Build a Small Office Network with VLANs

Segment a 3-department office network with VLANs and inter-VLAN routing.

Introduction

30 Second Summary

Think about a real office. You wouldn't want the sales team's file transfers slowing down HR's payroll system, or a rogue device in one department snooping on another's traffic. Companies solve this by splitting their network into isolated segments, one per department.

In this project, you will build a simulated small office network in Cisco Packet Tracer where three departments each live on their own VLAN. You'll watch communication break after segmentation, then fix it by configuring inter-VLAN routing on a router.

What You'll Build

You'll end up with a working office network where six PCs across Sales, HR, and IT can all ping each other across VLAN boundaries, with every packet flowing through a router you configured from scratch using real Cisco IOS commands.

By the end of this project, you'll have:

  • A segmented network where pinging between departments succeeds, proving your router bridges the VLAN boundaries you created.
  • Switch and router show commands that confirm your VLANs, port assignments, and routing tables are correctly configured.
  • A practiced troubleshooting workflow where you intentionally break the network, diagnose the root cause with show vlan brief, and fix it.
  • Secret Mission: DHCP pools that automatically assign IP addresses to every PC so you never touch a static configuration again.

Are there any prerequisites?

You need Cisco Packet Tracer installed on your computer with a free Cisco Networking Academy (Skills for All) account. If you don't have it yet, download it from the Cisco Networking Academy website before starting Step 1.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters. Committing to the scenario now grounds every configuration decision in a real-world rationale rather than abstract commands.

Build the Network Topology

Before configuring any software, you need the physical foundation in place. Placing devices and connecting cables in Cisco Packet Tracer mirrors how network engineers plan rack layouts and cabling before ever touching a CLI.

In this step, you will place a router, a switch, and six PCs into a new topology. Then you will cable them together and assign each PC an IP address so they are ready for configuration in later steps.

In this step, get ready to:
  • Place a router, switch, and six PCs into a new Packet Tracer topology.
  • Connect all devices with Copper Straight-Through cables and confirm green link lights.
  • Assign static IP addresses and default gateways to all six PCs.
Place the devices

Every network starts with hardware. You need one router to handle traffic between departments, one switch to connect PCs within the office, and six PCs representing employees in three departments.

  • In Cisco Packet Tracer, create a new topology by clicking File in the menu bar, then New.
  • Look at the bottom-left corner of the workspace for the device category icons.
  • Click the Network Devices category (the icon that looks like a hub/switch).
  • Select the Routers subcategory from the row that appears.
  • Find 1941 in the device list and click it, then click on the workspace to place it.
  • Select the Switches subcategory.
  • Find 2960 in the device list and place it on the workspace below the router.

You should now see a router and a switch on your workspace.

  • Click the End Devices category (the icon that looks like a PC/monitor).
  • Find PC-PT in the device list.
  • Place six PCs on the workspace, arranging them in three groups of two below the switch.

Now label each PC so you can identify which department it belongs to.

  • Click directly on the label text beneath the first PC to make it editable.
  • Rename the first group (left pair) to Sales-PC1 and Sales-PC2.
  • Rename the middle pair to HR-PC1 and HR-PC2.
  • Rename the right pair to IT-PC1 and IT-PC2.

Your workspace should now show a router at the top, a switch in the middle, and six labeled PCs in three groups at the bottom.

Why label PCs by department?

Labeling devices by department makes it easy to verify your VLAN assignments later. When you assign ports to VLANs in a future step, you will instantly see whether the right PCs ended up in the right segment.

Connect the cables

Devices need physical links to communicate. In Packet Tracer, you use Copper Straight-Through cables to connect PCs to switches and switches to routers.

  • Click the Connections category at the bottom-left of the workspace (the lightning bolt icon).
  • Select the Copper Straight-Through cable (solid black line icon).
  • Click Sales-PC1, select FastEthernet0 from the pop-up menu, then click the Switch and select FastEthernet0/1.
  • Click Sales-PC2, select FastEthernet0, then click the Switch and select FastEthernet0/2.
  • Click HR-PC1, select FastEthernet0, then click the Switch and select FastEthernet0/3.
  • Click HR-PC2, select FastEthernet0, then click the Switch and select FastEthernet0/4.
  • Click IT-PC1, select FastEthernet0, then click the Switch and select FastEthernet0/5.
  • Click IT-PC2, select FastEthernet0, then click the Switch and select FastEthernet0/6.

Now connect the switch to the router.

  • With the Copper Straight-Through cable still selected, click the Switch and select GigabitEthernet0/1.
  • Click the Router and select GigabitEthernet0/0.

Wait a few seconds for the link indicators (small circles on each end of the cables) to turn green. Green means the link is active.

Speed up the link lights

If the circles are still orange, click the Fast Forward Time button (the double-arrow icon in the bottom-right play controls) a few times. This advances Packet Tracer's simulation clock and brings the links up faster.

Seeing red link indicators?

A red circle means the cable is connected to the wrong port type. Delete the cable (click it and press Delete on your keyboard) and reconnect, making sure you select the correct port names listed above.

help me fix a red link indicator on my cable in Packet Tracer

Assign static IP addresses to all PCs

Each PC needs an IP address so the network knows where to send traffic. You will use three different subnets, one per department, so each department has its own address range.

What is a subnet?

A subnet is a smaller network carved out of a larger one. Devices in the same subnet can find each other directly. Devices in different subnets need a router to relay traffic between them.

Here, Sales uses 192.168.10.0/24, HR uses 192.168.20.0/24, and IT uses 192.168.30.0/24. The /24 means the first three octets identify the network and the last octet identifies the device.

Start with Sales-PC1 to learn the process.

  • Click Sales-PC1 to open its configuration window.
  • Click the Desktop tab at the top of the window.
  • Click IP Configuration.
  • In the IPv4 Address field, enter 192.168.10.10.
  • In the Subnet Mask field, enter 255.255.255.0.
  • In the Default Gateway field, enter 192.168.10.1.
  • Close the configuration window by clicking the X in the top-right corner.

Sales-PC1 is now configured. Repeat the same process for the remaining five PCs using the addresses below.

  • Click each PC, go to Desktop > IP Configuration, and enter the values from this table:
Sales-PC1: IP 192.168.10.10, Subnet 255.255.255.0, Gateway 192.168.10.1
Sales-PC2: IP 192.168.10.11, Subnet 255.255.255.0, Gateway 192.168.10.1
HR-PC1:    IP 192.168.20.10, Subnet 255.255.255.0, Gateway 192.168.20.1
HR-PC2:    IP 192.168.20.11, Subnet 255.255.255.0, Gateway 192.168.20.1
IT-PC1:    IP 192.168.30.10, Subnet 255.255.255.0, Gateway 192.168.30.1
IT-PC2:    IP 192.168.30.11, Subnet 255.255.255.0, Gateway 192.168.30.1

What is the Default Gateway for?

The Default Gateway is the IP address of the router interface that serves this subnet. When a PC wants to reach a device in a different subnet, it sends the traffic to its gateway. The router has not been configured yet, so these gateways will not respond until a later step.

After configuring all six PCs, verify one of them to make sure the values stuck.

  • Click IT-PC2 and go to Desktop > IP Configuration.
  • Confirm it shows IP 192.168.30.11, Subnet 255.255.255.0, Gateway 192.168.30.1.

IP fields showing 0.0.0.0?

Make sure the Static radio button is selected (not DHCP) in the IP Configuration window. If DHCP is selected, the PC will ignore your manual entries and wait for a DHCP server that does not exist yet.

help me fix my PC IP configuration in Packet Tracer

✔️ Awesome, I've got everything!

Great. Make sure you save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS).

ⓧ I'd like to double check the full configuration

Here is the complete IP addressing table. Click each PC, go to Desktop > IP Configuration, and confirm the values match:

Sales-PC1: IP 192.168.10.10, Subnet 255.255.255.0, Gateway 192.168.10.1
Sales-PC2: IP 192.168.10.11, Subnet 255.255.255.0, Gateway 192.168.10.1
HR-PC1:    IP 192.168.20.10, Subnet 255.255.255.0, Gateway 192.168.20.1
HR-PC2:    IP 192.168.20.11, Subnet 255.255.255.0, Gateway 192.168.20.1
IT-PC1:    IP 192.168.30.10, Subnet 255.255.255.0, Gateway 192.168.30.1
IT-PC2:    IP 192.168.30.11, Subnet 255.255.255.0, Gateway 192.168.30.1

Also confirm all cable link indicators (small circles at each end of the cables) are green for every connection.

Your physical topology is complete and every PC has an address. Next up, you will test whether these PCs can actually talk to each other on this flat, unsegmented network.

Test Connectivity on the Flat Network

Your network topology is cabled and every PC has an IP address. Right now, the switch has zero configuration applied.

All six ports sit on the default VLAN 1, which means the switch treats every connected device as part of one big broadcast domain. Before we change anything, let's establish a baseline so you can feel the difference when VLANs break this connectivity in the next step.

In this step, get ready to:
  • Verify same-subnet pings succeed between PCs in the same department.
  • Confirm cross-subnet pings fail because no router is configured yet.
  • Prove all ports share one broadcast domain with a temporary IP test.
Ping within the same subnet

PCs on the same subnet can reach each other directly because the switch forwards frames between ports in the same broadcast domain. Let's confirm this works.

  • Click on Sales-PC1 in your topology.
  • Click the Desktop tab.
  • Click Command Prompt.
  • Ping Sales-PC2 by running this command:
ping 192.168.10.11

You should see replies coming back from 192.168.10.11. Both PCs share the 192.168.10.0/24 subnet, so the switch delivers the traffic directly.

What is a subnet?

A subnet is a logical division of an IP network. Devices on the same subnet can communicate directly through a switch without needing a router.

Devices on different subnets must send traffic to a router (their default gateway) to reach each other. Right now, no router is configured to do this job.

Attempt to ping across subnets

Sales-PC1 is on the 192.168.10.0/24 subnet and HR-PC1 is on 192.168.20.0/24. What do you think will happen when Sales-PC1 tries to reach HR-PC1?

  • Still in Sales-PC1's Command Prompt, ping HR-PC1 by running:
ping 192.168.20.10

This ping fails. You will see "Request timed out" or "Destination host unreachable" messages.

Why does this ping fail?

Sales-PC1 sees that 192.168.20.10 is on a different subnet. It tries to send the traffic to its default gateway (192.168.10.1), but that gateway does not exist yet. No router is configured to route between subnets.

This is your baseline. Same-subnet communication works. Cross-subnet communication does not. Later steps will add VLANs to isolate departments AND configure routing to connect them in a controlled way.

Prove all ports share one broadcast domain

The cross-subnet ping failed because of routing, not because of VLAN isolation. Let's prove that the switch currently treats all ports as one flat network by temporarily placing HR-PC1 on the same subnet as Sales.

  • Click on HR-PC1 in your topology.
  • Click the Desktop tab, then click IP Configuration.
  • Change the IP address to 192.168.10.12. Leave the subnet mask as 255.255.255.0.

HR-PC1 is now on the same 192.168.10.0/24 subnet as the Sales PCs. Even though it is plugged into a different physical port (FastEthernet0/3), it should be able to reach Sales-PC1 directly.

  • Open HR-PC1's Command Prompt from the Desktop tab and ping Sales-PC1 by running:
ping 192.168.10.10

The ping succeeds with replies. This proves the switch is not isolating ports from each other. Every port is on the same default VLAN 1 broadcast domain.

Why does this matter?

After VLANs are configured in the next step, even same-subnet devices on different VLANs will be isolated. This test gives you the "before" picture so you can see exactly what VLANs change.

  • Return to HR-PC1's IP Configuration on the Desktop tab.
  • Change the IP address back to 192.168.20.10.
  • Confirm the gateway is still 192.168.20.1.

Ping still failing after the IP change?

Make sure you typed 192.168.10.12 (not 192.168.20.12) as HR-PC1's temporary IP. Both PCs must be on the same 192.168.10.x subnet for the test to work.

Also check that all cable link indicators between the switch and PCs are green. An orange or red indicator means the link is still initializing or disconnected.

Help me troubleshoot why my ping between PCs on the same subnet is failing in Packet Tracer.

You now have a clear baseline. Same-subnet PCs can communicate directly through the flat switch. Cross-subnet PCs cannot reach each other because no router exists yet. Next up, you will create VLANs to segment each department into its own isolated network.

Create VLANs and Segment the Network

In the previous step, you confirmed that your flat network lets same-subnet PCs talk freely. That means every device shares one big broadcast domain. Every broadcast frame from any PC reaches all other PCs on the switch.

This is a security risk and a performance problem. In a real office, you would not want the Sales team's broadcast traffic flooding HR and IT machines. VLANs solve this by splitting one physical switch into multiple isolated broadcast domains. After this step, departments will be completely cut off from each other.

In this step, get ready to:
  • Create three VLANs on the switch (Sales, HR, IT).
  • Assign switch ports to the correct VLANs.
  • Verify that departments are now isolated from each other.
Create VLANs on the switch

A VLAN is a logical grouping that exists inside the switch's configuration database. You need to create each VLAN and give it a name before you can assign any ports to it.

  • Click the Switch in your topology to open its properties.
  • Click the CLI tab to access the command-line interface.
  • Enter the following commands to create three VLANs:
enable
configure terminal
vlan 10
name Sales
exit
vlan 20
name HR
exit
vlan 30
name IT
exit

What do these commands do?

  • enable enters privileged EXEC mode, giving you full access to configuration commands.
  • configure terminal enters global configuration mode where you can change the switch's settings.
  • vlan 10 creates VLAN 10 and enters VLAN configuration mode for it.
  • name Sales gives the VLAN a human-readable label so you can identify it later.
  • exit returns to global configuration mode so you can create the next VLAN.
  • Confirm your VLANs exist by running this command:
show vlan brief

You should see VLAN 10 (Sales), VLAN 20 (HR), and VLAN 30 (IT) listed in the output table. All ports still appear under VLAN 1 because you have not assigned them yet.

Don't see your VLANs listed?

  • Make sure you typed exit after each VLAN's name command. Without it, you stay in that VLAN's config mode and the next vlan command will not work correctly.
  • Confirm you ran enable first. If your prompt shows Switch> instead of Switch#, you are not in privileged mode yet.
  • If you need to start over, type end to return to privileged mode and re-enter the commands from configure terminal.

Still stuck? Help me troubleshoot my VLAN creation on the switch

Assign switch ports to VLANs

Creating VLANs is only half the job. Each switch port needs to be told which VLAN it belongs to. Ports that are not explicitly assigned stay on the default VLAN 1.

  • Still in the switch CLI, enter the following commands to assign ports to their department VLANs:
interface range FastEthernet0/1-2
switchport mode access
switchport access vlan 10
exit
interface range FastEthernet0/3-4
switchport mode access
switchport access vlan 20
exit
interface range FastEthernet0/5-6
switchport mode access
switchport access vlan 30
exit
end

What do these commands do?

  • interface range FastEthernet0/1-2 selects multiple ports at once so you can configure them together.
  • switchport mode access tells the port it connects to an end device (a PC), not to another switch.
  • switchport access vlan 10 places that port into VLAN 10. Any device plugged into this port becomes part of the Sales network.
  • end exits all configuration modes and returns to privileged EXEC mode.
  • Verify your port assignments by running:
show vlan brief

You should now see Fa0/1 and Fa0/2 under VLAN 10, Fa0/3 and Fa0/4 under VLAN 20, and Fa0/5 and Fa0/6 under VLAN 30. Those ports no longer appear under VLAN 1.

Ports still showing under VLAN 1?

  • Check that you typed switchport access vlan 10 (not switchport vlan 10). The access keyword is required.
  • Confirm the port range syntax uses a hyphen with no spaces: FastEthernet0/1-2. A typo like FastEthernet 0/1-2 (with a space) will fail silently.
  • If some ports moved but not all, re-enter just the commands for the missing range.

Still stuck? Help me figure out why my port assignments aren't working

✔️ Awesome, I've got everything!

Great. Make sure you see all six ports correctly distributed across VLANs 10, 20, and 30 in your show vlan brief output.

ⓧ I'd like to double check the full code

Scroll up and confirm you entered both chunks in order:

  • Chunk 1 (VLAN creation): enable through creating VLANs 10, 20, and 30 with their names.
  • Chunk 2 (port assignment): interface range commands assigning Fa0/1-2 to VLAN 10, Fa0/3-4 to VLAN 20, Fa0/5-6 to VLAN 30, ending with end.

Run show vlan brief one more time to confirm everything matches.

Test isolation between departments

Your VLANs are configured. Now you will see the effect. PCs in the same VLAN should still reach each other, but PCs in different VLANs should be completely cut off.

  • Click Sales-PC1 in your topology.
  • Go to the Desktop tab, then open Command Prompt.
  • Test intra-VLAN connectivity by pinging Sales-PC2:
ping 192.168.10.11

You should see replies coming back. Both PCs are on VLAN 10, so the switch forwards traffic between them normally.

Now for the real test. Before you run the next command, predict what will happen when Sales-PC1 tries to reach IT-PC1 at 192.168.30.10. Do you think it will succeed or fail?

  • From the same command prompt on Sales-PC1, attempt a cross-VLAN ping:
ping 192.168.30.10

The ping fails. You will see "Request timed out" or "Destination host unreachable" messages. The switch refuses to forward traffic between VLANs 10 and 30.

Why does the cross-VLAN ping fail?

VLANs create hard boundaries at Layer 2. The switch treats VLAN 10 and VLAN 30 as if they were on completely separate physical switches. There is no path for a frame to cross from one VLAN to another without a router.

This isolation is exactly what you want for security. But right now it means Sales cannot email HR and IT cannot push updates to anyone. The next step will fix this by adding a router that bridges the VLANs in a controlled way.

Your network is now segmented. Each department is isolated on its own VLAN. Next up, you will configure a router to reconnect the departments in a controlled way using the Router-on-a-Stick method.

Configure Inter-VLAN Routing

In the previous step, you created VLANs that successfully isolated each department. The Sales, HR, and IT teams are now on separate broadcast domains.

But there is a problem. The departments are completely cut off from each other. In a real office, departments still need to share resources like printers, file servers, and internal applications. You need a way to reconnect them in a controlled manner.

The solution is Router-on-a-Stick inter-VLAN routing. This method uses a single physical router interface divided into virtual subinterfaces, one per VLAN, to route traffic between departments.

In this step, get ready to:
  • Configure the switch-to-router link as an 802.1Q trunk.
  • Create router subinterfaces for each VLAN.
  • Verify that all departments can communicate across VLAN boundaries.
Configure the trunk port on the switch

The cable connecting the switch to the router needs to carry traffic for all three VLANs simultaneously. A regular access port only carries one VLAN's traffic. A trunk port tags each frame with its VLAN ID using 802.1Q encapsulation, so the router knows which VLAN each packet belongs to.

  • Click the Switch in your topology, then click the CLI tab.
  • Configure GigabitEthernet0/1 as a trunk port by entering these commands:
enable
configure terminal
interface GigabitEthernet0/1
switchport mode trunk
end

What do these commands do?

  • interface GigabitEthernet0/1 selects the port connected to the router.
  • switchport mode trunk tells the switch to tag all frames leaving this port with their VLAN ID. This lets the router identify which VLAN each frame belongs to.

Why no encapsulation command?

On some Cisco switches, you need to run switchport trunk encapsulation dot1q before setting trunk mode. The 2960 switch in Packet Tracer only supports 802.1Q (no ISL), so it defaults to 802.1Q automatically. The switchport mode trunk command alone is sufficient.

  • Verify the trunk is active by running:
show interfaces trunk

You should see GigabitEthernet0/1 listed with Mode on, Encapsulation 802.1q, and Status trunking.

Not seeing the trunk?

  • Make sure you typed GigabitEthernet0/1 (not FastEthernet). The uplink to the router uses the Gigabit port.
  • Check that the cable between the switch and router shows green indicators on both ends. An orange indicator means the link is still negotiating.
  • help me troubleshoot my trunk port configuration
Configure router subinterfaces

Now you need the router to understand the tagged traffic arriving on its GigabitEthernet0/0 interface. You will create one subinterface per VLAN. Each subinterface acts as the default gateway for its department's subnet.

Why Router-on-a-Stick instead of a Layer 3 switch?

Router-on-a-Stick explicitly demonstrates the relationship between Layer 2 VLANs and Layer 3 routing by using separate devices for switching and routing. This makes the conceptual separation clear.

It is the approach taught in CCNA materials, tested in certification exams, and asked about in interviews. The 2960 switch in Packet Tracer does not support Layer 3 switching anyway.

  • Click the Router in your topology, then click the CLI tab.
  • First, bring up the physical interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
 no shutdown
 exit

Why do router interfaces need no shutdown?

Unlike switch ports, router interfaces are administratively shut down by default. The no shutdown command activates the physical interface. Subinterfaces inherit this state, so you must bring up the parent first.

  • Create the three subinterfaces by entering these commands (still in configuration mode):
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 exit

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 exit

interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 exit

end

What does each line do?

  • interface GigabitEthernet0/0.10 creates a virtual subinterface. The .10 suffix matches the VLAN number for clarity (this is a convention, not a requirement).
  • encapsulation dot1Q 10 tells the subinterface to handle frames tagged with VLAN 10.
  • ip address 192.168.10.1 255.255.255.0 assigns the gateway IP that Sales PCs already use as their default gateway.
  • Confirm all interfaces are up by running:
show ip interface brief

You should see GigabitEthernet0/0 and the three subinterfaces (Gi0/0.10, Gi0/0.20, Gi0/0.30) all showing up in both the Status and Protocol columns.

Seeing down on the subinterfaces?

  • Make sure you ran no shutdown on the physical GigabitEthernet0/0 interface. Subinterfaces inherit the physical interface state.
  • Verify the cable between the switch GigabitEthernet0/1 and router GigabitEthernet0/0 has green indicators on both ends.
  • help me fix my router subinterfaces showing down

✔️ Awesome, I've got everything!

Great. Make sure all four interfaces show up status before moving on.

ⓧ I'd like to double check the full code

Here is the complete router configuration you should have entered:

enable
configure terminal

interface GigabitEthernet0/0
 no shutdown
 exit

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 exit

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 exit

interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 exit

end

And the trunk command you entered on the switch:

enable
configure terminal
interface GigabitEthernet0/1
 switchport mode trunk
 exit
end
Verify inter-VLAN routing

The trunk is carrying tagged frames, and the router has a subinterface listening for each VLAN. It is time to test whether departments can talk to each other again.

Before you run the ping, think about what you expect to happen. In the previous step, pinging from Sales-PC1 to IT-PC1 failed because VLANs isolated them. Do you think the ping will succeed now that the router subinterfaces are configured?

  • Click Sales-PC1 in your topology.
  • Click the Desktop tab, then open Command Prompt.
  • Test connectivity to all three subnets by running these pings:
ping 192.168.10.11
ping 192.168.20.10
ping 192.168.30.10

All three pings should succeed with replies. The first ping reaches Sales-PC2 (same VLAN, direct switch path). The second reaches HR-PC1 and the third reaches IT-PC1, both crossing VLAN boundaries through the router.

Why does cross-VLAN traffic work now?

When Sales-PC1 pings 192.168.30.10, its traffic goes to its default gateway (192.168.10.1) on the router's Gi0/0.10 subinterface. The router checks its routing table, finds 192.168.30.0/24 on Gi0/0.30, and forwards the packet out that subinterface with a VLAN 30 tag. The switch delivers it to IT-PC1.

  • Return to the Router CLI and verify the routing table by running:
show ip route

You should see three connected (C) routes:

  • 192.168.10.0/24 is directly connected via GigabitEthernet0/0.10.
  • 192.168.20.0/24 is directly connected via GigabitEthernet0/0.20.
  • 192.168.30.0/24 is directly connected via GigabitEthernet0/0.30.

These three connected routes confirm the router knows about all three department subnets and is actively routing between them.

Pings still failing?

  • Run show ip interface brief on the router. All subinterfaces must show up/up. If the physical interface is down, run no shutdown on GigabitEthernet0/0.
  • Run show interfaces trunk on the switch. GigabitEthernet0/1 must appear as a trunk. If not, re-enter the trunk configuration commands.
  • Check that each PC's default gateway matches the router subinterface IP for its VLAN (Sales: 192.168.10.1, HR: 192.168.20.1, IT: 192.168.30.1).
  • help me troubleshoot my inter-VLAN routing

Your three departments are now securely segmented but able to communicate through the router. Next up, you will intentionally break this configuration to practice the structured troubleshooting approach that interviewers test for.

Troubleshoot a Misconfiguration

Your three departments can now communicate through the router. The network is working exactly as designed.

Entry-level network engineer interviews consistently test whether you can diagnose and fix broken configurations using a structured approach. You'll now intentionally break your working network and practice the exact diagnostic workflow interviewers expect.

In this step, get ready to:
  • Intentionally break the network by introducing a VLAN port assignment error.
  • Diagnose the problem using show commands and structured analysis.
  • Fix the misconfiguration and verify full connectivity is restored.
Break the network intentionally

A common real-world mistake is assigning a switch port to the wrong VLAN. The device on that port ends up in a network segment where its IP address doesn't belong, and all connectivity breaks.

  • Click the Switch, then open the CLI tab.
  • Move IT-PC1's port to the wrong VLAN by entering these commands:
enable
configure terminal
interface FastEthernet0/5
switchport access vlan 20
end

What does this do?

  • This moves FastEthernet0/5 (IT-PC1's port) from VLAN 30 (IT) to VLAN 20 (HR).
  • IT-PC1 still has the IP address 192.168.30.10, but it's now sitting in a network segment that expects 192.168.20.0/24 addresses.

Before you test, predict what will happen when IT-PC1 tries to ping IT-PC2. Will the ping succeed or fail?

  • Click IT-PC1, then open the Desktop tab.
  • Open Command Prompt.
  • Test the connection to IT-PC2 by running:
ping 192.168.30.11

The ping fails with "Request timed out" or "Destination host unreachable." IT-PC1 can no longer reach IT-PC2 even though they're in the same department.

Ping still working?

  • Make sure you ran the commands on the Switch, not the Router.
  • Verify you typed switchport access vlan 20 (not vlan 30).
  • help me figure out why my ping is still succeeding after changing the VLAN
Diagnose using show commands

In an interview, you wouldn't know what went wrong ahead of time. You'd need to follow a structured diagnostic approach that starts at the bottom of the network stack and works up.

What is structured troubleshooting?

Network engineers diagnose problems layer by layer:

  • Physical layer: Are all link lights green? Are cables connected? (Yes, they are.)
  • Data link layer: Are VLAN assignments correct? Are trunks carrying the right VLANs?
  • Network layer: Is routing configured properly? Are IP addresses in the right subnets?

Since the link lights are green, physical is fine. The data link layer (VLAN assignments) is where you should look next.

  • Switch back to the Switch CLI tab.
  • Check the current VLAN assignments by running:
show vlan brief

Look at the output. FastEthernet0/5 is listed under VLAN 20 instead of VLAN 30. This is your mismatch.

Why does a VLAN mismatch break connectivity?

  • IT-PC1 has IP 192.168.30.10 with gateway 192.168.30.1.
  • But it's now on VLAN 20, which routes through the router's subinterface at 192.168.20.1.
  • The router's VLAN 20 subinterface expects 192.168.20.0/24 addresses, so it drops IT-PC1's traffic entirely.
Fix the issue and verify

Now that you've identified the root cause, the fix is straightforward. Move the port back to the correct VLAN.

  • In the Switch CLI, correct the port assignment by entering these commands:
enable
configure terminal
interface FastEthernet0/5
switchport access vlan 30
end

What does this fix?

  • This moves FastEthernet0/5 back to VLAN 30 (IT).
  • IT-PC1's IP address (192.168.30.10) now matches the subnet of its VLAN again.
  • Traffic from IT-PC1 reaches the router's Gi0/0.30 subinterface, which routes it to any other VLAN.
  • Confirm the fix by running show vlan brief on the switch.
  • FastEthernet0/5 should now appear under VLAN 30 again.
show vlan brief

Before you test connectivity, do you think IT-PC1 can now reach both IT-PC2 and Sales-PC1?

  • Click IT-PC1, then open Command Prompt from the Desktop tab.
  • Test same-VLAN connectivity by running:
ping 192.168.30.11
  • Test cross-VLAN connectivity by running:
ping 192.168.10.10

Both pings succeed. IT-PC1 can reach IT-PC2 (same VLAN) and Sales-PC1 (cross-VLAN through the router). The network is fully restored.

Pings still failing?

  • Run show vlan brief again and confirm Fa0/5 appears under VLAN 30.
  • Click IT-PC1 > Desktop > IP Configuration and verify the IP is still 192.168.30.10 with gateway 192.168.30.1.
  • If cross-VLAN pings fail but same-VLAN works, check that GigabitEthernet0/1 on the switch is still in trunk mode by running show interfaces trunk.
  • help me fix my ping failures after correcting the VLAN assignment

You've just diagnosed and resolved a VLAN port assignment error using show vlan brief as your primary diagnostic tool. This structured approach (physical layer, data link layer, network layer) is exactly what interviewers look for.

Secret mission

Add DHCP for Automatic IP Assignment

In a real office, nobody walks to every desk and manually types IP addresses into each computer. DHCP automates this entirely. Can you configure the router to hand out IP addresses automatically to each department?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally inside Cisco Packet Tracer, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your topology file for future practice, or delete it entirely.

Resources you used:

  • Cisco Packet Tracer topology file (.pkt file saved on your computer).

Keep everything running

No action needed. Choose this if you plan to keep practicing with the topology or want to experiment with additional configurations.

  • Your .pkt file stays wherever you saved it.
  • You can reopen it anytime in Cisco Packet Tracer to review your VLAN setup, test new configurations, or practice troubleshooting scenarios.
  • Consider saving a second copy as a backup before making further changes.

Pause - I'll come back to this later

Since this is a local file with no running processes, pausing is the same as keeping. Your topology is already saved and uses no system resources when Packet Tracer is closed.

  • Save your topology file by pressing Cmd+S (macOS) or Ctrl+S (Windows).
  • Close Cisco Packet Tracer.
  • When you are ready to return, double-click the .pkt file to reopen it in Packet Tracer.

Delete - I don't want to use this again

Remove the project topology file from your computer entirely.

  • Close Cisco Packet Tracer if it is still open.
  • Navigate to the folder where you saved your .pkt topology file.
  • Delete the .pkt file. On macOS, drag it to the Trash and empty the Trash. On Windows, right-click the file and select Delete, then empty the Recycle Bin.
  • Cisco Packet Tracer itself remains installed on your computer. It is free software with no ongoing cost, so there is no reason to uninstall it unless you need the disk space.

Nice Work!

Nice Work!

Nice work! You just built a production-style segmented office network from scratch using Cisco Packet Tracer.

You've learned how to:

  • Build a multi-VLAN office network with three isolated departments, configure 802.1Q trunking between a switch and router, and assign ports to specific VLANs using the Cisco IOS CLI.
  • Implement Router-on-a-Stick inter-VLAN routing with subinterfaces on a Cisco 1941 router, restoring cross-department communication in a controlled, routed way.
  • Practice structured troubleshooting by intentionally breaking a VLAN port assignment, diagnosing the root cause with show vlan brief, and fixing the misconfiguration.
  • Secret Mission: Configured per-VLAN DHCP pools on the router so all six PCs receive IP addresses automatically instead of relying on manual static configuration.

Ready to quiz yourself?