Lab 13: TechCorp NZ — Multi-Branch Company Network
This is the final capstone lab for Introduction to Networks. It brings together every major skill from Labs 1–12 into a single, realistic company network. Treat this as exam preparation — next week is the exam.
Not marked. No file submission required. Save your
.pkt file as you work. All switch and router configuration must be done via the CLI tab — the GUI Config tab is off-limits for network devices.Overview
| Part | Session | Mode | What you do | What you prove |
|---|---|---|---|---|
| 1 | 1 | Solo | Build Branch A topology — devices, cables, port plan. | All link lights green; server has a static IP. |
| 2 | 1 | Solo | Create VLANs 10/20/30/99 on SW-A and assign access ports via CLI. | show vlan brief shows correct VLAN-to-port mapping. |
| 3 | 1 | Solo | Configure trunk on SW-A and Router-on-a-Stick sub-interfaces on R1. | Inter-VLAN pings succeed; all sub-interfaces up/up. |
| 4 | 1 | Solo | Configure DHCP pools and DNS on the server. Set PCs to DHCP. | PCs receive IPs automatically; ping intranet.techcorp.local resolves. |
| 5 | 1 | Solo | Run a full Branch A connectivity checklist. | Every test passes before Session 2. |
| 6 | 2 | Solo | Build Branch B — SW-B, R2, VLANs, trunk, Router-on-a-Stick. | Branch B inter-VLAN routing works. |
| 7 | 2 | Solo | Build HQ — R3, SW-C, Web-Server. Connect serial WAN links R1↔R3 and R2↔R3. | All serial links up/up; Web-Server has a static IP. |
| 8 | 2 | Solo | Configure static routes on R3, default routes on R1 and R2. | show ip route shows correct S, S*, and C entries on all routers. |
| 9 | 2 | Solo | Run a full network connectivity checklist — intra-VLAN, inter-VLAN, cross-branch, branch-to-HQ. | Every PC can reach every other PC and the Web-Server. |
| 10 | 3 | Pairs | Take turns introducing and diagnosing 7 deliberate faults covering every topic. | Can identify the symptom, run the right show command, and apply the fix. |
Prerequisites
- Cisco Packet Tracer 8.x installed and signed in.
- Completion of Labs 1–12 — this lab draws on every skill taught in the course.
- Your completed Lab 11 and Lab 12
.pktfiles are not required — this is a fresh topology. - All switch/router configuration must be done via the CLI tab.
- For Part 10 (pairs): both students need their own working copy of the finished Part 9 network.
The Scenario
TechCorp NZ is a growing company with two branch offices and a head office (HQ) data centre. You have been hired as a junior network engineer to build and configure the entire company network from scratch.
- Branch A (Auckland) has three departments: HR, Sales, and IT — each isolated in its own VLAN, plus a management VLAN for the server.
- Branch B (Wellington) has two departments: Finance and Marketing — each in a VLAN.
- HQ (Christchurch) hosts the company intranet web server. It connects to both branches via serial WAN links.
- All branches must be able to reach the HQ web server and each other.
Skills you will use. This lab covers: topologies & cabling (Lab 1, 3), static IPs (Lab 4), subnetting (Labs 5–7), VLANs & trunking (Labs 5, 10), Router-on-a-Stick (Labs 5–7, 11), DHCP & DNS (Labs 10–11), static & default routing (Lab 12), serial WAN links (Lab 12), and troubleshooting (Labs 11–12).
IOS CLI Quick Reference
This is a combined reference covering every command you need across all three sessions. Refer back to this when diagnosing faults in Part 10.
Switch Commands
| What you want | Command |
|---|---|
| Enter privileged mode | enable |
| Enter global config | configure terminal |
| Set hostname | hostname SW-A |
| Create a VLAN | vlan 10 then name HR |
| Select one interface | interface Fa0/1 |
| Select a range | interface range Fa0/1-2 |
| Set as access port | switchport mode access |
| Assign VLAN to port | switchport access vlan 10 |
| Set as trunk port | switchport mode trunk |
| Show all VLANs + ports | show vlan brief |
| Show trunk interfaces | show interfaces trunk |
| Show one port detail | show interfaces Fa0/1 switchport |
| Show MAC address table | show mac-address-table |
| Exit one level / to privileged | exit / end |
| Save running config | write memory |
Router Interface Commands
| What you want | Command |
|---|---|
| Enable a physical interface | interface Fa0/0 then no shutdown |
| Create a sub-interface | interface Fa0/0.10 |
| Set 802.1Q encapsulation | encapsulation dot1Q 10 |
| Set IP address | ip address 192.168.10.1 255.255.255.0 |
| Set serial clock rate (DCE only) | clock rate 64000 |
| Shut down / bring up | shutdown / no shutdown |
Router Routing Commands
| What you want | Command |
|---|---|
| Add a specific static route | ip route 192.168.40.0 255.255.255.0 172.16.0.5 |
| Add a default route | ip route 0.0.0.0 0.0.0.0 172.16.0.2 |
| Remove a static route | no ip route 192.168.40.0 255.255.255.0 172.16.0.5 |
Verification Commands
| What you want | Command |
|---|---|
| Show all interface statuses + IPs | show ip interface brief |
| Show the full routing table | show ip route |
| Show only static routes | show ip route static |
| Show running configuration | show running-config |
| Show VLAN summary | show vlan brief |
| Show trunk ports | show interfaces trunk |
PC Commands
| What you want | Command |
|---|---|
| Show IP configuration | ipconfig or ipconfig /all |
| Test reachability | ping 192.168.10.1 |
| Trace the route hop-by-hop | tracert 10.0.0.10 |
| Resolve a DNS name | ping intranet.techcorp.local |
Network Plan
The complete TechCorp NZ network spans three sites connected by serial WAN links:
Branch A VLANs (SW-A + R1)
| VLAN | Name | Network | Subnet Mask | Gateway (R1 sub-if) | DHCP Range |
|---|---|---|---|---|---|
| 10 | HR | 192.168.10.0 | 255.255.255.0 | 192.168.10.1 | .50 – .100 |
| 20 | Sales | 192.168.20.0 | 255.255.255.0 | 192.168.20.1 | .50 – .100 |
| 30 | IT | 192.168.30.0 | 255.255.255.0 | 192.168.30.1 | .50 – .100 |
| 99 | Mgmt | 192.168.99.0 | 255.255.255.0 | 192.168.99.1 | Static only |
Branch B VLANs (SW-B + R2)
| VLAN | Name | Network | Subnet Mask | Gateway (R2 sub-if) |
|---|---|---|---|---|
| 10 | Finance | 192.168.40.0 | 255.255.255.0 | 192.168.40.1 |
| 20 | Marketing | 192.168.50.0 | 255.255.255.0 | 192.168.50.1 |
WAN Links & HQ
| Network | Address | Subnet Mask | Used for |
|---|---|---|---|
| WAN R1↔R3 | 172.16.0.0 | 255.255.255.252 (/30) | Serial link — Branch A to HQ |
| WAN R2↔R3 | 172.16.0.4 | 255.255.255.252 (/30) | Serial link — Branch B to HQ |
| HQ LAN | 10.0.0.0 | 255.255.255.0 | Intranet — Web-Server behind R3 |
Subnetting Exercise — /30 WAN Links
Before building, make sure you understand the /30 point-to-point subnets used on the WAN links. A /30 mask gives 4 addresses: 1 network, 2 usable hosts, 1 broadcast. Fill in the blanks below and check your answers.
WAN Link: R1 ↔ R3 — 172.16.0.0/30
| Field | Your Answer | |
|---|---|---|
| Network Address | ||
| First Usable Host (R1) | ||
| Last Usable Host (R3) | ||
| Broadcast Address |
WAN Link: R2 ↔ R3 — 172.16.0.4/30
| Field | Your Answer | |
|---|---|---|
| Network Address | ||
| First Usable Host (R2) | ||
| Last Usable Host (R3) | ||
| Broadcast Address |
Why /30? A point-to-point serial link connects exactly two devices. Using a /30 mask wastes only 2 addresses (network + broadcast), leaving exactly 2 usable IPs — one for each end of the link. This is standard practice for WAN connections.
Complete Interface Plan
Branch A Devices
| Device | Interface | IP Address | Subnet Mask | Notes |
|---|---|---|---|---|
| R1 | Fa0/0 | — | — | Physical parent (no IP). Must be no shutdown. |
Fa0/0.10 | 192.168.10.1 | 255.255.255.0 | Gateway for VLAN 10 (HR) | |
Fa0/0.20 | 192.168.20.1 | 255.255.255.0 | Gateway for VLAN 20 (Sales) | |
Fa0/0.30 | 192.168.30.1 | 255.255.255.0 | Gateway for VLAN 30 (IT) | |
Fa0/0.99 | 192.168.99.1 | 255.255.255.0 | Gateway for VLAN 99 (Mgmt) | |
Se0/0/0 | 172.16.0.1 | 255.255.255.252 | DCE end to R3 — must set clock rate | |
| SW-A | Fa0/24 | — | — | Trunk to R1 Fa0/0 |
| HR-PC1 | NIC | DHCP | 255.255.255.0 | Gateway: 192.168.10.1 |
| Sales-PC1 | NIC | DHCP | 255.255.255.0 | Gateway: 192.168.20.1 |
| IT-PC1 | NIC | DHCP | 255.255.255.0 | Gateway: 192.168.30.1 |
| Server | NIC | 192.168.99.10 | 255.255.255.0 | Gateway: 192.168.99.1 — static IP |
Branch B Devices
| Device | Interface | IP Address | Subnet Mask | Notes |
|---|---|---|---|---|
| R2 | Fa0/0 | — | — | Physical parent (no IP). Must be no shutdown. |
Fa0/0.10 | 192.168.40.1 | 255.255.255.0 | Gateway for VLAN 10 (Finance) | |
Fa0/0.20 | 192.168.50.1 | 255.255.255.0 | Gateway for VLAN 20 (Marketing) | |
Se0/0/0 | 172.16.0.5 | 255.255.255.252 | DCE end to R3 — must set clock rate | |
| SW-B | Fa0/24 | — | — | Trunk to R2 Fa0/0 |
| Fin-PC1 | NIC | 192.168.40.10 | 255.255.255.0 | Gateway: 192.168.40.1 — static IP |
| Mkt-PC1 | NIC | 192.168.50.10 | 255.255.255.0 | Gateway: 192.168.50.1 — static IP |
HQ Devices
| Device | Interface | IP Address | Subnet Mask | Notes |
|---|---|---|---|---|
| R3 | Se0/0/0 | 172.16.0.2 | 255.255.255.252 | DTE end from R1 — no clock rate |
Se0/0/1 | 172.16.0.6 | 255.255.255.252 | DTE end from R2 — no clock rate | |
Fa0/0 | 10.0.0.1 | 255.255.255.0 | Gateway for HQ LAN | |
| Web-Server | NIC | 10.0.0.10 | 255.255.255.0 | Gateway: 10.0.0.1 |
Session 1 — Build Branch A (VLANs + DHCP + DNS)
Part 1 — Build Branch A Topology
Time: ~20 min • Save as: Lab13_<yourname>.pkt
1.1 Add devices
- Open Packet Tracer → File → New.
- From the Network Devices panel, add:
- 1 × 2960-24TT Switch — rename:
SW-A - 1 × 2811 Router — rename:
R1 - 3 × PC — rename:
HR-PC1,Sales-PC1,IT-PC1 - 1 × Server — rename:
Server
- 1 × 2960-24TT Switch — rename:
1.2 Add WIC-2T module to R1
Important. You must power the router OFF before inserting a module.
- Click R1 → Physical tab.
- Click the power button to turn R1 OFF.
- Drag the WIC-2T module into an empty slot. You will see
Se0/0/0andSe0/0/1appear. - Power R1 back ON.
1.3 Connect cables
Use Copper Straight-Through cables for all Branch A connections.
| From | To SW-A Port |
|---|---|
| HR-PC1 | Fa0/1 |
| Sales-PC1 | Fa0/2 |
| IT-PC1 | Fa0/3 |
| Server | Fa0/4 |
R1 Fa0/0 | Fa0/24 |
Wait for all link lights to turn green before continuing.
1.4 Configure Server static IP
Click Server → Desktop → IP Configuration → Static:
- IP Address:
192.168.99.10 - Subnet Mask:
255.255.255.0 - Default Gateway:
192.168.99.1 - DNS Server:
192.168.99.10(points to itself)
Part 2 — Configure VLANs on SW-A
Time: ~15 min • All commands via the CLI tab on SW-A.
2.1 Create VLANs and assign access ports
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-A
SW-A(config)# vlan 10
SW-A(config-vlan)# name HR
SW-A(config-vlan)# vlan 20
SW-A(config-vlan)# name Sales
SW-A(config-vlan)# vlan 30
SW-A(config-vlan)# name IT
SW-A(config-vlan)# vlan 99
SW-A(config-vlan)# name Management
SW-A(config-vlan)# exit
SW-A(config)# interface Fa0/1
SW-A(config-if)# switchport mode access
SW-A(config-if)# switchport access vlan 10
SW-A(config-if)# exit
SW-A(config)# interface Fa0/2
SW-A(config-if)# switchport mode access
SW-A(config-if)# switchport access vlan 20
SW-A(config-if)# exit
SW-A(config)# interface Fa0/3
SW-A(config-if)# switchport mode access
SW-A(config-if)# switchport access vlan 30
SW-A(config-if)# exit
SW-A(config)# interface Fa0/4
SW-A(config-if)# switchport mode access
SW-A(config-if)# switchport access vlan 99
SW-A(config-if)# exit
SW-A(config)# end
SW-A# write memory2.2 Verify VLAN configuration
SW-A# show vlan briefExpected: VLANs 10 (HR), 20 (Sales), 30 (IT), 99 (Management) are all active with correct ports assigned.
Tip. If a port shows in VLAN 1, you may have missed assigning it. Use
show interfaces Fa0/X switchport to check individual ports.Part 3 — Configure Trunk & Router-on-a-Stick
Time: ~20 min • Two CLI sessions: one on SW-A, one on R1.
3.1 Configure trunk on SW-A Fa0/24
SW-A# configure terminal
SW-A(config)# interface Fa0/24
SW-A(config-if)# switchport mode trunk
SW-A(config-if)# end
SW-A# write memoryVerify:
SW-A# show interfaces trunkYou should see Fa0/24 listed with VLANs 1, 10, 20, 30, 99 in the allowed and active column.
3.2 Configure R1 sub-interfaces (inter-VLAN routing)
Click R1 → CLI:
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface Fa0/0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface Fa0/0.10
R1(config-subif)# encapsulation dot1Q 10
R1(config-subif)# ip address 192.168.10.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface Fa0/0.20
R1(config-subif)# encapsulation dot1Q 20
R1(config-subif)# ip address 192.168.20.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface Fa0/0.30
R1(config-subif)# encapsulation dot1Q 30
R1(config-subif)# ip address 192.168.30.1 255.255.255.0
R1(config-subif)# exit
R1(config)# interface Fa0/0.99
R1(config-subif)# encapsulation dot1Q 99
R1(config-subif)# ip address 192.168.99.1 255.255.255.0
R1(config-subif)# exit
R1(config)# end
R1# write memory3.3 Verify router interfaces
R1# show ip interface briefAll four sub-interfaces should show status up and protocol up with their correct IP addresses.
Common mistake. If sub-interfaces show down/down, make sure
interface Fa0/0 has no shutdown. Sub-interfaces inherit the parent interface state.Part 4 — Configure DHCP & DNS on the Server
Time: ~15 min
4.1 Configure DHCP pools
Click Server → Services → DHCP. Turn the service ON, then create three pools:
| Pool Name | Default Gateway | DNS Server | Start IP | Subnet Mask | Max |
|---|---|---|---|---|---|
| HR_Pool | 192.168.10.1 | 192.168.99.10 | 192.168.10.50 | 255.255.255.0 | 50 |
| Sales_Pool | 192.168.20.1 | 192.168.99.10 | 192.168.20.50 | 255.255.255.0 | 50 |
| IT_Pool | 192.168.30.1 | 192.168.99.10 | 192.168.30.50 | 255.255.255.0 | 50 |
Click Add after entering each pool. Remove the default serverPool entry if it appears.
4.2 Configure DNS
Click Server → Services → DNS. Turn the service ON, then add one record:
| Name | Type | Address |
|---|---|---|
intranet.techcorp.local | A Record | 192.168.99.10 |
Click Add.
Why does DNS point to the Server itself? In this lab the Server acts as both DHCP and DNS server. In Session 2 you will test DNS from Branch B reaching this same server across the WAN.
4.3 Set PCs to DHCP
On each of the 3 PCs: Desktop → IP Configuration → DHCP.
Each PC should receive an address in its VLAN's range:
- HR-PC1 →
192.168.10.50 - Sales-PC1 →
192.168.20.50 - IT-PC1 →
192.168.30.50
No DHCP address? Check that: (1) the trunk on SW-A Fa0/24 is up, (2) R1 sub-interface for the affected VLAN is up/up, and (3) the DHCP pool has the correct gateway matching the sub-interface IP.
Part 5 — Verify Branch A Connectivity
Complete every test before moving to Session 2. All tests should pass.
- HR-PC1 →
ping 192.168.10.1(R1 VLAN 10 gateway) — should succeed ✅ - Sales-PC1 →
ping 192.168.20.1(R1 VLAN 20 gateway) — should succeed ✅ - IT-PC1 →
ping 192.168.30.1(R1 VLAN 30 gateway) — should succeed ✅ - HR-PC1 →
ping 192.168.20.50(Sales-PC1) — inter-VLAN, should succeed ✅ - Sales-PC1 →
ping 192.168.30.50(IT-PC1) — inter-VLAN, should succeed ✅ - IT-PC1 →
ping 192.168.99.10(Server) — cross-VLAN to Mgmt, should succeed ✅ - HR-PC1 →
ping intranet.techcorp.local— DNS resolution, should succeed ✅ show vlan briefon SW-A — VLANs 10, 20, 30, 99 with correct ports ✅show interfaces trunkon SW-A — Fa0/24 trunking all VLANs ✅show ip interface briefon R1 — all sub-interfaces up/up ✅
Save now. Use File → Save. You will extend this file in Session 2.
Session 2 — Branch B + HQ + WAN Routing
Part 6 — Build Branch B
Time: ~25 min • Open your Session 1 .pkt file.
6.1 Add Branch B devices
- Add a 2960-24TT Switch — rename:
SW-B - Add a 2811 Router — rename:
R2 - Add 2 × PC — rename:
Fin-PC1,Mkt-PC1
6.2 Add WIC-2T module to R2
- Click R2 → Physical. Power R2 OFF.
- Drag a WIC-2T module into an empty slot.
- Power R2 back ON.
6.3 Connect Branch B cables
Use Copper Straight-Through cables:
| From | To SW-B Port |
|---|---|
| Fin-PC1 | Fa0/1 |
| Mkt-PC1 | Fa0/2 |
R2 Fa0/0 | Fa0/24 |
6.4 Configure VLANs on SW-B
Switch> enable
Switch# configure terminal
Switch(config)# hostname SW-B
SW-B(config)# vlan 10
SW-B(config-vlan)# name Finance
SW-B(config-vlan)# vlan 20
SW-B(config-vlan)# name Marketing
SW-B(config-vlan)# exit
SW-B(config)# interface Fa0/1
SW-B(config-if)# switchport mode access
SW-B(config-if)# switchport access vlan 10
SW-B(config-if)# exit
SW-B(config)# interface Fa0/2
SW-B(config-if)# switchport mode access
SW-B(config-if)# switchport access vlan 20
SW-B(config-if)# exit
SW-B(config)# interface Fa0/24
SW-B(config-if)# switchport mode trunk
SW-B(config-if)# exit
SW-B(config)# end
SW-B# write memory6.5 Configure R2 sub-interfaces (Router-on-a-Stick)
Router> enable
Router# configure terminal
Router(config)# hostname R2
R2(config)# interface Fa0/0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface Fa0/0.10
R2(config-subif)# encapsulation dot1Q 10
R2(config-subif)# ip address 192.168.40.1 255.255.255.0
R2(config-subif)# exit
R2(config)# interface Fa0/0.20
R2(config-subif)# encapsulation dot1Q 20
R2(config-subif)# ip address 192.168.50.1 255.255.255.0
R2(config-subif)# exit
R2(config)# end
R2# write memory6.6 Configure static IPs on Branch B PCs
Click each PC → Desktop → IP Configuration → Static:
| PC | IP Address | Subnet Mask | Default Gateway | DNS Server |
|---|---|---|---|---|
| Fin-PC1 | 192.168.40.10 | 255.255.255.0 | 192.168.40.1 | 192.168.99.10 |
| Mkt-PC1 | 192.168.50.10 | 255.255.255.0 | 192.168.50.1 | 192.168.99.10 |
Why static IPs here? Branch B has no local DHCP server. In a real company you would configure DHCP relay (
ip helper-address), but that is beyond the scope of this course. Static IPs work fine for two PCs.6.7 Quick verify Branch B
- Fin-PC1 →
ping 192.168.40.1(R2 VLAN 10 gateway) — should succeed ✅ - Mkt-PC1 →
ping 192.168.50.1(R2 VLAN 20 gateway) — should succeed ✅ - Fin-PC1 →
ping 192.168.50.10(Mkt-PC1) — inter-VLAN, should succeed ✅
Inter-VLAN ping fails? Check: (1)
show vlan brief on SW-B — correct ports in correct VLANs, (2) show interfaces trunk — Fa0/24 is trunking, (3) show ip interface brief on R2 — sub-interfaces up/up.Part 7 — Build HQ & WAN Links
Time: ~25 min
7.1 Add HQ devices
- Add a 2811 Router — rename:
R3 - Add a 2960-24TT Switch — rename:
SW-C - Add a Server — rename:
Web-Server
7.2 Add WIC-2T module to R3
- Click R3 → Physical. Power R3 OFF.
- Drag a WIC-2T module into an empty slot.
- Power R3 back ON.
7.3 Connect WAN and HQ cables
| Cable type | From device / port | To device / port |
|---|---|---|
| Serial DCE | R1 Se0/0/0 — DCE end | R3 Se0/0/0 — DTE end |
| Serial DCE | R2 Se0/0/0 — DCE end | R3 Se0/0/1 — DTE end |
| Copper Straight-Through | R3 Fa0/0 | SW-C — Fa0/24 |
| Copper Straight-Through | Web-Server | SW-C — Fa0/1 |
Click R1’s Se0/0/0 first when placing the first serial cable so R1 gets the DCE end. Click R2’s Se0/0/0 first for the second serial cable so R2 gets the DCE end. Both branch routers provide the clock signal.
7.4 Configure Web-Server static IP
Click Web-Server → Desktop → IP Configuration → Static:
- IP Address:
10.0.0.10 - Subnet Mask:
255.255.255.0 - Default Gateway:
10.0.0.1
7.5 Configure R1 serial interface (WAN to HQ)
Open R1 → CLI:
R1# configure terminal
R1(config)# interface Se0/0/0
R1(config-if)# ip address 172.16.0.1 255.255.255.252
R1(config-if)# clock rate 64000
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# end
R1# write memory7.6 Configure R2 serial interface (WAN to HQ)
Open R2 → CLI:
R2# configure terminal
R2(config)# interface Se0/0/0
R2(config-if)# ip address 172.16.0.5 255.255.255.252
R2(config-if)# clock rate 64000
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# end
R2# write memory7.7 Configure R3 (HQ router)
Router> enable
Router# configure terminal
Router(config)# hostname R3
R3(config)# interface Se0/0/0
R3(config-if)# ip address 172.16.0.2 255.255.255.252
R3(config-if)# no shutdown
R3(config-if)# exit
R3(config)# interface Se0/0/1
R3(config-if)# ip address 172.16.0.6 255.255.255.252
R3(config-if)# no shutdown
R3(config-if)# exit
R3(config)# interface Fa0/0
R3(config-if)# ip address 10.0.0.1 255.255.255.0
R3(config-if)# no shutdown
R3(config-if)# exit
R3(config)# end
R3# write memoryVerify R3:
R3# show ip interface briefAll three interfaces (Se0/0/0, Se0/0/1, Fa0/0) should show up/up.
Part 8 — Configure Static & Default Routes
Time: ~20 min
Right now each router only knows about its directly connected networks. R1 cannot reach Branch B or HQ. R2 cannot reach Branch A or HQ. R3 cannot reach either branch. You need to add routes manually.
8.1 Add static routes on R3 (return routes to both branches)
R3 needs routes back to all 6 branch subnets:
R3# configure terminal
R3(config)# ip route 192.168.10.0 255.255.255.0 172.16.0.1
R3(config)# ip route 192.168.20.0 255.255.255.0 172.16.0.1
R3(config)# ip route 192.168.30.0 255.255.255.0 172.16.0.1
R3(config)# ip route 192.168.99.0 255.255.255.0 172.16.0.1
R3(config)# ip route 192.168.40.0 255.255.255.0 172.16.0.5
R3(config)# ip route 192.168.50.0 255.255.255.0 172.16.0.5
R3(config)# end
R3# write memoryWhy 6 routes? R3 must know how to send replies back to every VLAN subnet in both branches. Branch A subnets (192.168.10/20/30/99.0) go via R1 at 172.16.0.1. Branch B subnets (192.168.40/50.0) go via R2 at 172.16.0.5.
8.2 Add a default route on R1 (towards HQ)
Instead of adding specific routes to every destination, R1 uses a default route — a catch-all that sends unknown traffic towards R3:
R1# configure terminal
R1(config)# ip route 0.0.0.0 0.0.0.0 172.16.0.2
R1(config)# end
R1# write memoryWhat about Branch B? R1’s default route covers everything R1 doesn’t already know about — including Branch B subnets. Packets from Branch A to Branch B will travel: R1 → R3 → R2. This is not the most efficient path but it works because R3 has specific routes to both branches.
8.3 Add a default route on R2 (towards HQ)
R2# configure terminal
R2(config)# ip route 0.0.0.0 0.0.0.0 172.16.0.6
R2(config)# end
R2# write memory8.4 Verify routing tables
R1# show ip routeR1 should show:
C— Connected: 192.168.10/20/30/99.0/24 (sub-interfaces) + 172.16.0.0/30 (serial)S*— Default static:0.0.0.0/0 via 172.16.0.2
R2# show ip routeR2 should show:
C— Connected: 192.168.40/50.0/24 + 172.16.0.4/30S*— Default static:0.0.0.0/0 via 172.16.0.6
R3# show ip routeR3 should show:
C— Connected: 172.16.0.0/30, 172.16.0.4/30, 10.0.0.0/24S— Static: 6 routes to branch subnets
Part 9 — Verify Full Network Connectivity
This is the moment of truth. Complete every test. Do not proceed to Session 3 until all pass.
Intra-VLAN (same branch)
- HR-PC1 →
ping 192.168.10.1(R1 VLAN 10 gateway) ✅ - Fin-PC1 →
ping 192.168.40.1(R2 VLAN 10 gateway) ✅
Inter-VLAN (same branch)
- HR-PC1 →
ping 192.168.20.50(Sales-PC1) ✅ - HR-PC1 →
ping 192.168.30.50(IT-PC1) ✅ - Fin-PC1 →
ping 192.168.50.10(Mkt-PC1) ✅
Cross-branch (Branch A ↔ Branch B)
- HR-PC1 →
ping 192.168.40.10(Fin-PC1) — across WAN ✅ - Fin-PC1 →
ping 192.168.10.50(HR-PC1) — across WAN ✅ - HR-PC1 →
tracert 192.168.40.10— should show: R1 → R3 → R2 → Fin-PC1 ✅
Branch to HQ
- HR-PC1 →
ping 10.0.0.10(Web-Server) ✅ - Fin-PC1 →
ping 10.0.0.10(Web-Server) ✅ - IT-PC1 →
tracert 10.0.0.10— should show: R1 → R3 → Web-Server ✅ - Mkt-PC1 →
tracert 10.0.0.10— should show: R2 → R3 → Web-Server ✅
DNS & Services
- HR-PC1 →
ping intranet.techcorp.local— DNS resolves ✅ - Fin-PC1 →
ping intranet.techcorp.local— DNS works cross-branch ✅
Routing tables
show ip routeon R1 — showsS*default route ✅show ip routeon R2 — showsS*default route ✅show ip routeon R3 — shows 6Sstatic routes ✅
Save your file now. Keep this working copy. You will use it as the reset point for Part 10 fault scenarios.
Session 3 — Break & Fix (7 Fault Scenarios)
Part 10 — Break & Fix Fault Scenarios
Mode: Pairs. Student A introduces a fault (following the steps below) while Student B looks away. Student B then diagnoses and fixes the network using show commands and the CLI reference above. Swap roles after each fault. Record everything in the Fault Worksheet.
Important. After fixing each fault, verify the affected ping test from Part 9 passes again before introducing the next fault. Reload from your saved file if things become confusing.
Exam tip. In the exam you may see a scenario description and need to identify the fault. Practice thinking: “What layer is the problem? Physical? Data Link (VLAN/trunk)? Network (routing)? Application (DHCP/DNS)?”
Fault 1
Wrong VLAN on a port (Switch Layer)
How to introduce it
SW-A# configure terminal
SW-A(config)# interface Fa0/2
SW-A(config-if)# switchport access vlan 10
SW-A(config-if)# endSymptom clue
Sales-PC1 receives an IP address from the wrong DHCP pool — it gets a 192.168.10.x address instead of 192.168.20.x. Sales-PC1 cannot ping other Sales devices. HR-PC1 and IT-PC1 are unaffected.
Diagnostic commands
SW-A# show vlan brief
SW-A# show interfaces Fa0/2 switchportYou will see Fa0/2 is in VLAN 10 instead of VLAN 20.
The fix
SW-A(config)# interface Fa0/2
SW-A(config-if)# switchport access vlan 20
SW-A(config-if)# end
SW-A# write memoryRenew DHCP on Sales-PC1 after fixing (Desktop → IP Config → Static, then back to DHCP).
Fault 2
Trunk port set to access mode (Switch Layer)
How to introduce it
SW-B# configure terminal
SW-B(config)# interface Fa0/24
SW-B(config-if)# switchport mode access
SW-B(config-if)# endSymptom clue
Fin-PC1 can still ping Fin-PC1’s own gateway if the access port VLAN matches — but inter-VLAN routing at Branch B completely breaks. Fin-PC1 cannot ping Mkt-PC1. Branch A and HQ are unaffected.
Diagnostic commands
SW-B# show interfaces trunk
SW-B# show interfaces Fa0/24 switchportshow interfaces trunk returns no output for SW-B — there is no trunk any more.
The fix
SW-B(config)# interface Fa0/24
SW-B(config-if)# switchport mode trunk
SW-B(config-if)# end
SW-B# write memory
Fault 3
Router sub-interface shut down (Router Layer)
How to introduce it
R1# configure terminal
R1(config)# interface Fa0/0.30
R1(config-subif)# shutdown
R1(config-subif)# endSymptom clue
IT-PC1 loses its DHCP address. IT-PC1 cannot ping anything outside VLAN 30 — not even the gateway. HR-PC1 and Sales-PC1 are completely unaffected.
Diagnostic commands
R1# show ip interface briefLook for Fa0/0.30 showing administratively down.
The fix
R1(config)# interface Fa0/0.30
R1(config-subif)# no shutdown
R1(config-subif)# end
R1# write memoryRenew DHCP on IT-PC1 after fixing.
Fault 4
DHCP pool with wrong default gateway (Application Layer)
How to introduce it
Click Server → Services → DHCP. Select HR_Pool, change the Default Gateway from 192.168.10.1 to 192.168.1.1, then click Save.
On HR-PC1: release and renew (Desktop → IP Config → Static, then back to DHCP).
Symptom clue
HR-PC1 receives a DHCP address (192.168.10.50), but ping 192.168.10.1 (gateway) fails. HR-PC1 cannot reach any other VLAN or the internet. Sales and IT PCs are fine.
Tricky detail. The PC has a valid IP but the wrong gateway. Use
ipconfig /all on the PC — the Default Gateway field is the giveaway.Diagnostic commands
On HR-PC1:
ipconfig /allCheck the Default Gateway field — it shows 192.168.1.1 instead of 192.168.10.1.
The fix
In the DHCP service on the Server, select HR_Pool, change the Default Gateway back to 192.168.10.1, click Save. Renew DHCP on HR-PC1.
Fault 5
Missing return route on R3 (Routing Layer)
How to introduce it
R3# configure terminal
R3(config)# no ip route 192.168.40.0 255.255.255.0 172.16.0.5
R3(config)# no ip route 192.168.50.0 255.255.255.0 172.16.0.5
R3(config)# endSymptom clue
Branch A can still reach the Web-Server and HQ. But Branch B PCs (Fin-PC1, Mkt-PC1) cannot ping the Web-Server at 10.0.0.10. Branch B to Branch A also fails. Branch A to Branch B also fails — the outbound packet arrives at R3, but R3 drops the reply because it has no route back to Branch B.
This is asymmetric routing. Packets leave Branch B and arrive at R3 via the serial link. But R3 has no route to 192.168.40.0 or 192.168.50.0 to send replies back. The return path is broken even though the forward path works.
Diagnostic commands
R3# show ip route
R3# show ip route staticYou will see routes to Branch A subnets (192.168.10/20/30/99.0) but no routes to Branch B subnets (192.168.40/50.0).
The fix
R3(config)# ip route 192.168.40.0 255.255.255.0 172.16.0.5
R3(config)# ip route 192.168.50.0 255.255.255.0 172.16.0.5
R3(config)# end
R3# write memory
Fault 6
Serial WAN interface shut down (Physical/WAN Layer)
How to introduce it
R1# configure terminal
R1(config)# interface Se0/0/0
R1(config-if)# shutdown
R1(config-if)# endSymptom clue
Branch A is completely cut off from the rest of the network. HR-PC1 cannot ping the Web-Server or any Branch B PC. Intra-VLAN and inter-VLAN pings within Branch A still work. Branch B to HQ also still works.
Diagnostic commands
R1# show ip interface briefLook for Se0/0/0 showing administratively down / down. The LAN sub-interfaces are all still up.
R1# show ip routeThe default route S* 0.0.0.0/0 via 172.16.0.2 may disappear because the serial interface is down and the next hop is unreachable.
The fix
R1(config)# interface Se0/0/0
R1(config-if)# no shutdown
R1(config-if)# end
R1# write memory
Fault 7
DNS service disabled (Application Layer)
How to introduce it
Click Server → Services → DNS. Toggle the service to OFF.
Symptom clue
All pings by IP address still work perfectly. But ping intranet.techcorp.local from any PC returns Request timed out or Unknown host.
Diagnostic commands
On any PC, try both:
ping intranet.techcorp.local
ping 192.168.99.10If the IP ping works but the name ping fails — the problem is DNS, not routing.
The fix
Toggle DNS service back to ON on the Server.
Fault Worksheet
Complete this table as you work through Part 10. Write in your own words — a sentence or two per cell is enough.
| # | Symptom you observed | Commands you ran | Root cause | Fix you applied |
|---|---|---|---|---|
| 1 | ||||
| 2 | ||||
| 3 | ||||
| 4 | ||||
| 5 | ||||
| 6 | ||||
| 7 |
Reflection & Exam Preparation
Answer these questions in your own words. These cover the major concepts likely to appear in the exam.
VLANs & Trunking
- Explain the difference between an access port and a trunk port. Why can’t a trunk port be assigned to a single VLAN?
- In Fault 2, you set the trunk to access mode. Why did intra-VLAN pings at Branch B still work, but inter-VLAN routing stopped? Which device was bypassed?
- Branch A uses VLAN 10 for HR, while Branch B uses VLAN 10 for Finance. Are these the same VLAN? Explain why or why not, and what would happen if the two switches were connected by a trunk.
Router-on-a-Stick & Sub-Interfaces
- What does the command
encapsulation dot1Q 10do on a router sub-interface? What happens if you forget it? - If a student said “IT-PC1 cannot reach the internet but HR-PC1 can,” what is the first command you would run and on which device? Justify your choice.
DHCP & DNS
- In Fault 4, HR-PC1 received a valid IP address but still couldn’t reach other VLANs. Explain the role of the default gateway and why a wrong gateway breaks inter-subnet communication.
- Why does
ping intranet.techcorp.localfail when DNS is disabled, butping 192.168.99.10still works? At which layer of the OSI model does DNS operate?
Static Routing & WAN
- In Fault 5, you removed R3’s return routes to Branch B. Explain why Branch A to Branch B pings also failed, even though R1 has a default route to R3 and R3 has routes to Branch A.
- Why do R1 and R2 use default routes while R3 uses specific static routes? What would happen if R3 also had a default route pointing to R1?
- The WAN links use /30 subnets. How many usable host addresses does a /30 provide, and why is this sufficient for a point-to-point serial link?
Troubleshooting Methodology
- A user reports “I can’t access the company intranet.” Describe the systematic troubleshooting steps you would follow, starting from the physical layer and working up. List at least one
showor diagnostic command for each layer you check. - In the
tracertoutput from HR-PC1 to Fin-PC1, you saw 4 hops: R1 → R3 → R2 → Fin-PC1. Why does this traffic pass through R3 (HQ) even though both branches exist? Could this be improved, and if so, how?