Build an Enterprise Network in Packet Tracer

Design a multi-site network with VLANs, OSPF, NAT, and security configs.

Introduction

30 Second Summary

Every company you interact with online relies on a network that keeps departments separated, offices connected, and data secure. When you check your bank balance or send a message at work, packets are flowing through VLANs, routers, and firewalls that someone designed and configured.

In this project, you will build a complete enterprise network simulation from scratch in Cisco Packet Tracer. You will connect a headquarters and a branch office with dynamic routing, VLAN segmentation, and security hardening.

What You'll Build

A multi-site enterprise network with three department VLANs at headquarters, a branch office connected over a WAN link using OSPF, DHCP for automatic IP assignment, NAT for internet access, and security controls including ACLs and SSH.

By the end of this project, you'll have:

  • A fully functional multi-site enterprise network simulation (.pkt file) with a headquarters and a branch office connected via OSPF.
  • Documented proof of connectivity (successful pings, routing tables, VLAN verification) that demonstrates your network design skills.
  • Security configurations in place (ACLs, port security, SSH) that show your understanding of network hardening.
  • Secret Mission: Add EtherChannel (LACP) redundancy between HQ switches and configure HSRP for gateway failover.

Are there any prerequisites?

You should have a basic understanding of IP addressing and subnetting. Familiarity with the Cisco CLI (entering commands in privileged exec and global config mode) is also helpful.

You will also need Cisco Packet Tracer 9.0 installed on your computer. It is free to download through Cisco NetAcad.

Plan the Network and Build the Topology

Every enterprise network starts with a plan. Before you touch a single switch or router, you need to know exactly how IP addresses will be distributed across sites, departments, and links.

In this step, you'll create the IP addressing scheme for both your headquarters and branch office, place all network devices into Cisco Packet Tracer's workspace, and cable them together. This gives you a solid physical foundation to configure in the following steps.

In this step, get ready to:
  • Create a VLSM IP addressing scheme for HQ and Branch.
  • Place all network devices onto the Packet Tracer workspace.
  • Cable the devices together with the correct connections.
Create the IP addressing scheme

A good IP addressing scheme uses VLSM (Variable Length Subnet Masking) to assign appropriately sized subnets to each segment. This keeps the network organized and prevents address waste.

Your enterprise network has six segments that each need their own subnet. Document the following scheme so you can refer back to it throughout the project.

=== HQ VLAN Subnets ===
VLAN 10 (IT):       192.168.10.0/24   Gateway: 192.168.10.1
VLAN 20 (HR):       192.168.20.0/24   Gateway: 192.168.20.1
VLAN 30 (Finance):  192.168.30.0/24   Gateway: 192.168.30.1

=== Branch Office ===
Branch LAN:         192.168.40.0/24   Gateway: 192.168.40.1

=== WAN Links ===
HQ-Router <-> Branch-Router:  10.0.0.0/30
  HQ-Router Se0/1/0:          10.0.0.1
  Branch-Router Se0/1/0:       10.0.0.2

HQ-Core-SW <-> HQ-Router:    10.0.0.4/30
  HQ-Core-SW Gig0/2:          10.0.0.5
  HQ-Router Gig0/0/0:         10.0.0.6

Why /30 for WAN links?

A /30 subnet provides exactly 2 usable host addresses. Point-to-point links between routers only ever have two endpoints, so /30 is the perfect fit. It avoids wasting addresses on links that will never need more than two.

What is VLSM?

VLSM lets you use different subnet mask sizes within the same network. Instead of giving every segment a /24 (254 hosts), you match the mask to the actual number of devices. The WAN links use /30 because they only need 2 hosts.

The LAN segments use /24 because departments may have up to 254 devices each.

  • Write this addressing scheme down in a text file or notebook. You'll reference it throughout the project.
Place devices onto the workspace

With your addressing plan ready, it's time to build the physical topology. You'll place every device that makes up the HQ and Branch Office networks.

  • Open Cisco Packet Tracer.
  • Create a new project by clicking File in the menu bar, then selecting New.
  • Look at the bottom-left of the screen. You'll see the Network Component Box with two rows of icons. The top row shows device categories (routers, switches, end devices). The bottom row shows specific models.

Place the following devices by clicking a category in the top row, selecting the model in the bottom row, then clicking in the workspace to drop it:

  • Click the Switches category. Select 3650-24PS and place it in the center-left of the workspace. This is your HQ-Core-SW.
  • Still in Switches, select 2960-24TT and place it below HQ-Core-SW. This is your HQ-Access-SW.
  • Place another 2960-24TT on the right side of the workspace. This is your Branch-SW.
  • Click the Routers category. Select 4321 and place it above HQ-Core-SW. This is your HQ-Router.
  • Place another 4321 on the right side, above Branch-SW. This is your Branch-Router.
  • Click the End Devices category. Select PC and place 6 PCs on the workspace: 2 below HQ-Access-SW on the left (IT PCs), 2 in the middle (HR PCs), 2 below Branch-SW (Branch PCs).
  • Still in End Devices, select Server and place 1 server near HQ-Access-SW. This is your DHCP/DNS server.

How do I rename devices?

Click on any device to open its properties window. Go to the Config tab and change the Display Name field. Name them HQ-Core-SW, HQ-Access-SW, HQ-Router, Branch-Router, and Branch-SW to match the addressing scheme.

Now you need to add serial interface modules to both ISR 4321 routers. These routers do not have serial ports by default.

  • Click on HQ-Router to open its properties window.
  • Click the Physical tab.
  • Click the power switch on the right side of the router image to turn the device off. The green LED will turn off.
  • In the modules list on the left, find HWIC-2T. Drag it onto an empty slot on the router image.
  • Click the power switch again to turn the router back on.
  • Repeat this process for Branch-Router: open it, go to Physical, power off, add HWIC-2T, power on.

Don't see the HWIC-2T module?

Some versions of Packet Tracer list the serial module as NIM-2T instead of HWIC-2T. Both provide serial interfaces. Look through the available modules in the list for anything that mentions "2-Port Serial" and drag it to an empty slot.

If the module snaps back to the list, the router is still powered on. Make sure you click the power button to turn it off first. Help me add a serial module to my ISR 4321

  • Verify the serial interfaces exist by clicking HQ-Router, going to the CLI tab, and typing show ip interface brief. You should see Serial0/1/0 in the interface list.
Cable the devices

With all devices placed, the last task is connecting them with the correct cable types. Packet Tracer uses different cables for different connection types.

  • Click the Connections category (the lightning bolt icon) in the bottom-left Network Component Box.
  • Select Copper Straight-Through cable.
  • Click HQ-Core-SW and select port GigabitEthernet0/1. Then click HQ-Access-SW and select port GigabitEthernet0/1. This creates the trunk link between the two HQ switches.
  • Click HQ-Core-SW port GigabitEthernet0/2. Then click HQ-Router port GigabitEthernet0/0/0. This connects the core switch to the edge router.
  • Now select Serial DCE cable from the Connections list.
  • Click HQ-Router port Serial0/1/0. Then click Branch-Router port Serial0/1/0. This is your WAN link. HQ-Router becomes the DCE (clock provider) side.
  • Switch back to Copper Straight-Through cable.
  • Click Branch-Router port GigabitEthernet0/0/0. Then click Branch-SW port GigabitEthernet0/1.
  • Connect each HQ PC and the server to HQ-Access-SW using Copper Straight-Through cables. Use ports FastEthernet0/1 through FastEthernet0/7 on the access switch (one port per device).
  • Connect the 2 Branch PCs to Branch-SW using Copper Straight-Through cables on ports FastEthernet0/1 and FastEthernet0/2.

What is a DCE cable?

In a serial WAN connection, one side provides the clock signal that synchronizes data transmission. That side is called DCE (Data Communications Equipment). The other side is DTE (Data Terminal Equipment).

By choosing the Serial DCE cable and clicking HQ-Router first, you're making HQ-Router the clock provider. You'll set the clock rate on that interface in a later step.

  • Wait about 30 seconds for the link lights to stabilize. Green triangles on each end of a cable mean the physical connection is active. Orange triangles mean the port is in a blocking state (normal for switches before configuration).
  • Save your project by pressing Ctrl+S. Name it enterprise-network.pkt.

Seeing red X marks on your cables?

A red X on a cable means the physical link is down. For router interfaces, this is expected because all router interfaces start in a shutdown state. You'll bring them up with no shutdown commands in later steps.

If you see a red X between two switches, double-check that you connected the correct ports (GigabitEthernet0/1 to GigabitEthernet0/1). Help me troubleshoot my cable connections in Packet Tracer

Your topology is complete. You have all devices placed, named, and connected exactly as the addressing scheme requires. Next up, you'll bring this network to life by configuring VLANs and trunking on the HQ switches.

Configure VLANs and Trunking

Your devices are in place and cabled, but right now every port on both switches belongs to a single broadcast domain. That means every device can see every other device's traffic.

In a real enterprise, departments like IT, HR, and Finance need network separation for security and performance. VLANs let you create that separation on a single physical switch. In this step, you'll create VLANs on both HQ switches and set up 802.1Q trunking so VLAN traffic can pass between them.

In this step, get ready to:
  • Create VLANs on both HQ switches for IT, HR, and Finance departments.
  • Configure trunk links between the switches to carry VLAN traffic.
  • Assign access ports on HQ-Access-SW so each PC connects to the correct VLAN.
Create VLANs on HQ-Core-SW

The HQ-Core-SW (Catalyst 3650) is the multilayer switch at the center of your headquarters network. You need to create VLANs here first because this switch handles the trunk link that carries all VLAN traffic.

  • Click on HQ-Core-SW in your Packet Tracer workspace.
  • Go to the CLI tab.
  • Enter the following commands to create your department VLANs and a native VLAN:
enable
configure terminal
! Create VLAN for IT department
vlan 10
name IT
! Create VLAN for HR department
vlan 20
name HR
! Create VLAN for Finance department
vlan 30
name Finance
! Create native VLAN (unused, for trunk security)
vlan 99
name Native-Unused
exit

What do these commands do?

Each vlan command creates a logical broadcast domain on the switch. The name command gives it a human-readable label.

VLAN 99 is a security best practice. You'll use it as the native VLAN on trunk links so that untagged traffic lands in an unused VLAN instead of the default VLAN 1.

  • Verify the VLANs were created by running:
show vlan brief

You should see VLANs 10 (IT), 20 (HR), 30 (Finance), and 99 (Native-Unused) listed alongside the default VLAN 1.

Don't see your VLANs listed?

Make sure you typed each vlan command on its own line followed by the name command. If you see an error, confirm you are in global configuration mode (the prompt should show (config)#).

Help me troubleshoot missing VLANs on my Catalyst 3650 in Packet Tracer.

Configure the trunk port on HQ-Core-SW

A trunk port carries traffic from multiple VLANs over a single physical link. Without it, each VLAN would need its own cable between switches.

  • Still in the HQ-Core-SW CLI, configure the Gig0/1 interface as a trunk by entering these commands:
configure terminal
! Configure trunk link to HQ-Access-SW
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
exit

What does this trunk configuration do?

  • switchport mode trunk forces this port to always act as a trunk (no auto-negotiation).
  • switchport trunk allowed vlan 10,20,30 restricts the trunk to only carry your department VLANs. This is a security best practice that prevents unknown VLANs from crossing the link.
  • switchport trunk native vlan 99 sets the native VLAN to 99 so untagged frames go to an unused VLAN instead of VLAN 1.
  • Verify the trunk is active by running:
show interfaces trunk

You should see Gig0/1 listed as a trunk with VLANs 10, 20, and 30 in the "Vlans allowed" column and native VLAN 99.

Trunk not showing up?

If you see no output, the other end (HQ-Access-SW) has not been configured as a trunk yet. The trunk link may show as "not-trunking" until both sides are configured. This is expected at this point.

If you see an error on the switchport mode trunk command, make sure you are on interface GigabitEthernet0/1 (not a routed port).

Help me fix my trunk configuration on HQ-Core-SW.

Configure VLANs, trunk, and access ports on HQ-Access-SW

The HQ-Access-SW (Catalyst 2960) is where your end devices physically connect. It needs the same VLANs as HQ-Core-SW, a matching trunk configuration on its uplink, and access port assignments that place each PC into its correct department VLAN.

  • Click on HQ-Access-SW in your workspace.
  • Go to the CLI tab.
  • Create the same VLANs by entering these commands:
enable
configure terminal
! Create matching VLANs on access switch
vlan 10
name IT
vlan 20
name HR
vlan 30
name Finance
vlan 99
name Native-Unused
exit

Why create the same VLANs on both switches?

VLANs are locally significant to each switch. Even though the trunk carries VLAN-tagged frames, the receiving switch must already have those VLANs in its database to process them correctly.

  • Now configure the uplink to HQ-Core-SW as a trunk by entering:
configure terminal
! Configure trunk uplink to HQ-Core-SW
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
exit

What's happening here?

This mirrors the trunk configuration on HQ-Core-SW. Both sides of the trunk link must agree on the mode, allowed VLANs, and native VLAN. A mismatch causes connectivity problems or security warnings.

  • Verify the trunk is now active on HQ-Access-SW by running:
show interfaces trunk

You should now see Gig0/1 listed as an active trunk with VLANs 10, 20, 30 allowed and native VLAN 99. Both sides are configured now, so trunking is fully operational.

Still not seeing an active trunk?

Check that the cable between HQ-Core-SW Gig0/1 and HQ-Access-SW Gig0/1 shows green triangles on both ends. An orange or red indicator means the link is down.

Help me troubleshoot my trunk link between HQ-Core-SW and HQ-Access-SW.

Now it's time to assign the access ports. Each PC plugs into a specific port, and you need to tell the switch which VLAN that port belongs to.

  • Assign the IT department ports (where your two IT PCs are connected) by entering:
configure terminal
! Assign IT PCs to VLAN 10
interface range FastEthernet0/1-2
switchport mode access
switchport access vlan 10
exit

What does access mode do?

An access port belongs to exactly one VLAN. Unlike a trunk, it does not tag frames. The connected PC sends and receives traffic without knowing VLANs exist. The switch handles the VLAN assignment transparently.

  • Assign the HR department ports by entering:
! Assign HR PCs to VLAN 20
interface range FastEthernet0/3-4
switchport mode access
switchport access vlan 20
exit
  • Assign the Finance department ports by entering:
! Assign Finance PCs to VLAN 30
interface range FastEthernet0/5-6
switchport mode access
switchport access vlan 30
exit
  • Finally, assign the server port to VLAN 10 (IT department) by entering:
! Assign Server to VLAN 10 (IT)
interface FastEthernet0/7
switchport mode access
switchport access vlan 10
exit

Why is the server in VLAN 10?

The server will provide DHCP and DNS services. Placing it in the IT VLAN is a common enterprise pattern where IT manages shared infrastructure. Other VLANs will access the server through inter-VLAN routing (configured in the next step).

  • Verify your access port assignments by running:
show vlan brief

You should see Fa0/1 and Fa0/2 under VLAN 10, Fa0/3 and Fa0/4 under VLAN 20, Fa0/5 through Fa0/7 under VLAN 30 and VLAN 10 respectively.

Ports still showing up under VLAN 1?

If a port is still listed under VLAN 1, the access VLAN command did not apply. Run show running-config interface Fa0/1 to check if the VLAN assignment is present. Make sure you included switchport mode access before the switchport access vlan command.

Help me fix my access port VLAN assignments on HQ-Access-SW.

Verify the complete VLAN and trunk configuration

Now that both switches are configured, run verification commands on each one to confirm everything is working together.

  • On HQ-Core-SW, run these verification commands:
show vlan brief
show interfaces trunk
  • Confirm that show vlan brief lists VLANs 10, 20, 30, and 99.
  • Confirm that show interfaces trunk shows Gig0/1 as a trunk with VLANs 10, 20, 30 allowed and native VLAN 99.
  • On HQ-Access-SW, run the same verification commands:
show vlan brief
show interfaces trunk
  • Confirm that show vlan brief shows VLANs 10, 20, 30, and 99, with ports correctly assigned to each VLAN.
  • Confirm that show interfaces trunk shows Gig0/1 trunking with the same allowed VLANs and native VLAN as HQ-Core-SW.

What should the output look like?

On HQ-Access-SW, the trunk output should show Gig0/1 is NOT listed in show vlan brief (trunk ports are excluded from the VLAN port list). Access ports Fa0/1-Fa0/7 should appear under their respective VLANs.

On HQ-Core-SW, no access ports will show under the VLANs because it only has the trunk link configured. This is expected for a core/distribution switch.

✔️ Awesome, I've got everything!

Great. Make sure you've saved your Packet Tracer file before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete configuration applied in this step for each switch.

HQ-Core-SW full configuration:

enable
configure terminal
! Create VLANs
vlan 10
name IT
vlan 20
name HR
vlan 30
name Finance
vlan 99
name Native-Unused
exit
! Configure trunk to HQ-Access-SW
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
exit

HQ-Access-SW full configuration:

enable
configure terminal
! Create VLANs
vlan 10
name IT
vlan 20
name HR
vlan 30
name Finance
vlan 99
name Native-Unused
exit
! Configure trunk to HQ-Core-SW
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99
exit
! Assign IT PCs to VLAN 10
interface range FastEthernet0/1-2
switchport mode access
switchport access vlan 10
exit
! Assign HR PCs to VLAN 20
interface range FastEthernet0/3-4
switchport mode access
switchport access vlan 20
exit
! Assign Finance PCs to VLAN 30
interface range FastEthernet0/5-6
switchport mode access
switchport access vlan 30
exit
! Assign Server to VLAN 10
interface FastEthernet0/7
switchport mode access
switchport access vlan 10
exit

Your VLANs are configured and trunking is active. Each department's PCs are isolated in their own broadcast domain. Next up, you'll configure inter-VLAN routing on HQ-Core-SW so these departments can actually communicate with each other through Layer 3.

Configure Inter-VLAN Routing and DHCP

Your VLANs are in place and traffic is properly segmented at Layer 2. Right now, though, devices in different VLANs are completely isolated from each other.

To let departments communicate, you need Layer 3 routing between VLANs. You will configure SVIs (Switch Virtual Interfaces) on HQ-Core-SW to act as default gateways. You will also set up DHCP pools so PCs receive their IP addresses automatically.

In this step, get ready to:
  • Enable inter-VLAN routing using SVIs on HQ-Core-SW.
  • Configure DHCP pools for automatic IP assignment to all departments.
  • Verify connectivity between VLANs and confirm DHCP leases.
Enable Layer 3 routing and create SVIs

The Catalyst 3650 is a multilayer switch, meaning it can route traffic between VLANs without needing an external router. You enable this with the ip routing command, then create an SVI for each VLAN to serve as that VLAN's default gateway.

  • Click on HQ-Core-SW in the workspace to open its configuration window.
  • Click the CLI tab.
  • Enter privileged exec mode and then global configuration mode by running these commands:
enable
configure terminal
  • Enable Layer 3 routing and create SVI interfaces for each VLAN by entering these commands:
! Enable Layer 3 routing on the multilayer switch
ip routing

! Create SVI for VLAN 10 (IT department gateway)
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown
exit

! Create SVI for VLAN 20 (HR department gateway)
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown
exit

! Create SVI for VLAN 30 (Finance department gateway)
interface vlan 30
ip address 192.168.30.1 255.255.255.0
no shutdown
exit

What does this configuration do?

ip routing activates the switch's routing engine so it can forward packets between VLANs at Layer 3.

Each SVI acts as the default gateway for its VLAN. When a PC in VLAN 10 wants to reach VLAN 20, it sends the packet to 192.168.10.1 (its gateway), and the switch routes it to the VLAN 20 subnet.

Why SVIs instead of router-on-a-stick?

Router-on-a-stick funnels all inter-VLAN traffic through a single physical router interface, creating a bottleneck. SVIs on a multilayer switch route traffic internally at wire speed.

This is the approach real enterprises use. It is also the modern design pattern the CCNA exam expects you to understand.

  • Verify your SVIs are up by running:
do show ip interface brief

You should see VLAN 10, VLAN 20, and VLAN 30 listed with their IP addresses and a status of up/up.

Seeing down/down on your SVIs?

An SVI stays down unless at least one access or trunk port in that VLAN is active. Make sure your trunk between HQ-Core-SW and HQ-Access-SW is up and allowing VLANs 10, 20, and 30.

Also check that you typed no shutdown on each SVI interface. Help me troubleshoot my SVIs showing down/down

Configure DHCP pools for each VLAN

Instead of manually assigning IP addresses to every PC, you will create DHCP pools on HQ-Core-SW. Each pool hands out addresses from the correct subnet along with the gateway and DNS information.

  • First, exclude the addresses you do not want DHCP to hand out (gateways and the server's static IP) by entering these commands:
! Exclude gateway IPs and the server's static IP from DHCP pools
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.20.1
ip dhcp excluded-address 192.168.30.1
ip dhcp excluded-address 192.168.10.100

Why exclude addresses?

Without exclusions, DHCP could assign the gateway IP (192.168.10.1) to a PC, causing an IP conflict. The server at 192.168.10.100 also needs a fixed address so other devices can reliably reach it.

  • Create the DHCP pool for the IT department (VLAN 10) by entering:
! DHCP pool for IT department (VLAN 10)
ip dhcp pool IT-POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 192.168.10.100
exit
  • Create the DHCP pool for HR (VLAN 20) by entering:
! DHCP pool for HR department (VLAN 20)
ip dhcp pool HR-POOL
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
exit
  • Create the DHCP pool for Finance (VLAN 30) by entering:
! DHCP pool for Finance department (VLAN 30)
ip dhcp pool FINANCE-POOL
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1
exit

What do these pool settings mean?

  • network defines the subnet range that DHCP draws addresses from.
  • default-router tells the PC which gateway to use (the SVI IP you just configured).
  • dns-server points PCs to the DNS server for name resolution. Only IT-POOL gets this since the server lives in VLAN 10.
  • Save your configuration by running:
end
write memory

Seeing an invalid input error?

Make sure you are in global configuration mode when entering the ip dhcp pool commands. If you see Switch(config)# in the prompt, you are in the right place. If you see Switch#, type configure terminal first. Help me fix my DHCP pool configuration error

Set PCs to DHCP and verify inter-VLAN routing

Now you need to tell each PC to request an IP address from DHCP. Then you will test that packets can travel between VLANs.

  • Click on the first PC in VLAN 10 (an IT PC) in the workspace.
  • Click the Desktop tab.
  • Click IP Configuration.
  • Select the DHCP radio button.

After a moment, the PC should populate with an IP address in the 192.168.10.0/24 range and show 192.168.10.1 as the default gateway.

  • Repeat this process for all 6 HQ PCs. Set each one to DHCP mode.

Quick way to check VLAN assignment

Each PC should get an address matching its VLAN. VLAN 10 PCs get 192.168.10.x, VLAN 20 PCs get 192.168.20.x, and VLAN 30 PCs get 192.168.30.x. If a PC gets a 169.254.x.x address, DHCP failed to reach it.

  • Now test inter-VLAN routing. Click on a VLAN 10 PC (IT department).
  • Click the Desktop tab, then click Command Prompt.
  • Ping a PC in VLAN 20 by running:
ping 192.168.20.2

You should see successful replies. The first one or two pings may time out while ARP resolves. This is normal.

  • Verify DHCP leases on HQ-Core-SW. Go back to the HQ-Core-SW CLI and run:
show ip dhcp binding

You should see a list of all 6 leased IP addresses with their corresponding MAC addresses.

Ping failing between VLANs?

Confirm that ip routing is enabled on HQ-Core-SW by running show ip route. You should see connected routes for all three subnets. If routes are missing, re-enter ip routing in global config mode.

Also verify the PC's default gateway matches its VLAN's SVI address. Help me troubleshoot inter-VLAN routing failures in Packet Tracer

✔️ Awesome, I've got everything!

Great. Make sure you have saved your Packet Tracer file before moving on.

ⓧ I'd like to double check the full config

Here is the complete HQ-Core-SW configuration up to this point:

! === HQ-Core-SW Full Configuration (End of Step 3) ===

! VLANs
vlan 10
name IT
vlan 20
name HR
vlan 30
name Finance
vlan 99
name native

! Trunk to HQ-Access-SW
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,30
switchport trunk native vlan 99

! Enable Layer 3 routing
ip routing

! SVI for VLAN 10 (IT gateway)
interface vlan 10
ip address 192.168.10.1 255.255.255.0
no shutdown

! SVI for VLAN 20 (HR gateway)
interface vlan 20
ip address 192.168.20.1 255.255.255.0
no shutdown

! SVI for VLAN 30 (Finance gateway)
interface vlan 30
ip address 192.168.30.1 255.255.255.0
no shutdown

! DHCP exclusions
ip dhcp excluded-address 192.168.10.1
ip dhcp excluded-address 192.168.20.1
ip dhcp excluded-address 192.168.30.1
ip dhcp excluded-address 192.168.10.100

! DHCP pool for IT (VLAN 10)
ip dhcp pool IT-POOL
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 192.168.10.100

! DHCP pool for HR (VLAN 20)
ip dhcp pool HR-POOL
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1

! DHCP pool for Finance (VLAN 30)
ip dhcp pool FINANCE-POOL
network 192.168.30.0 255.255.255.0
default-router 192.168.30.1

Your headquarters network is fully operational. Departments can talk to each other through the multilayer switch, and PCs get their addresses automatically. Next up, you will extend this network to the branch office by configuring the WAN link and OSPF routing.

Configure WAN Link and OSPF Routing

Your headquarters network is running smoothly with VLANs, inter-VLAN routing, and DHCP all working together. Now it is time to connect HQ to the branch office over a WAN link.

In this step, you will configure the serial WAN connection between routers, set up OSPF dynamic routing so both sites automatically discover each other's networks, and bring the branch LAN online with its own DHCP pool.

In this step, get ready to:
  • Configure the WAN serial link and the routed connection between HQ-Core-SW and HQ-Router.
  • Enable OSPF Area 0 on all three Layer 3 devices so routes are learned dynamically.
  • Bring the branch LAN online with DHCP and verify end-to-end connectivity from HQ to Branch.
Configure the WAN serial link between HQ-Router and Branch-Router

A serial link simulates a dedicated WAN connection between two sites. One side acts as the DCE (provides the clock signal) and the other as the DTE (receives the clock).

  • Click on HQ-Router in your Packet Tracer workspace.
  • Go to the CLI tab.
  • Configure both the serial WAN interface and the Gigabit Ethernet link to HQ-Core-SW by entering these commands:
enable
configure terminal

! Configure the serial WAN link (DCE side - provides clock)
interface Serial0/1/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 128000
 no shutdown
 exit

! Configure the link to HQ-Core-SW
interface GigabitEthernet0/0/0
 ip address 10.0.0.6 255.255.255.252
 no shutdown
 exit

end

What do these commands do?

The /30 subnet mask (255.255.255.252) creates a point-to-point link with only two usable IP addresses. This is standard practice for WAN links because you only need one IP per router end.

The clock rate 128000 command is required on the DCE side of a serial link. It sets the speed of the connection. The DTE side (Branch-Router) does not need a clock rate because it receives the clock signal from the DCE.

  • Now click on Branch-Router in your workspace.
  • Go to the CLI tab.
  • Configure the serial interface on the DTE side by entering these commands:
enable
configure terminal

! Configure the serial WAN link (DTE side - receives clock)
interface Serial0/1/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown
 exit

end

What does this configure?

Branch-Router is the DTE end of the serial connection. It only needs an IP address and no shutdown to bring the interface up. The clock signal comes from HQ-Router on the other end.

  • Now click on HQ-Core-SW in your workspace.
  • Go to the CLI tab.
  • Convert Gig0/2 from a switch port to a routed port and assign its IP by entering these commands:
enable
configure terminal

! Convert to routed port and assign IP for link to HQ-Router
interface GigabitEthernet0/2
 no switchport
 ip address 10.0.0.5 255.255.255.252
 no shutdown
 exit

end

Why use no switchport?

The Catalyst 3650 is a multilayer switch. By default, all its ports operate as Layer 2 switch ports. The no switchport command converts a port into a Layer 3 routed interface so you can assign an IP address to it directly.

  • Verify the WAN link is up by pinging from HQ-Router to Branch-Router. On HQ-Router's CLI, run:
ping 10.0.0.2

You should see successful replies confirming the serial link between the two routers is active.

  • Also verify the link between HQ-Router and HQ-Core-SW. On HQ-Router's CLI, run:
ping 10.0.0.5

You should see successful replies from HQ-Core-SW's routed port.

Serial interface showing down/down?

If Serial0/1/0 does not appear in your router's interface list, the serial module was not installed during Step 1. Click on the router, go to the Physical tab, power off the router, drag the HWIC-2T or NIM-2T module (whichever is available for your router model) into an empty slot, then power it back on.

If the interface exists but shows down/down, check that you entered no shutdown on both ends. Also verify the serial cable is connected between Se0/1/0 on both routers.

Still stuck? Help me troubleshoot my serial WAN link between HQ-Router and Branch-Router in Packet Tracer.

Enable OSPF on all three Layer 3 devices

OSPF is a dynamic routing protocol that allows routers to automatically share their connected networks with each other. Instead of manually typing static routes, OSPF builds a complete map of the network topology.

Why OSPF instead of static routes?

Static routes work for small networks, but they do not scale. If a link goes down, static routes keep trying to use it. OSPF detects failures and recalculates paths automatically.

OSPF is also the only dynamic routing protocol tested on the CCNA 200-301 exam (single-area OSPFv2). Learning it here gives you direct exam preparation.

  • On HQ-Core-SW's CLI, enable OSPF and advertise all HQ networks by entering these commands:
configure terminal

router ospf 1
 router-id 1.1.1.1
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 10.0.0.4 0.0.0.3 area 0
 exit

end

What does this OSPF configuration do?

The router-id 1.1.1.1 gives this device a unique identity in the OSPF domain. Each router needs a different router ID.

Each network statement tells OSPF which interfaces to activate on. The wildcard mask 0.0.0.255 matches any host in a /24 subnet. The 0.0.0.3 wildcard matches the two hosts in a /30 link. All networks are placed in Area 0, the backbone area.

  • On HQ-Router's CLI, enable OSPF and advertise both connected point-to-point links:
configure terminal

router ospf 1
 router-id 2.2.2.2
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.0.4 0.0.0.3 area 0
 exit

end

What does HQ-Router advertise?

HQ-Router sits between the WAN serial link (10.0.0.0/30) and the internal link to HQ-Core-SW (10.0.0.4/30). It advertises both links so OSPF can build a path from the branch all the way into HQ's core.

  • On Branch-Router's CLI, enable OSPF and advertise the WAN link and the branch LAN network:
configure terminal

router ospf 1
 router-id 3.3.3.3
 network 192.168.40.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.3 area 0
 exit

end

What does Branch-Router advertise?

Branch-Router advertises its local LAN (192.168.40.0/24) and the WAN link (10.0.0.0/30). This allows HQ devices to learn how to reach the branch network through OSPF.

  • Verify OSPF adjacencies have formed. On HQ-Router's CLI, run:
show ip ospf neighbor

You should see two neighbors listed: HQ-Core-SW (router-id 1.1.1.1) and Branch-Router (router-id 3.3.3.3) both in FULL state.

No OSPF neighbors appearing?

OSPF neighbors will not form if the interfaces between them are down. Run show ip interface brief on each device and confirm all configured interfaces show up/up status.

Also check that the network statements use wildcard masks, not subnet masks. A common mistake is typing 255.255.255.0 instead of 0.0.0.255.

Need more help? Help me debug why my OSPF neighbors are not forming between my routers.

Configure the branch LAN and verify end-to-end connectivity

The branch office needs its own LAN interface and DHCP pool so branch PCs can get IP addresses automatically, just like the HQ PCs.

  • On Branch-Router's CLI, configure the LAN interface and create a DHCP pool by entering these commands:
configure terminal

! Configure the LAN interface facing Branch-SW
interface GigabitEthernet0/0/0
 ip address 192.168.40.1 255.255.255.0
 no shutdown
 exit

! Exclude the gateway from the DHCP pool
ip dhcp excluded-address 192.168.40.1

! Create DHCP pool for branch PCs
ip dhcp pool BRANCH-POOL
 network 192.168.40.0 255.255.255.0
 default-router 192.168.40.1
 exit

end

What does this configuration do?

The ip dhcp excluded-address command prevents the router from handing out its own gateway IP (192.168.40.1) to a PC. Without this exclusion, a PC could receive the gateway address and cause an IP conflict.

The DHCP pool BRANCH-POOL assigns IPs from the 192.168.40.0/24 range and tells clients to use 192.168.40.1 as their default gateway.

  • Click on each branch PC (the two PCs connected to Branch-SW).
  • Go to the Desktop tab, then open IP Configuration.
  • Select DHCP to have each PC request an address from Branch-Router's pool.

Each branch PC should receive an IP in the 192.168.40.x range with a default gateway of 192.168.40.1.

  • Now run the ultimate connectivity test. On a branch PC, go to the Desktop tab and open Command Prompt.
  • Ping an HQ PC in VLAN 10 by running:
ping 192.168.10.2

You should see successful replies. This confirms that OSPF has shared routes between all three devices and traffic flows from the branch, across the WAN serial link, through HQ-Router, to HQ-Core-SW, and into VLAN 10.

  • For a complete view of all learned routes, run this on HQ-Router's CLI:
show ip route

You should see routes marked with O (OSPF-learned) for 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24, and 192.168.40.0/24.

Ping from branch to HQ fails?

Run show ip route on Branch-Router. If you do not see the 192.168.10.0/24 route, OSPF has not propagated it yet. Wait 30 seconds for OSPF to converge and try again.

If routes exist but pings still fail, check that HQ-Core-SW has a route back to 192.168.40.0/24. Run show ip route on HQ-Core-SW and look for the branch network.

Still no luck? Help me troubleshoot end-to-end connectivity between my branch and HQ networks.

✔️ Awesome, I've got everything!

Great. Make sure your ping from branch to HQ succeeded before moving on.

ⓧ I'd like to double check the full configuration

Here is the complete configuration for each device at the end of this step.

HQ-Router:

interface GigabitEthernet0/0/0
 ip address 10.0.0.6 255.255.255.252
 no shutdown

interface Serial0/1/0
 ip address 10.0.0.1 255.255.255.252
 clock rate 128000
 no shutdown

router ospf 1
 router-id 2.2.2.2
 network 10.0.0.0 0.0.0.3 area 0
 network 10.0.0.4 0.0.0.3 area 0

Branch-Router:

interface Serial0/1/0
 ip address 10.0.0.2 255.255.255.252
 no shutdown

interface GigabitEthernet0/0/0
 ip address 192.168.40.1 255.255.255.0
 no shutdown

ip dhcp excluded-address 192.168.40.1

ip dhcp pool BRANCH-POOL
 network 192.168.40.0 255.255.255.0
 default-router 192.168.40.1

router ospf 1
 router-id 3.3.3.3
 network 192.168.40.0 0.0.0.255 area 0
 network 10.0.0.0 0.0.0.3 area 0

HQ-Core-SW (new additions this step):

interface GigabitEthernet0/2
 no switchport
 ip address 10.0.0.5 255.255.255.252
 no shutdown

router ospf 1
 router-id 1.1.1.1
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 10.0.0.4 0.0.0.3 area 0

Your multi-site network is now fully connected with dynamic routing. Next up, you will secure this network with NAT for internet access, ACLs for traffic control, and SSH for remote management.

Configure NAT and Security

Your network can route traffic between every site and every VLAN. But right now, any device in any department can reach any other device without restriction.

In a real enterprise, the edge router translates internal IPs for internet access using NAT. Security policies control which departments can talk to each other using ACLs. And management access is locked down with SSH instead of insecure Telnet. In this step, you will configure all three.

In this step, get ready to:
  • Configure PAT (NAT overload) on HQ-Router for internet access simulation.
  • Create an ACL that blocks HR from accessing Finance while permitting all other traffic.
  • Harden the network with port security and SSH remote management.
Configure PAT (NAT overload) on HQ-Router

PAT (Port Address Translation) allows all internal devices to share a single public IP address for internet access. You configure it on the edge router because that is where internal traffic exits toward the internet.

  • Click on HQ-Router in the workspace.
  • Go to the CLI tab.
  • Enter global configuration mode and create an access list that identifies all internal networks by entering these commands:
enable
configure terminal
! Create an ACL matching all internal subnets for NAT
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.20.0 0.0.0.255
access-list 1 permit 192.168.30.0 0.0.0.255
access-list 1 permit 192.168.40.0 0.0.0.255

What does this ACL do?

This standard ACL (number 1) does not filter traffic on its own. It identifies which source networks are eligible for NAT translation. The wildcard mask 0.0.0.255 matches all hosts in each /24 subnet.

  • Now apply NAT to the interfaces and enable PAT by entering these commands:
! Define inside NAT interface (toward HQ-Core-SW)
interface GigabitEthernet0/0/0
ip nat inside
exit
! Define outside NAT interface (toward WAN/Internet)
interface Serial0/1/0
ip nat outside
exit
! Enable PAT using the outside interface's IP
ip nat inside source list 1 interface Serial0/1/0 overload
end

What does this configuration do?

The ip nat inside command marks Gig0/0/0 as the internal-facing interface. ip nat outside marks Se0/1/0 as the external-facing interface.

The overload keyword is what makes this PAT. It allows multiple internal devices to share the single IP address on Se0/1/0 by using different port numbers to distinguish each session.

  • Verify your NAT configuration by running:
show ip nat statistics

You should see Gig0/0/0 listed as an inside interface and Se0/1/0 listed as an outside interface. The total active translations may show 0 since no traffic has been translated yet.

Not seeing inside/outside interfaces listed?

Make sure you ran ip nat inside and ip nat outside from within each interface's configuration mode, not from global config. Re-enter the interface with interface GigabitEthernet0/0/0 and check with show running-config | section interface.

Help me troubleshoot my NAT configuration on HQ-Router

Why can't we fully test NAT in Packet Tracer?

Without a real internet connection in the simulation, NAT translations will not populate. The configuration itself is correct and demonstrates your understanding. You can verify it was applied correctly with show ip nat translations after generating traffic across the NAT boundary.

Create an ACL to restrict inter-department traffic

Enterprise networks rarely allow unrestricted access between departments. A common security policy is blocking HR from directly accessing Finance servers while allowing IT full access for administration.

  • Click on HQ-Core-SW in the workspace.
  • Go to the CLI tab.
  • Enter global configuration mode and create an extended ACL that blocks HR traffic destined for the Finance network by entering these commands:
enable
configure terminal
! Block HR (VLAN 20) from reaching Finance (VLAN 30)
access-list 100 deny ip 192.168.20.0 0.0.0.255 192.168.30.0 0.0.0.255
! Allow all other traffic
access-list 100 permit ip any any

What does this ACL do?

Extended ACL 100 uses two rules. The first line denies any IP traffic from the 192.168.20.0/24 (HR) subnet going to the 192.168.30.0/24 (Finance) subnet.

The second line permits everything else. Without this explicit permit, the implicit deny any any at the end of every ACL would block all traffic.

  • Apply the ACL inbound on the VLAN 30 SVI (Finance gateway) by entering these commands:
! Apply ACL inbound on VLAN 30 interface
interface vlan 30
ip access-group 100 in
exit
end

Why apply the ACL inbound on VLAN 30?

Applying the ACL inbound on the VLAN 30 SVI means it checks traffic entering that interface from the Finance subnet. Since the deny rule targets HR source addresses going to Finance destinations, this placement filters the traffic at the gateway before it reaches Finance devices.

  • Verify the ACL is applied by running:
show access-lists

You should see Extended IP access list 100 with the deny and permit entries listed.

  • Test the ACL by opening a command prompt on an HR PC (any PC in VLAN 20).
  • Ping a Finance PC's IP address (any address in the 192.168.30.x range). The ping should fail with "Request timed out" or "Destination host unreachable".
  • Now open a command prompt on an IT PC (any PC in VLAN 10).
  • Ping the same Finance PC's IP address. This ping should succeed with replies.

This confirms the ACL is correctly blocking HR from Finance while allowing IT full access.

HR ping still succeeding to Finance?

Check that the ACL is applied to the correct interface. Run show running-config | section interface Vlan30 and confirm you see ip access-group 100 in. Also verify the HR PC is actually in VLAN 20 by checking its IP address starts with 192.168.20.

Help me troubleshoot my ACL not blocking HR from Finance

Configure port security and SSH

Physical security matters too. Port security limits which devices can connect to each switch port. SSH encrypts management traffic so passwords are not sent in plain text across the network.

  • Click on HQ-Access-SW in the workspace.
  • Go to the CLI tab.
  • Configure port security on all access ports (Fa0/1 through Fa0/6) by entering these commands:
enable
configure terminal
! Apply port security to all access ports
interface range FastEthernet0/1-6
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
exit
end

What does port security do here?

Each access port now allows a maximum of 2 MAC addresses. If a third device connects (or someone plugs in a rogue switch), the port shuts down automatically. This prevents unauthorized devices from joining the network.

  • Verify port security is active by running:
show port-security interface FastEthernet0/1

You should see Port Security enabled, Maximum MAC Addresses set to 2, and Violation Mode set to Shutdown.

Seeing 'Command rejected' on port security?

Port security only works on access ports. If any port in the range is still set to dynamic or trunk mode, the command will fail. Make sure all ports in the range are configured with switchport mode access before enabling port security. Check with show interface FastEthernet0/1 switchport.

Help me fix port security command rejected on my access switch

Now configure SSH on HQ-Core-SW so you can manage it remotely without sending passwords in clear text.

  • Click on HQ-Core-SW in the workspace.
  • Go to the CLI tab.
  • Configure the hostname, domain name, RSA keys, and a local user account by entering these commands:
enable
configure terminal
! Set hostname (required for RSA key generation)
hostname HQ-Core-SW
! Set domain name (required for RSA key generation)
ip domain-name nextwork.local
! Generate RSA encryption keys for SSH
crypto key generate rsa
! When prompted for key size, enter 1024
! Create a local user account for SSH login
username admin secret cisco123
! Configure VTY lines for SSH-only access
line vty 0 15
transport input ssh
login local
exit
end

What does each SSH command do?

  • The hostname and domain name are required before generating RSA keys. Without them, the switch cannot create the key pair.
  • RSA keys (1024 bits) provide the encryption that makes SSH secure.
  • The local user account (admin/cisco123) authenticates SSH sessions.
  • The transport input ssh command blocks Telnet on the VTY lines, allowing only encrypted SSH connections.

RSA key size prompt

When you run crypto key generate rsa, Packet Tracer will ask "How many bits in the modulus [512]:" and you need to type 1024 and press Enter. A key size of 1024 or higher is required for SSH version 2.

  • Test SSH access from any PC in the workspace.
  • Click on an IT PC (in VLAN 10) and go to the Desktop tab.
  • Open Command Prompt.
  • Connect to HQ-Core-SW via SSH by entering this command:
ssh -l admin 192.168.10.1
  • When prompted for the password, type cisco123 and press Enter.

You should see the HQ-Core-SW command prompt appear, confirming SSH access is working. You are now remotely managing the switch over an encrypted connection.

SSH connection refused or timed out?

Verify the RSA keys were generated by running show crypto key mypubkey rsa on HQ-Core-SW. If no keys appear, re-run the crypto key generate rsa command and enter 1024 for the modulus size.

Also confirm the PC has an IP address in the 192.168.10.x range and that the SVI for VLAN 10 (192.168.10.1) is reachable with a ping first.

Help me troubleshoot SSH not connecting to my switch

Your network is now secured with NAT for internet access, ACLs for department isolation, port security against rogue devices, and SSH for encrypted management. Next up, you will verify the entire network end-to-end and document it for your portfolio.

Verify and Document the Complete Network

You have built a complete multi-site enterprise network with VLANs, inter-VLAN routing, OSPF, NAT, and security hardening.

Now it is time to prove that everything works together as a unified system. In this step, you will run a full connectivity test, visually trace packets through the network, and document your design so the project is portfolio-ready.

In this step, get ready to:
  • Run a connectivity test matrix across all VLANs and sites.
  • Trace a packet visually using Simulation Mode.
  • Save and document your network project.
Run a full connectivity test matrix

A connectivity test matrix systematically verifies every communication path in your network. This confirms that your routing, VLANs, DHCP, and ACLs are all working together correctly.

You will test each path individually so you can pinpoint exactly where a problem lies if something fails.

  • Click on one of your VLAN 10 (IT) PCs.
  • Go to the Desktop tab, then open Command Prompt.
  • Verify the PC received an IP address from DHCP by running:
ipconfig

You should see an IP address in the 192.168.10.0/24 range with a default gateway of 192.168.10.1.

  • Test inter-VLAN routing by pinging a VLAN 20 (HR) PC from the VLAN 10 PC:
ping 192.168.20.2

This ping should succeed, confirming inter-VLAN routing is working via the SVIs on HQ-Core-SW.

  • Test the ACL by pinging a VLAN 30 (Finance) PC from a VLAN 20 (HR) PC:
ping 192.168.30.2

This ping should fail (Request timed out or Destination host unreachable). Your ACL is correctly blocking HR from reaching Finance.

  • Test cross-site connectivity by pinging a Branch PC from any HQ PC:
ping 192.168.40.2

This ping should succeed. It proves that OSPF routing is carrying traffic across the WAN link between HQ and Branch.

  • Verify DHCP assignments on HQ-Core-SW by clicking the switch, going to the CLI tab, and running:
show ip dhcp binding

You should see entries for each PC that received an address via DHCP.

  • Verify OSPF routes are complete on HQ-Router by running:
show ip route

What should I see in the routing table?

You should see routes marked with O (OSPF-learned) for all remote networks. On HQ-Router, look for OSPF routes to 192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24, and 192.168.40.0/24.

Connected routes (marked with C) show networks directly attached to the router's interfaces. The combination of C and O routes means your network has full reachability.

  • Also check OSPF adjacency on HQ-Router by running:
show ip ospf neighbor

You should see neighbor entries for both HQ-Core-SW and Branch-Router with a state of FULL.

Pings failing between HQ and Branch?

Run show ip ospf neighbor on both routers. If you do not see FULL state neighbors, check that your OSPF network statements include the correct wildcard masks and area 0.

Also verify that both serial interfaces show up/up with show ip interface brief. A down interface means the cable or no shutdown command is missing.

Help me troubleshoot why my OSPF neighbors are not forming between HQ and Branch routers

Trace a packet through the network using Simulation Mode

Packet Tracer's Simulation Mode lets you watch a packet travel hop-by-hop through your network. This is a powerful way to visually confirm that routing decisions are correct and that traffic follows the expected path.

  • Switch from Realtime to Simulation mode by clicking the Simulation tab in the bottom-right corner of the Packet Tracer workspace.
  • Click the Add Simple PDU tool (the closed envelope icon) in the right-side toolbar.
  • Click on a Branch PC as the source device.
  • Click on a VLAN 10 (IT) PC in HQ as the destination device.
  • Click Capture / Forward repeatedly to advance the packet one hop at a time.

What am I watching for?

Watch the packet travel from the Branch PC to Branch-Router, across the serial WAN link to HQ-Router, then to HQ-Core-SW, and finally to the destination PC. Each hop confirms that OSPF routes are correctly directing traffic.

You can click on the envelope at any hop to see Layer 2 and Layer 3 header details. This shows MAC addresses changing at each hop while the IP addresses stay the same.

  • Confirm the packet arrives at the HQ IT PC with a green checkmark.
  • Click Reset Simulation when you are done reviewing the trace.
  • Switch back to Realtime mode by clicking the Realtime tab in the bottom-right corner.

Great for screenshots

The Simulation Mode view with a packet mid-transit makes an excellent portfolio screenshot. It shows you understand how traffic flows through a multi-hop enterprise network.

Packet showing a red X at a hop?

A red X means the packet was dropped at that device. Check the device's routing table with show ip route to see if it has a route to the destination network. A missing route usually means an OSPF network statement is incomplete.

Help me figure out why my packet is being dropped in Simulation Mode

Save and document your network project

A well-documented network file is what separates a learning exercise from a portfolio piece. Adding notes directly to your topology means anyone who opens the file can immediately understand your design decisions.

  • Save your project by pressing Ctrl+S (or File > Save As).
  • Name the file something descriptive like Enterprise-Network-HQ-Branch.pkt and save it to your Desktop.

Now add documentation notes directly onto your topology workspace.

  • Click the Place Note tool in the top toolbar (it looks like a small "i" information icon, located near the drawing tools).
  • Click on an open area near your HQ devices to place a note.
  • Type your IP addressing scheme into the note. Include VLAN 10 (192.168.10.0/24), VLAN 20 (192.168.20.0/24), VLAN 30 (192.168.30.0/24), and the WAN link (10.0.0.0/30).
  • Place a second note near the HQ switches documenting the VLAN assignments: VLAN 10 = IT, VLAN 20 = HR, VLAN 30 = Finance, VLAN 99 = Native (unused).
  • Place a third note near HQ-Router documenting key design decisions: SVI-based inter-VLAN routing, OSPF Area 0 for WAN, PAT for internet access, ACL blocking HR-to-Finance traffic.

Why document inside the .pkt file?

When you share this file with a hiring manager or instructor, they can see your design rationale without needing a separate document. It shows you think about networks at the architectural level, not just the command level.

  • Press Ctrl+S again to save the file with your documentation notes included.
  • Verify the notes are visible by zooming out slightly to see your full topology with annotations.

Can't find the Place Note tool?

Look in the top toolbar row, in the same area as the drawing and shape tools. It may appear as a small rectangular note icon or an "i" icon. You can also try the shortcut by navigating to Place in the top menu bar.

Help me find the Place Note tool in Packet Tracer

Secret mission

Add Redundancy with EtherChannel and HSRP

Your enterprise network works, but what happens if a single link or switch fails? In real networks, redundancy is non-negotiable. In this secret mission, you'll bundle multiple links into an EtherChannel using LACP and configure HSRP for gateway failover across your core switches.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely inside Cisco Packet Tracer on your local machine, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your project file as-is, back it up for later, or delete it entirely.

Resources you used:

  • Packet Tracer .pkt project file saved on your computer.
  • Network devices configured in the simulation (HQ-Core-SW, HQ-Access-SW, HQ-Router, Branch-Router, Branch-SW).
  • PCs and server with DHCP-assigned IP addresses.
  • Configurations applied: VLANs, OSPF, NAT, ACLs, DHCP pools, port security, and SSH.

Keep everything running

No action needed. Choose this if you plan to continue building on the network or use it as a reference for future projects.

  • Your .pkt file stays where you saved it.
  • You can reopen it anytime in Packet Tracer to review configurations or extend the topology.
  • Consider saving a backup copy to a USB drive or cloud storage for safekeeping.

Pause - I'll come back to this later

Back up your project file so you can free up desktop clutter while keeping your work safe.

  • Save and close Packet Tracer to free up system memory.
  • Move your .pkt file to a dedicated folder (e.g., Documents/PacketTracer-Projects) so it is easy to find later.
  • Optionally, upload the file to Google Drive, OneDrive, or another cloud service as a backup.

Delete - I don't want to use this again

Remove all project files from your computer to start fresh.

  • Close Packet Tracer.
  • Navigate to the folder where you saved your .pkt file.
  • Delete the .pkt file.
  • Empty your Recycle Bin (Windows) or Trash (macOS) to fully remove it.

Nice Work!

Nice Work!

Nice work! You just built a complete multi-site enterprise network from scratch in Cisco Packet Tracer.

You've learned how to:

  • Designed a VLSM IP addressing scheme and implemented VLAN segmentation with Layer 3 inter-VLAN routing using SVIs on a multilayer switch.
  • Connected a headquarters and branch office over a WAN link using OSPF single-area routing, with DHCP for automatic IP assignment and NAT (PAT) for internet access.
  • Hardened the network with ACLs for inter-department access control, port security on access ports, and SSH for secure remote management.
  • Secret Mission: Added EtherChannel (LACP) link redundancy and HSRP gateway failover for high availability.

Ready to quiz yourself?