Build a Multi-VLAN Enterprise Network

Simulate a segmented office network with VLANs, trunking, and ACL security.

Introduction

30 Second Summary

Imagine an office where every employee's computer sits on the same network. The HR team's sensitive payroll data travels alongside a guest visitor's web browsing, with nothing separating them.

In this project, you will build a segmented enterprise network using VLANs to isolate departments, configure a router to allow controlled communication between them, and apply a security rule that blocks guest users from accessing HR resources.

What You'll Build

A simulated 3-department office network for a company called NovaTech, built in Cisco Packet Tracer with VLAN segmentation, inter-VLAN routing, and access control.

By the end of this project, you'll have:

  • A 3-VLAN enterprise network topology with separate HR, Engineering, and Guest departments running on isolated subnets.
  • A router-on-a-stick configuration enabling controlled communication between VLANs through a single physical link.
  • An extended ACL that blocks Guest users from accessing HR resources while allowing all other inter-VLAN traffic.
  • Secret Mission: Configure DHCP pools on the router so devices receive IP addresses automatically instead of static assignment.

Are there any prerequisites?

You only need a basic understanding of networking concepts like IP addresses and what routers and switches do. No prior CLI experience is required.

Set Up Cisco Packet Tracer

Every enterprise network starts with a blueprint. Before configuring VLANs and routing, you need a lab environment where you can build, test, and break things without affecting real hardware.

Cisco Packet Tracer is a free network simulation tool that runs the same CLI commands as real Cisco equipment. In this step, you'll install Packet Tracer and build the NovaTech office network topology.

In this step, get ready to:
  • Create a Skills For All account and install Cisco Packet Tracer.
  • Launch Packet Tracer and sign in.
  • Build a network topology with a router, switch, and six PCs.
Create a Skills For All account and install Packet Tracer

Cisco Packet Tracer requires a free Skills For All account to download and sign in. You'll create your account first, then check if you already have Packet Tracer installed.

  • Open your web browser and go to skillsforall.com.
  • Click Sign Up and complete the registration form to create your free account.
  • Once signed in, search for and enroll in the Getting Started with Cisco Packet Tracer course.

Why enroll in a course?

Enrolling in the free course unlocks the Packet Tracer download on Cisco's Resource Hub. You don't need to complete any course content.

Now check whether Cisco Packet Tracer is already on your machine. Press the Windows key to open your Start menu and type Cisco Packet Tracer.

✔️ I see Packet Tracer 8.2 or newer

You already have what you need. To confirm the version, open Packet Tracer and click Help, then About. You should see version 8.2 or higher.

Skip ahead to the next substep to sign in.

ⓧ I see an older version of Packet Tracer

You'll need to download the latest version. The new installer will replace your existing installation.

  • Navigate to the Resource Hub at netacad.com/resources/lab-downloads.
  • Download the Windows 64-bit version of Packet Tracer.
  • Run the installer.
  • Accept the license agreement.
  • Click through the setup wizard, keeping the default options.
  • Click Finish when the installation completes.

ⓧ I don't see Packet Tracer

No worries. Let's download and install it from scratch.

  • Navigate to the Resource Hub at netacad.com/resources/lab-downloads.
  • Download the Windows 64-bit version of Packet Tracer.
  • Run the downloaded installer file.
  • Accept the license agreement.
  • Click through the setup wizard, keeping the default install location and Start Menu folder.
  • Click Finish when the installation completes.

How much space does it need?

Packet Tracer requires about 1.4 GB of free disk space and 4 GB of RAM. Your 8 GB Windows machine meets both requirements comfortably.

Download page not showing Packet Tracer?

Make sure you're signed in to your Skills For All account on the Resource Hub page. The download only appears after enrollment in the Getting Started course.

If you still can't find it, try searching for Packet Tracer in the Resource Hub search bar.

help me find the Cisco Packet Tracer download on the Skills For All Resource Hub

Launch Packet Tracer and sign in
  • Press the Windows key, type Cisco Packet Tracer, and press Enter to open it.
  • A sign-in screen appears. Enter the email and password you used for your Skills For All account.
  • Click Log In.

After signing in, Packet Tracer opens to the main workspace. You should see a large blank canvas in the center and a device panel at the bottom of the screen.

Sign-in not working?

Double-check that you're using your Skills For All credentials (the account you just created), not a different Cisco account. If you recently created your account, wait a minute and try again.

help me troubleshoot the Cisco Packet Tracer sign-in screen

Build the network topology

NovaTech's office network needs a router, a switch, and six PCs. You'll place each device from the bottom panel and connect them with cables.

The device panel at the bottom-left of your screen has categories for different device types. You'll use three: Network Devices (routers and switches), End Devices (PCs), and Connections (cables).

  • In the bottom-left device panel, click Network Devices (the icon that looks like a router).
  • Click Routers in the sub-category row.
  • Find 2911 in the device list and click it, then click anywhere in the workspace to place the router.
  • Click Switches in the sub-category row.
  • Find 2960 in the device list and click it, then click in the workspace to place the switch to the right of the router.

What are these device models?

The Cisco 2911 is an enterprise router that handles traffic between networks. The Cisco 2960 is a Layer 2 switch that connects devices within the same network and supports VLANs.

  • Click End Devices in the device panel (the icon that looks like a computer).
  • Click PC in the device list.
  • Click six times in the workspace to place six PCs below the switch. Space them out so you can see each one clearly.

You should now have 8 devices in your workspace: one router, one switch, and six PCs (labeled PC0 through PC5). Next, you'll connect them with cables.

  • Click Connections in the device panel (the lightning bolt icon).
  • Select Copper Straight-Through (the solid black line).
  • Click the router. A popup menu of ports appears. Select GigabitEthernet0/0.
  • Click the switch. Select GigabitEthernet0/1 from the popup.

A cable now links the router to the switch. The link lights will flash orange, then turn green after a few seconds.

  • With Copper Straight-Through still selected, click PC0. Select FastEthernet0 from the popup.
  • Click the switch. Select FastEthernet0/1.
  • Connect PC1 to switch port FastEthernet0/2 using the same method.
  • Connect PC2 to switch port FastEthernet0/3.
  • Connect PC3 to switch port FastEthernet0/4.
  • Connect PC4 to switch port FastEthernet0/5.
  • Connect PC5 to switch port FastEthernet0/6.

Why copper straight-through?

Straight-through cables connect devices of different types (PC to switch, router to switch). Crossover cables connect devices of the same type (switch to switch). Since all our connections go between different device types, straight-through is correct for every link.

  • Press Esc to deselect the cable tool.
  • Wait 10-15 seconds for all link lights to stabilize. Each connection should show green or amber (orange) lights on both ends.

What do the link light colors mean?

Green means the link is active and ready to pass traffic. Amber (orange) means the port is still initializing. The switch ports may stay amber for a moment while the spanning tree protocol runs. Both colors indicate a successful physical connection.

  • Save your topology by clicking File, then Save As.
  • Choose your Desktop as the save location and name the file NovaTech-Network.pkt.
  • Click Save.

Link lights staying red?

A red link light means no physical connection was made. Click the cable and check both ends. Make sure you selected the correct port on each device (for example, GigabitEthernet0/0 on the router and GigabitEthernet0/1 on the switch).

If a cable is in the wrong port, delete it by clicking the red X tool in the toolbar, clicking the cable, then re-draw it to the correct ports.

help me fix my Packet Tracer cable connections

✔️ Awesome, all my links are green/amber

Your physical topology is complete. Double-check that your connection map matches the reference below.

ⓧ I'd like to double check my connections

Here's the full connection map for your topology. Verify each cable matches these port assignments:

  • Router GigabitEthernet0/0 to Switch GigabitEthernet0/1 (straight-through copper cable).
  • PC0 FastEthernet0 to Switch FastEthernet0/1.
  • PC1 FastEthernet0 to Switch FastEthernet0/2.
  • PC2 FastEthernet0 to Switch FastEthernet0/3.
  • PC3 FastEthernet0 to Switch FastEthernet0/4.
  • PC4 FastEthernet0 to Switch FastEthernet0/5.
  • PC5 FastEthernet0 to Switch FastEthernet0/6.

No VLANs or IP addresses are configured yet. That comes in the next steps.

Your network topology is ready. All devices are physically connected, but they can't communicate yet because there are no VLANs or IP addresses. Next up, you'll configure VLANs on the switch to segment NovaTech's departments into isolated networks.

Configure VLANs and Assign Switch Ports

Right now, all six PCs share the same flat network. Any device can talk to any other device with zero restrictions.

In a real office, you would not want the Guest Wi-Fi on the same network as the HR payroll system. VLANs solve this by creating isolated broadcast domains on a single physical switch. In this step, you will create three VLANs and assign each department's ports so traffic stays separated at the switch level.

In this step, get ready to:
  • Create three VLANs (HR, Engineering, Guest) on the switch.
  • Assign access ports to each VLAN so PCs are isolated by department.
  • Configure a trunk link to carry all VLAN traffic up to the router.
Create VLANs on the switch

Before assigning ports, you need to tell the switch which VLANs exist. Each VLAN gets an ID number and a human-readable name so you can identify departments at a glance.

  • Click the switch in your Packet Tracer workspace to open its configuration window.
  • Click the CLI tab at the top of the window.
  • Press Enter if you see a blank screen to get the Switch> prompt.
  • Enter privileged EXEC mode and create the three VLANs by entering these commands:
enable
configure terminal
hostname SW1
vlan 10
name HR
vlan 20
name Engineering
vlan 30
name Guest
end

What do these commands do?

  • enable moves you from user mode into privileged EXEC mode, which gives you full access to all switch commands.
  • configure terminal enters global configuration mode where you can change switch settings.
  • hostname SW1 sets the switch's name to SW1 so you can identify it in the CLI prompt.
  • vlan 10 creates VLAN 10, and name HR gives it a descriptive label. The same pattern repeats for VLANs 20 and 30.
  • end exits all configuration modes and returns you to privileged EXEC mode.
  • Verify the VLANs were created by running:
show vlan brief

You should see VLAN 10 (HR), VLAN 20 (Engineering), and VLAN 30 (Guest) listed in the output table alongside the default VLAN 1.

Don't see your VLANs listed?

  • Make sure you typed end after creating the VLANs. If you are still in VLAN configuration mode, the show vlan brief command will not work.
  • Check for typos in the VLAN numbers. If you accidentally created VLAN 100 instead of VLAN 10, delete it with no vlan 100 in global configuration mode and try again.

Help me troubleshoot my VLAN creation on a Cisco 2960 switch in Packet Tracer. I ran the commands but my VLANs are not appearing in show vlan brief.

Assign access ports to each VLAN

Creating VLANs alone does not isolate traffic. You must explicitly tell the switch which physical ports belong to which VLAN. Each port configured as an access port carries traffic for only one VLAN.

  • Assign the six PC ports to their respective VLANs by entering these commands:
configure terminal
interface range FastEthernet0/1-2
switchport mode access
switchport access vlan 10
interface range FastEthernet0/3-4
switchport mode access
switchport access vlan 20
interface range FastEthernet0/5-6
switchport mode access
switchport access vlan 30
end

What do these commands do?

  • interface range FastEthernet0/1-2 selects multiple ports at once so you can configure them together.
  • switchport mode access tells the port it belongs to exactly one VLAN and should not negotiate trunking.
  • switchport access vlan 10 assigns those ports to VLAN 10 (HR). The same pattern repeats for VLANs 20 and 30.
  • Verify the port assignments by running:
show vlan brief

You should now see FastEthernet0/1-2 under VLAN 10, FastEthernet0/3-4 under VLAN 20, and FastEthernet0/5-6 under VLAN 30.

Ports still showing under VLAN 1?

  • Double-check that you typed switchport access vlan 10 (not just switchport mode access). Setting the mode alone does not move the port to a new VLAN.
  • Make sure you used interface range FastEthernet0/1-2 with no spaces around the dash. A space before the dash causes a syntax error.

Help me figure out why my switch ports are still in VLAN 1 after I ran the access port commands in Packet Tracer.

Configure the trunk link to the router

Your PCs are now isolated into three VLANs, but the switch needs a way to send all three VLANs' traffic up to the router on a single cable. A trunk port uses 802.1Q tagging to label each frame with its VLAN ID so the router knows which VLAN it belongs to.

  • Configure the uplink port as a trunk by entering these commands:
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
end

What do these commands do?

  • interface GigabitEthernet0/1 selects the uplink port connected to the router.
  • switchport mode trunk forces this port into trunking mode so it carries traffic for multiple VLANs.
  • switchport trunk allowed vlan 10,20,30 restricts the trunk to only carry traffic for your three VLANs. This is a security best practice that prevents unknown VLANs from crossing the link.
  • Verify the trunk is active by running:
show interfaces GigabitEthernet0/1 trunk

You should see GigabitEthernet0/1 listed as a trunk with VLANs 10, 20, and 30 in the "Vlans allowed on trunk" column.

Trunk not showing as active?

  • Confirm you selected the correct interface. The uplink ports on a 2960 are GigabitEthernet, not FastEthernet. If you typed FastEthernet0/1 instead of GigabitEthernet0/1, the trunk is on the wrong port.
  • Make sure the cable between the switch and router is connected to the GigabitEthernet0/1 port on the switch side. You can verify by hovering over the link in Packet Tracer to see the port label.

Help me troubleshoot why my trunk link between the switch and router is not showing as active in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure you see all three VLANs with correct port assignments in show vlan brief and the trunk carrying VLANs 10, 20, 30 in show interfaces GigabitEthernet0/1 trunk.

ⓧ I'd like to double check the full code

Here is the complete switch configuration you should have entered across all three substeps:

enable
configure terminal
hostname SW1
!
vlan 10
 name HR
vlan 20
 name Engineering
vlan 30
 name Guest
!
interface range FastEthernet0/1-2
 switchport mode access
 switchport access vlan 10
!
interface range FastEthernet0/3-4
 switchport mode access
 switchport access vlan 20
!
interface range FastEthernet0/5-6
 switchport mode access
 switchport access vlan 30
!
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
!
end

Your switch now has three isolated VLANs with a trunk carrying all of them to the router. Next up, you will configure the router to perform inter-VLAN routing so departments can communicate in a controlled way.

Configure Router-on-a-Stick Inter-VLAN Routing

Your switch is fully configured with three VLANs and a trunk link ready to carry tagged traffic to the router.

Right now, devices on different VLANs cannot communicate with each other because VLANs create separate broadcast domains. The router needs to receive tagged frames from each VLAN, route between them, and send traffic back on the correct VLAN. You will configure this using the router-on-a-stick pattern, where a single physical interface is split into multiple sub-interfaces to handle each VLAN.

In this step, get ready to:
  • Bring up the router's physical interface.
  • Create sub-interfaces with 802.1Q encapsulation for each VLAN.
  • Verify that the router has connected routes for all three subnets.
Open the router CLI and bring up the physical interface

Router interfaces in Cisco IOS start in a shutdown state by default. Before you can create sub-interfaces, the physical interface they depend on must be enabled.

  • Click the router (R1) in your topology.
  • Go to the CLI tab.
  • Enter privileged EXEC mode and configure the hostname and interface by running these commands:
enable
configure terminal
hostname R1
interface GigabitEthernet0/0
 no shutdown
 exit

What do these commands do?

  • enable enters privileged EXEC mode, giving you access to configuration commands.
  • configure terminal enters global configuration mode where you can change the router's settings.
  • hostname R1 names the router so you can identify it in your topology.
  • interface GigabitEthernet0/0 selects the physical interface connected to your switch.
  • no shutdown enables the interface. Without this, the port stays administratively down and ignores all traffic.
  • After running no shutdown, you should see a message indicating the interface changed state to up.

Interface still showing as down?

  • Make sure you typed GigabitEthernet0/0 (the router port), not GigabitEthernet0/1 (the switch port name).
  • Confirm the cable between the router and switch is connected. Check that the link light on GigabitEthernet0/0 turns green in the topology view.
  • help me troubleshoot why my router interface is still down after no shutdown
Create sub-interfaces for each VLAN

A sub-interface is a logical division of a physical interface. Each sub-interface is assigned to one VLAN using 802.1Q encapsulation, which tells the router how to read and write VLAN tags on frames passing through.

  • Create sub-interfaces for VLAN 10 (HR), VLAN 20 (Engineering), and VLAN 30 (Guest) by running these commands:
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 exit
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 exit
interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 exit
end

What does this configuration do?

Each sub-interface follows the same three-line pattern:

  • interface GigabitEthernet0/0.10 creates a sub-interface. The .10 suffix is a convention matching the VLAN number for easy identification.
  • encapsulation dot1Q 10 tells the router to tag frames on this sub-interface with VLAN 10. This matches the trunk on the switch side.
  • ip address 192.168.10.1 255.255.255.0 assigns the gateway IP for that VLAN's subnet. Devices on VLAN 10 will use this address as their default gateway.

The end command exits configuration mode entirely and returns you to privileged EXEC mode.

Why router-on-a-stick instead of a Layer 3 switch?

A Layer 3 switch can also route between VLANs using SVIs (Switch Virtual Interfaces). The router-on-a-stick pattern uses a dedicated router instead.

Router-on-a-stick is the standard approach when your switch is Layer 2 only (like the 2960). It is also the pattern tested most heavily in CCNA exams and entry-level network engineer interviews.

  • You should now be back at the R1# prompt.

Seeing a command error?

  • If you see Invalid input detected, double check your spacing. The sub-interface number goes directly after the interface name with no space: GigabitEthernet0/0.10 not GigabitEthernet0/0 .10.
  • Make sure you ran exit after each sub-interface before starting the next one. Otherwise you are still inside the previous sub-interface context.
  • help me fix the command error when creating router sub-interfaces
Verify the sub-interfaces are up

Now confirm that all three sub-interfaces are active and have the correct IP addresses assigned.

  • Check the interface status by running this command:
show ip interface brief

What should I see?

You should see three sub-interfaces listed: GigabitEthernet0/0.10, GigabitEthernet0/0.20, and GigabitEthernet0/0.30. Each one should show status "up" and protocol "up" with its assigned IP address.

The parent interface GigabitEthernet0/0 should also show as up/up with no IP address (the sub-interfaces carry the IPs instead).

  • Confirm the router knows about all three subnets by running:
show ip route
  • You should see three connected routes: 192.168.10.0/24, 192.168.20.0/24, and 192.168.30.0/24. These routes marked with a "C" confirm the router can reach each VLAN subnet directly.

Sub-interfaces showing as down?

  • If a sub-interface shows "up/down", the physical interface beneath it may not be enabled. Go back and confirm you ran no shutdown on GigabitEthernet0/0 (the parent interface).
  • If the parent interface shows "up/up" but a sub-interface shows "down/down", verify the encapsulation VLAN number matches a VLAN that exists on the switch trunk. For example, encapsulation dot1Q 10 requires VLAN 10 to be in the trunk's allowed list.
  • help me troubleshoot sub-interfaces that are down

✔️ Awesome, I've got everything!

Great. Double check you see all three sub-interfaces as up/up, then move on to assigning PC IP addresses.

ⓧ I'd like to double check the full code

Here is the complete router configuration you should have entered in this step:

enable
configure terminal
hostname R1
!
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
!
end

Your router is now ready to route traffic between all three VLANs. Next up, you will assign IP addresses to the PCs and test whether devices on different VLANs can actually talk to each other.

Assign PC IP Addresses and Test Connectivity

Your router and switch are fully configured, but the PCs still have no idea how to talk to each other. Every device on a network needs its own IP address and a default gateway that tells it where to send traffic destined for other subnets.

In this step, you will assign static IP addresses to all six PCs and then run ping tests to prove that both intra-VLAN and inter-VLAN communication works through the router.

In this step, get ready to:
  • Assign static IP addresses, subnet masks, and gateways to all six PCs.
  • Test intra-VLAN connectivity with a ping between two HR PCs.
  • Test inter-VLAN connectivity by pinging across VLANs through the router.
Configure static IPs on each PC

Each PC needs three values: an IP address in the correct VLAN subnet, a subnet mask that defines the network boundary, and a default gateway pointing to the router sub-interface for that VLAN.

  • Click PC0 in your topology to open its configuration window.
  • Go to the Desktop tab at the top.
  • Click IP Configuration.
  • Make sure Static is selected (not DHCP).
  • Enter 192.168.10.10 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 192.168.10.1 in the Default Gateway field.
  • Close the PC0 window.

Now repeat the same process for the remaining five PCs using the values below.

  • PC1: IP 192.168.10.11, Mask 255.255.255.0, Gateway 192.168.10.1.
  • PC2: IP 192.168.20.10, Mask 255.255.255.0, Gateway 192.168.20.1.
  • PC3: IP 192.168.20.11, Mask 255.255.255.0, Gateway 192.168.20.1.
  • PC4: IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1.
  • PC5: IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1.

Why does each PC need a default gateway?

A PC can only talk directly to other devices on the same subnet. When it needs to reach a different VLAN (a different subnet), it sends the traffic to its default gateway instead.

The gateway is the router sub-interface IP for that VLAN. The router then forwards the packet to the correct destination VLAN.

Quick way to spot typos

Notice the pattern: HR PCs use 192.168.10.x, Engineering PCs use 192.168.20.x, and Guest PCs use 192.168.30.x. The third octet always matches the VLAN ID.

  • After configuring all six PCs, click on any PC and verify that the IP Configuration screen shows the correct values. Spot-check at least one PC from each VLAN.

IP configuration won't save?

Make sure you clicked Static and not DHCP at the top of the IP Configuration panel. If DHCP is selected, the fields are greyed out and won't accept manual input.

Also confirm you are clicking the correct PC. Hover over each device to see its label (PC0, PC1, etc.).

Help me troubleshoot my PC IP configuration in Packet Tracer.

Test intra-VLAN connectivity

Before testing across VLANs, confirm that devices within the same VLAN can reach each other. This validates that the switch port assignments and IP addressing are correct.

  • Click PC0 (HR VLAN) to open its window.
  • Go to the Desktop tab.
  • Click Command Prompt.
  • Ping PC1 (the other HR PC) by running this command:
ping 192.168.10.11

You should see four replies with Reply from 192.168.10.11 and 0% packet loss.

What does this ping prove?

This ping stays entirely within VLAN 10. It never touches the router. A successful reply confirms that the switch is correctly forwarding frames between ports assigned to VLAN 10, and that both PCs have valid IP addresses on the same subnet.

Seeing Request timed out?

The first one or two pings may time out while ARP resolves the MAC address. Wait a few seconds and try the ping command again.

If all four pings fail, double-check that PC1's IP address is exactly 192.168.10.11 and that both PC0 and PC1 are connected to switch ports in VLAN 10 (FastEthernet0/1 and FastEthernet0/2).

Help me fix my intra-VLAN ping failure.

Test inter-VLAN connectivity

Now for the real test. Devices on different VLANs cannot communicate directly through the switch. Their traffic must travel up to the router, get routed between sub-interfaces, and come back down. This is the router-on-a-stick pattern in action.

  • Still in PC0's Command Prompt, ping PC2 (Engineering VLAN) by running:
ping 192.168.20.10

You should see four replies from 192.168.20.10 with 0% packet loss. This confirms that traffic from VLAN 10 is being routed to VLAN 20 through the router.

  • Close PC0's window.
  • Click PC4 (Guest VLAN) to open its window.
  • Go to Desktop > Command Prompt.
  • Ping PC0 (HR VLAN) from the Guest network by running:
ping 192.168.10.10

This should also succeed with four replies. Right now there is no security policy in place, so all VLANs can talk to each other freely. You will lock this down in the next step.

Why does Guest-to-HR work right now?

The router's job is to forward packets between any connected networks. Without an access control list (ACL) telling it otherwise, it routes everything. This is exactly the problem you will solve next by adding a security rule.

Inter-VLAN pings failing?

Check that the router's physical interface GigabitEthernet0/0 is in a no shutdown state. Click the router, go to the CLI tab, and run show ip interface brief to confirm all sub-interfaces show up/up.

Also verify that each PC's default gateway matches the router sub-interface IP for its VLAN. A missing or incorrect gateway means the PC has nowhere to send cross-subnet traffic.

Help me troubleshoot my inter-VLAN routing.

All six PCs can now communicate across VLANs through the router. Next up, you will add a security policy that blocks Guest users from reaching HR resources while keeping all other traffic flowing.

Implement an ACL to Secure the HR VLAN

In the previous step, you confirmed that all departments can communicate freely across VLANs. That's great for connectivity, but terrible for security.

In a real enterprise, Guest users should never have access to sensitive HR resources like payroll systems or employee records. You'll now create an Access Control List (ACL) on the router that blocks Guest VLAN traffic from reaching the HR VLAN while leaving all other communication untouched.

In this step, get ready to:
  • Create an extended ACL that denies Guest-to-HR traffic.
  • Apply the ACL to the correct sub-interface.
  • Verify that the ACL selectively blocks Guest-to-HR while allowing everything else.
Create an extended ACL to block Guest-to-HR traffic

An extended ACL can filter traffic based on both source and destination IP addresses. This lets you write a rule that specifically targets traffic from the Guest subnet headed for the HR subnet, without affecting anything else.

  • Click the router (R1) in your topology.
  • Go to the CLI tab.
  • Enter privileged EXEC mode and global configuration mode by entering these commands:
enable
configure terminal
  • Create the extended ACL by entering these two lines:
access-list 100 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip any any

What do these ACL lines do?

The first line creates ACL number 100 (extended ACLs use numbers 100-199) and denies all IP traffic from the Guest subnet (192.168.30.0 0.0.0.255) destined for the HR subnet (192.168.10.0 0.0.0.255).

The 0.0.0.255 is a wildcard mask, which is the inverse of a subnet mask. It means "match any host in this /24 network."

The second line permits all other traffic. Without this line, the ACL would block everything because Cisco ACLs have an implicit "deny all" at the end.

Why an extended ACL instead of a standard ACL?

Standard ACLs (numbered 1-99) can only filter by source IP address. Extended ACLs (numbered 100-199) can filter by both source AND destination, which is exactly what you need here. You want to block traffic from Guest specifically when it's going to HR, not block Guest from everything.

Apply the ACL to the Guest sub-interface

An ACL does nothing until it's applied to an interface. You'll apply it inbound on the Guest sub-interface so traffic from Guest devices is checked as it enters the router.

  • While still in global configuration mode on R1, enter the Guest sub-interface and apply the ACL by running these commands:
interface GigabitEthernet0/0.30
ip access-group 100 in
end

What does this command do?

The ip access-group 100 in command attaches ACL 100 to the GigabitEthernet0/0.30 sub-interface in the inbound direction. Every packet arriving from the Guest VLAN is now checked against the ACL rules before the router forwards it.

Seeing an error when entering the sub-interface?

Make sure you're in global configuration mode (your prompt should end with (config)#) before entering the interface GigabitEthernet0/0.30 command. If your prompt shows R1#, type configure terminal first.

Help me apply my ACL to the correct interface in Packet Tracer.

Test the ACL with ping commands

Now for the moment of truth. You'll run three ping tests to confirm the ACL works exactly as intended.

  • Click PC4 (Guest VLAN), go to Desktop > Command Prompt.
  • Test Guest-to-HR by pinging PC0:
ping 192.168.10.10

This ping should FAIL with "Request timed out" or "Destination host unreachable." The ACL is blocking Guest traffic destined for HR.

  • Still on PC4, test Guest-to-Engineering by pinging PC2:
ping 192.168.20.10

This ping should SUCCEED. The ACL only blocks Guest-to-HR traffic, not Guest-to-Engineering.

  • Click PC2 (Engineering VLAN), go to Desktop > Command Prompt.
  • Test Engineering-to-HR by pinging PC0:
ping 192.168.10.10

This ping should SUCCEED. Engineering is not blocked by the ACL because the deny rule only targets the Guest subnet (192.168.30.0/24) as the source.

What should I see?

Your three tests confirm that the ACL is working selectively. Guest-to-HR fails. Guest-to-Engineering succeeds. Engineering-to-HR succeeds. This is exactly how enterprise networks protect sensitive departments while still allowing general connectivity.

Guest-to-HR ping still succeeding?

On the router CLI, run show access-lists to confirm ACL 100 exists with both the deny and permit lines. If the ACL exists but isn't working, run show ip interface GigabitEthernet0/0.30 and look for "Inbound access list is 100" in the output.

If neither shows, re-enter the commands from Substep 1 and 2. Make sure you type the wildcard mask 0.0.0.255 (not the subnet mask 255.255.255.0).

Help me figure out why my ACL isn't blocking Guest-to-HR traffic.

✔️ Awesome, I've got everything!

Great. Your router now has a working security policy protecting the HR VLAN from Guest access.

ⓧ I'd like to double check the full code

Here's the complete R1 configuration including the ACL:

enable
configure terminal
hostname R1
!
interface GigabitEthernet0/0
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
!
access-list 100 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip any any
!
interface GigabitEthernet0/0.30
 ip access-group 100 in
!
end

You've built a fully segmented enterprise network with security controls. NovaTech's HR data is now protected from Guest users, while Engineering can still collaborate across departments. Ready to take it further? The Secret Mission challenges you to add DHCP so devices get their IP addresses automatically.

Secret mission

Configure DHCP for Automatic IP Assignment

In a real enterprise network, nobody manually types IP addresses into every device. Configure the router as a DHCP server so new devices automatically receive correct IP addresses, gateways, and DNS settings the moment they connect to the network.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs. Decide whether to keep your resources available, pause them to come back later, or delete them entirely.

Resources you used:

  • Packet Tracer topology file (.pkt) saved on your computer.
  • Cisco Packet Tracer application installed on your Windows machine.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with your VLAN topology or want to build on it for future networking projects.

  • Your .pkt topology file stays on your computer for future use.
  • Cisco Packet Tracer remains installed and ready for other labs.
  • Your Skills For All account stays active for accessing other Cisco courses.

Pause - I'll come back to this later

Close Packet Tracer to free up system memory. Your topology file stays saved on disk so you can reopen it anytime.

  • Save your topology file by pressing Ctrl+S in Packet Tracer.
  • Close Cisco Packet Tracer.
  • To resume later, double-click your .pkt file to reopen it in Packet Tracer.

Delete - I don't want to use this again

Remove all project files and optionally uninstall Packet Tracer from your system.

  • Delete the .pkt topology file. Navigate to the folder where you saved it and delete it permanently.
  • To uninstall Cisco Packet Tracer, open Settings.
  • Select Apps, then Apps & features.
  • Find Cisco Packet Tracer in the list, click it, and select Uninstall.
  • Follow the uninstall wizard to complete the removal.

Nice Work!

Nice Work!

You just built a fully segmented enterprise network from scratch. NovaTech's HR, Engineering, and Guest departments are now isolated, routed, and secured with real Cisco IOS commands.

You've learned how to:

  • Create VLANs on a Cisco 2960 switch and assign access ports to segment traffic by department.
  • Configure router-on-a-stick inter-VLAN routing using sub-interfaces with 802.1Q encapsulation to enable controlled communication across VLANs.
  • Apply an extended ACL to enforce a security policy that blocks Guest users from accessing HR resources while allowing all other traffic.
  • (Secret Mission) Configure DHCP pools on the router to automate IP address assignment across all three VLANs.

Ready to quiz yourself?