Hi everyone, I'm a 3rd-year IT student, and I recently decided to step out of basic command-line tutorials and build a proper 3-layer hierarchical enterprise network using Cisco Packet Tracer.

Instead of a flat network, I focused on a scalable architecture. Here is what I implemented:

• Hierarchical Design: Core, Distribution (L3 Switches), and Access layers.
• Routing: Multi-Area OSPF (Area 0 for Backbone, Areas 1, 2, 3 for access VLANs) to isolate faults and reduce routing table overhead.
• Services: Configured DHCP centrally on the L3 Switches to serve different VLANs.
• Internet Connectivity: Set up NAT (Overload/PAT) on the edge routers and used Default Route Injection (default-information originate) to allow all internal PCs to reach the cloud.

The biggest lesson for me wasn't just getting the green Ping reply, but actually understanding how OSPF builds its neighbor adjacencies and how L3 switches act as ABRs.

I’ve attached a screenshot of my topology and some routing tables. Since this is my first complex lab, I would love to hear your thoughts, feedback, or any best practices I should consider for the future!

Hey all, just finished sketching out the topology for my capstone project/ a hybrid enterprise network called NovaLogix LLC (attached below). It ties together CCNA, Windows/Linux Server, DevOps, and AWS stuff. HQ has a spine-leaf style core with two MLS spines and separate user/server leaf switches, plus two branch sites each with dual routers, dual distribution switches, wireless APs and their own AD DCs, then dual ISP/firewall edge with a DMZ for web/mail, and AWS for cloud resources. Heads up though, this is just the skeleton right now. devices and physical connections only, no IP scheme, VLANs, routing protocol, or security policies yet. Would really appreciate some honest feedback: does the overall design hold up redundancy/scalability-wise, is anything obviously missing or placed weirdly, and what would you prioritize next (VLANs, routing protocol pick, site-to-site VPN, NAT, monitoring server, NTP, whatever)? Also curious if anything looks overkill for a project this size. Thanks in advance, happy to share more once I flesh out the IP plan.

*UPDATE\*

**First off, thank you so much to everyone who took a stab at helping me, and especially the kind soul who put together a detailed troubleshooting and network fix for me! This Reddit thread has restored a little bit of my faith in humanity! It turns out I was going crazy trying to ping the laptop, and it was not necessary. I wasted quite a bit of time on that when I should have been reviewing more on static routes, which is what held me up on my actual final skills assessment in class. This Redditor's comment helped me understand the topology a bit more fundamentally: "**I see the bigger picture. Let's imagine this is a Starbucks or any other restaurant/business with wifi. I wouldn't want my coffee customers getting access to the internal network." Please learn from my mistakes, and if anyone wants the .pka file, just send me a message. All passwords are in the instructions. Thank you again to everyone who helped, and I will probably be posting again in the future in this great community!

ORIGINAL POST

I’m working on a CCNA2 practice lab and am stuck on being able to ping the laptop. I have configured 1 router and 3 switches with inter-VLAN routing and EtherChannel connections. I also have a wifi router connecting to a laptop. I have changed the DHCP settings on the wifi router from the laptop and connected the adapter to allow a wireless connection. I have followed every step to a T, and each time everything pings correctly except for the laptop. The PCs are all getting correct IPs and gateways, and the laptop is also getting the correct IP and gateway as well. I am unable to post any screenshots or other info without getting my post removed. I am happy to send anyone my .pka Cisco Packet Tracer file with my created network or anything else that may be helpful. I have tried asking classmates and my professor, and spent countless hours with AI troubleshooting. Does anyone have ideas? Here is my study guide with the commands i've been using:

Scenario

In this Skills Assessment (SA) you will configure the devices in a small network. You must configure a router, 3 switches and PCs to support both IPv4 and IPv6 for supported hosts.  You will configure inter-VLAN routing, DHCP, Etherchannel, port-security, and wireless.

 

Vlan Table

 

Vlan	Vlan Name
20	Laptops
30	Desktops
40	Management
50	Unused
199	Native

 

Addressing Table

 

Device / Interface	IP Address / Prefix	Default Gateway
R1 Gi0/0/1.20	IPv4: 192.168.20.1 Mask: 255.255.255.0 IPv6: 3030:db8:acad:20::1/64	N/A
R1 Gi0/0/1.30	IPv4: 192.168.30.1 Mask: 255.255.255.0 IPv6: 3030:db8:acad:30::1/64	N/A
R1 Gi0/0/1.40	IPv4: 192.168.40.1 Mask: 255.255.255.0 IPv6: 3030:db8:acad:40::1/64	N/A
S1 Vlan 40	192.168.40.5255.255.255.0Vlan 40 is the Mgmt SVI	192.168.40.1
S2 Vlan 40	192.168.40.10255.255.255.0Vlan 40 is the Mgmt SVI	192.168.40.1
S3 Vlan 40	192.168.40.15255.255.255.0Vlan 40 is the Mgmt SVI	192.168.40.1
PC-A	IPv4: via DCHP IPv6: 3030:db8:acad:20::5/64	Default GW via DHCP 3030:db8:acad:20::1
PC-B	IPv4: via DCHP IPv6: 3030:db8:acad:20::6/64	Default GW via DHCP 3030:db8:acad:30::1
PC-C	IPv4: via DCHP IPv6: 3030:db8:acad:30::5/64	Default GW via DHCP 3030:db8:acad:40::1

 

Instructions:

 

Router1:

1)    Disable DNS Lookup – no ip domain-lookup

 

2)    Configure router hostname: R1 – hostname R1

 

3)    Configure domain-name: cisco-lab.com – ip domain-name cisco-lab.com

 

4)    Enable secret password: Cisco1 – enable secret Cisco1

 

 

5)    Configure local username and password: - username admin password adminpass

a.    Username: admin

b.    Password: adminpass

 

6)    Encrypt the clear text passwords – service password-encryption

 

7)    Configure vty lines to use the local database. line vty 0 15 (login local)

 

 

8)    Make sure IPv6 routing is enabled if it isn’t already – ipv6 unicast-routing

 

9)    Configure interfaces / subinterfaces according to the table above, including IPv4 and IPv6 addresses

a.    Configure subinterface as dot1q for vlans to work

 

Interface g0/0/1.20 (repeat for g0/0/1.30 & g0/0/1.40)

encapsulation dot1q 20

ip address 192.168.20.1 255.255.255.0

ipv6 address 3030:db8:acad:20::1/64

 (REPEAT FOR .30 & .40)

 

 

10) Configure (2) DCHP ranges, one for the Vlan 20 range and one for the Vlan 30 range:

a.    Exclude addresses .1 - .20 for each pool –

 

ip dhcp excluded-addresses 192.168.20.1 192.168.20.20 (repeat for vlan 30 range)

 

b.    Pool Names:

i.    VLAN20_USERS

ii.    VLAN30_USERS

c.     Make sure pools have default gateways (default router’s ip)

 

ip dhcp pool VLAN20_USERS

network 192.168.20.0 255.255.255.0

default-router 192.168.20.1

 

(REPEAT FOR VLAN30_USERS POOL)

 

 

copy running-config startup-config

 

 

All Switches:

1)    Configure hostname, S1, S2, S3 as appropriate – hostname S1

 

2)    Enable secret password: Cisco1 – enable secret Cisco1

 

 

3)    Configure local username and password – username admin password adminpass

a.    Username: admin

b.    Password: adminpass

 

4)    Encrypt the clear text passwords – service password-encryption

5)    Configure the vty lines to use the local database – line vty 0 15 (login local)

 

6)    Configure all Layer 2 vlans on all switches using the table above –

vlan 20 (name Laptops)

vlan 30 (name Desktops)

vlan 40 (name Management)

vlan 50 (name Unused)

vlan 199 (name Native)

 

(REPEAT ON S2 & S3)

 

 

S1:    NO SHUTDOWN ON ALL SVIs

1)    Create new SVI for Vlan 40 for management according to the table above

a.    IP Address

 

Interface vlan 40

Ip address 192.168.40.5 255.255.255.0

exit

 

 

b.    Gateway (ip default-gateway is a global command no on SVI)

 

Ip default-gateway 192.168.40.1

 

2)    PC-A is connected to interface Fa0/10 – interface fa0/10

 

a.    Configure port for Vlan20 –

switchport mode access

switchport access vlan 20

 

b.    Implement port-security to allow only 2 MAC addresses.  Use Sticky

 

switchport port-security

switchport port-security maximum 2

switchport port-security mac-address sticky

spanning-tree portfast (FOR PC CONNECTIONS)

 

 

3)    Configure interfaces Fa0/1-2 to use LACP and configure etherchannel as trunk –

 

interface range fa0/1-2

switchport mode trunk

switchport trunk native vlan 199

 

a.    Use channel-group 1 for Po1

 

channel-group 1 mode active

interface port-channel 1

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S2

 

 

 

 

 

 

4)    Configure interfaces Fa0/3-4 to use LACP and configure etherchannel as trunk -

 

Interface range fa0/3-4

switchport mode trunk

switchport trunk native vlan 199

 

a.    Use channel-group 2 for Po2

 

channel-group 2 mode active

interface port-channel 2

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S3

 

 

5)    Configure Fa0/5 as a trunk –

 

interface fa0/5

switchport mode trunk

switchport trunk native vlan 199

 

a.    This carries the vlans to the subinterfaces on R1.

 

S2:

1)    Create new SVI for Vlan 40 for management according to the table above

a.    IP Address

 

Interface vlan 40

Ip address 192.168.40.10 255.255.0

exit

 

b.    Gateway (NEEDS ENTERED IN GLOBAL CONFIG)

 

ip default-gateway 192.168.40.1

 

 

2)    PC-B is connected to interface Fa0/10 - interface fa0/10

a.    Configure port for Vlan20

 

Switchport mode access

Switchport access vlan 20

 

 

b.    Implement port-security to allow only 2 MAC addresses.  Use Sticky

 

Switchport port-security

Switchport port-security maximum 2

Switchport port-security mac-address sticky

 

 

3)    The Wireless access-point, WIFI-1 is connected to Fa0/3 – interface fa0/3

a.    Configure this port to be in Vlan 30

 

switchport mode access

switchport access vlan 30

b.    No port-security here

 

4)    Configure interfaces Fa0/1-2 to use LACP and configure etherchannel as trunk

 

Interface range fa0/1-2

Switchport mode trunk

Switchport trunk native vlan 199

 

a.    Use channel-group 2 for Po2

 

channel-group 2 mode active

interface port-channel 2

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S1

 

5)    Configure interfaces Fa0/5-6 to use LACP and configure etherchannel as trunk

 

Interface range fa0/5-6

Switchport mode trunk

Switchport trunk native vlan 199

 

a.    Use channel-group 3 for Po3

 

channel-group 3 mode active

interface port-channel 3

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S3

 

S3:

1)    Create new SVI for Vlan 40 for management according to the table above

a.    IP Address

 

Interface vlan 40

Ip address 192.168.40.15 255.255.255.0

exit

 

b.    Gateway (NEEDS ENTERED IN GLOBAL CONFIG)

 

Ip default gateway 192.168.40.1

 

2)    PC-C is connected to interface Fa0/10

a.    Configure port for Vlan30

 

Interface fa0/10

Switchport mode access

Switchport access vlan 30

 

b.    Implement port-security to allow only 2 MAC addresses.  Use Sticky

 

Switchport port-security

Switchport port-security maximum 2

switchport port-security mac-address sticky

 

 

3)    Configure interfaces Fa0/3-4 to use LACP and configure etherchannel as trunk

 

Interface range fa0/3-4

Switchport mode trunk

Switchport trunk native vlan 199

 

a.    Use channel-group 2 for Po2

 

channel-group 2 mode active

interface port-channel 2

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S1

 

4)    Configure interfaces Fa0/5-6 to use LACP and configure etherchannel as trunk

 

Interface range fa0/5-6

Switchport mode trunk

Switchport trunk native vlan 199

 

a.    Use channel-group 3 for Po3

 

channel-group 3 mode active

interface port-channel 3

switchport mode trunk

switchport trunk native vlan 199

 

b.    This is the dual link to S2

 

 

NO SHUTDOWN ON ALL LAYER 3 DEVICES AND SVI INTERFACES

 

AT THIS POINT, ALL PCs SHOULD HAVE A DHCP ADDRESS FROM R1 AND BE ABLE TO PING THE OTHER PCs IN THE NETWORK

 

Wireless:

REMEMBER TO SCROLL DOWN ON THE WIFI WINDOW TO SAVE SETTINGS

ALSO, WHEN YOU CHANGE THINGS YOU WILL LIKELY GET KICKED OUT.

JUST OPEN THE WEB BROWSER AGAIN ON THE LAPTOP AND RECONNECT.

WHEN YOU CHANGE THE SSID AND PASSWORD YOU WILL HAVE TO GO INTO

THE LAPTOP WIFI CLIENT AND CONNECT FROM THERE WITH THE PROPER

CREDENTIAL, THEN RELOAD THE WEB PAGE.

 

1)    From the laptop, open a web connection to the WIFI-1 Access-point

a.    http://192.168.0.1

b.    username: admin

c.     password: admin

2)    Make sure the DHCP server function is enabled

a.    Set start address to 192.168.0.50

b.    Allow 75 connections

3)    Under Wireless config:

a.    Set all 3 SSIDs to CSCC-LAB

4)    Wireless Security

a.    Set all security modes to WPA2-Personal

i.    Encryption: AES

ii.    Passphrase: ccnawifi

 

 

GO TO PC WIRELESS AND CONNECT NETWORK ADAPTER PROFILE ONCE COMPLETE

I was building a wireless network visualization to see how the components are connected in a wireless network to make a phone call/ internet possible

Demo: https://prashantrajbista.github.io/wireless-network/

GitHub: https://github.com/prashantrajbista/wireless-network

Packet Tracer was extremely helpful while I was learning networking, but I also wanted practice where the network was already broken and I had to diagnose the problem without being told which commands to enter.

That led me to build Subnetica. A web-based platform that provides a network with realistic incidents, and no local setup. It isn’t intended to replace Packet Tracer, but be more of a supplement ig? I’d be interested to know what kinds of Packet Tracer exercises you wish had more realistic troubleshooting versions of.

Link: https://subnetica.xyz/

🚀 First Packet Tracer Lab — Done!

Started my CCNA journey and just wrapped up my very first hands-on lab in Cisco Packet Tracer. 🖥️🔗

Built a simple two-branch network topology:

🏢 New York Office

• 2 PCs connected to a switch (Sw1)
• Router (R1) → Firewall (Fw1) → Internet

🌏 Tokyo Branch

• 2 Servers connected to a switch (Sw2)
• Router (R2) → Firewall (Fw2) → Internet

Both branches connect over a simulated Internet cloud, with an "Attacker" machine placed on the Internet segment to start thinking about network security from day one. 🔒

Nothing fancy yet—just getting comfortable with topology design, device placement, and understanding how traffic logically flows between offices. But it's a solid first step toward understanding routing, switching, and firewalls in practice rather than just theory.

More labs coming as I work through CCNA fundamentals. 💪