Provision a Small Office Network

Introduction

30 Second Summary

Every office network starts the same way. Someone hands you a stack of blank switches, a router, and a floor plan, then asks you to make it all talk to each other by Monday.

In this project, you will provision a 3-VLAN office network from scratch in Cisco Packet Tracer, then intentionally break it three different ways and fix each one using the same troubleshooting methodology real technicians use on the job.

What You'll Build

Imagine opening Packet Tracer, running a ping from a PC in the Management VLAN to a PC in the Guest VLAN, and watching the reply come back through a router you configured yourself.

By the end of this project, you'll have:

• A live 3-VLAN office network where PCs in different departments ping each other through router-on-a-stick inter-VLAN routing you configured from blank equipment.
• Three resolved trouble tickets with documented root causes, proving you can diagnose failures at Layer 1, Layer 2, and Layer 3 in order.
• Config backups and a port-mapping document that demonstrate the "backup before touching anything" habit employers test for.
• Secret Mission: Build a GitHub portfolio repository with professional network documentation ready to share in interviews.

Are there any prerequisites?

You need Cisco Packet Tracer installed (free via a NetAcad account) and a basic understanding of what an IP address and subnet mask are. No prior Cisco IOS experience is required.

Before We Start

Before you touch any equipment, real or simulated, you need to know what you are building and why. This is the "Read-Only Friday" mindset: never start configuring without a plan.

Build the Physical Topology

Before you can configure any network, you need the physical layer in place. In a real office, this is the "rack, stack, and cable" step where you physically install equipment into racks and run patch cables between devices.

Getting Layer 1 right first means you will not waste time debugging configuration issues that are actually just missing cables. In this step, you will place all your devices, connect them with the correct cable types, and verify every link is active before touching any configuration.

In this step, get ready to:

• Place the router, switches, and PCs in the Packet Tracer workspace.
• Connect all devices with the correct cable types and ports.
• Assign static IP addresses and default gateways to each PC.

Place the network devices

Every network starts with the physical equipment. You need one router to handle traffic between VLANs, two switches to connect end devices, and three PCs representing users in different departments.

• Look at the bottom of the Cisco Packet Tracer window to find the Device-Type Selection Box.
• Click the Network Devices category in the top row, then click Routers in the bottom row.
• Find 2911 in the Device-Specific Selection Box and drag it onto the workspace.
• Click Switches in the bottom row of categories.
• Drag a 2960 switch onto the workspace to the left of the router. This is Switch1.
• Drag a second 2960 switch onto the workspace below or to the right of Switch1. This is Switch2.
• Click End Devices in the top row of categories.
• Drag three PC devices onto the workspace below the switches. They will be labelled PC0, PC1, and PC2 automatically.

You should now see six devices on your workspace: one router, two switches, and three PCs.

What are all these devices?

The 2911 router is a Cisco router with GigabitEthernet ports that will handle routing between your VLANs. The 2960 switches are Layer 2 switches that forward traffic within VLANs and support trunk links.

The PCs simulate end-user machines in different departments. Each one will sit in a different VLAN once you configure the switches in the next step.

Connect the devices with cables

Now you need to run cables between devices. The cable type matters: PCs connect to switches with straight-through cables, while switch-to-switch and switch-to-router links use crossover cables (or auto-detect).

• Click the Connections category in the Device-Type Selection Box (it looks like a lightning bolt icon).
• Select Copper Straight-Through cable.
• Click on PC0, then select FastEthernet0 from the pop-up menu.
• Click on Switch1, then select FastEthernet0/2 from the pop-up menu.

A cable now connects PC0 to Switch1 on port Fa0/2. Repeat this process for the remaining PC-to-switch connections:

• Connect PC1 FastEthernet0 to Switch1 FastEthernet0/3 using a Copper Straight-Through cable.
• Connect PC2 FastEthernet0 to Switch2 FastEthernet0/2 using a Copper Straight-Through cable.

Now connect the switches to each other and to the router. These links carry traffic for multiple VLANs, so they will become trunk links once you configure them in the next step.

• Select Copper Cross-Over cable from the Connections panel.
• Click Switch1 and select FastEthernet0/1.
• Click Switch2 and select FastEthernet0/1.
• Select another Copper Cross-Over cable.
• Click Switch1 and select GigabitEthernet0/1.
• Click the Router and select GigabitEthernet0/0.

All five cables are now in place. You should see link lights (small coloured indicators) appear at each end of every cable.

What do the link light colours mean?

Green triangles on both sides of a cable mean the link is active and the correct cable type was used. Amber lights are normal for a few seconds after connecting. They turn green once the switch finishes its startup process.

If you see a red light, the cable type is wrong for that device pair. Orange on one side only usually means the port is in a blocking state or still initialising.

Seeing red or orange link lights that won't turn green?

PC-to-switch connections need Copper Straight-Through cables. Switch-to-switch and switch-to-router connections need Copper Cross-Over cables.

If you used the wrong cable type, click on the cable to delete it, then reconnect with the correct type. Wait about 30 seconds for amber lights to turn green before troubleshooting further.

Still stuck? Why are my Packet Tracer link lights not turning green?

Assign static IP addresses to the PCs

Each PC needs a static IP address and a default gateway so it knows where to send traffic destined for other networks. The gateway addresses point to router sub-interfaces you will create in a later step.

• Click on PC0 to open its configuration window.
• Click the Desktop tab.
• Click IP Configuration.
• Make sure Static is selected (not DHCP).
• Enter 192.168.10.10 in the IP Address field.
• Enter 255.255.255.0 in the Subnet Mask field.
• Enter 192.168.10.1 in the Default Gateway field.
• Close the PC0 window by clicking the X in the top-right corner. Settings save automatically.

Now repeat for PC1 and PC2 with their respective addresses:

• Click PC1 and open Desktop then IP Configuration.
• Set IP Address to 192.168.20.10, Subnet Mask to 255.255.255.0, Default Gateway to 192.168.20.1.
• Close the PC1 window.
• Click PC2 and open Desktop then IP Configuration.
• Set IP Address to 192.168.30.10, Subnet Mask to 255.255.255.0, Default Gateway to 192.168.30.1.
• Close the PC2 window.

Why are the gateway addresses different for each PC?

Each PC sits in a different VLAN with its own subnet. PC0 is in the 192.168.10.0/24 network (VLAN 10), PC1 in 192.168.20.0/24 (VLAN 20), and PC2 in 192.168.30.0/24 (VLAN 30).

The gateway address for each subnet is the router sub-interface that will live in that VLAN. You will create those sub-interfaces in Step 4 when you configure router-on-a-stick.

Verify the IPs are correctly set by clicking on PC0, opening the Desktop tab, and clicking Command Prompt.

• Type the following command and press Enter:
• ipconfig

You should see the IP address 192.168.10.10, subnet mask 255.255.255.0, and default gateway 192.168.10.1 displayed in the output.

IP address showing 0.0.0.0?

This means DHCP was selected instead of Static. Go back to Desktop then IP Configuration and make sure the Static radio button is selected before entering the addresses.

Need more help? Help me troubleshoot my PC IP configuration in Packet Tracer.

Verify Layer 1 connectivity

Before you do anything else, confirm that every physical link is up. This is the Layer 1 check that real technicians do before moving on to configuration.

Before you check, predict: do you expect all link lights to be green on both ends of every cable?

• Look at each cable connection in your topology view.
• Confirm that every link shows green indicators (triangles) on both ends.
• Click on the Router to open it, then look at the Physical tab to confirm GigabitEthernet0/0 shows a connected cable.
• Click on Switch1 and check the Physical tab to confirm ports Fa0/1, Fa0/2, Fa0/3, and Gig0/1 all have cables attached.
• Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS). Name the file something memorable like office-network.pkt.

All cable connections should show green indicators on both ends. Clicking on any device shows its physical ports with cables attached. Your Layer 1 foundation is solid.

Don't see green link light indicators at all?

If you cannot see any link light indicators on the cables, navigate to Options then Preferences from the Packet Tracer menu bar. Check the Show Link Lights checkbox and click OK.

If lights are visible but some stay amber or red, delete the cable and reconnect it using the correct cable type. Help me figure out why my cables aren't showing green in Packet Tracer.

Your physical topology is complete and every link is confirmed active. Next up, you will configure the switches with VLANs to segment your network into three isolated departments.

Provision the Switches with VLANs

Your physical topology is cabled and all links are green. Now it is time to make those switches useful by programming them with VLANs, the logical boundaries that separate your office traffic into Management, Staff, and Guest networks.

In real offices, technicians deploy out-of-the-box network equipment using pre-approved configuration templates. You will follow that same workflow here, entering Cisco IOS commands to create VLANs, assign access ports, configure trunk links, and practice the non-negotiable backup habit.

In this step, get ready to:

• Configure SW1-Office with VLANs and trunk ports.
• Configure SW2-Office with matching VLANs and a trunk link.
• Save config backups as text files on your computer.

Configure Switch1 with VLANs

You will access each switch through its CLI tab in Packet Tracer. This is where you enter IOS commands, the same way a technician would connect via console cable in a real server room.

• In your Packet Tracer topology, click on Switch1 (the switch connected to PC0 and PC1).
• Click the CLI tab at the top of the device window.
• Click inside the black terminal area and press Enter to get a command prompt.
• Set the hostname and create VLANs by entering these commands:

enable
configure terminal
hostname SW1-Office
vlan 10
name Management
vlan 20
name Staff
vlan 30
name Guest
exit

What do these commands do?

• enable enters privileged EXEC mode, which gives you access to configuration commands.
• configure terminal enters global configuration mode where you can make changes to the switch.
• hostname SW1-Office gives the switch a recognisable name so you know which device you are configuring.
• vlan 10 followed by name Management creates VLAN 10 and labels it. The same pattern repeats for Staff (20) and Guest (30).

• Confirm your VLANs exist by running this command:

show vlan brief

You should see VLAN 10 (Management), VLAN 20 (Staff), and VLAN 30 (Guest) listed alongside the default VLAN 1. No ports are assigned yet.

Don't see your VLANs?

• Make sure you typed exit after creating the VLANs to return to global config mode. If your prompt still shows (config-vlan)#, you are still inside VLAN configuration.
• Check for typos in VLAN numbers. If you accidentally created the wrong VLAN, use no vlan 99 (replacing 99 with the wrong number) to delete it.
• Help me troubleshoot my VLAN creation on a Cisco 2960 switch in Packet Tracer

• Assign PC0's port to VLAN 10 and PC1's port to VLAN 20 by entering these commands:

configure terminal
interface Fa0/2
switchport mode access
switchport access vlan 10
interface Fa0/3
switchport mode access
switchport access vlan 20
exit

What do these port assignments do?

switchport mode access tells the port it connects to a single end device (not another switch). switchport access vlan 10 places that port into VLAN 10, so any traffic from the connected PC belongs to the Management network.

• Verify the port assignments by running:

show vlan brief

You should now see Fa0/2 listed under VLAN 10 and Fa0/3 listed under VLAN 20.

• Configure trunk ports on Fa0/1 (to Switch2) and Gig0/1 (to Router) and save your configuration:

configure terminal
interface Fa0/1
switchport mode trunk
interface Gig0/1
switchport mode trunk
end
copy running-config startup-config

What is a trunk port?

A trunk port carries traffic for ALL VLANs across a single cable. It uses 802.1Q tagging to label each frame with its VLAN ID so the receiving device knows which VLAN it belongs to.

The link between Switch1 and Switch2 must be a trunk so VLAN traffic can pass between switches. The link to the router must also be a trunk so the router can see all VLANs for inter-VLAN routing later.

• When prompted to confirm the filename, press Enter to accept the default.
• Verify your trunk ports by running:

show interfaces trunk

You should see Fa0/1 and Gig0/1 listed as trunking ports with VLANs 1-4094 allowed.

Trunk ports not showing?

• Make sure you typed switchport mode trunk while inside the correct interface (check your prompt shows (config-if)#).
• Confirm the interface names match exactly: Fa0/1 for FastEthernet and Gig0/1 for GigabitEthernet.
• Help me fix my trunk port configuration on a Cisco 2960 switch

Configure Switch2 with VLANs and a trunk

Switch2 follows the same pattern. It needs matching VLANs, one access port for PC2 (Guest), and a trunk link back to Switch1.

• Close the Switch1 device window.
• Click on Switch2 in your topology (the switch connected to PC2).
• Click the CLI tab, click inside the terminal area, and press Enter.
• Configure Switch2 with its hostname, VLANs, access port, and trunk by entering these commands:

enable
configure terminal
hostname SW2-Office
vlan 10
name Management
vlan 20
name Staff
vlan 30
name Guest
interface Fa0/2
switchport mode access
switchport access vlan 30
interface Fa0/1
switchport mode trunk
end
copy running-config startup-config

Why create all three VLANs on Switch2?

Even though Switch2 only has a Guest PC connected, it needs all three VLANs in its database. Trunk links carry tagged frames for every VLAN. If Switch2 does not recognise a VLAN ID in an incoming frame, it drops that traffic.

• When prompted to confirm the filename, press Enter to accept the default.

Before you verify, what do you expect to see when you run show vlan brief on SW2-Office? Which port should appear under VLAN 30?

• Verify the VLAN configuration by running:

show vlan brief

You should see VLAN 30 (Guest) with Fa0/2 listed beneath it. VLANs 10 and 20 appear with no ports assigned because no access-mode devices are connected to them on this switch.

• Confirm the trunk is active by running:

show interfaces trunk

You should see Fa0/1 listed as a trunking port.

VLAN 30 not showing Fa0/2?

• Double-check you used switchport access vlan 30 (not vlan 10 or 20) on interface Fa0/2.
• If you assigned the wrong VLAN, re-enter the interface and run the correct switchport access vlan 30 command. It overwrites the previous assignment.
• Help me verify my Switch2 VLAN configuration in Packet Tracer

Back up your switch configurations

In production networks, you always back up your running config before and after making changes. If a change breaks something, you can paste the backup to restore the previous state in seconds.

• In the SW2-Office CLI, run this command to display the full configuration:

show running-config

• Select all the output text in the CLI window (click at the start, scroll to the end, and drag to highlight everything).
• Copy it with Cmd+C (macOS) or Ctrl+C (Windows).
• Open a plain text editor (TextEdit on macOS, Notepad on Windows).
• Paste the config and save the file as SW2-config-backup.txt on your Desktop.

• Now repeat for Switch1. Close the SW2-Office window.
• Click on Switch1 (now labelled SW1-Office) in your topology.
• Click the CLI tab and run:

show running-config

• Select all the output text, copy it, and save it as SW1-config-backup.txt on your Desktop.
• Confirm you have both files on your Desktop: SW1-config-backup.txt and SW2-config-backup.txt.

Why back up before moving on?

If you accidentally misconfigure something later, these text files let you paste an entire known-good config back into the switch. This "backup before touching anything" habit is what separates reliable technicians from risky ones.

Can't select the full config output?

• If the output is too long to see in one screen, press Space or Enter to scroll through it page by page until you see the end.
• You can also run terminal length 0 before show running-config to disable paging and show all output at once.
• Help me copy the running config from a switch in Packet Tracer

Save your Packet Tracer topology file as well (Ctrl+S or Cmd+S). Both switches are now provisioned with VLANs, access ports, and trunk links.

✔️ Awesome, I've got everything!

Great. You should have both switches configured and both backup text files saved on your Desktop. Your topology file is saved.

ⓧ I'd like to double check my switch configs

Go back to each switch CLI and confirm these outputs match your setup:

• On SW1-Office, run show vlan brief. You should see VLAN 10 with Fa0/2, VLAN 20 with Fa0/3.
• On SW1-Office, run show interfaces trunk. You should see Fa0/1 and Gig0/1 listed.
• On SW2-Office, run show vlan brief. You should see VLAN 30 with Fa0/2.
• On SW2-Office, run show interfaces trunk. You should see Fa0/1 listed.

Your switches are now programmed and backed up. But here is the thing. Right now, PCs in different VLANs cannot talk to each other at all. In the next step, you will feel that limitation firsthand and understand exactly why a router is needed.

Hit the Wall — Cross-VLAN Ping Fails

Your switches are provisioned and your PCs have their static IPs assigned. The physical cables are green and the logical VLAN configuration looks correct.

The next step in any provisioning task is connectivity verification. You will ping between PCs in different VLANs to confirm the network is fully operational.

In this step, get ready to:

• Test cross-VLAN connectivity by pinging between PCs.
• Investigate the results using switch show commands.
• Document the failure as a formal trouble ticket.

Test connectivity from PC0

You configured PC0 with a default gateway of 192.168.10.1 in the previous step. That IP address should be answered by a router acting as the gateway for VLAN 10.

Before you run the ping, think about what you expect to happen. Do you think PC0 will get a reply from its gateway at 192.168.10.1? What about reaching PC1 at 192.168.20.10 in a different VLAN?

• In Packet Tracer, click on PC0 to open its window.
• Click the Desktop tab, then click Command Prompt.
• Ping your default gateway by typing this command and pressing Enter:

ping 192.168.10.1

You see Request timed out repeated four times. No device on the network is answering as the gateway for VLAN 10.

• Now ping PC1 (in VLAN 20) by running:

ping 192.168.20.10

This also returns Request timed out. PC0 in VLAN 10 cannot reach PC1 in VLAN 20.

• Ping PC2 (in VLAN 30) to confirm the same behaviour:

ping 192.168.30.10

Same result. Every cross-VLAN ping fails. This is not a misconfiguration. This is exactly how VLANs are designed to behave.

Why do the pings fail?

VLANs isolate traffic at Layer 2. A switch will never forward a frame from one VLAN to another on its own.

For traffic to move between VLANs, a Layer 3 device (a router) must receive the frame, make a routing decision, and forward it into the destination VLAN. Your router is still unconfigured, so no device exists to perform this job.

Investigate with show commands on SW1-Office

The pings failed, but a good technician does not stop at "it doesn't work." You need evidence from the switch that explains the isolation.

• Click on SW1-Office to open its window.
• Click the CLI tab to access the command line.
• Enter privileged EXEC mode by typing enable and pressing Enter.
• View the MAC address table by running:

show mac address-table

What does this output show?

The show mac address-table command displays each learned MAC address alongside its VLAN and port.

You can see PC0's MAC address on Fa0/2 in VLAN 10 and PC1's MAC address on Fa0/3 in VLAN 20. The switch knows both devices exist, but because they are in separate VLANs, it treats them as if they are on completely different networks.

This is the proof. The switch sees both PCs but will not forward frames between their VLANs.

Document the failure as a trouble ticket

In a real helpdesk environment, every failure gets documented before you escalate or fix it. This is how you write escalation notes for senior engineers.

• On your computer (not in Packet Tracer), create a new text file called trouble-tickets.txt.
• Paste the following trouble ticket into the file:

Trouble Ticket 1: Cross-VLAN communication fails. PCs in VLAN 10 cannot reach VLAN 20 or 30. Root cause: No Layer 3 device performing inter-VLAN routing.

Why document before fixing?

The trouble ticket captures the symptom (what failed), the scope (which VLANs), and the root cause (no router). This is the exact format senior engineers expect when a junior tech escalates an issue.

Writing it down before you fix anything forces you to understand the problem clearly. It also creates an audit trail you can reference later.

• Save trouble-tickets.txt.

Your trouble ticket file now captures the first network issue you have diagnosed.

Seeing replies instead of timeouts?

If your pings return successful replies, check that your VLAN assignments are correct. Run show vlan brief on SW1-Office. Fa0/2 should be in VLAN 10 and Fa0/3 should be in VLAN 20.

Also verify that PC0 and PC1 have different subnet IPs (192.168.10.10 vs 192.168.20.10). If they are on the same subnet, the switch treats them as same-VLAN traffic.

Help me troubleshoot why my cross-VLAN pings are succeeding when they should fail.

You have confirmed the limitation first-hand. VLANs do their job perfectly. They isolate. In the next step, you will configure the router to bridge these VLANs and make cross-VLAN communication possible.

Fix It — Configure Router-on-a-Stick

In the previous step, you proved that VLANs isolate traffic by design. PC0 cannot reach PC1 or PC2 because no Layer 3 device is routing between the VLANs.

The router is that Layer 3 device. You will configure sub-interfaces on a single physical port, one per VLAN, with 802.1Q encapsulation. This "router-on-a-stick" pattern is the standard inter-VLAN routing setup for small office networks with Layer 2 switches.

In this step, get ready to:

• Configure the router's hostname and bring up its physical interface.
• Create sub-interfaces with 802.1Q encapsulation for all three VLANs.
• Verify cross-VLAN pings succeed and back up the router config.

Access the router and bring up the physical interface

Before creating sub-interfaces, the physical interface they attach to must be in an "up" state. Router interfaces start in a shutdown state by default, so you need to explicitly activate it.

• Click the Router (2911) in your topology to open it.
• Select the CLI tab.
• Enter the following commands to set the hostname and bring up the physical interface:

enable
configure terminal
hostname R1-Office
interface GigabitEthernet0/0
no shutdown
exit

What do these commands do?

• enable enters privileged EXEC mode, giving you access to all show and config commands.
• configure terminal enters global configuration mode where you can change the device settings.
• hostname R1-Office names the router so your prompt reads R1-Office# instead of a generic name.
• no shutdown activates the physical interface. You do NOT assign an IP address here. The sub-interfaces you create next will carry the IPs.

• Verify the physical interface is up by running:

do show ip interface brief

You should see GigabitEthernet0/0 with Status "up" and Protocol "up". The IP-Address column shows "unassigned" because no IP belongs on the physical interface itself.

Interface still showing "down"?

• Make sure the cable between Switch1 Gig0/1 and Router Gig0/0 shows green on both ends. A red indicator means Layer 1 is down.
• Confirm you typed no shutdown while inside the interface GigabitEthernet0/0 context. Your prompt should say R1-Office(config-if)# when you enter that command.
• help me figure out why my router interface won't come up

Create sub-interfaces for each VLAN

Each sub-interface maps to one VLAN. The router tags outbound frames with the matching VLAN ID using 802.1Q encapsulation, so the switch trunk delivers them to the correct VLAN.

• From global config mode on R1-Office, create the three sub-interfaces by entering these commands:

interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface GigabitEthernet0/0.30
encapsulation dot1Q 30
ip address 192.168.30.1 255.255.255.0
exit

What does each sub-interface command do?

• interface GigabitEthernet0/0.10 creates a virtual sub-interface numbered .10 (matching the VLAN ID for clarity).
• encapsulation dot1Q 10 tells the router to tag frames on this sub-interface with VLAN 10. This is the 802.1Q trunk tagging.
• ip address 192.168.10.1 255.255.255.0 assigns the gateway IP that PCs in VLAN 10 use as their default gateway.

The same pattern repeats for VLAN 20 (gateway 192.168.20.1) and VLAN 30 (gateway 192.168.30.1).

• Save the configuration to startup-config so it survives a reboot:

copy running-config startup-config

• When prompted, press Enter to accept the default filename.
• Verify your sub-interfaces are up by running:

show ip interface brief

You should see GigabitEthernet0/0.10, GigabitEthernet0/0.20, and GigabitEthernet0/0.30 each showing their IP address with Status "up" and Protocol "up".

Sub-interfaces showing "down"?

• Sub-interfaces inherit the physical interface state. If GigabitEthernet0/0 is down, all sub-interfaces will be down too. Go back and run no shutdown on the physical interface.
• If a sub-interface shows an IP of "unassigned", you may have typed the ip address command while in the wrong interface context. Re-enter the sub-interface and re-apply the command.
• help me troubleshoot my sub-interface configuration

Why router-on-a-stick instead of a Layer 3 switch?

Layer 3 switches can also perform inter-VLAN routing, but that is a more advanced pattern. Router-on-a-stick is the standard CCNA-level approach for small offices with Layer 2-only switches like the 2960.

In junior network roles, you will encounter this setup on day one because it uses dedicated routers the team already has in the rack. L3 switching is something you grow into once you manage larger campus networks.

Verify cross-VLAN connectivity and back up the config

This is the moment of truth. In the last step, pings between VLANs failed because there was no router. Now the router is configured.

Before you run the ping, predict: do you think PC0 (VLAN 10, 192.168.10.10) can now reach PC1 (VLAN 20, 192.168.20.10)?

• Click PC0 in your topology.
• Select the Desktop tab, then open Command Prompt.
• Ping PC1 by typing:

ping 192.168.20.10

You should see replies coming back with TTL values. This confirms traffic is flowing from VLAN 10 through the router to VLAN 20.

• Now ping PC2 to test VLAN 30 connectivity:

ping 192.168.30.10

Replies confirm that all three VLANs can communicate through the router. Cross-VLAN routing is working.

• Return to the R1-Office CLI and run show ip interface brief one more time.

Confirm all three sub-interfaces show Status "up" and Protocol "up".

Pings still failing?

• Check that each PC's default gateway matches the sub-interface IP for its VLAN. PC0 should have gateway 192.168.10.1, PC1 should have 192.168.20.1, and PC2 should have 192.168.30.1.
• Run show interfaces trunk on SW1-Office. Confirm Gig0/1 shows as trunking. If it does not, the switch is not passing tagged frames to the router.
• Verify encapsulation dot1Q VLAN numbers on the router match the VLAN IDs on the switches (10, 20, 30).
• help me debug why my cross-VLAN pings are still failing

Before moving on, save a backup of your router config following the same habit you built with the switches.

• On R1-Office, run show running-config.
• Select all the output text and save it to a text file on your computer named R1-config-backup.txt.

Why back up after every configuration change?

In production networks, you always save a known-good config before touching anything else. If a future change breaks connectivity, you can compare the current config against this backup to find what changed.

Your network is fully operational. Three VLANs, two switches, one router, and cross-VLAN routing working end to end. Next up, you will intentionally break this working network in three specific ways and diagnose each failure using the L1-L2-L3 troubleshooting methodology.

Troubleshoot Broken Scenarios

Your network is fully operational. PCs across all three VLANs can reach each other through the router-on-a-stick configuration.

In the real world, working networks break constantly. Junior technicians are measured on how quickly they resolve tickets using a systematic approach. In this step, you will intentionally break your network in three specific ways, then diagnose and fix each failure using the L1-L2-L3 troubleshooting methodology.

In this step, get ready to:

• Simulate and resolve a Layer 1 (physical cable) failure.
• Diagnose and fix a Layer 2 (VLAN mismatch) issue.
• Troubleshoot a Layer 3 (sub-interface down) problem and confirm full connectivity.

Simulate Ticket A: a Layer 1 cable failure

Layer 1 is the physical layer. If a cable is unplugged, damaged, or connected to the wrong port, no amount of configuration will fix the problem. You will simulate this by removing the cable between PC2 and Switch2.

• In Packet Tracer, click the Delete tool (the X icon in the toolbar on the right side of the workspace).
• Click the cable connecting PC2 to SW2-Office to remove it.

The link indicator on SW2-Office port Fa0/2 disappears because there is no physical connection anymore.

Before you test, what do you think will happen when PC2 tries to ping its gateway?

• Click on PC2, then select the Desktop tab.
• Open Command Prompt.
• Ping PC2's gateway by typing this command:

ping 192.168.30.1

You see "Request timed out" for every attempt. With no cable attached, PC2 has no path to any other device.

Why start at Layer 1?

The L1-L2-L3 methodology works from the bottom of the OSI model upward. Always check physical connectivity first. A misconfigured VLAN or downed interface is irrelevant if the cable is simply unplugged.

Now fix the failure by reconnecting the cable.

• Click the Connections category (lightning bolt icon) at the bottom-left of the workspace.
• Select Copper Straight-Through cable.
• Click on PC2 and choose FastEthernet0.
• Click on SW2-Office and choose FastEthernet0/2.

Wait a few seconds for the link indicators to turn green on both ends.

• In PC2's Command Prompt, run the ping again:

ping 192.168.30.1

You now see "Reply from 192.168.30.1" with TTL values. Layer 1 is restored.

• Document this ticket in your trouble-tickets.txt file by adding the following entry:

Ticket A: PC2 unreachable. Root cause: Physical cable disconnected (L1). Resolution: Reconnected patch cable to SW2 Fa0/2.

Cable still showing red or orange?

Make sure you selected Copper Straight-Through (not Crossover) for the PC-to-switch connection. Also confirm you connected to FastEthernet0/2 on SW2-Office, not a different port.

If the indicators stay orange, wait 30 seconds for STP to converge. The lights turn green once the port transitions to forwarding state.

help me troubleshoot my cable connection in Packet Tracer

Simulate Ticket B: a Layer 2 VLAN mismatch

Layer 2 issues are sneakier than unplugged cables. The link looks healthy (green indicators), but traffic still does not flow because the port is in the wrong VLAN. You will simulate this common misconfiguration on SW1-Office.

• Click on SW1-Office in your topology.
• Select the CLI tab.
• Enter privileged EXEC mode and then global configuration mode by typing these commands:

enable
configure terminal

• Reassign PC0's port to the wrong VLAN by typing these commands:

interface Fa0/2
switchport access vlan 30
exit

What did you just break?

PC0 has IP 192.168.10.10 with a gateway of 192.168.10.1 (VLAN 10's sub-interface on the router). By moving its port to VLAN 30, PC0's traffic now reaches the router on sub-interface Gi0/0.30 (192.168.30.1) instead. The router has no reason to route the traffic to 192.168.10.1 because PC0 is not in VLAN 10 anymore.

What do you think will happen when PC0 pings its own gateway at 192.168.10.1?

• Click on PC0 and open Desktop then Command Prompt.
• Ping PC0's gateway:

ping 192.168.10.1

You see "Request timed out." The cable is green and the switch is configured, but the VLAN assignment is wrong. This is a Layer 2 problem.

Now diagnose it using the show command that reveals VLAN-to-port mappings.

• Return to SW1-Office's CLI. Exit configuration mode and run:

end
show vlan brief

In the output, you see Fa0/2 listed under VLAN 30 (Guest) instead of VLAN 10 (Management). That confirms the mismatch.

• Fix the VLAN assignment by entering these commands on SW1-Office:

configure terminal
interface Fa0/2
switchport access vlan 10
exit

• Verify the fix by running:

end
show vlan brief

Fa0/2 now appears under VLAN 10 (Management) again.

• Return to PC0's Command Prompt and ping the gateway again:

ping 192.168.10.1

You see "Reply from 192.168.10.1" with TTL values. Layer 2 connectivity is restored.

• Add this entry to your trouble-tickets.txt file:

Ticket B: PC0 cannot ping gateway. Root cause: Port assigned to wrong VLAN 30 (L2). Resolution: Corrected VLAN assignment to VLAN 10 on SW1-Office Fa0/2.

Ping still failing after fixing the VLAN?

Run show vlan brief one more time and confirm Fa0/2 is listed under VLAN 10, not VLAN 30. If it still shows VLAN 30, you may have exited config mode before the command applied. Re-enter configure terminal and run the interface commands again.

help me fix the VLAN mismatch on my switch port

Simulate Ticket C: a Layer 3 sub-interface down

Layer 3 problems occur when the routing device itself has an issue. The switches are fine, the cables are connected, but the router is not forwarding traffic for a specific VLAN. You will simulate this by shutting down a sub-interface on R1-Office.

• Click on R1-Office in your topology.
• Select the CLI tab.
• Enter privileged EXEC mode and global configuration mode:

enable
configure terminal

• Shut down the VLAN 20 sub-interface by typing:

interface GigabitEthernet0/0.20
shutdown
exit

What do you think PC1 (in VLAN 20) will experience when it tries to reach PC0 or PC2?

• Click on PC1 and open Desktop then Command Prompt.
• Ping PC0:

ping 192.168.10.10

You see "Request timed out." PC1 can no longer reach any other VLAN because its gateway sub-interface is down.

Diagnose this from the router using the command that shows all interface statuses.

• Return to R1-Office's CLI. Exit configuration mode and run:

end
show ip interface brief

What does the output tell you?

The show ip interface brief output shows GigabitEthernet0/0.20 with Status "administratively down" and Protocol "down." The word "administratively" tells you a human (you) issued the shutdown command. This is not a hardware failure. It is a configuration choice.

• Fix the issue by bringing the sub-interface back up:

configure terminal
interface GigabitEthernet0/0.20
no shutdown
exit

• Confirm the fix by running:

end
show ip interface brief

GigabitEthernet0/0.20 now shows Status "up" and Protocol "up" with IP address 192.168.20.1.

• Return to PC1's Command Prompt and ping PC0 again:

ping 192.168.10.10

You see "Reply from 192.168.10.10" with TTL values. Layer 3 routing for VLAN 20 is restored.

• Add this entry to your trouble-tickets.txt file:

Ticket C: PC1 cannot ping other VLANs. Root cause: Router sub-interface Gi0/0.20 administratively down (L3). Resolution: Brought interface back up with no shutdown.

Sub-interface still showing down?

Make sure you typed no shutdown while inside the sub-interface context (interface GigabitEthernet0/0.20), not on the physical interface Gi0/0. Also check that the physical interface Gi0/0 itself is still up. If both show "up" in show ip interface brief and the ping still fails, verify PC1's gateway is set to 192.168.20.1.

help me bring my router sub-interface back up

Run the final ping sweep

All three tickets are resolved. Before you declare the network healthy, you need to confirm full connectivity across every VLAN pair. This is what a senior engineer expects in your escalation notes.

Do you think every ping will succeed now? If any one fails, which layer would you check first?

• Open PC0's Command Prompt and run these pings:

ping 192.168.20.10
ping 192.168.30.10

• Open PC1's Command Prompt and run:

ping 192.168.10.10
ping 192.168.30.10

• Open PC2's Command Prompt and run:

ping 192.168.10.10
ping 192.168.20.10

Every ping returns "Reply from..." with TTL values. All six cross-VLAN paths are working. Your network is fully operational after resolving three trouble tickets at three different OSI layers.

Why a full sweep matters

Fixing one ticket can accidentally break another path. The full ping sweep proves that every VLAN pair can still communicate. In a production environment, this is the "smoke test" you run before closing all tickets and reporting resolution to senior engineers.

• Save your Packet Tracer topology by pressing Ctrl+S (Windows) or Cmd+S (macOS).

One or more pings still failing?

Work through the L1-L2-L3 checklist for the failing PC:

• Layer 1: Are both cable indicators green?
• Layer 2: Does show vlan brief on the connected switch show the port in the correct VLAN?
• Layer 3: Does show ip interface brief on R1-Office show the matching sub-interface as "up"?

help me diagnose why my ping sweep is failing after fixing all three tickets

You have diagnosed and resolved failures at all three OSI layers using the exact show commands that interviewers test for. Your trouble-tickets.txt now documents root causes and resolutions the way a real escalation report would. Next up, take this work and build an interview-ready portfolio in the Secret Mission.

Secret mission

Build the Interview-Ready GitHub Repository

Your network works. Your configs are saved. But can an employer see any of that? In this secret mission, you will package your topology, configs, and documentation into a professional GitHub repository that proves you document by reflex.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally in Cisco Packet Tracer, so there are no ongoing costs.

Resources you used:

• Cisco Packet Tracer topology file (.pkt) on your local machine.
• Local project folder containing config backups (/configs), documentation (/docs), and README.md.
• Public GitHub repository with all project files.

Keep everything running

No action needed. Choose this if you are still actively building or want to reference your configs later.

• Your local project folder stays on your Desktop.
• Your GitHub repository remains public and accessible for interview showcase.
• The .pkt file stays openable in Cisco Packet Tracer whenever you want to revisit your topology.

Pause - I'll come back to this later

Free up disk space while keeping your work recoverable. Your GitHub repo acts as a remote backup.

• Confirm your latest changes are pushed to GitHub by running this in your project folder:

git status

• If git status shows nothing to commit and your working tree is clean, your remote copy is up to date.
• You can safely close Cisco Packet Tracer.
• When you are ready to return, clone the repo again from GitHub and open the .pkt file.

Delete - I don't want to use this again

Remove all project resources and start fresh. This permanently deletes your local files and GitHub repository.

• Delete the local project folder by running the appropriate command for your OS.

macOS/Linux:

cd ~/Desktop
rm -rf provision-office-network

Windows (PowerShell):

cd ~\Desktop
Remove-Item -Recurse -Force provision-office-network

• Delete the GitHub repository:
• Open your repository page on GitHub.
• Click Settings (under the repository name).
• Scroll down to the Danger Zone section on the General settings page.
• Click Delete this repository.
• Click I want to delete this repository.
• Click I have read and understand these effects.
• Type the repository name to confirm, then click Delete this repository.

What about Cisco Packet Tracer and Git?

These are general-purpose tools you will use across many projects. There is no need to uninstall them unless you are certain you will not use them again.

Nice Work!

Nice Work!

You just provisioned a small office network from scratch and proved you can troubleshoot it under pressure. That is the exact day-one workflow a junior network technician performs.

You've learned how to:

• Build a 3-VLAN office network from blank devices using 802.1Q trunking and router-on-a-stick inter-VLAN routing.
• Experience the designed failure of cross-VLAN isolation and understand why Layer 3 routing is required for VLANs to communicate.
• Diagnose and resolve 3 trouble tickets using the L1-L2-L3 troubleshooting methodology with show vlan brief, show ip interface brief, and show mac address-table.
• Secret Mission: Created an interview-ready GitHub portfolio with professional network documentation, config backups, and a port-mapping document.

Ready to quiz yourself?