Build a Multi-Site Office Network

Configure VLANs, inter-VLAN routing, and static routes in Packet Tracer.

Introduction

30 Second Summary

Think about how a large company keeps its Sales team's traffic separate from Engineering, even though they share the same building and cabling. Now imagine that same company has a second office across town that needs to communicate with headquarters seamlessly.

In this project, you will build a two-site enterprise network from scratch in Cisco Packet Tracer. You will configure VLANs to separate departments, set up routing between sites, and lock down your devices with security best practices.

What You'll Build

A fully functional two-site company network with VLAN segmentation, inter-VLAN routing, a simulated WAN link with static routes, and hardened device security.

By the end of this project, you'll have:

  • Two configured Cisco switches with VLANs and 802.1Q trunk ports separating department traffic.
  • Two configured Cisco routers with subinterfaces (Router-on-a-Stick), static routes, and security hardening connecting a Headquarters and Branch Office.
  • Four PCs across three subnets with verified end-to-end connectivity proving your network works.
  • A completed network topology you can reuse as a CCNA study reference.
  • Secret Mission: Add DHCP pools so PCs get their IP addresses automatically, and create an ACL to block specific subnets from reaching the Branch.

Are there any prerequisites?

You should have a basic understanding of IP addressing and subnetting, and general familiarity with what routers and switches do. You also need Cisco Packet Tracer installed on your computer.

Before We Start

Before We Start...

Build Your Network Topology

Every network starts with a physical layout. Before you configure a single IP address or VLAN, you need to place your devices and connect them with the correct cables.

In this step, you will build the physical topology for a two-site company network in Cisco Packet Tracer. You will place routers, switches, and PCs, then wire them together so that later steps can focus purely on configuration.

In this step, get ready to:
  • Place 2 routers, 2 switches, and 4 PCs on the canvas.
  • Connect all devices with the correct cable types.
  • Verify your physical connections are in place.
Place your network devices

You need eight devices total: two routers to handle routing between sites, two switches to connect end devices within each site, and four PCs representing users at each location.

  • Look at the bottom-left corner of the Packet Tracer window. You will see the device panel with category icons.
  • Click the Network Devices category (the icon that looks like a hub/switch).
  • Click Routers in the subcategory bar.
  • Find 2911 in the device list and drag it onto the left side of your workspace. This is R1 (your HQ router).
  • Drag another 2911 onto the right side of your workspace. This is R2 (your Branch router).
  • Click Switches in the subcategory bar.
  • Find 2960 in the device list and drag one below R1. This is SW1.
  • Drag another 2960 below R2. This is SW2.
  • Click the End Devices category (the icon that looks like a PC/monitor).
  • Drag two PCs below SW1. These are PC1 and PC2 (HQ users).
  • Drag two PCs below SW2. These are PC3 and PC4 (Branch users).
  • Rename each device by clicking on it, selecting the Config tab, and changing the Display Name to R1, R2, SW1, SW2, PC1, PC2, PC3, and PC4.

You should now see eight labelled devices on your canvas arranged in two groups: HQ on the left (R1, SW1, PC1, PC2) and Branch on the right (R2, SW2, PC3, PC4).

Why the 2911 and 2960?

The 2911 router has built-in GigabitEthernet ports and supports serial interfaces for WAN links. The 2960 is a standard Layer 2 switch. Both are the most common models in CCNA exam lab topologies.

Don't see the 2911 or 2960?

Make sure you are in the correct subcategory. The 2911 is under Network Devices then Routers. The 2960 is under Network Devices then Switches. Scroll through the device list if you do not see them immediately.

help me find the 2911 router and 2960 switch in Packet Tracer

Connect devices with the correct cables

Choosing the right cable type is critical. In real networks, cable selection depends on the device types being connected.

Which cable type do I use?

Use a Copper Straight-Through cable when connecting different device types (PC to switch, switch to router). Use a Serial DCE cable to simulate a WAN link between two routers.

With the Serial DCE cable, the first device you click becomes the DCE end. That router will provide the clock signal for the link. In our network, R1 is the DCE end.

  • In the bottom-left panel, click the Connections category (the lightning bolt icon).
  • Select the Copper Straight-Through cable (solid black line icon).
  • Click PC1, then select FastEthernet0.
  • Click SW1, then select FastEthernet0/1.
  • Repeat for PC2: click PC2, select FastEthernet0, then click SW1 and select FastEthernet0/2.
  • Connect SW1 to R1: click SW1, select GigabitEthernet0/1, then click R1 and select GigabitEthernet0/0.
  • Connect PC3 to SW2: click PC3, select FastEthernet0, then click SW2 and select FastEthernet0/1.
  • Connect PC4 to SW2: click PC4, select FastEthernet0, then click SW2 and select FastEthernet0/2.
  • Connect SW2 to R2: click SW2, select GigabitEthernet0/1, then click R2 and select GigabitEthernet0/0.

Now connect the two routers with the WAN link.

  • In the Connections panel, select the Serial DCE cable (the red zigzag line with a clock icon).
  • Click R1 first (this makes R1 the DCE end), then select Serial0/0/0.
  • Click R2, then select Serial0/0/0.

What is DCE?

DCE stands for Data Communications Equipment. In a WAN link, the DCE side provides the clock signal that controls the data rate. In a real network, your ISP's equipment is the DCE. In our lab, R1 simulates this role.

Don't see Serial0/0/0 on the router?

The 2911 router in Packet Tracer comes with the HWIC-2T serial module installed by default. If you do not see the serial interface, click on the router, go to the Physical tab, power off the router, and check that the HWIC-2T module is present in one of the slots.

help me find or add the serial interface on my 2911 router in Packet Tracer

Verify your physical connections

Every cable in Packet Tracer shows coloured dots at each end indicating the link state. Green means up, orange means the interface is blocked or initialising, and red means down.

  • Look at the connections between PCs and switches. The dots on both ends should turn green after a few seconds (the switch ports auto-enable).
  • Look at the connections between switches and routers. These dots will likely show red or orange on the router side. This is expected because the router interfaces are administratively shut down by default.
  • Look at the serial cable between R1 and R2. Both ends will show red for the same reason.

Why are some link lights red?

Cisco routers ship with all interfaces in a shutdown state. You will bring them up with the no shutdown command in later steps. For now, red link lights on router-facing connections are completely normal.

The switch ports connecting to PCs should show green because switch interfaces are enabled by default.

  • Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Name your file something descriptive like multi-site-network.pkt and save it to your Desktop.

✔️ Awesome, I've got everything!

Great. Make sure you have saved your file before moving on.

ⓧ I'd like to double check the full topology

Your canvas should have exactly these devices and connections:

  • R1 (2911) and R2 (2911) positioned on opposite sides of the canvas.
  • SW1 (2960) below R1, SW2 (2960) below R2.
  • PC1 and PC2 below SW1. PC3 and PC4 below SW2.
  • PC1 FastEthernet0 connected to SW1 FastEthernet0/1 (straight-through).
  • PC2 FastEthernet0 connected to SW1 FastEthernet0/2 (straight-through).
  • SW1 GigabitEthernet0/1 connected to R1 GigabitEthernet0/0 (straight-through).
  • PC3 FastEthernet0 connected to SW2 FastEthernet0/1 (straight-through).
  • PC4 FastEthernet0 connected to SW2 FastEthernet0/2 (straight-through).
  • SW2 GigabitEthernet0/1 connected to R2 GigabitEthernet0/0 (straight-through).
  • R1 Serial0/0/0 connected to R2 Serial0/0/0 (Serial DCE, R1 is the DCE side).

Your physical topology is complete. Next up, you will configure VLANs and 802.1Q trunking on SW1 to segment HQ traffic into separate departments.

Configure VLANs and Trunking at HQ

Your physical topology is in place, but right now every device sits on a single flat network. In a real office, the Sales team and Engineering team need separate network segments for security and performance.

VLANs let you logically divide a single switch into isolated broadcast domains. In this step, you'll create two VLANs on SW1, assign ports to each department, and configure a trunk link that carries both VLANs up to the router.

In this step, get ready to:
  • Create VLAN 10 (Sales) and VLAN 20 (Engineering) on SW1.
  • Assign switch access ports to each VLAN.
  • Configure an 802.1Q trunk link between SW1 and R1.
Create VLANs on SW1

A VLAN (Virtual Local Area Network) groups switch ports into separate broadcast domains. Traffic in VLAN 10 never reaches VLAN 20 unless a router forwards it.

  • In Packet Tracer, click on SW1 to open its device window.
  • Select the CLI tab at the top.
  • Press Enter to get a prompt, then enter privileged exec mode and global configuration mode by running these commands:
enable
configure terminal
  • Create VLAN 10 and VLAN 20 with descriptive names by entering:
! Create the Sales VLAN
vlan 10
name Sales
exit

! Create the Engineering VLAN
vlan 20
name Engineering
exit

What do these commands do?

Each vlan <number> command creates a VLAN in the switch's VLAN database.

The name command gives it a human-readable label so you can identify it later in show output.

Assign access ports to each VLAN

An access port belongs to exactly one VLAN. PC1 connects to Fa0/1 (Sales) and PC2 connects to Fa0/2 (Engineering).

  • Assign FastEthernet0/1 to VLAN 10 and FastEthernet0/2 to VLAN 20 by entering:
! Assign PC1's port to the Sales VLAN
interface FastEthernet0/1
switchport mode access
switchport access vlan 10
exit

! Assign PC2's port to the Engineering VLAN
interface FastEthernet0/2
switchport mode access
switchport access vlan 20
exit

What do these commands do?

The switchport mode access command tells the port it will connect to a single end device (not another switch or router carrying multiple VLANs).

The switchport access vlan 10 command places that port into VLAN 10, so all traffic from PC1 is tagged as Sales traffic internally.

Configure the trunk port to R1

A trunk port carries traffic from multiple VLANs over a single physical link. SW1's GigabitEthernet0/1 connects to R1, so it needs to carry both VLAN 10 and VLAN 20 traffic.

  • Configure GigabitEthernet0/1 as an 802.1Q trunk with only VLANs 10 and 20 allowed by entering:
! Configure the trunk link to the router
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
exit

What does this code do?

The switchport mode trunk command turns the port into a trunk that tags each frame with its VLAN ID using 802.1Q encapsulation.

The switchport trunk allowed vlan 10,20 command restricts the trunk to only carry your two department VLANs. This is a security best practice. Without it, the trunk would carry all 4094 VLANs by default.

Why not switchport trunk encapsulation dot1q?

On the CCNA exam, you may see the command switchport trunk encapsulation dot1q used on switches that support multiple encapsulation types (dot1q and ISL).

The 2960 switch in Packet Tracer only supports 802.1Q, so it applies dot1q automatically. The encapsulation command is not available on this model. On exam questions, only use it if the switch supports both ISL and dot1q.

Verify your VLAN and trunk configuration

Verification commands are critical for the CCNA exam. These show commands confirm your VLANs are active and the trunk is operational.

  • Return to privileged exec mode and verify VLANs by running:
end
show vlan brief
  • You should see VLAN 10 (Sales) with Fa0/1 listed under its ports, and VLAN 20 (Engineering) with Fa0/2 listed under its ports.
  • Now verify the trunk link by running:
show interfaces trunk
  • You should see GigabitEthernet0/1 listed as a trunk port with 802.1q encapsulation, status trunking, and VLANs 10 and 20 in the allowed list.

What should I see?

The show vlan brief output shows a table with VLAN numbers, names, status (active), and assigned ports. Fa0/1 should appear under VLAN 10 and Fa0/2 under VLAN 20.

The show interfaces trunk output confirms which port is trunking, what encapsulation it uses, and which VLANs are allowed. If GigabitEthernet0/1 does not appear, the trunk is not active.

Trunk not showing up?

If show interfaces trunk returns empty output, the most common cause is that the other end of the link (R1's GigabitEthernet0/0) is still shut down. The trunk will not appear as active until both ends of the link are up.

This is expected at this stage. You will enable R1's interface in the next step. For now, confirm your VLANs appear correctly in show vlan brief.

If VLANs 10 and 20 are missing from show vlan brief, make sure you ran the vlan 10 and vlan 20 commands in global configuration mode (not interface configuration mode).

help me troubleshoot my VLAN and trunk configuration on SW1 in Packet Tracer

✔️ Awesome, I've got everything!

Great work. Your HQ switch is now segmented into two departments.

ⓧ I'd like to double check the full code

Here is the complete set of commands you should have entered on SW1 in this step:

enable
configure terminal

vlan 10
name Sales
exit

vlan 20
name Engineering
exit

interface FastEthernet0/1
switchport mode access
switchport access vlan 10
exit

interface FastEthernet0/2
switchport mode access
switchport access vlan 20
exit

interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20
exit

end
show vlan brief
show interfaces trunk

Your HQ switch now has two isolated department networks. Next up, you'll configure the router to forward traffic between them using subinterfaces.

Configure Inter-VLAN Routing on R1

Your switch now has VLANs and a trunk port ready, but the two departments still cannot talk to each other. Devices in different VLANs need a router to forward traffic between them.

In this step, you will configure R1 as the gateway between VLAN 10 and VLAN 20 using a technique called Router-on-a-Stick. Instead of dedicating a physical interface per VLAN, you create virtual subinterfaces on a single physical link. Each subinterface tags traffic for one VLAN using 802.1Q encapsulation.

In this step, get ready to:
  • Enable the physical interface GigabitEthernet0/0 on R1.
  • Create subinterfaces for VLAN 10 and VLAN 20 with gateway IPs.
  • Configure PCs with static IPs and verify inter-VLAN connectivity.
Enable the physical interface on R1

On Cisco routers, interfaces start in a shutdown state by default. The physical interface must be active before any subinterfaces on it can operate.

  • Click on R1 in your topology to open its configuration window.
  • Click the CLI tab to access the router command line.
  • Enter global configuration mode and enable the GigabitEthernet0/0 interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0
no ip address
no shutdown
exit

What do these commands do?

  • enable enters privileged EXEC mode so you can make configuration changes.
  • configure terminal enters global configuration mode.
  • interface GigabitEthernet0/0 selects the physical interface connected to SW1's trunk port.
  • no ip address ensures no IP is assigned directly to the physical interface. Routing will happen on the subinterfaces instead.
  • no shutdown activates the interface. Without this, all subinterfaces remain down.
  • You should see a message indicating the interface changed state to up.

Interface still showing as down?

  • Verify the cable between SW1's GigabitEthernet0/1 and R1's GigabitEthernet0/0 shows green link lights on both ends.
  • Make sure you typed no shutdown (two words). A common typo is running shutdown instead, which disables the interface.

Help me troubleshoot why my R1 GigabitEthernet0/0 interface is not coming up after running no shutdown.

Create subinterfaces for each VLAN

Subinterfaces are logical divisions of a physical interface. Each one handles traffic for a specific VLAN by using the encapsulation dot1Q command to match the VLAN tag on incoming frames.

  • Create the subinterface for VLAN 10 (Sales) by entering these commands in R1's CLI:
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit

What does this configure?

  • interface GigabitEthernet0/0.10 creates subinterface .10 on the physical interface. The .10 number is a convention matching the VLAN ID.
  • encapsulation dot1Q 10 tells the router to tag and untag frames for VLAN 10 on this subinterface.
  • ip address 192.168.10.1 255.255.255.0 assigns the default gateway IP that Sales PCs will use to reach other networks.
  • Create the subinterface for VLAN 20 (Engineering) by entering these commands:
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

What does this configure?

This follows the same pattern as the VLAN 10 subinterface. encapsulation dot1Q 20 associates the subinterface with VLAN 20 traffic. The IP 192.168.20.1 becomes the default gateway for Engineering PCs.

  • Verify your subinterfaces are up by running:
do show ip interface brief
  • You should see GigabitEthernet0/0 with no IP and status up, plus GigabitEthernet0/0.10 showing 192.168.10.1 and GigabitEthernet0/0.20 showing 192.168.20.1. Both subinterfaces should display up status.

Why Router-on-a-Stick instead of a Layer 3 switch?

Router-on-a-Stick is explicitly tested on the CCNA exam under objective 2.2 (configuring and verifying interswitch connectivity with 802.1Q and trunk ports). It demonstrates the relationship between trunking and routing more clearly than a Layer 3 switch, where the process is abstracted.

In production networks, Layer 3 switches are faster because routing happens in hardware. For the exam, you need to know both approaches.

Subinterfaces showing as down?

  • The physical interface GigabitEthernet0/0 must be no shutdown for subinterfaces to come up. Run show ip interface brief and check the physical interface status first.
  • Confirm the VLAN IDs in your encapsulation dot1Q commands match the VLANs configured on SW1 (10 and 20).

Help me figure out why my Router-on-a-Stick subinterfaces are down in Packet Tracer.

Configure PCs and test inter-VLAN connectivity

The router is ready to forward traffic between VLANs. Now you need to give each PC an IP address and point it to the correct gateway so it knows where to send traffic destined for other networks.

  • Click on PC1 in your topology.
  • Click the Desktop tab.
  • Click IP Configuration.
  • Make sure Static is selected.
  • Enter 192.168.10.2 in the IPv4 Address field.
  • Enter 255.255.255.0 in the Subnet Mask field.
  • Enter 192.168.10.1 in the Default Gateway field.
  • Close the PC1 window.
  • Now click on PC2 and repeat the process with these values:
  • IPv4 Address: 192.168.20.2
  • Subnet Mask: 255.255.255.0
  • Default Gateway: 192.168.20.1

Why does the default gateway matter?

When PC1 (192.168.10.2) wants to reach PC2 (192.168.20.2), it recognizes the destination is on a different subnet. It sends the packet to its default gateway (192.168.10.1) instead. R1 then routes the packet out the correct subinterface to reach VLAN 20.

  • Test inter-VLAN communication by clicking on PC1, then opening the Desktop tab.
  • Click Command Prompt.
  • Ping PC2 by entering this command:
ping 192.168.20.2
  • You should see replies from 192.168.20.2 confirming that traffic is flowing between VLANs through R1.

First ping may time out

The first one or two pings often time out while ARP resolves MAC addresses. This is normal. If you see at least two successful replies out of four, your configuration is correct.

All pings timing out?

  • Double-check that PC1's default gateway is 192.168.10.1 and PC2's default gateway is 192.168.20.1. A missing or incorrect gateway means the PC does not know where to send cross-subnet traffic.
  • Verify the trunk on SW1 allows VLANs 10 and 20. Go to SW1's CLI and run show interfaces trunk to confirm.
  • Confirm R1's subinterfaces are up by running show ip interface brief on R1.

Help me troubleshoot why my inter-VLAN ping is failing between PC1 and PC2 in Packet Tracer.

✔️ Awesome, I've got everything!

Great. Make sure your ping from PC1 to PC2 returned successful replies, confirming inter-VLAN routing is working.

ⓧ I'd like to double check the full configuration

Here is the complete R1 configuration you should have at this point:

enable
configure terminal
interface GigabitEthernet0/0
no ip address
no shutdown
exit
interface GigabitEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
exit
interface GigabitEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
exit

PC1 should have: IP 192.168.10.2, Subnet Mask 255.255.255.0, Default Gateway 192.168.10.1.

PC2 should have: IP 192.168.20.2, Subnet Mask 255.255.255.0, Default Gateway 192.168.20.1.

Your HQ network now has full inter-VLAN communication. Sales and Engineering can reach each other through R1. Next up, you will build the Branch Office network and connect the two sites together.

Configure the Branch Network

Your HQ network is fully operational. PC1 and PC2 can communicate across VLANs thanks to Router-on-a-Stick on R1.

Now it is time to build the Branch Office. This site has a single department (Staff) on its own subnet. You will repeat the same VLAN-and-subinterface pattern on SW2 and R2, giving the Branch its own isolated network before connecting the two sites together.

In this step, get ready to:
  • Create VLAN 10 on SW2, assign the access port, and configure the trunk to R2.
  • Configure R2's subinterface for inter-VLAN routing at the Branch.
  • Assign static IPs to PC3 and PC4 and verify local connectivity.
Create VLAN 10 and configure trunking on SW2

The Branch has one department called Staff. You need a VLAN to isolate that traffic, an access port for the PCs, and a trunk port carrying tagged frames up to R2.

  • Click on SW2 in your topology to open its CLI tab.
  • Enter the following commands to create VLAN 10, assign the access port, and configure the trunk:
enable
configure terminal

! Create VLAN 10 for the Staff department
vlan 10
 name Staff
 exit

! Assign FastEthernet0/1 as an access port in VLAN 10
interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
 exit

! Configure the trunk port to R2
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10
 exit

end

What does this configuration do?

You created VLAN 10 named Staff to segment Branch traffic. FastEthernet0/1 is set as an access port so PC3 sends untagged frames into VLAN 10.

GigabitEthernet0/1 is set as a trunk port carrying only VLAN 10 up to R2. The 2960 uses 802.1Q automatically because it is the only encapsulation this switch supports.

  • Verify the VLAN was created by running:
show vlan brief
  • You should see VLAN 10 listed with the name Staff and Fa0/1 assigned to it.
  • Verify the trunk is active by running:
show interfaces trunk
  • You should see Gig0/1 listed as a trunk port with VLAN 10 in the allowed list.

Trunk not showing in the output?

If show interfaces trunk shows nothing, R2's GigabitEthernet0/0 may still be shut down. The trunk only appears as active once both sides of the link are up. You will enable R2's interface in the next substep, then the trunk will show.

If you see an error about the switchport trunk encapsulation command, that is expected on the 2960. This switch only supports 802.1Q so it does not need an explicit encapsulation command. Just use switchport mode trunk and it will work.

help me troubleshoot my SW2 trunk configuration in Packet Tracer

Configure Router-on-a-Stick on R2

Just like at HQ, the Branch router needs a subinterface with encapsulation dot1Q to receive tagged VLAN 10 frames from SW2. The subinterface IP becomes the default gateway for all Branch PCs.

  • Click on R2 in your topology to open its CLI tab.
  • Enter the following commands to enable the physical interface and create the subinterface:
enable
configure terminal

! Bring up the physical interface (no IP here)
interface GigabitEthernet0/0
 no shutdown
 no ip address
 exit

! Create subinterface for VLAN 10 (Staff)
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.30.1 255.255.255.0
 exit

end

What does this configuration do?

The physical interface GigabitEthernet0/0 is enabled with no shutdown but gets no IP address. The subinterface G0/0.10 handles all VLAN 10 traffic.

encapsulation dot1Q 10 tells R2 to expect 802.1Q-tagged frames with VLAN ID 10 on this subinterface. The IP 192.168.30.1 becomes the default gateway for Branch PCs.

  • Verify the subinterface is up by running:
show ip interface brief
  • You should see GigabitEthernet0/0 with status up and GigabitEthernet0/0.10 showing IP 192.168.30.1 with status up.

Subinterface showing down/down?

Make sure you ran no shutdown on the physical interface GigabitEthernet0/0 (not on the subinterface). The subinterface inherits its up/down state from the physical interface.

Also check that the cable between SW2 and R2 is connected to the GigabitEthernet0/1 port on SW2 and GigabitEthernet0/0 on R2. Both link lights should be green.

help me fix R2's subinterface that is showing down

Configure PC3 and PC4 with static IPs

With the switch and router ready, you can now assign IP addresses to the Branch PCs and confirm they can reach each other through the local VLAN.

  • Click on PC3 in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Enter the following values:
  • IP Address: 192.168.30.2.
  • Subnet Mask: 255.255.255.0.
  • Default Gateway: 192.168.30.1.
  • Click on PC4 in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Enter the following values:
  • IP Address: 192.168.30.3.
  • Subnet Mask: 255.255.255.0.
  • Default Gateway: 192.168.30.1.

Why do both PCs share the same gateway?

PC3 and PC4 are both in the 192.168.30.0/24 subnet. Their default gateway is R2's subinterface IP (192.168.30.1). Any traffic destined outside this subnet will be forwarded to R2 for routing.

  • Test local connectivity by opening the Command Prompt on PC3 (Desktop tab > Command Prompt).
  • Ping PC4 by running:
ping 192.168.30.3
  • You should see replies from 192.168.30.3 confirming that PC3 and PC4 can communicate through SW2.

First ping may time out

The first ping often shows "Request timed out" because the switch is learning MAC addresses via ARP. Try the ping a second time and all four replies should succeed.

Ping failing between PC3 and PC4?

Double-check that both PCs have the correct subnet mask (255.255.255.0). A mismatched mask means the PCs think they are on different networks.

Verify that PC3 is connected to Fa0/1 on SW2 (the access port in VLAN 10). If it is plugged into a different port that has not been assigned to VLAN 10, traffic will not pass.

help me troubleshoot ping failures between PC3 and PC4 on my Branch network

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete SW2 configuration you should have:

! SW2 Configuration
vlan 10
 name Staff

interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10

Here is the complete R2 configuration you should have:

! R2 Configuration
interface GigabitEthernet0/0
 no shutdown
 no ip address

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.30.1 255.255.255.0

PC3: IP 192.168.30.2, Subnet 255.255.255.0, Gateway 192.168.30.1.

PC4: IP 192.168.30.3, Subnet 255.255.255.0, Gateway 192.168.30.1.

Your Branch network is live. PC3 and PC4 can talk to each other, and R2 is ready to route traffic. Next, you will connect the two sites with a WAN link and static routes so HQ and the Branch can communicate end to end.

Connect the Sites with Static Routing

Your HQ and Branch networks are both working internally. PCs in the same site can ping each other. But right now, a PC at HQ has no idea how to reach a PC at the Branch.

In this step, you will bring the serial WAN link online and add static routes so both routers know how to forward traffic to the other site. By the end, any device on the entire network can reach any other device.

In this step, get ready to:
  • Configure the serial WAN link between R1 and R2 with IP addresses.
  • Add static routes on both routers so each site knows how to reach the other.
  • Verify end-to-end connectivity with ping from HQ to the Branch.
Configure the WAN link on R1 and R2

The serial cable between R1 and R2 simulates a WAN link connecting two remote offices. Before the routers can exchange traffic over this link, you need to assign IP addresses to the serial interfaces and bring them up.

  • Click on R1 in your topology to open it.
  • Go to the CLI tab.
  • Configure the R1 serial interface by entering these commands:
enable
configure terminal
interface Serial0/0/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 64000
 no shutdown
exit

What do these commands do?

  • interface Serial0/0/0 enters the serial interface that connects to R2 via the DCE cable.
  • ip address 10.0.0.1 255.255.255.252 assigns R1's WAN IP. The /30 mask (255.255.255.252) gives exactly two usable host addresses, which is perfect for a point-to-point link.
  • clock rate 64000 sets the clocking speed on the DCE side. In a serial connection, one end (the DCE) provides the clock signal. R1 is the DCE end in this lab.
  • no shutdown enables the interface.

What is DCE and why does R1 need a clock rate?

Serial links have a DCE (Data Communications Equipment) side and a DTE (Data Terminal Equipment) side. The DCE side provides the timing signal that synchronizes data transmission.

In Packet Tracer, R1 is connected to the DCE end of the serial cable. You can verify this by running show controllers Serial0/0/0 and looking for "DCE" in the output. Only the DCE side needs the clock rate command.

  • Now click on R2 in your topology to open it.
  • Go to the CLI tab.
  • Configure the R2 serial interface by entering these commands:
enable
configure terminal
interface Serial0/0/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown
exit

Why no clock rate on R2?

R2 is the DTE (Data Terminal Equipment) end of the serial cable. The DTE side receives the clock signal from the DCE side. Only the DCE end (R1) sets the clock rate. If you try to add clock rate on a DTE interface, the router rejects it with an error.

  • Verify the WAN link is up by running this command on R2:
do show ip interface brief

You should see Serial0/0/0 showing status up and protocol up. This confirms the physical link between the two routers is working.

Serial0/0/0 showing down/down?

  • Make sure you ran no shutdown on BOTH R1 and R2's Serial0/0/0 interfaces. Both ends must be enabled.
  • Confirm R1 has clock rate 64000 configured. Without the clock signal from the DCE side, the link stays down.
  • Check that the serial cable is connected properly in the topology. Hover over the cable to verify it connects the Serial0/0/0 ports on both routers.

help me troubleshoot my serial link showing down/down in Packet Tracer

Add static routes on both routers

The WAN link is up, but the routers still cannot forward traffic to each other's LANs. Each router only knows about its directly connected networks. You need to tell each router how to reach the remote subnets using static routes.

  • Switch back to R1's CLI.
  • Add a static route to reach the Branch network by entering this command:
configure terminal
ip route 192.168.30.0 255.255.255.0 10.0.0.2
exit

What does this static route do?

The command ip route 192.168.30.0 255.255.255.0 10.0.0.2 tells R1: "To reach the 192.168.30.0/24 network (the Branch), forward packets to 10.0.0.2 (R2's serial interface)." Without this route, R1 would drop any traffic destined for the Branch because it would not know where to send it.

  • Switch back to R2's CLI.
  • Add static routes so R2 can reach both HQ subnets by entering these commands:
configure terminal
ip route 192.168.10.0 255.255.255.0 10.0.0.1
ip route 192.168.20.0 255.255.255.0 10.0.0.1
exit

Why does R2 need two routes but R1 only needs one?

HQ has two subnets that R2 needs to reach: VLAN 10 (Sales, 192.168.10.0/24) and VLAN 20 (Engineering, 192.168.20.0/24). Each requires its own route entry pointing to R1 at 10.0.0.1.

The Branch only has one subnet (192.168.30.0/24), so R1 only needs a single route to cover all Branch traffic.

Seeing an invalid input error?

  • Make sure you are in global configuration mode (your prompt should show (config)#). The ip route command does not work from privileged EXEC mode.
  • Double-check that the next-hop IP matches the other router's serial IP exactly: 10.0.0.2 for R1's route and 10.0.0.1 for R2's routes.

help me fix a static route configuration error on my Cisco router

Verify end-to-end connectivity

Both routers now have routes to every subnet in the network. Time to confirm that traffic can actually flow from one site to the other.

  • On R1's CLI, check the routing table by running:
show ip route

You should see routes marked with C (directly connected) for your local subnets and S (static) for the remote subnet 192.168.30.0/24 pointing to 10.0.0.2.

  • Now test end-to-end connectivity. Click on PC1 in your topology.
  • Go to the Desktop tab, then open Command Prompt.
  • Ping PC3 at the Branch by running:
ping 192.168.30.2

You should see replies coming back from 192.168.30.2. This confirms that traffic flows from HQ's Sales VLAN all the way to the Branch, crossing the WAN link via static routes.

First ping may time out

The very first ping often shows "Request timed out" for 1-2 packets while ARP resolves MAC addresses along the path. This is normal. The remaining pings should succeed. If all four packets time out, something is misconfigured.

All pings timing out?

  • Run show ip route on both routers and confirm you see all the expected static (S) and connected (C) routes. A missing route means traffic gets dropped.
  • Verify that PC1's default gateway is set to 192.168.10.1 and PC3's default gateway is 192.168.30.1. Without correct gateways, PCs cannot send traffic off their local subnet.
  • Check that R2 has routes back to HQ (192.168.10.0/24 and 192.168.20.0/24). Pings require a return path too.

help me troubleshoot why pings between my two sites are failing

✔️ Awesome, I've got everything!

Great. Double check that you have saved your router configurations. On each router, run write memory from privileged EXEC mode to save the running configuration to startup.

ⓧ I'd like to double check the full configuration

Here is the full R1 configuration you should have at this point:

! R1 Configuration (relevant sections)
!
interface GigabitEthernet0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
!
interface Serial0/0/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 64000
 no shutdown
!
ip route 192.168.30.0 255.255.255.0 10.0.0.2

Here is the full R2 configuration you should have at this point:

! R2 Configuration (relevant sections)
!
interface GigabitEthernet0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.30.1 255.255.255.0
!
interface Serial0/0/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown
!
ip route 192.168.10.0 255.255.255.0 10.0.0.1
ip route 192.168.20.0 255.255.255.0 10.0.0.1

Your two sites can now talk to each other. Any device at HQ can reach any device at the Branch, and vice versa. Next up, you will lock down these routers with proper security so they are protected from unauthorized access.

Secure Your Network Devices

Your network is fully connected. Any PC can reach any other PC across both sites. But right now, anyone who walks up to a router or connects remotely has full access to your configuration with no password required.

In this step, you'll lock down both routers with passwords, encryption, and SSH access. These are the exact security commands tested in CCNA exam objectives 5.3 (device access control) and 4.8 (remote access using SSH).

In this step, get ready to:
  • Configure hostnames and encrypted passwords on both routers.
  • Set up SSH for secure remote management.
  • Secure the console line and verify SSH access works.
Configure hostnames and encrypted passwords

Every Cisco device should have a hostname for identification, an encrypted enable password to protect privileged EXEC mode, and password encryption turned on so no plaintext passwords appear in the configuration file.

  • Click on R1 in your topology to open it.
  • Go to the CLI tab.
  • Configure the hostname, enable secret, and password encryption by entering these commands:
enable
configure terminal
hostname R1
enable secret cisco123
service password-encryption

What do these commands do?

  • hostname R1 sets the device name that appears in your CLI prompt.
  • enable secret cisco123 creates an MD5-hashed password required to enter privileged EXEC mode.
  • service password-encryption applies type 7 encryption to any plaintext passwords in the running config. It is weak encryption, but prevents casual shoulder-surfing.
  • Verify the hostname took effect by checking your prompt. It should now show R1(config)# instead of Router(config)#.

Not seeing the R1 prompt?

Make sure you typed enable first to enter privileged EXEC mode, then configure terminal to enter global configuration mode. The hostname command only works in global config mode.

Help me troubleshoot my hostname and enable secret configuration on R1.

  • Now repeat the same on R2. Click on R2 in your topology and go to the CLI tab.
  • Enter the same commands for R2:
enable
configure terminal
hostname R2
enable secret cisco123
service password-encryption

Your prompt should now show R2(config)# confirming the hostname is set.

Set up SSH access on both routers

SSH encrypts all traffic between a remote administrator and the router. Without SSH, management traffic travels in plaintext using Telnet. The CCNA exam requires you to configure SSH as the only allowed remote access method.

Why SSH instead of Telnet?

Telnet sends every keystroke (including passwords) as plaintext across the network. Anyone capturing packets can read your credentials. SSH encrypts the entire session, making it the only acceptable option for remote device management.

  • On R1 (you should still be in global configuration mode), configure the domain name and generate RSA keys by entering:
ip domain-name nextwork.com
crypto key generate rsa
  • Packet Tracer will prompt you for the modulus size. Type 1024 and press Enter.

What is the RSA modulus?

The modulus is the key length in bits. A minimum of 1024 bits is required for SSH version 2. Larger keys (2048) are more secure but take longer to generate in simulation.

  • Create a local user account and lock down the VTY lines to SSH only by entering:
username admin secret admin123
ip ssh version 2
line vty 0 4
login local
transport input ssh
exit

What does this code do?

  • username admin secret admin123 creates a local user called admin with an encrypted password stored in the local database.
  • ip ssh version 2 forces the router to use only the more secure SSH version 2 protocol.
  • line vty 0 4 enters configuration for all five virtual terminal lines (the remote access sessions).
  • login local tells the VTY lines to authenticate against the local username database.
  • transport input ssh restricts remote access to SSH only, blocking Telnet entirely.
  • Verify SSH is enabled by running:
do show ip ssh

You should see SSH version 2.0 enabled with a timeout and authentication retry value listed.

Seeing SSH disabled?

SSH requires both a domain name and RSA keys to activate. If you skipped ip domain-name nextwork.com or the crypto key generate rsa step, SSH cannot enable.

Re-enter both commands from global configuration mode, then run do show ip ssh again to confirm.

Help me troubleshoot why SSH is showing as disabled on my router.

  • Now repeat the SSH configuration on R2. Click on R2 and enter these commands in the CLI tab:
ip domain-name nextwork.com
crypto key generate rsa
  • Type 1024 when prompted for the modulus size and press Enter.
  • Then enter the user and VTY configuration:
username admin secret admin123
ip ssh version 2
line vty 0 4
login local
transport input ssh
exit
  • Run do show ip ssh on R2 to confirm SSH version 2.0 is enabled.
Secure the console line and verify SSH access

The console port is the physical management port on the router. Without a password, anyone with physical access can reconfigure the device.

  • On R1, configure the console line password by entering:
line con 0
password console123
login local
exit

What does this code do?

  • line con 0 enters configuration for the console port.
  • password console123 sets a line password (encrypted by service password-encryption from earlier).
  • login local requires the local username and password (admin/admin123) to access the console.
  • Repeat the same console configuration on R2:
line con 0
password console123
login local
exit
  • Save the configuration on R1 so it persists after a reboot by entering:
end
write memory
  • Save the configuration on R2 as well:
end
write memory

What does write memory do?

The write memory command saves your running configuration to the startup configuration file. Without this, all your changes would be lost if the router reboots.

Now test that SSH actually works by connecting from a PC to R1.

  • Click on PC1 in your topology.
  • Go to the Desktop tab.
  • Click Command Prompt.
  • SSH into R1 by entering this command:
ssh -l admin 192.168.10.1
  • When prompted for the password, type admin123 and press Enter.

You should see the R1> prompt appear, confirming you have a secure SSH session into the router from PC1.

Connection refused or timed out?

Make sure the -l in the SSH command is a lowercase letter L, not the number 1.

Verify that transport input ssh is configured on R1's VTY lines. Click on R1, go to CLI, and run show running-config | section vty to check.

If the password is rejected, confirm the username is admin and the password is admin123 (case-sensitive).

Help me troubleshoot my SSH connection from PC1 to R1 in Packet Tracer.

  • Type exit to close the SSH session and return to the PC command prompt.
  • Test SSH to R2 across the WAN link by entering:
ssh -l admin 10.0.0.2
  • Enter the password admin123 when prompted.

You should see the R2> prompt, confirming SSH access works across the WAN link to the Branch router.

✔️ Awesome, I've got everything!

Great. Make sure you ran write memory on both R1 and R2 to save your security configuration.

ⓧ I'd like to double check the full configuration

Here is the complete security configuration for R1:

enable
configure terminal
hostname R1
enable secret cisco123
service password-encryption
ip domain-name nextwork.com
crypto key generate rsa
! (enter 1024 when prompted for modulus)
username admin secret admin123
ip ssh version 2
line vty 0 4
login local
transport input ssh
exit
line con 0
password console123
login local
exit
end
write memory

And here is the complete security configuration for R2:

enable
configure terminal
hostname R2
enable secret cisco123
service password-encryption
ip domain-name nextwork.com
crypto key generate rsa
! (enter 1024 when prompted for modulus)
username admin secret admin123
ip ssh version 2
line vty 0 4
login local
transport input ssh
exit
line con 0
password console123
login local
exit
end
write memory

Secret mission

Add DHCP and Access Control Lists to Your Network

Your network works, but every PC has a manually typed IP address. In a real enterprise, that does not scale. Can you configure R1 to hand out addresses automatically AND block Engineering from reaching the Branch?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely in Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about.

Decide whether to keep your topology file for future study, close Packet Tracer to free up memory, or delete the file entirely.

Resources you used:

  • Cisco Packet Tracer topology file (.pkt file saved on your computer).

Keep everything running

No action needed. Choose this if you plan to keep studying with this topology or want to extend it with additional configurations.

  • Your .pkt file stays saved wherever you stored it.
  • You can reopen it anytime to practice commands, test new configurations, or use it as a reference for exam prep.

Pause - I'll come back to this later

Save your work and close Packet Tracer to free up system memory. Your topology file remains on disk for when you return.

  • In Packet Tracer, click File, then Save to make sure your latest changes are saved.
  • Close Cisco Packet Tracer.

Delete - I don't want to use this again

Remove the topology file from your computer entirely. You can always rebuild it by following the project again.

  • Close Cisco Packet Tracer if it is still open.
  • Navigate to the folder where you saved your .pkt file.
  • Delete the .pkt file by moving it to the Trash (macOS) or Recycle Bin (Windows), then empty it.

Nice Work!

Nice Work!

You just built a multi-site enterprise network from scratch in Cisco Packet Tracer. Your topology covers three of the highest-weighted CCNA 200-301 exam domains, giving you hands-on CLI practice with the exact commands tested on the exam.

You've learned how to:

  • Create VLANs and 802.1Q trunks to segment network traffic by department across multiple switches.
  • Configure Router-on-a-Stick with subinterfaces and static routes to enable inter-VLAN routing and end-to-end connectivity between two remote sites.
  • Harden network devices with SSH, encrypted passwords, and console lockdown to meet CCNA Security Fundamentals requirements.
  • Secret Mission: Configure DHCP pools and Access Control Lists to automate IP addressing and enforce traffic policies between subnets.

Ready to quiz yourself?