Build a Small Office Network with VLANs

Introduction

30 Second Summary

Think about how a large office keeps departments separate. Sales doesn't need to see IT's internal traffic, and IT doesn't want broadcast noise from the sales floor slowing down their servers. Real networks solve this with virtual boundaries that segment traffic without needing separate physical hardware.

In this project, you will build a two-department office network in Cisco Packet Tracer, configure VLANs to separate Sales and IT traffic, and set up a router so both departments can still communicate when needed.

What You'll Build

A segmented office network with two VLANs connected through a router using the router-on-a-stick method, built and tested entirely in Cisco Packet Tracer.

By the end of this project, you'll have:

• A complete network topology with 1 router, 1 switch, and 4 PCs cabled and configured from scratch.
• Configured VLANs with trunk links and 802.1Q encapsulation for inter-VLAN routing.
• Hands-on practice with CLI commands (show vlan brief, show ip interface brief, ping) that appear on the CompTIA Network+ N10-009 performance-based questions.
• Secret Mission: Add a Management VLAN and configure a Switch Virtual Interface for remote switch access.

Are there any prerequisites?

This project assumes light familiarity with networking concepts like IP addresses and what routers and switches do. You also need a free Cisco Networking Academy account to download Packet Tracer.

Build the Network Topology

Before you can configure any VLANs or routing, you need the physical foundation of your network in place. Every real network starts with choosing hardware and running cables between devices.

In this step, you will place a router, a switch, and four PCs into your Cisco Packet Tracer workspace. Then you will connect them all with the correct cables and confirm everything is linked up properly.

In this step, get ready to:

• Add network devices (router, switch, PCs) to the workspace.
• Cable all devices together with Copper Straight-Through connections.
• Document the IP addressing plan for both VLANs.

Add network devices to the workspace

Your network needs three types of devices: a router to forward traffic between subnets, a switch to connect end devices within each department, and PCs to represent the employees.

• In the bottom-left device panel of Packet Tracer, click Network Devices.
• Click Routers in the subcategory row.
• Find and drag a 1941 router into the top-center of the workspace.
• Click Switches in the subcategory row.
• Drag a 2960 switch into the workspace, placing it below the router.
• Click End Devices in the main device category.
• Drag 4 PCs into the workspace, arranging them in a row below the switch.

Your workspace should now show Router0 at the top, Switch0 in the middle, and PC0 through PC3 in a row at the bottom.

Why these specific device models?

The Cisco 1941 router supports subinterfaces with 802.1Q encapsulation, which you will need for inter-VLAN routing later. The Cisco 2960 switch supports VLANs and trunk ports.

These are the standard devices used in Cisco Networking Academy labs and are widely referenced in Network+ and CCNA study materials.

Don't see the 1941 or 2960 in the list?

Make sure you are clicking the correct subcategory. The 1941 is under Network Devices > Routers and the 2960 is under Network Devices > Switches. Scroll through the options if they are not immediately visible.

Help me find the 1941 router and 2960 switch in Cisco Packet Tracer's device panel.

Cable the devices together

With all devices placed, you need to connect them using the correct cable type. PCs connect to switches, and the switch connects up to the router.

• In the bottom-left panel, click Connections (the lightning bolt icon).
• Select Copper Straight-Through cable (the solid black line).
• Click on PC0, then select FastEthernet0.
• Click on Switch0, then select FastEthernet0/1.
• Repeat to connect PC1 FastEthernet0 to Switch0 FastEthernet0/2.
• Connect PC2 FastEthernet0 to Switch0 FastEthernet0/3.
• Connect PC3 FastEthernet0 to Switch0 FastEthernet0/4.
• Finally, connect Switch0 GigabitEthernet0/1 to Router0 GigabitEthernet0/0.
• Wait for all link lights to turn green. This may take 30-60 seconds.

Why Copper Straight-Through cables?

Copper Straight-Through cables are used when connecting different types of devices together (PC to switch, switch to router). This is one of the cabling rules tested on the Network+ exam.

You would use a crossover cable to connect two identical device types (switch to switch). Packet Tracer enforces these rules just like real hardware.

Link lights are orange instead of green?

Orange lights mean the interfaces are still negotiating. For switch ports, this is normal and can take up to 30 seconds because of the Spanning Tree Protocol (STP) process.

If a light stays orange after a full minute, double-check that you used a Copper Straight-Through cable and connected to the correct port numbers listed above.

My Packet Tracer link lights are staying orange and won't turn green. Help me troubleshoot.

Plan the IP addressing scheme

Before configuring anything, you need a clear plan of which devices belong to which VLAN and what IP addresses they will use. This prevents mistakes when you start entering commands in the next steps.

Here is the addressing plan for your two-department network:

• VLAN 10 (Sales) uses the 192.168.10.0/24 subnet.
• VLAN 30 (IT) uses the 192.168.30.0/24 subnet.

Why separate subnets for each VLAN?

Each VLAN operates as its own isolated broadcast domain. For devices in different VLANs to communicate, their traffic must pass through a router. Giving each VLAN its own subnet makes this routing possible.

The /24 mask (255.255.255.0) gives each department 254 usable host addresses. That is far more than two PCs need, but it keeps the addressing simple.

Write it down

Jot this IP plan on a sticky note or keep this page visible while you work through the next steps. You will type these addresses multiple times during configuration.

Your physical topology is complete and your addressing plan is locked in. Next up, you will start configuring the switch by creating VLANs and assigning ports to each department.

Create VLANs and Configure Switch Ports

Your topology is fully cabled and all link lights are green. Now it's time to tell the switch which ports belong to which department.

Right now, all four PCs are on the same default VLAN (VLAN 1), meaning they can all talk to each other freely. In a real office, you would not want Sales staff to see IT traffic and vice versa. VLANs let you segment the network at Layer 2, so devices only see traffic within their own group.

In this step, get ready to:

• Create VLAN 10 (Sales) and VLAN 30 (IT) on the switch.
• Assign access ports to each VLAN so PCs are placed in the correct department.
• Configure a trunk port between the switch and router to carry all VLANs over one cable.

Create VLANs on the switch

VLANs are created in global configuration mode on the switch. Each VLAN gets an ID number and a descriptive name.

• Click Switch0 in your workspace. A window pops up with several tabs.
• Click the CLI tab.
• Press Enter to get a command prompt.
• Enter privileged EXEC mode and then global configuration mode by running these commands:

enable
configure terminal

• Create VLAN 10 and VLAN 30 by running these commands:

vlan 10
name Sales
exit
vlan 30
name IT
exit

What do these commands do?

Each vlan command creates a new VLAN with the specified ID number. The name command gives it a human-readable label. The exit command returns you to global configuration mode so you can create the next VLAN.

• Verify that both VLANs were created by running:

do show vlan brief

You should see VLAN 10 with the name Sales and VLAN 30 with the name IT in the output table. All ports still appear under VLAN 1 because you have not assigned them yet.

Don't see your VLANs listed?

Make sure you typed do show vlan brief (with the do prefix). You need do to run a privileged EXEC command while you are inside global configuration mode.

If you accidentally typed just show vlan brief without do, the switch will show an error. Add the do prefix and try again.

Help me troubleshoot my VLAN creation on the switch

Assign access ports to VLANs

An access port belongs to exactly one VLAN. Any device plugged into that port becomes a member of that VLAN. You will assign PC0 and PC1's ports to VLAN 10 (Sales), and PC2 and PC3's ports to VLAN 30 (IT).

• Still in global configuration mode, assign the Sales ports by running these commands:

interface range fastEthernet 0/1-2
switchport mode access
switchport access vlan 10
exit

What do these commands do?

The interface range command lets you configure multiple ports at once. switchport mode access tells the switch these ports connect to end devices (not other switches or routers).

Finally, switchport access vlan 10 places both ports into VLAN 10 so any traffic from PC0 and PC1 is tagged as Sales traffic.

• Assign the IT ports by running these commands:

interface range fastEthernet 0/3-4
switchport mode access
switchport access vlan 30
exit

• Verify the port assignments by running:

do show vlan brief

You should now see Fa0/1 and Fa0/2 listed under VLAN 10 (Sales), and Fa0/3 and Fa0/4 listed under VLAN 30 (IT). These ports are no longer under VLAN 1.

Ports still showing under VLAN 1?

Double-check that you typed switchport access vlan 10 (not switchport vlan 10). The word access in the middle is required.

Also confirm you included switchport mode access before the VLAN assignment line. Without it, the port may not accept the VLAN assignment properly.

Help me figure out why my ports are still on VLAN 1

Configure the trunk port to the router

A trunk port carries traffic from multiple VLANs over a single physical cable. The link between the switch and router needs to be a trunk so the router can receive traffic from both VLAN 10 and VLAN 30.

• Still in global configuration mode, configure the trunk by running these commands:

interface gigabitEthernet 0/1
switchport mode trunk
exit

Why does trunking matter here?

Without trunking, the switch would only send one VLAN's traffic to the router. The trunk link uses 802.1Q encapsulation to tag each frame with its VLAN ID. The router reads these tags to know which VLAN a packet came from and which subnet to route it to.

• Verify the trunk is working by running:

do show interfaces trunk

You should see GigabitEthernet0/1 listed as a trunk port. Under the "Vlans allowed on trunk" column, you should see 1, 10, and 30 (plus others in the default range).

• Return to privileged EXEC mode by running:

end

Trunk not showing up?

Make sure you ran switchport mode trunk on gigabitEthernet 0/1 (the port connected to the router), not on one of the FastEthernet ports connected to the PCs.

If show interfaces trunk shows nothing, re-enter global config with configure terminal, select the interface again, and reapply the trunk command.

Help me troubleshoot my trunk port configuration

✔️ Awesome, I've got everything!

Great. Double check that you see VLANs 10 and 30 in show vlan brief with the correct ports assigned, and GigabitEthernet0/1 listed in show interfaces trunk.

ⓧ I'd like to double check the full commands

Here is the complete sequence of commands you should have entered on Switch0 during this step:

enable
configure terminal
vlan 10
name Sales
exit
vlan 30
name IT
exit
interface range fastEthernet 0/1-2
switchport mode access
switchport access vlan 10
exit
interface range fastEthernet 0/3-4
switchport mode access
switchport access vlan 30
exit
interface gigabitEthernet 0/1
switchport mode trunk
exit
end

Your switch is now segmented into two departments with a trunk link ready to carry both VLANs up to the router. Next up, you will configure the router to perform inter-VLAN routing so Sales and IT can actually communicate with each other.

Configure Inter-VLAN Routing on the Router

Your switch now has two VLANs and a trunk link ready to carry tagged traffic up to the router. The problem is that devices in VLAN 10 and VLAN 30 are completely isolated from each other.

To let Sales and IT communicate, you need a router that can accept tagged VLAN traffic on a single physical link and route between the subnets. This technique is called router-on-a-stick. You will create virtual subinterfaces on the router, one per VLAN, each acting as the default gateway for its subnet.

In this step, get ready to:

• Create subinterfaces on the router with 802.1Q encapsulation for each VLAN.
• Enable the physical interface to bring both subinterfaces online.
• Save the router configuration to startup-config.

Create subinterfaces on the router

A subinterface is a virtual interface tied to a physical port. Each subinterface handles traffic for one VLAN by stripping and adding 802.1Q tags.

• Click on Router0 in your workspace.
• Go to the CLI tab and press Enter to get a command prompt.
• Enter privileged EXEC mode and then global configuration mode by running these commands:

enable
configure terminal

• Create the subinterface for VLAN 10 (Sales) by entering these commands:

interface gigabitEthernet 0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

What do these commands do?

• interface gigabitEthernet 0/0.10 creates a virtual subinterface numbered .10 on the physical GigabitEthernet0/0 port. The number after the dot is just a label, but matching it to the VLAN number keeps things organised.
• encapsulation dot1Q 10 tells the subinterface to handle frames tagged with VLAN 10. This is how the router knows which traffic belongs to which VLAN.
• ip address 192.168.10.1 255.255.255.0 assigns the gateway IP for the Sales subnet. PCs in VLAN 10 will point to this address as their default gateway.

• Create the subinterface for VLAN 30 (IT) by entering these commands:

interface gigabitEthernet 0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What does this command do?

This is the same pattern as before, but for VLAN 30. The subinterface G0/0.30 handles frames tagged with VLAN 30, and 192.168.30.1 becomes the default gateway for IT department PCs.

Why router-on-a-stick instead of separate cables?

You could connect a separate physical router port to each VLAN, but that wastes ports and cables. Router-on-a-stick uses one physical link carrying all VLAN traffic via 802.1Q tags. The router reads the tag, routes the packet, and sends it back down with the correct destination VLAN tag.

This is the standard approach taught for the CompTIA Network+ and CCNA because it demonstrates trunking, tagging, and subinterfaces in a single topology.

Enable the physical interface

Subinterfaces inherit their up/down status from the physical interface they belong to. Until you enable GigabitEthernet0/0, both subinterfaces stay down and cannot pass traffic.

• Bring up the physical interface by entering these commands:

interface gigabitEthernet 0/0
no shutdown
exit

What does this command do?

The no shutdown command enables the physical interface. On Cisco routers, interfaces are administratively shut down by default. Enabling the physical port automatically brings up all subinterfaces attached to it.

• Verify that both subinterfaces are up by running:

do show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.30 all showing "up" in the Status and Protocol columns, with the correct IP addresses assigned.

Seeing "administratively down" on a subinterface?

Make sure you ran no shutdown on the physical interface gigabitEthernet 0/0 (not on the subinterface). Subinterfaces come up automatically when their parent is enabled.

Also confirm the cable between Switch0 GigabitEthernet0/1 and Router0 GigabitEthernet0/0 is connected and showing green link lights.

Help me troubleshoot my subinterfaces not coming up in Packet Tracer.

Save the router configuration

Cisco routers store configuration in RAM (the running-config) which is lost on reboot. Saving to startup-config writes it to persistent storage.

• Return to privileged EXEC mode and save your configuration by running:

end
copy running-config startup-config

• Press Enter when prompted for the destination filename to accept the default.

What does this command do?

The end command exits all configuration modes and returns to privileged EXEC mode. Then copy running-config startup-config writes your current configuration to non-volatile memory so it persists after a reboot.

You should see the message [OK] confirming the save was successful.

Getting an error when saving?

The copy running-config startup-config command only works in privileged EXEC mode (the Router# prompt). If you see an error, type end first to exit any configuration sub-mode, then try again.

Help me save my Cisco router configuration in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Your router is now configured for inter-VLAN routing and the configuration is saved.

ⓧ I'd like to double check the full commands

Here is the complete sequence of commands you should have entered on Router0 in this step:

enable
configure terminal
interface gigabitEthernet 0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface gigabitEthernet 0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit
interface gigabitEthernet 0/0
no shutdown
exit
end
copy running-config startup-config

After running do show ip interface brief (while in config mode) or show ip interface brief (in privileged EXEC), you should see G0/0, G0/0.10, and G0/0.30 all listed as up/up with their respective IP addresses.

Your router is now the bridge between Sales and IT. Next up, you will assign IP addresses to the PCs and test whether traffic actually flows between the two VLANs.

Assign PC IP Addresses and Test Connectivity

Your router is now configured with subinterfaces that act as gateways for each VLAN. The switch knows how to tag traffic, and the router knows how to route between VLANs. One piece is still missing: the PCs themselves have no IP addresses yet.

In this step, you will give each PC an IP address and default gateway, then prove the entire network works by pinging across VLANs. This is the moment everything comes together.

In this step, get ready to:

• Assign static IP addresses to all four PCs.
• Test same-VLAN and cross-VLAN connectivity using ping and tracert.

Assign IPs to Sales PCs (VLAN 10)

Each PC needs three things to communicate on the network: an IP address, a subnet mask, and a default gateway. The default gateway is the router subinterface IP for that PC's VLAN.

• Click on PC0 in the workspace to open its configuration window.
• Click the Desktop tab at the top of the window.
• Click IP Configuration.
• In the IP Address field, enter 192.168.10.10.
• In the Subnet Mask field, enter 255.255.255.0.
• In the Default Gateway field, enter 192.168.10.1.

What is a default gateway?

The default gateway is the IP address a PC sends traffic to when the destination is outside its own subnet. For PC0, that means any traffic heading to the IT department (192.168.30.0/24) goes to the router at 192.168.10.1 first.

Without a default gateway, PCs can only talk to devices on their own VLAN.

Now repeat the same process for PC1.

• Click on PC1 in the workspace.
• Go to Desktop > IP Configuration.
• Set IP Address to 192.168.10.11.
• Set Subnet Mask to 255.255.255.0.
• Set Default Gateway to 192.168.10.1.

Both Sales PCs now have IP addresses on the 192.168.10.0/24 subnet.

Assign IPs to IT PCs (VLAN 30)

The IT department uses a different subnet, so these PCs point to a different gateway address on the router.

• Click on PC2 in the workspace.
• Go to Desktop > IP Configuration.
• Set IP Address to 192.168.30.10.
• Set Subnet Mask to 255.255.255.0.
• Set Default Gateway to 192.168.30.1.

Now configure PC3 with its IP address.

• Click on PC3 in the workspace.
• Go to Desktop > IP Configuration.
• Set IP Address to 192.168.30.11.
• Set Subnet Mask to 255.255.255.0.
• Set Default Gateway to 192.168.30.1.

All four PCs now have IP addresses configured. Here is a summary of the full addressing scheme:

Sales (VLAN 10)

• PC0: IP 192.168.10.10, Mask 255.255.255.0, Gateway 192.168.10.1.
• PC1: IP 192.168.10.11, Mask 255.255.255.0, Gateway 192.168.10.1.

IT (VLAN 30)

• PC2: IP 192.168.30.10, Mask 255.255.255.0, Gateway 192.168.30.1.
• PC3: IP 192.168.30.11, Mask 255.255.255.0, Gateway 192.168.30.1.

Verify connectivity across VLANs

The real test of your network is whether PCs in different departments can actually reach each other. A successful cross-VLAN ping proves that the switch is tagging traffic correctly, the trunk link is carrying both VLANs, and the router is forwarding between subinterfaces.

• Click on PC0 in the workspace.
• Click the Desktop tab.
• Click Command Prompt.

• Test same-VLAN connectivity by pinging PC1:

ping 192.168.10.11

You should see four successful replies from 192.168.10.11.

Why does this ping work?

PC0 and PC1 are both on VLAN 10. The switch forwards traffic directly between them at Layer 2 without involving the router. This is identical to how two devices on the same physical switch would communicate.

• Now test cross-VLAN connectivity by pinging PC2 in the IT department:

ping 192.168.30.10

You should see four successful replies from 192.168.30.10. This proves your inter-VLAN routing is working.

First ping timed out?

The first ping attempt often fails because ARP needs to resolve the destination's MAC address before traffic can flow. Run the same ping command a second time. If it still fails after two attempts, double check that the default gateway on the PCs matches the router subinterface IP for their VLAN.

help me figure out why my cross-VLAN ping is failing in Packet Tracer

• Finally, run a traceroute to see the path traffic takes between VLANs:

tracert 192.168.30.10

The output shows two hops. The first hop is 192.168.10.1 (the router), and the second hop is 192.168.30.10 (PC2 in the IT department).

What does the traceroute tell you?

The traceroute confirms the router-on-a-stick pattern in action. Even though the switch and router are connected by a single cable, traffic from VLAN 10 travels up the trunk to the router, gets routed to VLAN 30, and comes back down the same trunk to reach the IT PCs.

This is exactly the behavior the CompTIA Network+ exam tests. You should be able to explain why the router appears as a hop between two devices on the same switch.

Your segmented office network is fully operational. Sales and IT are isolated at Layer 2 but can communicate through the router. Next up, you will use Packet Tracer's Simulation Mode to watch packets travel through the network hop by hop and see the 802.1Q VLAN tags in action.

Explore the Network with Simulation Mode

You've confirmed that your network works. Pings succeed both within VLANs and across them, and tracert proves the router is doing its job.

But how does a packet actually travel from the Sales department to IT? Cisco Packet Tracer has a unique feature called Simulation Mode that lets you freeze time and watch packets hop between devices one step at a time. In this step, you'll use it to see 802.1Q VLAN tags in action on your trunk link.

In this step, get ready to:

• Switch to Simulation Mode to watch packets in slow motion.
• Send a cross-VLAN ping and trace its path hop by hop.
• Inspect the 802.1Q VLAN tag on the trunk link between the switch and router.

Switch to Simulation Mode

Packet Tracer runs in Realtime Mode by default. Simulation Mode pauses the clock so you can step through network events one at a time and inspect each packet along the way.

• Look at the bottom-right corner of the Packet Tracer window. You'll see two tabs: Realtime and Simulation.
• Click the Simulation tab.

The Simulation Panel appears on the right side of your workspace. This panel contains the Event List (which will record every packet event) and the Play Controls you'll use to step through the simulation.

What is Simulation Mode?

In Realtime Mode, packets fly through the network instantly (just like a real network). Simulation Mode freezes time so you can advance one event at a time using the Capture/Forward button.

Each event shows a packet as an animated envelope in the workspace. You can click on any envelope to inspect its contents at every OSI layer.

Send a ping and watch it travel

Now you'll generate a cross-VLAN ping from PC0 (Sales) to PC2 (IT) and watch each hop in slow motion.

• Click PC0 in the workspace.
• Go to the Desktop tab, then click Command Prompt.
• Send a cross-VLAN ping by typing this command and pressing Enter:

ping 192.168.30.10

• Close the PC0 window and return to the Simulation Panel on the right side of the workspace.
• In the Play Controls area of the Simulation Panel, click Capture/Forward repeatedly. Each click advances the simulation by one event.
• Watch the packet envelope move from PC0 to Switch0, then up the trunk link to Router0, back down the trunk to Switch0, and finally to PC2.
• Continue clicking Capture/Forward until the reply packet makes it back from PC2 to PC0.

What is happening at each hop?

PC0 sends an ICMP echo request. The switch receives it on an access port (VLAN 10) and forwards it out the trunk port to the router, adding a VLAN 10 tag.

The router receives the tagged frame on subinterface G0/0.10, strips the tag, routes the packet to the 192.168.30.0/24 subnet, re-tags it with VLAN 30, and sends it back down the trunk.

The switch receives the VLAN 30 tagged frame, strips the tag, and delivers it out the access port to PC2. The reply follows the same path in reverse.

First ping may show ARP packets too

If you see extra ARP packets in the Event List, that is normal. ARP resolves MAC addresses before the ICMP ping can travel. Click Capture/Forward through all of them to watch the full process.

Not seeing any packets move?

Make sure you are in Simulation Mode (the Simulation tab should be active in the bottom-right). If you accidentally ran the ping in Realtime Mode, switch to Simulation and run the ping again.

Also check that you closed the PC0 window before clicking Capture/Forward. The simulation panel can be hidden behind the PC window.

help me troubleshoot why packets aren't appearing in Simulation Mode

Observe 802.1Q VLAN tags

The real magic of Simulation Mode is that you can click on a packet while it sits on the trunk link and see the VLAN tag that is normally invisible.

• Click Reset Simulation in the Simulation Panel to clear the Event List.
• Click PC0, go to Desktop > Command Prompt, and type the ping command again:

ping 192.168.30.10

• Close the PC0 window and click Capture/Forward a few times until you see the packet envelope sitting on the trunk link (the cable between Switch0 and Router0).
• Click directly on the packet envelope while it is on the trunk link. A PDU Information window opens.
• In the PDU Information window, click the OSI Model tab.
• Look at Layer 2. You will see the 802.1Q VLAN tag indicating which VLAN this frame belongs to (VLAN 10 for the outgoing request from PC0).

Why does the tag only appear on the trunk?

Access ports strip the VLAN tag before delivering frames to end devices. PCs never see VLAN tags. The tag only exists on trunk links where multiple VLANs share one physical cable.

This is exactly how 802.1Q encapsulation works in real enterprise networks. The 4-byte tag is inserted into the Ethernet frame header so the receiving device knows which VLAN the frame belongs to.

You should now see the 802.1Q header in the Layer 2 section, confirming your trunk link is carrying tagged VLAN traffic between the switch and router.

• Close the PDU Information window.
• Save your project by pressing Ctrl+S (Windows) or Cmd+S (macOS).

Can't see the VLAN tag in the OSI Model tab?

Make sure you clicked on the packet while it was on the trunk link (between Switch0 and Router0), not while it was on an access link (between a PC and the switch). Only the trunk link carries tagged frames.

If the packet has already moved past the trunk, click Reset Simulation and re-run the ping. Step through slowly with Capture/Forward until the envelope is positioned on the trunk cable.

help me find the 802.1Q VLAN tag in Packet Tracer Simulation Mode

Secret mission

Add a Management VLAN

Your network is working, but the switch itself has no IP address. That means you can't reach it remotely over the network. Add a Management VLAN and give the switch a network identity so it can be managed from anywhere in the office.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your resources as they are, close Packet Tracer to free up memory, or delete everything entirely.

Resources you used:

• Cisco Packet Tracer application (installed on your computer).
• Your Packet Tracer topology file (.pkt file saved locally).

Keep everything running

No action needed. Choose this if you plan to keep experimenting with your VLAN topology or want to reference it later.

• Your .pkt file stays wherever you saved it.
• Cisco Packet Tracer remains installed and ready to open your topology anytime.

Pause - I'll come back to this later

Close Packet Tracer to free up system memory. Your saved topology file will be waiting when you come back.

• Save your topology if you haven't already. Click File, then Save As, and choose a location you'll remember (like your Desktop).
• Close Cisco Packet Tracer.

Delete - I don't want to use this again

Remove your topology file and optionally uninstall Cisco Packet Tracer from your computer.

• Delete your .pkt topology file. Find it wherever you saved it and move it to the Trash (macOS) or Recycle Bin (Windows).
• To uninstall Cisco Packet Tracer on macOS, open Finder, go to Applications, find Cisco Packet Tracer, and drag it to the Trash.
• To uninstall on Windows, open Settings, select Apps, then Installed apps. Find Cisco Packet Tracer in the list and click Uninstall.

Nice Work!

Nice Work!

You just built a segmented office network from scratch in Cisco Packet Tracer. Two departments, two VLANs, one router connecting them all.

Here's what you learned:

• Built a multi-VLAN network topology with proper cabling, configured VLANs on a Cisco 2960 switch, and assigned access ports to isolate Sales and IT departments at Layer 2.
• Configured router-on-a-stick inter-VLAN routing using subinterfaces and 802.1Q encapsulation so traffic from different VLANs can travel over a single trunk link.
• Verified full cross-VLAN connectivity with ping, tracert, and show commands, then used Simulation Mode to visualize 802.1Q VLAN tags on the trunk link at Layer 2.
• Added a Management VLAN and configured a Switch Virtual Interface (SVI) so the switch itself can be reached over the network for remote management.

Ready to quiz yourself?