Simulate a Post-Merger Network Migration

Build a multi-site VPN network with VLANs in Cisco Packet Tracer.

Introduction

30 Second Summary

When two companies merge, their IT teams face a massive challenge. They need to connect separate office networks into one unified system without disrupting day-to-day work.

In this project, you will simulate a post-merger network migration using Cisco Packet Tracer. You will build a multi-site network connecting a Corporate HQ to a Remote Branch Office with department-segmented VLANs, inter-VLAN routing, and an encrypted site-to-site VPN tunnel.

What You'll Build

A fully functional two-site enterprise network in Cisco Packet Tracer with department-segmented VLANs, Router-on-a-Stick inter-VLAN routing, and a site-to-site IPsec VPN encrypting all cross-site traffic.

By the end of this project, you'll have:

  • A working multi-site network topology with VLANs segmenting departments (HR and Engineering) at both sites.
  • A site-to-site IPsec VPN tunnel encrypting all traffic between Corporate HQ and a Remote Branch Office over a simulated ISP.
  • Complete network documentation including an IP addressing table, VLAN assignments, and device inventory ready to reference in job interviews.
  • Secret Mission: Add an access control list (ACL) to restrict inter-department communication between sites, simulating a real post-merger security policy.

Do I need any prerequisites?

You need Cisco Packet Tracer installed (version 8.x or newer). It is free through a Cisco Networking Academy account.

Basic familiarity with typing commands in a terminal is helpful but not required. Each command is provided for you to copy and paste.

Set Up Your Network Topology

Your environment is ready. Now it's time to build the physical network layout that both offices will rely on.

In a real post-merger deployment, IT teams stage equipment in a lab before shipping it to live sites. This lets you verify configurations in a controlled environment where mistakes don't disrupt production. Your Cisco Packet Tracer workspace is that virtual staging lab.

In this step, get ready to:
  • Create a new blank topology and place all network devices.
  • Cable the devices together to form the physical network.
  • Verify all links show green (up/up) status.
Create a new topology and place your devices

Your network has two offices: Corporate HQ and a Remote Branch Office. A third router sits between them to simulate the public internet (the ISP). Each site also needs a switch to connect department PCs and a router to handle traffic between departments.

  • Open a new blank topology by clicking File in the top menu bar, then New.

Now you'll place routers from the device panel at the bottom of the screen.

  • Click the Routers category in the bottom-left device panel (the icon looks like a cylinder with arrows).
  • Find 1941 in the list of available routers.
  • Click and drag the 1941 onto the workspace three times to place three routers.
  • Label the first router HQ-Router by clicking the text below it and typing the name.
  • Label the second router Branch-Router.
  • Label the third router ISP.

Next, place the switches.

  • Click the Switches category in the bottom-left device panel.
  • Find 2960 in the list.
  • Drag two 2960 switches onto the workspace.
  • Label the first HQ-Switch and the second Branch-Switch.

Finally, place the end-user PCs.

  • Click the End Devices category in the device panel.
  • Drag four PC devices onto the workspace.
  • Label them HQ-HR-PC, HQ-ENG-PC, Branch-HR-PC, and Branch-ENG-PC.

Arrange devices visually by site

Position HQ devices (HQ-Router, HQ-Switch, HQ-HR-PC, HQ-ENG-PC) on the left side of the workspace. Position Branch devices on the right side. Place the ISP router in the middle. This mirrors how network diagrams look in real documentation.

Why an ISP router in the middle?

In real life, your two offices connect through the public internet provided by an ISP. The ISP router simulates that untrusted network sitting between your two private sites.

Later, you'll build a VPN tunnel that encrypts traffic as it crosses this simulated public network. Without the ISP router, there would be nothing to protect against.

Cable the devices

With all devices placed, you need to connect them with cables. The topology mirrors a real enterprise layout: PCs connect to a LAN switch, the switch connects to a site router, and the site router connects to the ISP for WAN connectivity.

  • Click the Connections category in the bottom-left device panel (the lightning bolt icon).
  • Select Copper Straight-Through (the solid black line). You will use this cable type for all connections.

Now connect the HQ site devices. Click on the first device, select the interface, then click on the second device and select its interface.

  • Connect HQ-Switch port FastEthernet0/1 to HQ-Router port GigabitEthernet0/0.
  • Connect HQ-Router port GigabitEthernet0/1 to ISP port GigabitEthernet0/0.
  • Connect ISP port GigabitEthernet0/1 to Branch-Router port GigabitEthernet0/1.
  • Connect Branch-Router port GigabitEthernet0/0 to Branch-Switch port FastEthernet0/1.

Now connect the PCs to their respective switches.

  • Connect HQ-HR-PC to HQ-Switch port FastEthernet0/2.
  • Connect HQ-ENG-PC to HQ-Switch port FastEthernet0/3.
  • Connect Branch-HR-PC to Branch-Switch port FastEthernet0/2.
  • Connect Branch-ENG-PC to Branch-Switch port FastEthernet0/3.

What does this topology represent?

Each site has PCs connecting into a LAN switch, which connects up to the site's router. The routers then connect outward to the ISP. This is the standard three-tier layout you'll see in enterprise branch offices.

The switch-to-router link at each site will become a trunk link carrying multiple VLANs. The router-to-ISP links simulate WAN connections over the public internet.

Wait a few seconds for the link indicators to stabilize. All links should turn green, indicating an up/up state.

Seeing red or orange link indicators?

Orange triangles are normal for the first 30 seconds. Switches run Spanning Tree Protocol on startup, which temporarily blocks ports. Wait for them to turn green.

If a link stays red, you may have connected the wrong interface types. Delete the cable by clicking on it and pressing Delete, then reconnect using the exact interface names listed above.

Make sure you selected Copper Straight-Through (not Crossover or Serial) for every cable.

Still stuck? Help me troubleshoot my red/orange link indicators in Packet Tracer.

  • Save your topology by pressing Cmd+S (macOS) or Ctrl+S (Windows). Name the file something like post-merger-network.pkt and save it to your Desktop.

Your physical network is staged and wired. Next up, you'll configure VLANs on the switches to logically separate departments at each site.

Configure VLANs and Switch Ports

Your topology is cabled and all links are green. Now you need to logically separate departments on each switch so that HR traffic stays isolated from Engineering traffic.

When two companies merge, employees get reorganized into new departments. VLANs let you create these logical boundaries on a single physical switch. In this step, you will configure VLANs on both switches and set up trunk links so VLAN traffic can reach the router.

In this step, get ready to:
  • Create VLAN 10 (HR) and VLAN 20 (Engineering) on HQ-Switch.
  • Create the same VLANs on Branch-Switch.
  • Verify trunk links are carrying all VLAN traffic to the routers.
Configure VLANs on HQ-Switch

On a real deployment, you would stage switches with VLAN configs in a lab before shipping them to each office. This is your virtual staging area.

  • Click HQ-Switch in your topology.
  • Click the CLI tab.
  • Create VLANs and assign switch ports by entering the following commands:
enable
configure terminal
vlan 10
name HR
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit
interface FastEthernet0/1
switchport mode trunk
exit
end

What do these commands do?

  • vlan 10 and name HR create VLAN 10 and label it "HR" so you can identify it later.
  • switchport mode access tells the port it connects to a single end device (a PC), not another switch.
  • switchport access vlan 10 assigns that port to VLAN 10 so only HR traffic flows through it.
  • switchport mode trunk on Fa0/1 allows ALL VLAN traffic to travel over a single cable to the router.
  • Verify your VLANs are configured correctly by running:
show vlan brief

You should see VLAN 10 (HR) with Fa0/2 listed under its Ports column, and VLAN 20 (Engineering) with Fa0/3.

Don't see your VLANs listed?

  • Make sure you typed end to exit configuration mode before running show vlan brief. Show commands only work in privileged EXEC mode.
  • If a port does not appear under the correct VLAN, re-enter the interface config and double check you typed switchport access vlan 10 (not just switchport vlan 10).
  • Help me troubleshoot my HQ-Switch VLAN configuration in Packet Tracer. I ran the commands but show vlan brief does not show the correct port assignments.
Configure VLANs on Branch-Switch

Branch-Switch gets the exact same VLAN structure. Consistent VLAN numbering across all locations makes troubleshooting and documentation much simpler for the operations team.

  • Click Branch-Switch in your topology.
  • Click the CLI tab.
  • Enter the following commands to create the same VLAN structure:
enable
configure terminal
vlan 10
name HR
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit
interface FastEthernet0/1
switchport mode trunk
exit
end

Why use the same VLAN numbers at both sites?

In a merged company, you want consistent VLAN numbering across all locations. VLAN 10 is always HR and VLAN 20 is always Engineering, regardless of which office you are in.

This consistency makes troubleshooting faster because any engineer at any site immediately knows which VLAN belongs to which department.

  • Verify the configuration by running:
show vlan brief

You should see the same layout as HQ-Switch. VLAN 10 (HR) with Fa0/2, and VLAN 20 (Engineering) with Fa0/3.

Branch-Switch VLANs not showing up?

  • Confirm you clicked Branch-Switch and not HQ-Switch. Both devices look similar in the topology.
  • If the CLI shows a different hostname (like Switch>), you may be on the wrong device. Close and click the correct switch.
  • Help me figure out why my Branch-Switch VLANs are not configured correctly in Packet Tracer.
Verify trunk links

A trunk port carries traffic from all VLANs over a single cable to the router. Without trunking, only one VLAN's traffic would reach the router, and inter-VLAN routing would fail in the next step.

  • On HQ-Switch, run the following command in the CLI:
show interfaces trunk
  • On Branch-Switch, run the same command:
show interfaces trunk

On both switches, you should see Fa0/1 listed as a trunk port with VLANs 1-4094 in the "Vlans allowed" column.

What is 802.1Q trunking?

802.1Q is the standard that "tags" each Ethernet frame with a VLAN ID as it crosses the trunk link. The router reads these tags to know which VLAN each frame belongs to.

Without trunking, you would need a separate physical cable from the switch to the router for every VLAN. Trunking lets one cable carry all VLAN traffic.

Fa0/1 not showing as a trunk?

  • Go back into the switch CLI and run enable, then configure terminal, then interface FastEthernet0/1, then switchport mode trunk. Run end and check again.
  • Make sure the cable is connected to Fa0/1 on the switch side. You can hover over the link in the topology to confirm which interfaces it connects.
  • Help me troubleshoot why my trunk link is not showing up on show interfaces trunk in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure both switches show the same VLAN and trunk output before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete set of commands for both switches. Compare your show vlan brief and show interfaces trunk output against this:

HQ-Switch
enable
configure terminal
vlan 10
name HR
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit
interface FastEthernet0/1
switchport mode trunk
exit
end
Branch-Switch
enable
configure terminal
vlan 10
name HR
exit
vlan 20
name Engineering
exit
interface FastEthernet0/2
switchport mode access
switchport access vlan 10
exit
interface FastEthernet0/3
switchport mode access
switchport access vlan 20
exit
interface FastEthernet0/1
switchport mode trunk
exit
end

After running these commands, show vlan brief on each switch should show VLAN 10 (HR) on Fa0/2 and VLAN 20 (Engineering) on Fa0/3. The show interfaces trunk command should show Fa0/1 as a trunk port.

Both switches are now staged with identical VLAN structures. Next up, you will configure the routers to route traffic between these VLANs using a technique called Router-on-a-Stick.

Configure Inter-VLAN Routing

Your switches are now segmenting traffic into VLANs. HR devices only see HR traffic, and Engineering devices only see Engineering traffic. But there is a problem: devices in different VLANs cannot communicate with each other at all.

In this step, you will configure inter-VLAN routing using a technique called Router-on-a-Stick. This splits a single physical router interface into virtual sub-interfaces, one per VLAN, so departments can reach each other through the router.

In this step, get ready to:
  • Configure sub-interfaces on HQ-Router for inter-VLAN routing.
  • Configure sub-interfaces on Branch-Router for inter-VLAN routing.
  • Assign IP addresses to all PCs and verify inter-VLAN connectivity.
Configure HQ-Router sub-interfaces

Devices in VLAN 10 and VLAN 20 are isolated by design. A Layer 2 switch cannot route traffic between VLANs on its own. You need a router to act as the gateway for each VLAN.

Router-on-a-Stick creates virtual sub-interfaces on one physical port. Each sub-interface handles traffic for one VLAN by tagging it with 802.1Q encapsulation.

  • Click HQ-Router in your topology to open its configuration window.
  • Click the CLI tab.
  • Configure the sub-interfaces by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end

What do these commands do?

  • no shutdown activates the physical interface. Without this, no traffic flows through the port at all.
  • interface GigabitEthernet0/0.10 creates a virtual sub-interface. The .10 at the end is just a label (it matches the VLAN number for clarity).
  • encapsulation dot1Q 10 tells the router that traffic tagged with VLAN 10 belongs to this sub-interface.
  • ip address 192.168.10.1 255.255.255.0 makes this sub-interface the default gateway for all HR devices at HQ.
  • Verify your sub-interfaces are up by running:
show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all listed with their IP addresses and showing up status.

Sub-interfaces showing down?

Make sure you ran no shutdown on the parent interface GigabitEthernet0/0 (not on the sub-interfaces). Sub-interfaces inherit their up/down state from the parent.

Also check that the cable from HQ-Switch Fa0/1 is connected to HQ-Router GigabitEthernet0/0. If the cable connects to a different port, the sub-interfaces will stay down.

Help me troubleshoot why my HQ-Router sub-interfaces are showing down status in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure all three interfaces show up status before moving on.

ⓧ I'd like to double check the full code

Here is everything you should have entered on HQ-Router:

enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit
end
Configure Branch-Router sub-interfaces

Branch-Router needs the same Router-on-a-Stick setup, but with different IP subnets. HQ uses 192.168.10.0/24 and 192.168.20.0/24. Branch uses 192.168.30.0/24 and 192.168.40.0/24.

  • Click Branch-Router in your topology to open its configuration window.
  • Click the CLI tab.
  • Configure the sub-interfaces by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.30.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.40.1 255.255.255.0
exit
end

Why different subnets at each site?

Each site gets its own IP range. This is standard enterprise practice because it makes routing decisions clearer and avoids IP conflicts when sites connect over a VPN later.

VLAN 10 is always HR and VLAN 20 is always Engineering regardless of location. The consistency in VLAN numbering makes troubleshooting much simpler for the operations team who maintains the network after deployment.

  • Verify your sub-interfaces are up by running:
show ip interface brief

You should see GigabitEthernet0/0, GigabitEthernet0/0.10, and GigabitEthernet0/0.20 all listed with their IP addresses and showing up status.

Seeing errors when entering commands?

If you see Invalid input detected, check that you are in global configuration mode (the prompt should show (config)#). Run configure terminal to re-enter it.

If sub-interfaces show down, confirm you ran no shutdown on the parent GigabitEthernet0/0 interface and that the cable from Branch-Switch Fa0/1 connects to Branch-Router GigabitEthernet0/0.

Help me fix errors on my Branch-Router sub-interface configuration in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure all three interfaces show up status before moving on to the PC configuration.

ⓧ I'd like to double check the full code

Here is everything you should have entered on Branch-Router:

enable
configure terminal
interface GigabitEthernet0/0
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.30.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.40.1 255.255.255.0
exit
end
Configure PC IP addresses

Each PC needs an IP address, a subnet mask, and a default gateway. The gateway points to the router sub-interface for that PC's VLAN.

  • Click HQ-HR-PC in your topology.
  • Click the Desktop tab, then click IP Configuration.
  • Enter the following values:
  • IP Address: 192.168.10.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.10.1
  • Repeat for HQ-ENG-PC:
  • IP Address: 192.168.20.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.20.1
  • Repeat for Branch-HR-PC:
  • IP Address: 192.168.30.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.30.1
  • Repeat for Branch-ENG-PC:
  • IP Address: 192.168.40.10
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.40.1

Why does each PC need a gateway?

The default gateway is the router sub-interface IP for that VLAN. When a PC wants to reach a device in a different VLAN, it sends the traffic to its gateway. The router then forwards it to the correct destination VLAN.

Without a gateway, PCs can only talk to other devices in the same VLAN on the same switch.

  • Test inter-VLAN routing at HQ. Click HQ-HR-PC, go to the Desktop tab, and open Command Prompt.
  • Ping HQ-ENG-PC by entering:
ping 192.168.20.10

You should see replies from 192.168.20.10. This proves that HR can reach Engineering through the router at HQ.

  • Test inter-VLAN routing at Branch. Click Branch-HR-PC, go to Desktop > Command Prompt.
  • Ping Branch-ENG-PC by entering:
ping 192.168.40.10

You should see replies from 192.168.40.10. Inter-VLAN routing is working at both sites.

What about cross-site pings?

If you try pinging from HQ-HR-PC to Branch-HR-PC (192.168.30.10), it will fail. That is expected. The two sites are not connected yet. The VPN you configure in a later step creates that cross-site link.

Pings timing out?

Check that the PC's default gateway matches the router sub-interface IP for that VLAN. For example, HQ-HR-PC's gateway must be 192.168.10.1 (the IP on GigabitEthernet0/0.10).

Also verify the trunk link between the switch and router is active. On HQ-Switch, run show interfaces trunk and confirm Fa0/1 is listed.

The first ping attempt sometimes times out while the switch learns MAC addresses. Try pinging a second time before troubleshooting further.

Help me figure out why my inter-VLAN pings are failing in Packet Tracer.

Both sites now have full internal connectivity between departments. Next up, you will connect the two sites through a simulated ISP and configure the WAN links that make cross-site communication possible.

Configure WAN Links and Static Routing

Your two sites can now route traffic between departments internally. HR can reach Engineering within the same building. But right now, HQ and Branch are completely isolated from each other.

In a real merger scenario, these offices could be in different cities. They connect through an ISP. In this step, you will configure the WAN-facing interfaces on each router and add static routes so each site knows how to reach the other through the simulated public internet.

In this step, get ready to:
  • Configure WAN interfaces on HQ-Router, ISP, and Branch-Router.
  • Add static routes so the ISP can forward traffic between sites.
  • Verify end-to-end WAN connectivity with a ping test.
Configure HQ-Router WAN interface

HQ-Router needs a public-facing IP address on its WAN port so it can communicate with the ISP. It also needs a default route telling it to send all unknown traffic toward the ISP.

  • Click HQ-Router in your topology, then select the CLI tab.
  • Enter the following commands to configure the WAN interface and default route:
enable
configure terminal
! Configure the WAN-facing interface toward the ISP
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
no shutdown
exit
! Default route: send all unknown traffic to the ISP
ip route 0.0.0.0 0.0.0.0 203.0.113.2
end

What do these commands do?

The ip address 203.0.113.1 255.255.255.252 assigns a public IP to the WAN port. The /30 subnet mask means only two usable addresses exist on this link (one for HQ-Router, one for the ISP).

The ip route 0.0.0.0 0.0.0.0 203.0.113.2 is a default static route. It tells HQ-Router to forward any traffic it does not have a specific route for to the ISP at 203.0.113.2.

Why 203.0.113.0 for the WAN addresses?

These addresses come from RFC 5737, which reserves 203.0.113.0/24 and 198.51.100.0/24 specifically for documentation and testing. In real life, your ISP would assign you public IPs. In a lab, these reserved ranges keep things realistic without conflicting with real networks.

Configure ISP router interfaces

The ISP router sits between both sites, simulating the public internet. It needs an interface facing HQ and another facing Branch.

  • Click ISP in your topology, then select the CLI tab.
  • Enter the following commands to bring up both WAN-facing interfaces:
enable
configure terminal
! Interface facing HQ-Router
interface GigabitEthernet0/0
ip address 203.0.113.2 255.255.255.252
no shutdown
exit
! Interface facing Branch-Router
interface GigabitEthernet0/1
ip address 198.51.100.1 255.255.255.252
no shutdown
exit
end

What does this configure?

GigabitEthernet0/0 connects to HQ-Router on the 203.0.113.0/30 subnet. GigabitEthernet0/1 connects to Branch-Router on the 198.51.100.0/30 subnet. This creates two separate point-to-point links, just like a real ISP connecting two customer sites.

Configure Branch-Router WAN interface
  • Click Branch-Router in your topology, then select the CLI tab.
  • Enter the following commands to configure the WAN interface and default route:
enable
configure terminal
! Configure the WAN-facing interface toward the ISP
interface GigabitEthernet0/1
ip address 198.51.100.2 255.255.255.252
no shutdown
exit
! Default route: send all unknown traffic to the ISP
ip route 0.0.0.0 0.0.0.0 198.51.100.1
end

Why does Branch-Router also get a default route?

Both HQ-Router and Branch-Router use a default route pointing to the ISP. This means any traffic destined for a network they do not know about locally gets forwarded to the ISP for delivery. The ISP then decides where to send it next.

  • Check the link indicators between your routers. After entering no shutdown on all three routers, the connections between HQ-Router and ISP, and between ISP and Branch-Router, should show green triangles.

Links still showing red or orange?

Make sure you entered no shutdown on each interface. A missing no shutdown leaves the interface administratively down. Also verify you connected the correct interfaces during cabling (GigabitEthernet0/1 on HQ-Router to GigabitEthernet0/0 on ISP, and GigabitEthernet0/1 on ISP to GigabitEthernet0/1 on Branch-Router).

Help me troubleshoot my WAN link status in Packet Tracer

Configure ISP static routes

The ISP router currently knows about its directly connected subnets, but it does not know how to route between them. Without static routes on the ISP, traffic arriving from HQ destined for Branch would be dropped.

  • Switch back to the ISP router CLI tab.
  • Enter the following commands to add static routes for both WAN subnets:
enable
configure terminal
! Route for the HQ-facing subnet
ip route 203.0.113.0 255.255.255.252 GigabitEthernet0/0
! Route for the Branch-facing subnet
ip route 198.51.100.0 255.255.255.252 GigabitEthernet0/1
end

Why does the ISP need these routes?

In real life, your ISP handles routing with BGP. In this lab, static routes simulate the same result. The ISP needs to know that traffic for 203.0.113.0/30 exits through GigabitEthernet0/0 (toward HQ), and traffic for 198.51.100.0/30 exits through GigabitEthernet0/1 (toward Branch).

Verify WAN connectivity

Before configuring the VPN, you need to confirm that both routers can reach each other through the ISP. This is a real troubleshooting principle: always verify the underlay before configuring the overlay.

  • Click HQ-Router and open the CLI tab.
  • Test connectivity to Branch-Router's WAN IP by running this command:
ping 198.51.100.2

You should see replies coming back with !!!! symbols, confirming the ping succeeded.

  • Now click Branch-Router and open the CLI tab.
  • Verify the reverse path by running:
ping 203.0.113.1

This should also return successful replies.

What about cross-site LAN pings?

If you try pinging from HQ-HR-PC (192.168.10.10) to Branch-HR-PC (192.168.30.10), it will fail. That is expected. The ISP does not know about your private subnets (192.168.x.x). It only routes between the public WAN addresses.

This is exactly what the VPN in the next step fixes. The VPN tunnel will encrypt your private traffic and carry it across the ISP without the ISP needing to know about your internal addresses.

Ping shows dots instead of exclamation marks?

Dots (.....) mean the ping timed out. Check these common causes:

  • Verify the IP addresses on each interface match exactly. On HQ-Router: 203.0.113.1 on Gi0/1. On ISP: 203.0.113.2 on Gi0/0 and 198.51.100.1 on Gi0/1. On Branch-Router: 198.51.100.2 on Gi0/1.
  • Make sure you entered the ISP static routes from the previous substep.
  • Run show ip interface brief on each router to check all interfaces show up status.

Help me troubleshoot why my WAN ping is failing between routers

✔️ Awesome, I've got everything!

Great. Make sure you save your Packet Tracer topology file before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete set of commands entered on each router during this step.

HQ-Router:

enable
configure terminal
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 203.0.113.2
end

ISP Router:

enable
configure terminal
interface GigabitEthernet0/0
ip address 203.0.113.2 255.255.255.252
no shutdown
exit
interface GigabitEthernet0/1
ip address 198.51.100.1 255.255.255.252
no shutdown
exit
ip route 203.0.113.0 255.255.255.252 GigabitEthernet0/0
ip route 198.51.100.0 255.255.255.252 GigabitEthernet0/1
end

Branch-Router:

enable
configure terminal
interface GigabitEthernet0/1
ip address 198.51.100.2 255.255.255.252
no shutdown
exit
ip route 0.0.0.0 0.0.0.0 198.51.100.1
end

Your WAN backbone is live. Both routers can reach each other across the simulated internet. Next up, you will configure a site-to-site IPsec VPN to encrypt all private traffic crossing this public link.

Configure Site-to-Site IPsec VPN

Your two offices can reach each other through the ISP, but the traffic is completely unencrypted. Anyone on the public internet could intercept it.

A site-to-site IPsec VPN creates an encrypted tunnel between HQ-Router and Branch-Router. All traffic between the private LAN subnets gets encrypted before crossing the ISP. This is the standard approach for connecting branch offices in enterprise networks, and cheaper than leasing a private circuit between offices.

In this step, get ready to:
  • Configure the IPsec VPN tunnel on HQ-Router (Phase 1 and Phase 2 settings).
  • Mirror the VPN configuration on Branch-Router.
  • Verify end-to-end encrypted connectivity between sites and document the network.
Configure IPsec VPN on HQ-Router

The IPsec VPN has two phases. Phase 1 (ISAKMP) negotiates how the two routers authenticate each other and agree on encryption. Phase 2 (IPsec) defines how the actual data traffic is encrypted.

  • Click HQ-Router in your topology, then click the CLI tab.
  • Enter the following commands to configure the full IPsec VPN:
enable
configure terminal
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
exit
crypto isakmp key MergerVPN2024! address 198.51.100.2
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
exit
access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.40.0 0.0.0.255
crypto map VPN-MAP 10 ipsec-isakmp
set peer 198.51.100.2
set transform-set VPN-SET
match address 100
exit
interface GigabitEthernet0/1
crypto map VPN-MAP
exit
end

What does each section do?

  • crypto isakmp policy 10 (Phase 1): Negotiates how the two routers authenticate and encrypt. AES-256 is strong encryption. Pre-shared key is the simplest authentication method for site-to-site VPNs. Group 5 is the Diffie-Hellman key exchange group.
  • crypto isakmp key MergerVPN2024!: A password both routers know. In production you would use certificates, but PSK is standard for small deployments and labs.
  • crypto ipsec transform-set VPN-SET (Phase 2): Defines how the actual data traffic is encrypted (AES encryption + SHA integrity checking).
  • access-list 100 entries: Define "interesting traffic" that should trigger the VPN tunnel. Only traffic between HQ private subnets (192.168.10.0/24, 192.168.20.0/24) and Branch private subnets (192.168.30.0/24, 192.168.40.0/24) gets encrypted.
  • crypto map VPN-MAP: Ties everything together. It links the peer address, the transform set, and the interesting traffic ACL, then gets applied to the WAN interface.

You will not see the tunnel come up yet. The Branch-Router needs matching configuration first.

Seeing a % Invalid input detected error?

Make sure you are in global configuration mode (the prompt should show (config)#) when entering the crypto commands. If you accidentally exited to privileged exec mode, type configure terminal to re-enter config mode.

help me troubleshoot crypto commands not being recognized on my 1941 router in Packet Tracer

Configure IPsec VPN on Branch-Router (mirror configuration)

The Branch-Router needs an identical VPN configuration, but with two key differences: the peer address points to HQ-Router, and the ACLs are reversed. If HQ says "encrypt traffic FROM 192.168.10.0 TO 192.168.30.0", Branch must say "encrypt traffic FROM 192.168.30.0 TO 192.168.10.0".

  • Click Branch-Router in your topology, then click the CLI tab.
  • Enter the following commands to configure the mirror VPN:
enable
configure terminal
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
exit
crypto isakmp key MergerVPN2024! address 203.0.113.1
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
exit
access-list 100 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
crypto map VPN-MAP 10 ipsec-isakmp
set peer 203.0.113.1
set transform-set VPN-SET
match address 100
exit
interface GigabitEthernet0/1
crypto map VPN-MAP
exit
end

Why are the ACLs reversed?

Both ends must agree on what traffic to encrypt, or the tunnel never establishes. The source and destination in Branch-Router's ACL are the reverse of HQ-Router's ACL. This is a requirement Cisco documents explicitly: the ACLs applied to the crypto map on both devices must be mirror images of each other.

Both routers now have matching VPN configurations. The tunnel is ready to negotiate as soon as interesting traffic triggers it.

Worried about typos in the ACL entries?

The most common VPN failure is mismatched ACLs between peers. Double-check that every access-list 100 entry on Branch-Router swaps the source and destination subnets compared to HQ-Router. For example, HQ says 192.168.10.0 ... 192.168.30.0 and Branch says 192.168.30.0 ... 192.168.10.0.

help me verify my VPN ACLs are correctly mirrored between HQ and Branch routers

Test the VPN tunnel and document your network

The moment of truth. You are about to send traffic between private subnets at different sites, encrypted through the IPsec tunnel over the simulated public internet.

  • Click HQ-HR-PC in your topology.
  • Click the Desktop tab, then click Command Prompt.
  • Ping Branch-HR-PC by running:
ping 192.168.30.10

First ping might time out

The first ping may fail or time out because the tunnel needs a moment to negotiate its Phase 1 and Phase 2 security associations. This is normal. Run the ping command a second time and you should see successful replies.

  • If the first ping times out, run ping 192.168.30.10 again. You should see replies from 192.168.30.10.
  • Now verify the tunnel is active on HQ-Router. Click HQ-Router, then click the CLI tab.
  • Run this command to check the ISAKMP security association:
show crypto isakmp sa
  • You should see an entry with state QM_IDLE. This means the Phase 1 tunnel is active and ready.
  • Run this command to check the IPsec security association:
show crypto ipsec sa
  • Look for the #pkts encaps and #pkts decaps counters. Both should show non-zero numbers, confirming traffic is being encrypted and decrypted through the tunnel.

Pings still failing after the second attempt?

  • Run show crypto isakmp sa on HQ-Router. If you see no entries at all, the tunnel never attempted to negotiate. Check that crypto map VPN-MAP was applied to GigabitEthernet0/1 on both routers.
  • If you see MM_NO_STATE instead of QM_IDLE, the pre-shared keys do not match. Verify both routers use MergerVPN2024! as the key.
  • If Phase 1 shows QM_IDLE but pings still fail, the ACLs are likely mismatched. Run show access-lists on both routers and confirm the source/destination subnets are correctly mirrored.

help me troubleshoot my IPsec VPN tunnel that won't come up in Packet Tracer

Your VPN is working. Every packet between HQ and Branch is now encrypted with AES-256 before crossing the simulated public internet.

Now that connectivity is verified, create a documentation sheet for your network. In real deployments, documentation is what you hand off to the operations team after staging.

  • Open a text editor on your computer (Notepad, TextEdit, or any app you prefer).
  • Create your network documentation using the template below:
# Post-Merger Network Documentation

## Device Inventory
| Device         | Model | Role                      |
|----------------|-------|---------------------------|
| HQ-Router      | 1941  | HQ gateway + VPN peer     |
| Branch-Router  | 1941  | Branch gateway + VPN peer |
| ISP            | 1941  | Simulated ISP             |
| HQ-Switch      | 2960  | HQ LAN switch             |
| Branch-Switch  | 2960  | Branch LAN switch         |
| HQ-HR-PC       | PC    | HR workstation (HQ)       |
| HQ-ENG-PC     | PC    | Engineering workstation (HQ) |
| Branch-HR-PC   | PC    | HR workstation (Branch)   |
| Branch-ENG-PC  | PC    | Engineering workstation (Branch) |

## VLAN Assignments
| VLAN ID | Name        | HQ Subnet        | Branch Subnet     |
|---------|-------------|-------------------|-------------------|
| 10      | HR          | 192.168.10.0/24   | 192.168.30.0/24   |
| 20      | Engineering | 192.168.20.0/24   | 192.168.40.0/24   |

## IP Addressing Table
| Device        | Interface   | IP Address       | Subnet Mask       |
|---------------|-------------|------------------|-------------------|
| HQ-Router     | Gi0/0.10    | 192.168.10.1     | 255.255.255.0     |
| HQ-Router     | Gi0/0.20    | 192.168.20.1     | 255.255.255.0     |
| HQ-Router     | Gi0/1       | 203.0.113.1      | 255.255.255.252   |
| ISP           | Gi0/0       | 203.0.113.2      | 255.255.255.252   |
| ISP           | Gi0/1       | 198.51.100.1     | 255.255.255.252   |
| Branch-Router | Gi0/0.10    | 192.168.30.1     | 255.255.255.0     |
| Branch-Router | Gi0/0.20    | 192.168.40.1     | 255.255.255.0     |
| Branch-Router | Gi0/1       | 198.51.100.2     | 255.255.255.252   |
| HQ-HR-PC      | NIC         | 192.168.10.10    | 255.255.255.0     |
| HQ-ENG-PC    | NIC         | 192.168.20.10    | 255.255.255.0     |
| Branch-HR-PC  | NIC         | 192.168.30.10    | 255.255.255.0     |
| Branch-ENG-PC | NIC         | 192.168.40.10    | 255.255.255.0     |

## VPN Configuration Summary
- Type: Site-to-Site IPsec VPN
- Encryption: AES-256
- Authentication: Pre-shared key
- DH Group: 5
- Transform Set: esp-aes + esp-sha-hmac
- Peers: 203.0.113.1 <-> 198.51.100.2

Why create documentation?

In the real job, you hand this documentation to the operations team who maintains the network after you deploy it. It is also what interviewers expect when they ask about your lab experience. Having a clean IP addressing table and device inventory ready shows you think like a professional engineer.

  • Save your documentation file somewhere easy to find (your Desktop works well).
  • Save your Packet Tracer topology by pressing Ctrl+S (Windows) or Cmd+S (macOS).

✔️ Awesome, I've got everything!

Great. Double check you have saved both your .pkt topology file and your network documentation.

ⓧ I'd like to double check the full VPN config

Here is the complete VPN configuration for both routers.

! === HQ-Router VPN Configuration ===
enable
configure terminal
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
exit
crypto isakmp key MergerVPN2024! address 198.51.100.2
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
exit
access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.40.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
access-list 100 permit ip 192.168.20.0 0.0.0.255 192.168.40.0 0.0.0.255
crypto map VPN-MAP 10 ipsec-isakmp
set peer 198.51.100.2
set transform-set VPN-SET
match address 100
exit
interface GigabitEthernet0/1
crypto map VPN-MAP
exit
end
! === Branch-Router VPN Configuration ===
enable
configure terminal
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
exit
crypto isakmp key MergerVPN2024! address 203.0.113.1
crypto ipsec transform-set VPN-SET esp-aes esp-sha-hmac
exit
access-list 100 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 100 permit ip 192.168.40.0 0.0.0.255 192.168.20.0 0.0.0.255
crypto map VPN-MAP 10 ipsec-isakmp
set peer 203.0.113.1
set transform-set VPN-SET
match address 100
exit
interface GigabitEthernet0/1
crypto map VPN-MAP
exit
end

ⓧ I'd like to double check verification commands

Run these on HQ-Router to confirm the VPN is active.

show crypto isakmp sa
! Expected: QM_IDLE state

show crypto ipsec sa
! Expected: non-zero #pkts encaps and #pkts decaps

Your post-merger network is fully operational. Traffic between HQ and Branch now flows through an encrypted IPsec tunnel, invisible to anyone on the simulated public internet. Next up, you will tackle the Secret Mission: adding access control lists to restrict which departments can communicate across sites.

Secret mission

Add Post-Merger Security ACLs

Your VPN tunnel is working, but security has a problem with it. Right now, every department at HQ can reach every department at Branch with zero restrictions. After a merger, not every team should have unrestricted access to the other company's resources. Can you implement a security policy using Access Control Lists?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about.

Resources you used:

  • Cisco Packet Tracer .pkt topology file (local file on your computer).
  • Network documentation sheet (local file).

Keep everything running

No action needed. Choose this if you plan to revisit the topology, extend it with additional sites, or use it as interview prep material.

  • Your .pkt file stays wherever you saved it. Consider moving it to a dedicated folder for portfolio projects.
  • The network documentation you created can be printed or saved as a PDF for job interviews.
  • Cisco Packet Tracer remains installed on your machine for future labs.

Pause - I'll come back to this later

There are no running processes to pause. Your topology is already saved inside the .pkt file.

  • Make sure you saved your topology (File > Save) before closing Packet Tracer.
  • When you reopen the .pkt file later, all device configurations, cabling, and labels will be exactly as you left them.

Delete - I don't want to use this again

Remove all project files from your computer.

  • Delete your .pkt topology file. Find the file in Finder (macOS) or File Explorer (Windows) and move it to the Trash or Recycle Bin.
  • Delete your network documentation file the same way.
  • Empty your Trash (macOS) or Recycle Bin (Windows) to permanently remove the files.

Nice Work!

Nice Work!

You just built a production-grade multi-site network from scratch and connected it with an encrypted VPN tunnel. That is exactly the kind of hands-on infrastructure work that junior network engineers do on the job every day.

You've learned how to:

  • Build a multi-site enterprise topology with VLANs segmenting departments (HR and Engineering) across both sites, using 802.1Q trunking and Router-on-a-Stick for inter-VLAN routing.
  • Configure a site-to-site IPsec VPN tunnel with AES-256 encryption, connecting Corporate HQ to a Remote Branch Office over a simulated ISP.
  • Create professional network documentation including an IP addressing table, VLAN assignments, and device inventory ready for job interviews.
  • Secret Mission: Applied post-merger security ACLs to restrict cross-department access between sites, enforcing a real-world security policy over the VPN tunnel.

Ready to quiz yourself?