the Layer 2 switches.

  • Find 2960 in the Switches subcategory and drag four onto the workspace.
  • Place two near MLS2 (Site 2) and two near MLS3 (Site 3).
  • Rename them: SW1 and SW2 near MLS2, SW3 and SW4 near MLS3.

Now place the servers and PCs.

  • In the device panel, click the End Devices category.
  • Drag two Server devices near MLS1 (the Data Center). Rename them SRV-DHCP-DNS and SRV-WEB.
  • Drag two PC devices near SW1. Rename them PC1 and PC2.
  • Drag two PCs near SW2. Rename them PC3 and PC4.
  • Drag two PCs near SW3. Rename them PC5 and PC6.
  • Drag two PCs near SW4. Rename them PC7 and PC8.

You should now see all 17 devices on your workspace: 3 routers, 3 L3 switches, 4 L2 switches, 2 servers, and 8 PCs. All labelled with their correct names.

Cable the WAN triangle and site links

With all devices placed, it is time to connect them with cables. The WAN triangle uses Serial DCE cables. All other links use Copper Straight-Through cables.

Why does the click order matter for serial cables?

When you draw a Serial DCE cable, the device you click first becomes the DCE end. The DCE end is responsible for providing the clock signal that synchronizes communication. In a real network, the ISP side is usually DCE.

For this lab, R1 is DCE on both its serial links, and R2 is DCE on its link to R3. Getting this right now means clock rate configuration works correctly later.

  • In the bottom-left panel, click the Connections category (the lightning bolt icon).
  • Select Serial DCE (the cable with a small clock icon).
  • Click R1 first, then select Serial0/0/0. Click R2 and select Serial0/0/0.
  • Select Serial DCE again. Click R2 first, then select Serial0/0/1. Click R3 and select Serial0/0/0.
  • Select Serial DCE again. Click R1 first, then select Serial0/0/1. Click R3 and select Serial0/0/1.

You should see three red serial links forming a triangle between R1, R2, and R3. Red means the interfaces are down, which is expected since they have no IP configuration yet.

Now connect each router to its local L3 switch using Copper Straight-Through cables.

  • In the Connections panel, select Copper Straight-Through.
  • Click R1, select GigabitEthernet0/0. Click MLS1, select GigabitEthernet0/1.
  • Click R2, select GigabitEthernet0/0. Click MLS2, select GigabitEthernet0/1.
  • Click R3, select GigabitEthernet0/0. Click MLS3, select GigabitEthernet0/1.

These three links should show green triangles on both ends after a few seconds. That means the Ethernet interfaces are up.

Next, connect the L3 switches to their downstream devices (servers and L2 switches). Keep using Copper Straight-Through.

  • Click MLS1, select FastEthernet0/1. Click SRV-DHCP-DNS, select FastEthernet0.
  • Click MLS1, select FastEthernet0/2. Click SRV-WEB, select FastEthernet0.
  • Click MLS2, select FastEthernet0/1. Click SW1, select FastEthernet0/1.
  • Click MLS2, select FastEthernet0/2. Click SW2, select FastEthernet0/1.
  • Click MLS3, select FastEthernet0/1. Click SW3, select FastEthernet0/1.
  • Click MLS3, select FastEthernet0/2. Click SW4, select FastEthernet0/1.

Finally, connect each PC to its L2 switch. Keep using Copper Straight-Through.

  • Click SW1, select FastEthernet0/2. Click PC1, select FastEthernet0.
  • Click SW1, select FastEthernet0/3. Click PC2, select FastEthernet0.
  • Click SW2, select FastEthernet0/2. Click PC3, select FastEthernet0.
  • Click SW2, select FastEthernet0/3. Click PC4, select FastEthernet0.
  • Click SW3, select FastEthernet0/2. Click PC5, select FastEthernet0.
  • Click SW3, select FastEthernet0/3. Click PC6, select FastEthernet0.
  • Click SW4, select FastEthernet0/2. Click PC7, select FastEthernet0.
  • Click SW4, select FastEthernet0/3. Click PC8, select FastEthernet0.

Can't find the right port on a device?

When you click a device with a cable selected, Packet Tracer shows a list of available ports. If a port is greyed out, it is already in use. If you do not see serial ports on a router, the HWIC-2T module was not installed correctly. Go back to the Physical tab and verify the module is in the slot.

Help me find the right port to cable my device.

Verify the topology

Before you look at the link lights, what colors do you expect the serial WAN links to show compared to the Ethernet switch-to-PC links?

  • Look at the link indicator dots on each cable in your topology.

The serial links between routers show red dots on both ends. This is expected. Serial interfaces are administratively down by default and have no IP addresses yet. The Ethernet links between switches and PCs should show amber (briefly) then turn to green triangles, meaning those interfaces are up.

What do the link light colors mean?

Red means the interface is down (either administratively shut down or not configured). Green means the interface is up and operational. Amber means the interface is initializing (STP on switches takes about 30 seconds to transition to forwarding).

Seeing red dots on Ethernet links too?

If an Ethernet link between a switch and PC shows red, you may have used the wrong cable type. Delete the cable (click it and press Delete) and reconnect using Copper Straight-Through. A crossover cable between a switch and a PC will not work in all cases.

Help me fix my red link lights on Ethernet cables.

Your physical topology is complete. All 17 devices are placed, named, and connected. Next up, you will bring those red serial links to life by configuring IP addresses and enabling the WAN interfaces.

Configure the WAN Links

Your three routers form the backbone triangle of the network. Right now, their serial interfaces are administratively down with no IP addresses assigned.

Until these WAN links come up with proper addressing, your three sites are completely isolated islands that cannot communicate. This step brings the backbone to life.

In this step, get ready to:
  • Assign IP addresses and clock rates to all serial and LAN interfaces on the three routers.
  • Bring all interfaces up with the no shutdown command.
  • Verify that all three WAN triangle links pass traffic with successful pings.
Configure R1 serial and LAN interfaces

Each WAN link uses a /30 subnet (only 2 usable host addresses) because point-to-point links only need one IP per end. Here is the addressing plan for the entire triangle.

What is the IP addressing plan?

WAN links (serial interfaces):

  • R1-R2 link: 10.0.0.0/30 (R1 = 10.0.0.1, R2 = 10.0.0.2).
  • R2-R3 link: 10.0.0.4/30 (R2 = 10.0.0.5, R3 = 10.0.0.6).
  • R1-R3 link: 10.0.0.8/30 (R1 = 10.0.0.9, R3 = 10.0.0.10).

Router-to-L3-Switch links (GigabitEthernet):

  • R1 to MLS1: 192.168.1.0/30 (R1 = 192.168.1.1, MLS1 = 192.168.1.2).
  • R2 to MLS2: 192.168.2.0/30 (R2 = 192.168.2.1, MLS2 = 192.168.2.2).
  • R3 to MLS3: 192.168.3.0/30 (R3 = 192.168.3.1, MLS3 = 192.168.3.2).
  • Click on R1 to open it, then go to the CLI tab.
  • Configure R1's serial and GigabitEthernet interfaces by entering these commands:
enable
configure terminal
hostname R1
!
interface Serial0/0/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 128000
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.9 255.255.255.252
 clock rate 128000
 no shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.252
 no shutdown
!
end

What do these commands do?

  • enable enters privileged exec mode. configure terminal enters global configuration mode where you can make changes.
  • ip address assigns an IP and subnet mask to the interface. The 255.255.255.252 mask means only 2 usable IPs per link.
  • clock rate 128000 sets the clocking speed on the DCE end of a serial cable. R1 is the DCE end on both its serial links because you clicked R1 first when drawing those cables.
  • no shutdown administratively brings the interface up. Router interfaces are shut down by default.
  • Verify that R1's interfaces are configured by running this command on R1:
show ip interface brief

You should see GigabitEthernet0/0 showing status "up" and protocol "up". The serial interfaces will show "up" and "down" because the other end is not configured yet.

Seeing all interfaces as down?

  • Make sure you typed no shutdown on each interface. Without it, the interface stays administratively down.
  • Confirm you typed end after the configuration to exit config mode. show ip interface brief only works from privileged exec mode.
  • Check that your cables are connected to the correct ports. R1's Gi0/0 should connect to MLS1's Gi0/1.

Help me troubleshoot why my R1 interfaces are all showing down.

Configure R2 and R3
  • Click on R2 to open it, then go to the CLI tab.
  • Configure R2's interfaces by entering these commands:
enable
configure terminal
hostname R2
!
interface Serial0/0/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.5 255.255.255.252
 clock rate 128000
 no shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.252
 no shutdown
!
end

Why does R2 only have clock rate on Serial0/0/1?

The clock rate command is only needed on the DCE end of a serial cable. R2's Serial0/0/0 connects to R1 (where R1 is the DCE end), so R2 is the DTE end on that link. R2's Serial0/0/1 connects to R3 (where R2 is the DCE end because you clicked R2 first when drawing that cable).

  • Verify the R1-to-R2 link is now working by going back to R1's CLI and running:
ping 10.0.0.2

You should see 5 successful replies. The R1-R2 serial link is alive.

  • Click on R3 to open it, then go to the CLI tab.
  • Configure R3's interfaces by entering these commands:
enable
configure terminal
hostname R3
!
interface Serial0/0/0
 ip address 10.0.0.6 255.255.255.252
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.10 255.255.255.252
 no shutdown
!
interface GigabitEthernet0/0
 ip address 192.168.3.1 255.255.255.252
 no shutdown
!
end

Why does R3 have no clock rate at all?

R3 is the DTE end on both its serial links. R1 provides clocking on the R1-R3 link, and R2 provides clocking on the R2-R3 link. Only the DCE end sets the clock rate.

✔️ Awesome, I've got everything!

Great. All three routers are configured. Time to test the full triangle.

ⓧ I'd like to double check the full code

Compare your router configurations against these. Run show running-config on each router and look for the interface sections.

R1 configuration:

hostname R1
!
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.252
 no shutdown
!
interface Serial0/0/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 128000
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.9 255.255.255.252
 clock rate 128000
 no shutdown
!
end

R2 configuration:

hostname R2
!
interface GigabitEthernet0/0
 ip address 192.168.2.1 255.255.255.252
 no shutdown
!
interface Serial0/0/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.5 255.255.255.252
 clock rate 128000
 no shutdown
!
end

R3 configuration:

hostname R3
!
interface GigabitEthernet0/0
 ip address 192.168.3.1 255.255.255.252
 no shutdown
!
interface Serial0/0/0
 ip address 10.0.0.6 255.255.255.252
 no shutdown
!
interface Serial0/0/1
 ip address 10.0.0.10 255.255.255.252
 no shutdown
!
end
Verify WAN connectivity across the full triangle

All three routers now have addresses on every interface. Before you run the tests below, predict: will all three pings succeed, or will any of them fail?

  • On R1's CLI, test connectivity to R3 by running:
ping 10.0.0.10
  • On R2's CLI, test connectivity to R3 by running:
ping 10.0.0.6

Both pings should return 5 successful replies. All three legs of the WAN triangle are now up and passing traffic. The serial link lights in your topology should have turned from red to green.

Ping is failing on one or more links?

  • Check that both ends of the failing link have IPs in the same /30 subnet. For example, R2 Se0/0/1 (10.0.0.5) and R3 Se0/0/0 (10.0.0.6) must both use mask 255.255.255.252.
  • Verify the DCE end has clock rate 128000 configured. Without a clock rate on the DCE side, the serial link protocol stays down.
  • Run show ip interface brief on the failing router. If an interface shows "administratively down", you missed the no shutdown command on that interface.

Help me figure out why my serial link pings are failing in Packet Tracer.

Your WAN backbone is alive. All three routers can reach their direct neighbors across the serial triangle. Next up, you will build VLANs and local site networks so the PCs and servers can join the party.

Configure VLANs and Local Site Networks

Your WAN backbone is live. All three routers can ping their neighbors across the triangle. Now it's time to build out the local networks at each site so that PCs and servers have somewhere to connect.

Each site needs VLANs to separate departments, Layer 3 switch interfaces to act as default gateways, and routed uplinks to reach the WAN. Without these, PCs have no gateway and cannot communicate even within their own building.

In this step, get ready to:
  • Configure all three L3 switches with routed uplinks, VLANs, and SVIs.
  • Configure all four L2 switches with department VLANs and access ports.
  • Set static IPs on the data center servers and test PCs, then verify local connectivity.
Configure MLS1 (Data Center L3 switch)

MLS1 is the data center's multilayer switch. It needs a routed uplink toward R1, a VLAN for the servers, and a gateway address so the servers can reach the rest of the network.

  • Click MLS1 in your topology, then go to the CLI tab.
  • Enter the following configuration:
enable
configure terminal
hostname MLS1
ip routing
!
vlan 99
 name DATA-CENTER
!
interface GigabitEthernet0/1
 no switchport
 ip address 192.168.1.2 255.255.255.252
!
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 99
!
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 99
!
interface Vlan99
 ip address 192.168.99.1 255.255.255.0
!
end

What does this configuration do?

  • ip routing enables Layer 3 routing on the switch so it can forward packets between VLANs and toward the router.
  • no switchport on GigabitEthernet0/1 converts the port from a Layer 2 switchport into a Layer 3 routed port, so it can hold an IP address and route traffic toward R1.
  • VLAN 99 groups the two server ports together. The SVI (interface Vlan99) gives that VLAN a gateway address of 192.168.99.1.
  • Verify the routed uplink is working by switching to R1's CLI and running:
ping 192.168.1.2

You should see 4 out of 5 (or 5 out of 5) pings succeed. This confirms R1 and MLS1 can talk across the routed link.

Ping to 192.168.1.2 fails?

  • Make sure you included no switchport on GigabitEthernet0/1. Without it, the port stays in Layer 2 mode and ignores the IP address.
  • Check that both R1's GigabitEthernet0/0 (192.168.1.1) and MLS1's GigabitEthernet0/1 (192.168.1.2) use the same /30 subnet mask (255.255.255.252).

Why can't R1 reach MLS1 on the routed link?

Now assign static IPs to both data center servers so they can use MLS1 as their gateway.

  • Click SRV-DHCP-DNS in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Enter IP Address: 192.168.99.10.
  • Enter Subnet Mask: 255.255.255.0.
  • Enter Default Gateway: 192.168.99.1.
  • Repeat for SRV-WEB with IP Address: 192.168.99.20, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.99.1.
  • Verify by clicking SRV-DHCP-DNS, opening the Desktop tab, then Command Prompt, and running:
ping 192.168.99.1

You should see successful replies. This confirms the server can reach its gateway on MLS1.

Configure MLS2 and MLS3 (User Site L3 switches)

The user sites need the same treatment as the data center. Each L3 switch gets a routed uplink, department VLANs, and SVI gateways so PCs in each department can route traffic.

  • Click MLS2, go to the CLI tab, and enter this configuration:
enable
configure terminal
hostname MLS2
ip routing
!
vlan 10
 name DEPT-A
!
vlan 20
 name DEPT-B
!
interface GigabitEthernet0/1
 no switchport
 ip address 192.168.2.2 255.255.255.252
!
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
!
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
!
end

What's different about MLS2?

MLS2 has two VLANs (10 for Department A, 20 for Department B) instead of one. Each VLAN gets its own SVI with a unique subnet. FastEthernet0/1 connects to SW1 (VLAN 10) and FastEthernet0/2 connects to SW2 (VLAN 20).

With ip routing enabled, MLS2 routes packets between these VLANs locally. This is inter-VLAN routing without needing a separate router.

  • Click MLS3, go to the CLI tab, and enter this configuration:
enable
configure terminal
hostname MLS3
ip routing
!
vlan 30
 name DEPT-C
!
vlan 40
 name DEPT-D
!
interface GigabitEthernet0/1
 no switchport
 ip address 192.168.3.2 255.255.255.252
!
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 30
!
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 40
!
interface Vlan30
 ip address 192.168.30.1 255.255.255.0
!
interface Vlan40
 ip address 192.168.40.1 255.255.255.0
!
end

What does this configuration do?

MLS3 mirrors MLS2's structure with different VLAN numbers (30 and 40) and subnets (192.168.30.0/24 and 192.168.40.0/24). Site 3's departments get the same inter-VLAN routing capability.

  • Verify both uplinks by clicking R2, opening the CLI tab, and running:
ping 192.168.2.2
  • Then click R3, open the CLI tab, and run:
ping 192.168.3.2

Both should succeed. Each router can now reach its local L3 switch across the routed link.

Pings to the L3 switch fail?

  • Confirm you included no switchport on GigabitEthernet0/1. A missing no switchport means the port ignores the IP address entirely.
  • Run show ip interface brief on the L3 switch to confirm GigabitEthernet0/1 shows an IP address and status up/up.

Help me troubleshoot my L3 switch routed uplink.

Configure L2 switches and test PCs

The L2 switches connect directly to PCs. Each one needs to know which VLAN its ports belong to so that traffic reaches the correct SVI gateway on the L3 switch above it.

  • Click SW1, go to the CLI tab, and enter this configuration:
enable
configure terminal
hostname SW1
!
vlan 10
 name DEPT-A
!
interface range FastEthernet0/1-3
 switchport mode access
 switchport access vlan 10
!
end

What does this configuration do?

VLAN 10 is created on SW1 to match the VLAN on MLS2. The interface range FastEthernet0/1-3 command configures three ports at once. All three are set as access ports in VLAN 10: Fa0/1 connects upward to MLS2, and Fa0/2-3 connect to PC1 and PC2.

  • Click SW2, go to the CLI tab, and enter this configuration:
enable
configure terminal
hostname SW2
!
vlan 20
 name DEPT-B
!
interface range FastEthernet0/1-3
 switchport mode access
 switchport access vlan 20
!
end
  • Verify VLAN assignment on SW1 by opening its CLI tab and running:
show vlan brief

You should see VLAN 10 (DEPT-A) listed with Fa0/1, Fa0/2, and Fa0/3 assigned to it.

  • Now configure SW3. Click it, go to the CLI tab, and enter:
enable
configure terminal
hostname SW3
!
vlan 30
 name DEPT-C
!
interface range FastEthernet0/1-3
 switchport mode access
 switchport access vlan 30
!
end
  • Click SW4, go to the CLI tab, and enter:
enable
configure terminal
hostname SW4
!
vlan 40
 name DEPT-D
!
interface range FastEthernet0/1-3
 switchport mode access
 switchport access vlan 40
!
end
  • Verify VLAN assignment on SW3 by running show vlan brief in its CLI.

You should see VLAN 30 (DEPT-C) with Fa0/1, Fa0/2, and Fa0/3 assigned.

VLAN not showing ports?

  • Make sure you created the VLAN first (vlan 10 in global config) before assigning ports to it. If the VLAN does not exist, ports stay in VLAN 1.
  • Confirm the interface range syntax is correct: interface range FastEthernet0/1-3 with no spaces around the dash.

Help me fix my VLAN port assignments on a 2960 switch.

Now set static IPs on one test PC per site to verify local connectivity.

  • Click PC1 in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Enter IP Address: 192.168.10.100.
  • Enter Subnet Mask: 255.255.255.0.
  • Enter Default Gateway: 192.168.10.1.
  • Repeat for PC5 (at Site 3) with IP Address: 192.168.30.100, Subnet Mask: 255.255.255.0, Default Gateway: 192.168.30.1.

Before you test, think about this: PC1 is in VLAN 10 on Site 2, and the data center server is in VLAN 99 on Site 1. Do you think PC1 can reach the server at 192.168.99.10?

  • Click PC1, go to Desktop > Command Prompt, and run:
ping 192.168.10.1

This pings PC1's local gateway on MLS2. You should see successful replies.

  • Now try to reach the data center server by running:
ping 192.168.99.10

This ping fails. You see "Request timed out" for every attempt.

Why does the local ping work but the remote ping fail?

PC1 can reach its local gateway (192.168.10.1 on MLS2) because that traffic stays within the same site. The path from MLS2 to MLS1 requires passing through routers R2 and R1.

The routers know about their directly connected links, but they have no idea that subnet 192.168.99.0/24 exists behind MLS1, or that 192.168.10.0/24 exists behind MLS2. No routing protocol is distributing these routes. That is exactly what OSPF will fix in the next step.

Every site now has working local connectivity with VLANs, gateways, and IP addresses in place. The missing piece is a routing protocol to connect the islands. Next up, you will deploy OSPF across all routers and L3 switches to make every subnet reachable from everywhere.

Configure OSPF Across All Sites

At the end of the last step, you hit a wall. PC1 could reach its local gateway on MLS2, but pinging the data center server at 192.168.99.10 failed. Each site is an isolated island because no device knows about subnets on other sites.

OSPF solves this by having every router and L3 switch automatically advertise its connected networks to its neighbors. Once all devices speak OSPF, every device learns a complete map of the network and can forward traffic across sites without manual route entries.

In this step, get ready to:
  • Enable OSPF on all three WAN routers so they share route information across the triangle.
  • Enable OSPF on all three L3 switches so VLAN subnets are advertised into the network.
  • Verify that cross-site pings now succeed end-to-end.
Enable OSPF on all three routers

Each router needs an OSPF process that advertises its directly connected WAN and LAN subnets into Area 0. You will also assign a stable router ID to each device so OSPF neighbor relationships stay consistent.

  • Click on R1 to open it, then go to the CLI tab.
  • Configure OSPF on R1 by entering these commands:
enable
configure terminal
router ospf 1
 router-id 1.1.1.1
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.0.8 0.0.0.3 area 0
 network 192.168.1.0 0.0.0.3 area 0
!
end

What do these commands do?

The router ospf 1 command starts OSPF process 1 on the device. The router-id command manually assigns a stable identifier so OSPF does not pick one unpredictably from the interface IPs.

Each network statement uses a wildcard mask to match an interface's IP address. When a match occurs, OSPF activates on that interface and advertises that subnet to neighbors. The area 0 places all interfaces in the backbone area.

  • Click on R2, open the CLI tab, and configure OSPF on R2 by entering these commands:
enable
configure terminal
router ospf 1
 router-id 2.2.2.2
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.0.4 0.0.0.3 area 0
 network 192.168.2.0 0.0.0.3 area 0
!
end
  • Return to R1's CLI and verify that R1 has formed a neighbor relationship with R2 by running:
show ip ospf neighbor

You should see an entry with Neighbor ID 2.2.2.2 in a FULL state. This confirms the R1-R2 WAN link is actively exchanging routes.

  • Click on R3, open the CLI tab, and configure OSPF on R3 by entering these commands:
enable
configure terminal
router ospf 1
 router-id 3.3.3.3
 network 10.0.0.4 0.0.0.3 area 0
 network 10.0.0.8 0.0.0.3 area 0
 network 192.168.3.0 0.0.0.3 area 0
!
end
  • Return to R1's CLI and run show ip ospf neighbor again.

You should now see two neighbors listed: 2.2.2.2 (R2 via 10.0.0.2) and 3.3.3.3 (R3 via 10.0.0.10). Both should show FULL state.

Not seeing any OSPF neighbors?

  • Verify that you typed the wildcard masks correctly. For /30 subnets, the wildcard is 0.0.0.3 (not 255.255.255.252).
  • Make sure the serial interfaces are still up. Run show ip interface brief and check that Serial0/0/0 and Serial0/0/1 show up/up.
  • Confirm that both sides of a link are in area 0. Mismatched areas prevent adjacency.

Still stuck? Help me troubleshoot why my OSPF neighbors are not forming between my three routers.

Enable OSPF on all three L3 switches

The routers now know about each other's WAN subnets, but they still cannot reach the VLAN subnets behind each L3 switch. Each L3 switch needs to run OSPF and advertise its VLAN networks. You will also add passive-interface on VLAN SVIs to prevent OSPF hello packets from being sent toward end-user PCs.

  • Click on MLS1 (Data Center), open the CLI tab, and configure OSPF by entering these commands:
enable
configure terminal
router ospf 1
 router-id 4.4.4.4
 network 192.168.1.0 0.0.0.3 area 0
 network 192.168.99.0 0.0.0.255 area 0
 passive-interface Vlan99
!
end

What does passive-interface do?

The passive-interface Vlan99 command tells OSPF to advertise the 192.168.99.0/24 subnet into the routing table but NOT send hello packets out of that interface. Servers and PCs do not need to receive OSPF traffic, so this is best practice on any SVI facing end devices.

  • Click on MLS2 (Site 2), open the CLI tab, and configure OSPF by entering these commands:
enable
configure terminal
router ospf 1
 router-id 5.5.5.5
 network 192.168.2.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 passive-interface Vlan10
 passive-interface Vlan20
!
end
  • Return to R1's CLI and run show ip ospf neighbor to confirm MLS1 has joined as a neighbor.

You should now see three neighbors on R1: 2.2.2.2 (R2), 3.3.3.3 (R3), and 4.4.4.4 (MLS1 via 192.168.1.2).

  • Click on MLS3 (Site 3), open the CLI tab, and configure OSPF by entering these commands:
enable
configure terminal
router ospf 1
 router-id 6.6.6.6
 network 192.168.3.0 0.0.0.3 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 192.168.40.0 0.0.0.255 area 0
 passive-interface Vlan30
 passive-interface Vlan40
!
end

Switch says 'Invalid input detected'?

  • Make sure you are in global configuration mode (the prompt shows (config)#). If your prompt shows # without (config), type configure terminal first.
  • Confirm you typed router ospf 1 (with a space before the 1). A missing space causes a syntax error.
  • Verify that ip routing is already enabled on the switch. Run show running-config | include ip routing to check.

Need more help? Help me fix an 'Invalid input detected' error when configuring OSPF on my L3 switch in Packet Tracer.

Verify OSPF adjacencies and cross-site connectivity

All six devices are now running OSPF. Time to confirm the routing table is complete and traffic flows across sites.

  • On R1's CLI, run show ip ospf neighbor to see the full neighbor table.
show ip ospf neighbor

You should see neighbors 2.2.2.2 (R2), 3.3.3.3 (R3), and 4.4.4.4 (MLS1), all in FULL state.

  • On R2's CLI, check the OSPF routes it has learned by running:
show ip route ospf

You should see routes marked with O for all remote subnets including 192.168.99.0/24 (data center), 192.168.30.0/24 and 192.168.40.0/24 (Site 3 VLANs), plus the WAN links 10.0.0.8/30 and router-to-switch subnets 192.168.1.0/30 and 192.168.3.0/30.

What does the O mean in the routing table?

Routes marked with O were learned dynamically through OSPF. Routes marked C are directly connected interfaces. Before you enabled OSPF, only C routes existed, which is why cross-site traffic had nowhere to go.

Now for the real test. In Step 3, pinging the data center from PC1 failed because no route existed. Do you think it will succeed now?

  • Click on PC1, open the Desktop tab, and click Command Prompt.
  • Ping the data center server by running:
ping 192.168.99.10

You should see replies from 192.168.99.10 with 0% packet loss. The route that was missing in Step 3 now exists because OSPF distributed it across all six devices.

Ping still failing from PC1?

  • Verify PC1 still has IP 192.168.10.100 with gateway 192.168.10.1 in Desktop > IP Configuration.
  • On MLS2, run show ip route and confirm there is an O route for 192.168.99.0. If it is missing, re-check that MLS2's network 192.168.2.0 0.0.0.3 area 0 statement is correct.
  • Try the ping a second time. In Packet Tracer, the first ping sometimes fails due to ARP resolution timing. If you get 3 out of 4 replies, that counts as success.

Need help? Help me figure out why my PC still cannot ping across sites after configuring OSPF on all devices in Packet Tracer.

Your three-site network is now fully routed. Every device knows how to reach every other subnet, all learned dynamically through OSPF. Next up, you will configure the data center to provide real network services like DHCP, DNS, and web hosting to all those remote PCs.

Configure Data Center Services

Your OSPF configuration has connected all three sites into a single routed network. PCs can now reach the data center server by IP address.

The network is routed, but PCs still rely on manually assigned static IPs and have no way to resolve hostnames or browse web pages. In this step, you'll configure the data center servers to provide DHCP, DNS, and web services to the entire network.

In this step, get ready to:
  • Configure DHCP pools and DNS on SRV-DHCP-DNS.
  • Enable web services and configure DHCP relay for remote sites.
  • Switch all PCs to DHCP and verify end-to-end connectivity.
Configure DHCP and DNS on SRV-DHCP-DNS

Right now, every PC needs its IP address set by hand. A centralized DHCP server can distribute IP configuration automatically to all PCs across every VLAN.

  • Click SRV-DHCP-DNS in your topology to open its configuration window.
  • Click the Services tab at the top.
  • Click DHCP in the left-hand menu.
  • Click the On radio button to enable the DHCP service.

You'll create four address pools, one for each department VLAN. Start with the VLAN10 pool:

  • In the Pool Name field, type VLAN10.
  • In the Default Gateway field, type 192.168.10.1.
  • In the DNS Server field, type 192.168.99.10.
  • In the Start IP Address field, type 192.168.10.100.
  • In the Subnet Mask field, type 255.255.255.0.
  • In the Maximum number of Users field, type 50.
  • Click Add.

What do these fields mean?

Each pool defines the network settings that DHCP will hand to PCs in that VLAN. The Default Gateway is the SVI on the L3 switch that the PCs use to reach other subnets. The DNS Server points PCs at this same server for name resolution.

The Start IP Address is the first IP the server will lease. Addresses are assigned sequentially from that point. Maximum number of Users caps how many leases this pool can hand out.

Now create three more pools using the same process. Click Add after entering each set of values:

  • VLAN20: Pool Name VLAN20, Default Gateway 192.168.20.1, DNS Server 192.168.99.10, Start IP Address 192.168.20.100, Subnet Mask 255.255.255.0, Max Users 50.
  • VLAN30: Pool Name VLAN30, Default Gateway 192.168.30.1, DNS Server 192.168.99.10, Start IP Address 192.168.30.100, Subnet Mask 255.255.255.0, Max Users 50.
  • VLAN40: Pool Name VLAN40, Default Gateway 192.168.40.1, DNS Server 192.168.99.10, Start IP Address 192.168.40.100, Subnet Mask 255.255.255.0, Max Users 50.
  • If you see a default pool named serverPool in the list, select it and click Remove to delete it.

You should now see exactly four pools listed: VLAN10, VLAN20, VLAN30, and VLAN40.

Now configure the DNS service on the same server:

  • Click DNS in the left-hand services menu.
  • Click the On radio button to enable the DNS service.
  • In the Name field, type www.datacenter.local.
  • In the Address field, type 192.168.99.20.
  • Click Add.

What does this DNS record do?

This A record maps the hostname www.datacenter.local to the web server's IP address 192.168.99.20. When a PC types that name into a browser, DNS translates it to the IP so the traffic can be routed across the network.

You should see the A record listed in the DNS records table. Close the SRV-DHCP-DNS window.

Enable web services and configure DHCP relay

The web server needs HTTPS enabled so PCs can browse it. The user sites also need DHCP relay configured, because DHCP broadcast requests from remote VLANs cannot cross routed boundaries on their own.

  • Click SRV-WEB in your topology.
  • Click the Services tab, then click HTTP in the left menu.
  • Confirm that both HTTP and HTTPS are set to On. They are enabled by default in Packet Tracer.
  • Close the SRV-WEB window.

Now configure DHCP relay on MLS2. This tells the L3 switch to forward DHCP requests from local PCs to the centralized DHCP server across the routed network.

  • Click MLS2 and open its CLI tab.
  • Add the ip helper-address command to each VLAN SVI by entering:
enable
configure terminal
interface Vlan10
 ip helper-address 192.168.99.10
!
interface Vlan20
 ip helper-address 192.168.99.10
!
end

What does ip helper-address do?

DHCP clients send broadcast requests to find a server. Broadcasts do not cross router or L3 switch boundaries. The ip helper-address command on a VLAN SVI intercepts those broadcasts and forwards them as unicast packets to the specified DHCP server.

Without this relay, PCs on remote VLANs would never receive an IP address because their DHCP Discover messages would stay trapped in the local subnet.

  • Click MLS3 and open its CLI tab.
  • Add the same relay configuration for Site 3's VLANs:
enable
configure terminal
interface Vlan30
 ip helper-address 192.168.99.10
!
interface Vlan40
 ip helper-address 192.168.99.10
!
end

Helper-address not saving?

Make sure you are in interface configuration mode (the prompt shows (config-if)#) before typing ip helper-address. If you typed it at the global config prompt, the command will be rejected.

Help me troubleshoot

Switch PCs to DHCP and test all services

Everything is in place: DHCP pools exist, DNS can resolve the web server's name, HTTPS is running, and relay bridges the broadcast gap. Time to prove the full chain works end-to-end.

  • Click PC1 and go to the Desktop tab.
  • Click IP Configuration.
  • Click the DHCP radio button. Wait a moment for the IP address fields to populate automatically.
  • Confirm that PC1 received an IP in the 192.168.10.x range, with gateway 192.168.10.1 and DNS 192.168.99.10.
  • Repeat this process for all remaining PCs: PC2, PC3, PC4, PC5, PC6, PC7, and PC8.
  • On each one, click Desktop then IP Configuration then select DHCP.

How does the server know which pool to use?

When MLS2 or MLS3 relays a DHCP request, it stamps the request with its own SVI address (the gateway IP for that VLAN). The DHCP server matches this address against each pool's Default Gateway field to pick the correct pool. That is why each pool needs the exact gateway IP for its target VLAN.

Before you test the web browser, take a moment to predict: do you think typing www.datacenter.local on a PC at Site 2 will load a page? What has to happen for that request to succeed?

  • On any PC (for example PC1), click the Desktop tab.
  • Click Web Browser.
  • In the URL bar, type www.datacenter.local and press Go.

The browser displays the default Cisco Packet Tracer web page from SRV-WEB. This single result proves the entire service chain works: DHCP assigned an IP, DNS resolved the hostname, OSPF routed traffic to the data center, and the web server served the page.

Page not loading?

If you see "Host Name Unresolved" in the browser, the DNS lookup failed. Verify that you enabled the DNS service on SRV-DHCP-DNS and that the A record name is exactly www.datacenter.local (no trailing spaces or typos).

If you see "Request Timeout", the PC cannot reach the web server. Check that the PC received a valid gateway via DHCP. Open the PC's Command Prompt and run ping 192.168.99.20 to isolate whether it is a DNS problem or a routing problem.

If DHCP is not assigning an IP (fields stay blank), confirm that ip helper-address 192.168.99.10 appears under the correct VLAN interface on MLS2 or MLS3.

Help me troubleshoot why my PC cannot browse www.datacenter.local

✔️ Awesome, I've got everything!

Great. Double check you've confirmed the web page loads from at least two PCs on different sites (one at Site 2 and one at Site 3) to prove cross-site services work.

ⓧ I'd like to double check the full code

Here is the complete MLS2 configuration after adding DHCP relay:

hostname MLS2
ip routing
vlan 10
 name DEPT-A
vlan 20
 name DEPT-B
interface GigabitEthernet0/1
 no switchport
 ip address 192.168.2.2 255.255.255.252
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 20
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
 ip helper-address 192.168.99.10
interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip helper-address 192.168.99.10
router ospf 1
 router-id 5.5.5.5
 network 192.168.2.0 0.0.0.3 area 0
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 passive-interface Vlan10
 passive-interface Vlan20
end

Here is the complete MLS3 configuration after adding DHCP relay:

hostname MLS3
ip routing
vlan 30
 name DEPT-C
vlan 40
 name DEPT-D
interface GigabitEthernet0/1
 no switchport
 ip address 192.168.3.2 255.255.255.252
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 30
interface FastEthernet0/2
 switchport mode access
 switchport access vlan 40
interface Vlan30
 ip address 192.168.30.1 255.255.255.0
 ip helper-address 192.168.99.10
interface Vlan40
 ip address 192.168.40.1 255.255.255.0
 ip helper-address 192.168.99.10
router ospf 1
 router-id 6.6.6.6
 network 192.168.3.0 0.0.0.3 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 192.168.40.0 0.0.0.255 area 0
 passive-interface Vlan30
 passive-interface Vlan40
end

Your network is now a fully operational enterprise simulation. Every PC gets its IP automatically, names resolve to addresses, and a web server is reachable from any site. Next up, you'll prove that the triangle WAN makes this network resilient by testing what happens when a link fails.

Secret mission

Prove OSPF Failover

You built a triangle WAN specifically for redundancy. But does it actually work? In this mission, you'll pull the plug on a live WAN link and watch OSPF reroute traffic through the surviving path without any manual intervention.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer. There are no cloud resources, no ongoing costs, and nothing that will charge you money if left running.

Decide whether to keep your simulation file, pause by saving it for later, or delete it entirely.

Resources you used:

  • Packet Tracer simulation file (.pkt file saved to your local machine).

Keep everything running

No action needed. Choose this if you want to keep building on your OSPF network or use it as a teaching reference.

  • Save your Packet Tracer file by pressing Ctrl+S (Windows/Linux) or Cmd+S (macOS).
  • You can reopen this file any time to extend the network with additional sites, VLANs, or convert to multi-area OSPF.
  • Share the .pkt file with others so they can load and explore your topology independently.

Pause - I'll come back to this later

Save your simulation file so you can pick up exactly where you left off.

  • Save your Packet Tracer file by pressing Ctrl+S (Windows/Linux) or Cmd+S (macOS).
  • Close Packet Tracer. Your network state is fully preserved in the .pkt file.
  • When you return, double-click the file to reopen your full topology with all configurations intact.

Delete - I don't want to use this again

Remove the simulation file from your machine entirely.

  • Close Packet Tracer without saving (click Don't Save if prompted).
  • If you previously saved the file, locate it in your file system and delete it.
  • On macOS or Linux, delete the file by running:
rm ~/Desktop/ospf-network.pkt
  • On Windows, right-click the .pkt file in File Explorer and select Delete.
  • That is everything. No cloud resources, accounts, or services need to be cleaned up.

Nice Work!

Nice Work!

Nice work! You just built a full three-site enterprise network from scratch, complete with dynamic routing, centralized services, and built-in redundancy.

You've learned how to:

  • Build a triangle WAN backbone with serial links and configure OSPF single-area routing so every device automatically learns paths to every subnet.
  • Segment user sites into department VLANs with Layer 3 switches handling inter-VLAN routing and DHCP relay forwarding requests to a centralized server.
  • Deploy centralized DHCP, DNS, and HTTPS services in a data center so PCs across all sites receive IP addresses automatically and browse a web server by hostname.
  • Secret Mission: Proved OSPF automatic failover by shutting a WAN link and watching traffic reroute through the triangle's alternate path without any manual intervention.

Ready to quiz yourself?