Design a Small Business Network

Build a multi-VLAN network with routing, DHCP, and ACLs in Packet Tracer.

Introduction

30 Second Summary

Every office network you've ever connected to was designed by someone. They decided which departments could talk to each other, which devices got automatic IP addresses, and which traffic got blocked for security.

In this project, you will design and build a complete small business network for a fictional company called "TechFlow Solutions" using Cisco Packet Tracer, then document and publish it to GitHub as a professional portfolio piece.

What You'll Build

A multi-department network simulation with three VLANs, inter-VLAN routing, automatic IP assignment via DHCP, and security policies enforced by ACLs.

By the end of this project, you'll have:

  • A fully functional network topology with 3 department VLANs communicating through a router using Router-on-a-Stick inter-VLAN routing.
  • Professional network documentation including an IP addressing table, exported device configurations, and testing results.
  • A GitHub repository showcasing your networking skills to employers with a polished README and topology diagram.
  • Secret Mission: Expand the network with a second switch and a server VLAN with restricted access.

Are there any prerequisites?

Basic familiarity with the Cisco Packet Tracer interface (dragging and dropping devices) is helpful. If you've never opened Packet Tracer before, spend a few minutes exploring the device panel and workspace before starting.

Plan Your Network on Paper

Before configuring a single switch or router, professional network engineers always start with a plan on paper. An IP addressing table maps out every device, every subnet, and every VLAN assignment so you can configure the network confidently without second-guessing.

In this step, you'll design the complete addressing scheme for TechFlow Solutions and document it in a Markdown file. This table becomes your single source of truth for every configuration command in the steps that follow.

In this step, get ready to:
  • Design the IP addressing scheme for 3 department VLANs.
  • Create a professional IP addressing table in VS Code.
  • Save the documentation to your project folder.
Design the IP addressing scheme

TechFlow Solutions has three departments that need to be separated into their own network segments. Each department gets its own VLAN and its own /24 subnet from the 192.168.0.0/16 private address space.

  • VLAN 10 (Management) uses subnet 192.168.10.0/24.
  • VLAN 20 (Sales) uses subnet 192.168.20.0/24.
  • VLAN 30 (IT) uses subnet 192.168.30.0/24.
  • The router gets the .1 address in each subnet as the default gateway (e.g. 192.168.10.1 for Management).

Why /24 subnets?

A /24 subnet means the first three octets identify the network, and the last octet identifies the host. This gives each department up to 254 usable addresses, which is plenty for a small business.

Using a different third octet for each VLAN (10, 20, 30) makes the scheme immediately readable. You can tell which department a device belongs to just by looking at its IP address.

Create the addressing table in VS Code

Now that you have the scheme mapped out, it's time to write it into a proper reference document. You'll create a Markdown table listing every device with its interface, IP address, subnet mask, default gateway, and VLAN.

  • In VS Code, expand the docs/ folder inside techflow-network in the Explorer sidebar.
  • Right-click the docs/ folder and select New File.
  • Name the file ip-addressing-table.md and press Enter.
  • Paste the following content into the new file:
# TechFlow Solutions – IP Addressing Table

## Network Summary
| VLAN | Name | Subnet | Gateway |
|------|------|--------|---------|
| 10 | Management | 192.168.10.0/24 | 192.168.10.1 |
| 20 | Sales | 192.168.20.0/24 | 192.168.20.1 |
| 30 | IT | 192.168.30.0/24 | 192.168.30.1 |

## Device Addressing
| Device | Interface | IP Address | Subnet Mask | Default Gateway | VLAN |
|--------|-----------|------------|-------------|-----------------|------|
| R1 | G0/0.10 | 192.168.10.1 | 255.255.255.0 | N/A | 10 |
| R1 | G0/0.20 | 192.168.20.1 | 255.255.255.0 | N/A | 20 |
| R1 | G0/0.30 | 192.168.30.1 | 255.255.255.0 | N/A | 30 |
| S1 | VLAN 1 | N/A | N/A | N/A | 1 |
| PC1-Management | NIC | 192.168.10.10 | 255.255.255.0 | 192.168.10.1 | 10 |
| PC2-Sales | NIC | 192.168.20.10 | 255.255.255.0 | 192.168.20.1 | 20 |
| PC3-IT | NIC | 192.168.30.10 | 255.255.255.0 | 192.168.30.1 | 30 |
| PC4-IT | NIC | 192.168.30.11 | 255.255.255.0 | 192.168.30.1 | 30 |

What does this table tell you?

The Network Summary section gives a quick overview of which VLAN maps to which subnet and gateway. This is the bird's-eye view you'll reference when creating DHCP pools and subinterfaces later.

The Device Addressing section lists every device individually. Notice that R1 has three subinterfaces (G0/0.10, G0/0.20, G0/0.30) acting as the gateway for each VLAN. S1 is a Layer 2 switch, so it doesn't need an IP for routing traffic.

PC3-IT and PC4-IT share the same subnet (192.168.30.0/24) because they belong to the same department. Their IP addresses differ only in the last octet (.10 and .11).

Save and verify the document
  • Save the file by pressing Cmd+S (macOS) or Ctrl+S (Windows).
  • Preview the rendered Markdown by pressing Cmd+Shift+V (macOS) or Ctrl+Shift+V (Windows).
  • You should see two cleanly formatted tables with all 8 device rows and 3 VLAN summaries rendered without any pipe characters or dashes.

Tables not rendering correctly in preview?

Make sure there is no extra space before the pipe characters (|) at the start of each row. Markdown tables require that the separator row (|------|) sits directly below the header row with no blank lines between them.

If the preview still shows raw text, check that the file extension is .md and that VS Code recognizes it as Markdown (visible in the bottom status bar).

Help me troubleshoot my Markdown table formatting

✔️ Awesome, I've got everything!

Great. Double check you've saved docs/ip-addressing-table.md and move on to the next step.

ⓧ I'd like to double check the full code

Here is the complete docs/ip-addressing-table.md file for comparison:

# TechFlow Solutions – IP Addressing Table

## Network Summary
| VLAN | Name | Subnet | Gateway |
|------|------|--------|---------|
| 10 | Management | 192.168.10.0/24 | 192.168.10.1 |
| 20 | Sales | 192.168.20.0/24 | 192.168.20.1 |
| 30 | IT | 192.168.30.0/24 | 192.168.30.1 |

## Device Addressing
| Device | Interface | IP Address | Subnet Mask | Default Gateway | VLAN |
|--------|-----------|------------|-------------|-----------------|------|
| R1 | G0/0.10 | 192.168.10.1 | 255.255.255.0 | N/A | 10 |
| R1 | G0/0.20 | 192.168.20.1 | 255.255.255.0 | N/A | 20 |
| R1 | G0/0.30 | 192.168.30.1 | 255.255.255.0 | N/A | 30 |
| S1 | VLAN 1 | N/A | N/A | N/A | 1 |
| PC1-Management | NIC | 192.168.10.10 | 255.255.255.0 | 192.168.10.1 | 10 |
| PC2-Sales | NIC | 192.168.20.10 | 255.255.255.0 | 192.168.20.1 | 20 |
| PC3-IT | NIC | 192.168.30.10 | 255.255.255.0 | 192.168.30.1 | 30 |
| PC4-IT | NIC | 192.168.30.11 | 255.255.255.0 | 192.168.30.1 | 30 |

Your network plan is locked in. Next up, you'll open Cisco Packet Tracer and bring this plan to life by building the physical topology.

Build the Topology in Packet Tracer

With your IP addressing plan documented, it is time to bring the network to life.

In this step, you will place devices in Cisco Packet Tracer, connect them with cables, and configure basic security settings on the router and switch. These foundational settings protect the devices from unauthorized access.

In this step, get ready to:
  • Place a router, switch, and PCs in the Packet Tracer workspace.
  • Cable all devices together using the correct interfaces.
  • Configure basic security on the router and switch (hostname, passwords, encryption).
Add devices to the workspace

Every network starts with physical devices. You need one router to handle traffic between VLANs, one switch to connect end devices, and four PCs representing employees in each department.

  • Open Cisco Packet Tracer.
  • In the bottom-left corner, click the Network Devices category in the Device-Type Selection box.
  • Click Routers in the subcategory row.
  • Find the 2911 model in the Device-Specific Selection box and click it, then click in the workspace to place it.
  • Click Switches in the subcategory row.
  • Find the 2960 model and click it, then click in the workspace to place it to the right of the router.
  • Switch to the End Devices category in the Device-Type Selection box.
  • Click PC and place four PCs below the switch, spaced out across the workspace.

You should see 6 devices in your workspace: one router, one switch, and four PCs.

Rename devices for clarity

Click on each device, then click the Config tab and change the Display Name to match your addressing table: R1, S1, PC1, PC2, PC3, PC4.

Connect all devices with cables

Copper straight-through cables connect devices that operate at different layers (router to switch, PC to switch). You will wire the router to the switch, then each PC to its assigned switch port.

  • In the bottom-left Device-Type Selection box, click the Connections category (the lightning bolt icon).
  • Select Copper Straight-Through (the solid black line) from the cable options.
  • Click on R1 and select GigabitEthernet0/0 from the pop-up menu.
  • Click on S1 and select GigabitEthernet0/1. A cable now connects the router to the switch.
  • With Copper Straight-Through still selected, click PC1 and select FastEthernet0.
  • Click S1 and select FastEthernet0/2.
  • Repeat for PC2 to FastEthernet0/3, PC3 to FastEthernet0/4, and PC4 to FastEthernet0/5.

You should see cables connecting all 6 devices. The link lights between each PC and S1 will turn green after a few seconds, indicating active connections. The link between R1 and S1 will show orange or red because the router interface is not yet enabled.

Why orange link lights?

Router interfaces are administratively shut down by default in Cisco IOS. The link light turns green only after you enable the interface with no shutdown (which you will do in a later step when configuring subinterfaces).

Don't see any link lights?

Make sure link lights are enabled. Go to Options in the menu bar, then Preferences, and check Show Link Lights. Also try clicking the Fast Forward Time button in the yellow bar above the workspace to let STP converge.

help me troubleshoot missing link lights in Packet Tracer

Configure basic settings on the router

Before configuring routing, you need to secure the device. A hostname identifies it, an enable secret protects privileged mode, and line passwords protect console and remote access.

  • Double-click R1 to open its configuration window.
  • Click the CLI tab at the top of the window.
  • Press Enter to get the initial prompt if the CLI asks you to proceed.
  • Enter the following commands to configure the router hostname and passwords:
enable
configure terminal
hostname R1
enable secret class
line console 0
password cisco
login
exit
line vty 0 4
password cisco
login
exit
service password-encryption
end

What do these commands do?

enable enters privileged EXEC mode (the # prompt). configure terminal enters global configuration mode where you can change device settings.

hostname R1 sets the device name that appears in the CLI prompt. enable secret class protects privileged mode with a hashed password.

The line console 0 and line vty 0 4 sections set passwords for the physical console port and remote (Telnet/SSH) sessions respectively. The login command tells IOS to require the password when someone connects.

service password-encryption encrypts all plaintext passwords stored in the running configuration so they cannot be read in clear text.

  • Verify the configuration by running:
show running-config

You should see the hostname set to R1, the enable secret displayed as an encrypted hash, and the line passwords shown as encrypted strings (type 7).

Still seeing 'Router' as the hostname?

Make sure you typed configure terminal before the hostname command. Commands entered in privileged EXEC mode (Router#) instead of global config mode (Router(config)#) will not be accepted.

help me fix my router hostname configuration in Packet Tracer

Configure basic settings on the switch

The switch needs the same baseline security as the router. This ensures only authorized users can manage it.

  • Close the router window and double-click S1 to open its configuration window.
  • Click the CLI tab.
  • Press Enter if prompted.
  • Enter the following commands to configure the switch:
enable
configure terminal
hostname S1
enable secret class
line console 0
password cisco
login
exit
line vty 0 15
password cisco
login
exit
service password-encryption
end

Why does the switch use line vty 0 15?

The Cisco 2960 switch supports 16 simultaneous VTY (remote access) sessions, numbered 0 through 15. The 2911 router supports 5 sessions (0 through 4). Both need passwords set on every available VTY line to prevent unauthorized remote access.

  • Verify the configuration by running:
show running-config

You should see the hostname set to S1, with all passwords encrypted.

  • Save your Packet Tracer file by going to File then Save As. Name it techflow-network.pkt and save it inside your techflow-network project folder on your Desktop.

Switch CLI not responding?

If the switch CLI shows startup messages scrolling, wait for them to finish and then press Enter. If you see a prompt asking whether to enter the initial configuration dialog, type no and press Enter.

help me troubleshoot my switch CLI in Packet Tracer

✔️ Awesome, I've got everything!

Great. Double check that you have saved your Packet Tracer file. Your workspace should have R1 connected to S1, and all four PCs connected to S1 on separate FastEthernet ports.

ⓧ I'd like to double check my topology

Your topology should match this summary:

  • R1 (2911): hostname R1, enable secret class, console/VTY password cisco, service password-encryption enabled.
  • S1 (2960): hostname S1, enable secret class, console/VTY password cisco, service password-encryption enabled.
  • R1 GigabitEthernet0/0 connected to S1 GigabitEthernet0/1 (straight-through cable).
  • PC1 connected to S1 Fa0/2.
  • PC2 connected to S1 Fa0/3.
  • PC3 connected to S1 Fa0/4.
  • PC4 connected to S1 Fa0/5.

Run show running-config on both R1 and S1 to confirm hostnames and encrypted passwords appear correctly.

Your physical topology is wired and secured. Next up, you will create VLANs on the switch to separate each department's traffic and configure trunk links so the router can see all VLAN traffic.

Configure VLANs and Trunking

Your switch and router are secured with passwords and hostnames. Now it is time to create the logical network segments that will separate TechFlow Solutions' departments from each other.

VLANs (Virtual LANs) let you group switch ports into isolated networks without needing separate physical hardware. You will create three VLANs for Management, Sales, and IT, then configure a trunk link so all VLAN traffic can travel between the switch and router on a single cable.

In this step, get ready to:
  • Create three department VLANs and assign switch ports to each one.
  • Configure a trunk link between your switch and router.
  • Secure all unused switch ports by shutting them down.
Create VLANs and assign switch ports

Right now, every port on S1 belongs to the same default VLAN (VLAN 1). That means all four PCs can see each other's broadcast traffic. You need to create separate VLANs and assign each PC's port to the correct one.

  • In Packet Tracer, click on switch S1 to open its properties window.
  • Click the CLI tab to access the command line.
  • Enter privileged exec mode and then global configuration mode by running these commands:
enable
configure terminal
  • Create the three department VLANs by running these commands:
vlan 10
name Management
vlan 20
name Sales
vlan 30
name IT

What do these commands do?

Each vlan command creates a new VLAN with that ID number. The name command gives it a human-readable label so you can identify each VLAN by department instead of just a number.

  • Assign each PC's switch port to its department VLAN by running these commands:
interface fa0/2
switchport mode access
switchport access vlan 10
interface fa0/3
switchport mode access
switchport access vlan 20
interface range fa0/4-5
switchport mode access
switchport access vlan 30

What does this configuration do?

switchport mode access tells the port it connects to a single end device (not another switch). switchport access vlan 10 assigns that port to VLAN 10 so only Management traffic flows through it.

interface range fa0/4-5 lets you configure multiple ports at once. Both ports 4 and 5 get assigned to VLAN 30 (IT) since TechFlow has two IT workstations.

  • Exit configuration mode and verify your VLANs by running:
end
show vlan brief

You should see VLANs 10, 20, and 30 listed with their names. Fa0/2 should appear under VLAN 10, Fa0/3 under VLAN 20, and Fa0/4-5 under VLAN 30.

Don't see your VLANs or port assignments?

Make sure you typed vlan 10 (not vlan10 without the space). The space between vlan and the number is required.

If a port still shows under VLAN 1, confirm you entered switchport access vlan 10 while inside the correct interface (check the prompt says S1(config-if)#).

Help me troubleshoot my VLAN configuration in Packet Tracer. I ran show vlan brief but my ports are not assigned to the correct VLANs.

Configure the trunk link between S1 and R1

Your VLANs now isolate each department, but that isolation also means no VLAN can reach the router. A trunk link carries traffic from all VLANs across a single physical cable using 802.1Q tags to identify which VLAN each frame belongs to.

  • Enter global configuration mode and configure the uplink port to R1 as a trunk by running these commands:
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
end

What does switchport mode trunk do?

A trunk port tags every outgoing frame with its VLAN ID (using the 802.1Q standard) so the router on the other end knows which VLAN the frame belongs to. Without trunking, only one VLAN's traffic could travel over the cable to the router.

The 2960 switch only supports 802.1Q trunking, so no additional encapsulation command is needed.

  • Verify the trunk is active by running:
show interfaces trunk

You should see GigabitEthernet0/1 listed as a trunk port with VLANs 1-4094 allowed.

Trunk not showing up?

If show interfaces trunk returns nothing, wait 10-15 seconds and try again. The Spanning Tree Protocol (STP) needs time to converge after a port mode change.

Also confirm the cable between R1 and S1 is connected to GigabitEthernet0/1 on the switch (not a FastEthernet port). You can hover over the cable endpoints in the topology to check.

Help me figure out why my trunk link is not working between my switch and router in Packet Tracer.

Secure unused switch ports

Any switch port left active and unassigned is a security risk. An attacker could plug into an open port and access your network. Best practice is to shut down every unused port and assign it to a dedicated "parking lot" VLAN that goes nowhere.

  • Create VLAN 99 (ParkingLot) and shut down all unused ports by running these commands:
configure terminal
vlan 99
name ParkingLot
interface range fa0/6-24
switchport mode access
switchport access vlan 99
shutdown
end

Why a ParkingLot VLAN?

Assigning unused ports to VLAN 99 means even if someone plugs in a device, it lands on an isolated VLAN with no gateway and no access to your production traffic. The shutdown command adds a second layer of protection by electrically disabling the port entirely.

  • Confirm the ports are shut down by running:
show vlan brief

You should see ports Fa0/6 through Fa0/24 listed under VLAN 99. The ports will also show as administratively down if you run show ip interface brief.

Ports still showing in VLAN 1?

If any ports from Fa0/6-24 still appear under VLAN 1, confirm you created VLAN 99 before assigning ports to it. The VLAN must exist first for the assignment to take effect.

Double-check that interface range fa0/6-24 has a space between fa0/6 and the dash. The correct syntax is fa0/6-24 with no spaces around the dash.

Help me fix my unused port configuration on the switch.

✔️ Awesome, I've got everything!

Great. Double check you see VLANs 10, 20, 30, and 99 in show vlan brief with the correct port assignments, and that show interfaces trunk shows GigabitEthernet0/1 as a trunk.

ⓧ I'd like to double check the full configuration

Here is the complete sequence of commands you should have entered on S1 during this step:

enable
configure terminal
vlan 10
name Management
vlan 20
name Sales
vlan 30
name IT
interface fa0/2
switchport mode access
switchport access vlan 10
interface fa0/3
switchport mode access
switchport access vlan 20
interface range fa0/4-5
switchport mode access
switchport access vlan 30
interface GigabitEthernet0/1
switchport mode trunk
vlan 99
name ParkingLot
interface range fa0/6-24
switchport mode access
switchport access vlan 99
shutdown
end

Your switch is now properly segmented with three department VLANs, a secure trunk link to the router, and all unused ports locked down. Next up, you will configure the router to route traffic between these VLANs using subinterfaces.

Configure Router-on-a-Stick Inter-VLAN Routing

Right now, your VLANs are completely isolated from each other. A PC in the Sales VLAN cannot talk to a PC in the Management VLAN, even though they share the same physical switch.

To enable communication between VLANs, you need a router. The technique you'll use is called Router-on-a-Stick. It uses a single physical connection between the router and switch, split into virtual subinterfaces that each handle traffic for one VLAN.

In this step, get ready to:
  • Create router subinterfaces for each VLAN with 802.1Q encapsulation.
  • Assign static IP addresses to all four PCs.
  • Test inter-VLAN routing by pinging between departments.
Enable the physical interface and create the first subinterface

Before subinterfaces can carry traffic, the physical interface they belong to must be enabled. Then you'll create your first subinterface and tag it with the VLAN number using 802.1Q encapsulation.

  • Click on router R1 in your Packet Tracer topology to open it.
  • Switch to the CLI tab.
  • Enter privileged exec and global configuration mode, then enable the physical interface and create subinterface G0/0.10 by entering these commands:
enable
configure terminal

! Enable the physical interface
interface GigabitEthernet0/0
no shutdown
exit

! Create the Management VLAN subinterface
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

What does this configuration do?

The no shutdown command activates the physical GigabitEthernet0/0 interface. Without this, all subinterfaces remain down regardless of their individual configuration.

The encapsulation dot1Q 10 command tells the router that this subinterface handles frames tagged with VLAN 10. The IP address 192.168.10.1 becomes the default gateway for all devices in the Management VLAN.

Why Router-on-a-Stick instead of a Layer 3 switch?

Router-on-a-Stick makes you configure subinterfaces, VLAN tagging, and routing decisions explicitly. A Layer 3 switch uses SVIs (Switch Virtual Interfaces) that abstract some of this away.

ROAS is the standard CCNA teaching method and what employers expect networking beginners to understand first. It gives you a clearer picture of how packets actually flow between VLANs.

  • You should see a message like %LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up confirming the physical interface is active.

Not seeing the interface come up?

Make sure the cable between R1 G0/0 and S1 G0/1 is still connected. In Packet Tracer, green triangles on both ends of the link indicate connectivity.

If you see a syntax error, double-check that you typed GigabitEthernet0/0 (not FastEthernet). The 2911 router uses GigabitEthernet interfaces.

Help me troubleshoot why my R1 GigabitEthernet0/0 interface won't come up in Packet Tracer.

Create the remaining subinterfaces and verify
  • Still in global configuration mode on R1, create the Sales and IT subinterfaces by entering these commands:
! Create the Sales VLAN subinterface
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

! Create the IT VLAN subinterface
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What does this configuration do?

Each subinterface matches one VLAN. G0/0.20 handles VLAN 20 (Sales) traffic, and G0/0.30 handles VLAN 30 (IT) traffic.

The router now has three logical interfaces on a single physical port. When it receives a tagged frame, it reads the VLAN tag, routes the packet to the correct destination subinterface, and re-tags it before sending it back out.

  • Verify all subinterfaces are up by running this command:
do show ip interface brief
  • You should see GigabitEthernet0/0, GigabitEthernet0/0.10, GigabitEthernet0/0.20, and GigabitEthernet0/0.30 all showing up in both the Status and Protocol columns.

Seeing 'down' on the subinterfaces?

If the subinterfaces show as down, check that you ran no shutdown on the physical GigabitEthernet0/0 interface. Subinterfaces inherit the up/down state from their parent interface.

Also verify the trunk link is still active on S1. The link indicators between R1 and S1 should both be green triangles.

Help me figure out why my router subinterfaces are showing down.

Assign static IP addresses to PCs and test connectivity

With the router ready to forward traffic between VLANs, each PC needs an IP address and a default gateway so it knows where to send traffic destined for other networks.

  • Click on PC1 in the topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Make sure Static is selected (not DHCP).
  • Enter the following values for PC1:
  • IP Address: 192.168.10.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.10.1
  • Repeat the same process for the remaining PCs with these values:
  • PC2: IP 192.168.20.10, Subnet Mask 255.255.255.0, Default Gateway 192.168.20.1.
  • PC3: IP 192.168.30.10, Subnet Mask 255.255.255.0, Default Gateway 192.168.30.1.
  • PC4: IP 192.168.30.11, Subnet Mask 255.255.255.0, Default Gateway 192.168.30.1.

Why does every PC need a default gateway?

The default gateway tells a PC where to send traffic that is not on its own subnet. When PC1 (192.168.10.10) wants to reach PC2 (192.168.20.10), it recognizes that 192.168.20.x is a different network and forwards the packet to its gateway (192.168.10.1) for routing.

Now test that inter-VLAN routing is working.

  • Click on PC1 and go to the Desktop tab.
  • Click Command Prompt.
  • Test connectivity to PC2 in the Sales VLAN by typing this command:
ping 192.168.20.10
  • You should see replies coming back from 192.168.20.10. The first ping may time out (this is normal as the router builds its ARP table), but the remaining 3 should succeed.
  • Also try pinging PC3 in the IT VLAN to confirm all three VLANs can communicate:
ping 192.168.30.10
  • You should see successful replies from 192.168.30.10 as well.
  • Save your Packet Tracer file by pressing Ctrl+S (Windows) or Cmd+S (macOS).

Pings failing between VLANs?

If the first ping times out but the rest succeed, that is normal. Packet Tracer needs time to build ARP entries. If ALL pings fail, check these common causes:

  • Verify the default gateway on each PC matches the router subinterface IP for that VLAN (e.g., PC1's gateway must be 192.168.10.1, not 192.168.20.1).
  • Confirm the trunk between S1 and R1 is still active by running show interfaces trunk on S1.
  • Check that the VLAN number in each encapsulation dot1Q command matches the VLAN assigned to the switch port (e.g., G0/0.10 must use dot1Q 10, not a different number).

Help me debug why pings fail between my VLANs even though subinterfaces are up.

✔️ Awesome, I've got everything!

Great. Make sure your Packet Tracer file is saved before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete R1 subinterface configuration and PC addressing for this step:

! R1 Router Configuration (this step)
!
enable
configure terminal

! Enable physical interface
interface GigabitEthernet0/0
no shutdown
exit

! Subinterface for VLAN 10 (Management)
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

! Subinterface for VLAN 20 (Sales)
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

! Subinterface for VLAN 30 (IT)
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

! Verify with:
! show ip interface brief

! ---
! PC Static IP Assignments (set via Desktop > IP Configuration > Static):
!
! PC1: IP 192.168.10.10, Mask 255.255.255.0, Gateway 192.168.10.1
! PC2: IP 192.168.20.10, Mask 255.255.255.0, Gateway 192.168.20.1
! PC3: IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1
! PC4: IP 192.168.30.11, Mask 255.255.255.0, Gateway 192.168.30.1

Your departments can now talk to each other through the router. Next up, you'll automate IP addressing with DHCP so you don't have to configure every single PC by hand.

Configure DHCP on the Router

Your inter-VLAN routing is working. PCs in different departments can communicate through the router's subinterfaces.

Right now, every PC has a manually configured IP address. In a real office with dozens of devices, assigning IPs by hand is impractical and error-prone. DHCP automates this by handing out addresses from a pool you define on the router.

In this step, get ready to:
  • Reserve a range of addresses for static devices so DHCP never assigns them.
  • Create DHCP pools for each department VLAN.
  • Switch all PCs from static IPs to DHCP and verify they receive addresses automatically.
Reserve addresses for static devices

Before creating DHCP pools, you need to tell the router which addresses it should never hand out. These reserved addresses are for devices that need a predictable IP, like the router gateway itself and any future servers or printers.

  • In Packet Tracer, click on router R1 and select the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode by running these commands:
enable
configure terminal
  • Exclude the first 10 addresses in each VLAN subnet by entering these commands:
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp excluded-address 192.168.30.1 192.168.30.10

What do these commands do?

Each ip dhcp excluded-address command tells the router to skip a range of addresses when handing out IPs. The range 192.168.10.1 through 192.168.10.10 reserves the first 10 addresses in each subnet for static devices like gateways, servers, and printers.

The very first address (.1) is already used by R1's subinterface. Reserving .1 through .10 leaves room for other static devices you might add later.

You will not see a visible change yet. The DHCP pools you create next will use these exclusions.

Create DHCP pools for each VLAN

A DHCP pool defines the network range, default gateway, and DNS server that clients in each VLAN will receive automatically.

  • Still in global configuration mode on R1, create the Management pool by entering these commands:
ip dhcp pool MGMT-POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8
  • Exit the pool configuration and create the Sales pool:
exit
ip dhcp pool SALES-POOL
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8
  • Exit and create the IT pool:
exit
ip dhcp pool IT-POOL
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 8.8.8.8
  • Type exit to return to global configuration mode.

What do these pool settings mean?

  • network defines which subnet this pool serves. The router matches incoming DHCP requests to the correct pool based on which subinterface received the request.
  • default-router tells each PC which gateway to use. This is the subinterface IP for that VLAN.
  • dns-server 8.8.8.8 provides Google's public DNS server so PCs can resolve domain names.

You will not see active leases yet. The PCs are still using static IPs. The next substep switches them to DHCP.

Getting a syntax error?

Make sure you are in global configuration mode (the prompt shows R1(config)#) before entering each ip dhcp pool command. If you see R1(dhcp-config)#, you are still inside the previous pool. Type exit first to return to global config.

help me troubleshoot my DHCP pool configuration on R1

✔️ Awesome, I've got everything!

Great. Double check you have all three pools configured, then move on to switch the PCs to DHCP below.

ⓧ I'd like to double check the full DHCP configuration

Here is the complete DHCP configuration you should have entered on R1. Compare it against your running config:

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp excluded-address 192.168.30.1 192.168.30.10

ip dhcp pool MGMT-POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8

ip dhcp pool SALES-POOL
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 8.8.8.8

ip dhcp pool IT-POOL
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
dns-server 8.8.8.8
Switch PCs to DHCP and verify leases

With the pools ready, you can now switch each PC from its static IP to DHCP mode. The router will automatically assign an address from the correct pool based on which VLAN the PC belongs to.

  • Click on PC1 in the topology.
  • Select the Desktop tab.
  • Click IP Configuration.
  • Select the DHCP radio button. You should see a message that says DHCP request successful and the fields populate with an IP address, subnet mask, default gateway, and DNS server.
  • Close the PC1 window.
  • Repeat the same process for PC2, PC3, and PC4. Each PC should receive an address from its VLAN's pool.

What addresses will the PCs receive?

Because you excluded .1 through .10, the first available address in each pool is .11. PC1 should get 192.168.10.11, PC2 should get 192.168.20.11, PC3 should get 192.168.30.11, and PC4 should get 192.168.30.12.

  • Verify DHCP leases on the router by clicking on R1, selecting the CLI tab, and running:
show ip dhcp binding

You should see a table listing each PC's assigned IP address, its MAC address, and the lease expiration. All four PCs should appear.

PCs not receiving addresses?

If a PC shows 0.0.0.0 or the DHCP request fails, try these fixes:

  • Click Static then click DHCP again to force a new request.
  • Verify the trunk link between S1 and R1 is still up. On S1, check that GigabitEthernet0/1 shows as a trunk.
  • Confirm the DHCP pool network statement matches the subinterface subnet exactly. A typo in the subnet mask will prevent the router from matching the pool.

help me troubleshoot why my PCs are not getting DHCP addresses from my router

  • Test connectivity between VLANs by opening PC1, selecting Desktop > Command Prompt, and pinging PC2's new address:
ping 192.168.20.11

You should see successful replies, confirming that DHCP-assigned addresses still route correctly between VLANs.

  • Update your documentation to reflect the switch to DHCP. In VS Code, open docs/ip-addressing-table.md and find the four PC rows at the bottom of the Device Addressing table.
  • Replace the static IP entries with the following DHCP entries:
| PC1-Management | NIC | DHCP (192.168.10.11+) | 255.255.255.0 | 192.168.10.1 | 10 |
| PC2-Sales | NIC | DHCP (192.168.20.11+) | 255.255.255.0 | 192.168.20.1 | 20 |
| PC3-IT | NIC | DHCP (192.168.30.11+) | 255.255.255.0 | 192.168.30.1 | 30 |
| PC4-IT | NIC | DHCP (192.168.30.12+) | 255.255.255.0 | 192.168.30.1 | 30 |
  • Save docs/ip-addressing-table.md.

Why write DHCP (192.168.10.11+) instead of the exact IP?

DHCP addresses can change each time a lease expires and renews. The "+" notation indicates the starting address in the pool. In professional documentation, this signals that the address is dynamic rather than permanently assigned.

Your network now hands out IP addresses automatically. No more manual configuration for every new device that joins. Next up, you will add security to control which departments can talk to each other using Access Control Lists.

Configure Access Control Lists

Your PCs are now receiving IP addresses automatically from the router's DHCP pools. Every department can talk to every other department freely.

In a real business, that level of openness is a security risk. The Sales team has no reason to access Management's network directly. Access Control Lists (ACLs) let you define traffic rules that the router enforces on every packet passing through.

In this step, get ready to:
  • Create an extended ACL that blocks Sales from reaching Management.
  • Apply the ACL to the correct router subinterface.
  • Test and verify the security policy with ping tests.
Create the extended ACL on router R1

An extended ACL inspects the source address, destination address, and protocol of each packet. This gives you precise control over which departments can communicate with which.

You will create ACL 100 with two rules: one that denies traffic from the Sales subnet to the Management subnet, and one that permits everything else.

  • In Packet Tracer, click on router R1 to open its configuration window.
  • Click the CLI tab.
  • Enter privileged EXEC mode and then global configuration mode by running these commands:
enable
configure terminal
  • Create the ACL by entering these two lines:
access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip any any

What do these commands do?

The first line creates ACL number 100 (an extended ACL) that denies all IP traffic originating from the 192.168.20.0/24 subnet (Sales) heading to the 192.168.10.0/24 subnet (Management).

The 0.0.0.255 value is a wildcard mask. It means the first three octets must match exactly, but the last octet can be anything. This targets every host in the subnet.

The second line permits all other traffic. Without it, the ACL's implicit deny would block everything, cutting off all communication.

Why an extended ACL instead of a standard ACL?

Standard ACLs (numbered 1-99) can only filter by source address. Extended ACLs (numbered 100-199) filter by source, destination, and protocol. Since you need to block Sales traffic specifically when it targets Management (not when it targets IT), you need the destination-aware filtering that only an extended ACL provides.

  • Verify your ACL was created by running:
do show access-lists

You should see ACL 100 listed with both the deny and permit statements.

Don't see your ACL listed?

Make sure you typed access-list 100 (not access-list 1 or another number). The number 100 places it in the extended ACL range.

Check that you are in global configuration mode. Your prompt should show R1(config)# before entering the commands.

Help me troubleshoot my ACL configuration in Packet Tracer.

Apply the ACL to the Sales subinterface

An ACL does nothing until you apply it to an interface. Cisco best practice is to place extended ACLs close to the source of the traffic you want to filter. That means applying it inbound on the subinterface that faces the Sales VLAN.

  • While still in global configuration mode on R1, enter the Sales subinterface and apply ACL 100 inbound by running these commands:
interface GigabitEthernet0/0.20
ip access-group 100 in
exit

What does this do?

The ip access-group 100 in command tells the router to check every packet arriving on G0/0.20 (Sales traffic) against ACL 100 before forwarding it.

Applying inbound means Sales traffic destined for Management gets blocked immediately at the source subinterface. It never crosses the router to reach Management's network.

  • Confirm the ACL is applied by running:
do show ip interface GigabitEthernet0/0.20

Look for a line that says Inbound access list is 100. This confirms ACL 100 is active on the Sales subinterface.

ACL not showing on the interface?

Make sure you entered the subinterface with interface GigabitEthernet0/0.20 (not the physical interface G0/0). The ACL must go on the subinterface that handles VLAN 20 traffic.

Verify the direction is in (not out). Inbound filters packets as they arrive from Sales PCs.

Help me fix my ACL interface application.

Test and verify the ACL

The real proof of a security policy is testing it. You will run three ping tests that confirm the ACL blocks exactly what it should and permits everything else.

  • Click on PC2 (Sales) in your topology.
  • Click the Desktop tab, then open Command Prompt.
  • Ping PC1 (Management) by running:
ping 192.168.10.11

This ping should fail. You should see "Request timed out" or "Destination host unreachable" messages. The ACL is blocking Sales from reaching Management.

  • From the same PC2 Command Prompt, ping PC3 (IT) by running:
ping 192.168.30.11

This ping should succeed with replies. The ACL only blocks Sales-to-Management traffic. Sales can still reach IT.

  • Now click on PC3 (IT) in your topology.
  • Open Desktop > Command Prompt.
  • Ping PC1 (Management) by running:
ping 192.168.10.11

This ping should succeed. IT is on VLAN 30, and the ACL only restricts VLAN 20 (Sales). IT has full access to Management.

What do these results prove?

  • PC2 (Sales) to PC1 (Management): blocked. The ACL denies Sales-to-Management traffic.
  • PC2 (Sales) to PC3 (IT): permitted. The permit ip any any rule allows all other traffic through.
  • PC3 (IT) to PC1 (Management): permitted. The ACL is only applied on G0/0.20 (Sales), so IT traffic is never checked against it.

PC2 can still ping PC1?

If Sales can still reach Management, check that the ACL is applied to the correct subinterface (G0/0.20, not G0/0.10 or G0/0.30).

Verify the deny statement uses the correct wildcard masks. The source should be 192.168.20.0 0.0.0.255 and the destination should be 192.168.10.0 0.0.0.255.

Also confirm the direction is in. If applied as out, the router checks packets leaving the interface instead of arriving, which changes the filtering behavior.

Help me figure out why my ACL isn't blocking traffic.

Note your PC's DHCP address

Your PCs received addresses via DHCP, so PC1's address might be 192.168.10.11 or similar. If your ping target is different, check the PC's IP in Desktop > IP Configuration and use that address instead.

Your network now enforces a real security policy. Sales cannot snoop on Management traffic, but every other department can communicate freely. Next up, you will document everything and publish your project to GitHub.

Document and Publish to GitHub

Your network is fully configured, tested, and proven secure. The final piece of any professional networking project is documentation.

Hiring managers evaluate networking candidates by their ability to communicate design decisions clearly. In this step, you'll export your configurations, document your test results, and publish everything to GitHub as a portfolio-ready repository.

In this step, get ready to:
  • Export device configurations from R1 and S1.
  • Create test documentation and a topology screenshot.
  • Write a professional README and publish to GitHub.
Export device configurations

Device configurations are the blueprint of your network. Saving them as text files lets anyone review your work without needing Packet Tracer open.

  • Switch to Cisco Packet Tracer and click on router R1 to open its window.
  • Click the CLI tab.
  • If you see a > prompt, type enable and enter the password class to reach the # prompt.
  • Disable paging so the full configuration displays at once by entering this command:
terminal length 0
  • Display the full configuration by entering this command:
show running-config
  • Click and drag to select all the output in the CLI window.
  • Right-click the selected text and choose Copy (or press Ctrl+C).

What does terminal length 0 do?

By default, Cisco IOS pauses output after every 24 lines and waits for you to press a key. The terminal length 0 command removes this paging so you can see and select the entire configuration at once.

  • Switch back to VS Code.
  • Open the integrated terminal by pressing Ctrl+` (macOS and Windows).
  • Create the configs folder by running this command:
mkdir configs
  • In the VS Code Explorer sidebar, right-click the configs folder and select New File.
  • Name the file R1-running-config.txt.
  • Paste the copied configuration (Cmd+V on macOS or Ctrl+V on Windows) and save the file.

Now repeat the process for switch S1.

  • Switch back to Packet Tracer and click on switch S1 to open its window.
  • Click the CLI tab.
  • Enter enable (password class) to reach the # prompt.
  • Enter terminal length 0 followed by show running-config.
  • Select all the output, right-click, and choose Copy.
  • In VS Code, right-click the configs folder, select New File, and name it S1-running-config.txt.
  • Paste the configuration and save.

Confirm both files exist by running this in the VS Code terminal:

ls configs

You should see R1-running-config.txt and S1-running-config.txt listed.

Output is cut off or missing sections?

If your pasted configuration looks incomplete, go back to the device CLI and verify you ran terminal length 0 before show running-config. Without it, only the first page of output appears.

Also make sure you selected all the text before copying. Click at the very top of the output, then scroll down and shift-click at the bottom to select everything.

Help me troubleshoot my configuration export

Capture the topology and document test results

A topology screenshot gives viewers an instant visual understanding of your network design. Test documentation proves your network actually works.

  • In Packet Tracer, make sure your Logical workspace is visible and all devices are labeled clearly.
  • Take a screenshot of the topology using the Snipping Tool (Windows) or Cmd+Shift+4 (macOS).
  • Create the diagrams folder by running this command in the VS Code terminal:
mkdir diagrams
  • Save or move your screenshot into the diagrams folder and name it network-topology.png.

Make your screenshot readable

Before capturing, drag devices apart so cables don't overlap. Add labels if you haven't already (right-click a device and choose Place Note to add VLAN labels near each PC group). A clean screenshot makes a much stronger impression on your GitHub repo.

Now create the test results documentation. This file records the ping tests you ran in the previous step and explains why each result happened.

  • In VS Code, right-click the docs folder, select New File, and name it test-results.md.
  • Paste the following content into test-results.md:
# TechFlow Solutions – Network Test Results

## Connectivity Tests
| Test | Source | Destination | Expected | Result |
|------|--------|-------------|----------|--------|
| Same VLAN | PC3 (IT) | PC4 (IT) | Success | PASS |
| Inter-VLAN (allowed) | PC1 (Mgmt) | PC2 (Sales) | Success | PASS |
| Inter-VLAN (allowed) | PC3 (IT) | PC1 (Mgmt) | Success | PASS |
| ACL Block | PC2 (Sales) | PC1 (Mgmt) | Blocked | PASS |
| ACL Allow | PC2 (Sales) | PC3 (IT) | Success | PASS |

## ACL Explanation
ACL 100 is applied inbound on G0/0.20 (Sales subinterface). It denies all IP traffic from 192.168.20.0/24 to 192.168.10.0/24, then permits everything else. This prevents Sales from accessing Management while allowing all other inter-VLAN communication.

What does this document prove?

The test results table shows that your VLANs, routing, and ACLs all work together correctly. Each row maps a specific scenario to an expected outcome and confirms it passed.

The ACL explanation section demonstrates you understand WHY the policy works, not just that it does. This is what separates a portfolio piece from a screenshot.

  • Save test-results.md.
  • Confirm the file exists by running:
ls docs

You should see both ip-addressing-table.md and test-results.md listed.

Only see one file in docs?

Double check you saved test-results.md inside the docs folder and not in the project root. If it's in the wrong place, drag it into the docs folder using the VS Code Explorer sidebar.

Help me find my test-results file

Create the README and publish to GitHub

The README is the first thing anyone sees when they visit your repository. A well-structured README with clear sections tells employers you can communicate technical decisions, not just configure devices.

  • In VS Code, right-click the techflow-network folder root in the Explorer sidebar and select New File.
  • Name it README.md.
  • Paste the following template into README.md:
# TechFlow Solutions - Small Business Network

## Project Overview
This project simulates a complete small business network for TechFlow Solutions using Cisco Packet Tracer. The network segments three departments (Management, Sales, IT) using VLANs, routes between them with Router-on-a-Stick, automates IP assignment with DHCP, and enforces security policies with Access Control Lists.

## Network Diagram
![Network Topology](diagrams/network-topology.png)

## Technologies Used
- **VLANs** - Network segmentation for department isolation
- **802.1Q Trunking** - Carrying multiple VLANs over a single link
- **Router-on-a-Stick** - Inter-VLAN routing using subinterfaces
- **DHCP** - Automatic IP address assignment
- **Access Control Lists (ACLs)** - Traffic filtering and security enforcement
- **Cisco Packet Tracer** - Network simulation environment

## IP Addressing Scheme
| VLAN | Department | Subnet | Gateway |
|------|------------|--------|---------|
| 10 | Management | 192.168.10.0/24 | 192.168.10.1 |
| 20 | Sales | 192.168.20.0/24 | 192.168.20.1 |
| 30 | IT | 192.168.30.0/24 | 192.168.30.1 |

See [docs/ip-addressing-table.md](docs/ip-addressing-table.md) for the complete device addressing table.

## Key Configurations
- **Router R1**: Three subinterfaces (G0/0.10, G0/0.20, G0/0.30) with 802.1Q encapsulation for inter-VLAN routing
- **Switch S1**: VLANs 10, 20, 30 with access ports assigned per department; trunk link to R1 on G0/1
- **DHCP**: Three pools (MGMT-POOL, SALES-POOL, IT-POOL) with first 10 addresses excluded for static devices
- **Security**: Unused ports shut down and assigned to VLAN 99 (ParkingLot)

## Security Implementation
- Extended ACL 100 blocks Sales (VLAN 20) from accessing Management (VLAN 10)
- ACL applied inbound on G0/0.20 (close to source - Cisco best practice)
- All unused switch ports disabled and moved to a parking lot VLAN
- Password encryption enabled on all devices

## Testing Results
| Test | Source | Destination | Result |
|------|--------|-------------|--------|
| Same VLAN | PC3 (IT) | PC4 (IT) | PASS |
| Inter-VLAN allowed | PC1 (Mgmt) | PC2 (Sales) | PASS |
| ACL block | PC2 (Sales) | PC1 (Mgmt) | BLOCKED |
| ACL allow other | PC2 (Sales) | PC3 (IT) | PASS |

See [docs/test-results.md](docs/test-results.md) for detailed test documentation.

## What I Learned
- How to design an IP addressing scheme using private address space
- How VLANs segment broadcast domains and improve security
- How Router-on-a-Stick uses subinterfaces and 802.1Q to route between VLANs
- How DHCP automates IP assignment across multiple subnets
- How extended ACLs filter traffic based on source and destination
- The importance of network documentation for troubleshooting and collaboration

What makes this README effective?

The README leads with a visual (the topology image) and a clear summary of what the project demonstrates. Recruiters scan repositories quickly, so structure matters more than length.

Each section answers a specific question a reviewer would ask: What is this? What tools were used? How is it addressed? Is it secure? Does it work? What did you learn?

  • Save README.md.

Now initialize a Git repository and push everything to GitHub.

  • In the VS Code terminal, initialize a git repository by running this command:
git init
  • Stage all your project files by running:
git add .
  • Create your first commit by running:
git commit -m "Initial commit: TechFlow Solutions network project"
  • Open your browser and go to github.com.
  • Click the + icon in the top right corner and select New repository.
  • Enter techflow-network as the repository name.
  • Select Public for visibility.
  • Leave all other options unchecked (no README, no .gitignore, no license).
  • Click Create repository.

GitHub shows you a set of commands to push an existing repository. Copy the commands from the section labeled "push an existing repository from the command line" and run them in your VS Code terminal. They look like this:

git remote add origin [[YOUR_REPO_URL="https://github.com/YOUR_USERNAME/techflow-network.git"]]
git branch -M main
git push -u origin main

What do these commands do?

The git remote add origin command connects your local repository to the GitHub repository you just created. The git branch -M main command renames your default branch to main.

The git push -u origin main command uploads all your committed files to GitHub. The -u flag sets up tracking so future pushes only need git push.

  • Refresh your GitHub repository page in the browser.

You should see all your project files listed: configs/, diagrams/, docs/, and README.md rendered with your topology image and formatted sections.

Push failed or permission denied?

If you see a permission error, GitHub may need you to authenticate. Try signing in with gh auth login if you have the GitHub CLI, or set up a personal access token in your GitHub settings under Developer settings > Personal access tokens.

If the push fails because the remote already has content, make sure you left all checkboxes unchecked when creating the repository (no README, no .gitignore, no license).

Help me push my project to GitHub

Your network project is documented and live on GitHub. Next up, take on the Secret Mission to expand your network with a second switch and a server VLAN.

Secret mission

Expand the Network

Your network works great for three departments. But what happens when TechFlow Solutions needs a dedicated server segment with restricted access? Add a second switch and a server VLAN to simulate a real data center topology.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally with a free GitHub repository, so there are no ongoing costs.

Resources you used:

  • Local project folder techflow-network on your Desktop.
  • Cisco Packet Tracer topology file (.pkt) inside your project folder.
  • GitHub repository containing your network documentation and configs.

Keep everything running

No action needed. Choose this if you're still actively building or want to revisit the network simulation later.

  • Your techflow-network folder stays on your Desktop, ready to open in VS Code or Packet Tracer anytime.
  • Your GitHub repository remains public and accessible as a portfolio piece.
  • Cisco Packet Tracer and VS Code remain installed on your machine.

Pause - I'll come back to this later

Close your running applications to free up memory. Your files and repository stay intact for when you return.

  • Save and close your Packet Tracer topology file.
  • Close Cisco Packet Tracer.
  • Close VS Code.
  • Your local files and GitHub repository remain untouched and ready to reopen later.

Delete - I don't want to use this again

Remove all project files and the GitHub repository. This cannot be undone.

  • Delete the local project folder by opening your terminal and running the commands below.

macOS

cd ~/Desktop
rm -rf techflow-network

Windows

cd ~\Desktop
rmdir /s /q techflow-network
  • Delete the GitHub repository.
  • Go to your repository page on GitHub.
  • Click Settings (the tab at the top of the repository page).
  • Scroll to the bottom of the page to the Danger Zone section.
  • Click Delete this repository.
  • Follow the confirmation prompts to permanently delete the repository.

Nice Work!

Nice Work!

You just designed, built, and documented a complete business network from scratch. Your TechFlow Solutions network is now live on GitHub as a professional portfolio piece that demonstrates real networking skills to employers.

You've learned how to:

  • Build a multi-VLAN network with Router-on-a-Stick inter-VLAN routing and 802.1Q trunking to segment and connect three departments.
  • Configure DHCP pools for automatic IP assignment and implement Access Control Lists to enforce department-level security policies.
  • Create professional network documentation including IP addressing tables, exported configurations, test results, and a polished README, then publish it all to GitHub.
  • Expanded the network with a second switch, a Server VLAN, and an advanced ACL restricting SSH access to the IT department only.

Ready to quiz yourself?